📘 Free SCS-C03 Sample Questions
A security engineer is troubleshooting an AWS Lambda function that is named MyLambdaFunction. The function is encountering an error when the function attempts to read the objects in an Amazon S3 bucket that is named DOC - EXAMPLE-BUCKET. The S3 bucket has the following bucket policy:
Which change should the security engineer make to the policy to ensure that the Lambda function can read the bucket objects?
A
Remove the Condition element. Change the Principal element to the following:
B
Change the Action element to the following:
C
Change the Resource element to "arn:aws:s3:::DOC-EXAMPLE- BUCKET/*''.
D
Change the Resource element to "arn:aws:lambda:::function:MyLambdaFunction". Change the Principal element to the following:
Correct Answer:
C. Change the Resource element to "arn:aws:s3:::DOC-EXAMPLE- BUCKET/*''.
Explanation:
C. Change the Resource element to arn:aws:s3:::DOC-EXAMPLE-BUCKET/* Grants access to all objects inside the bucket
Enables s3:GetObject, which is required for Lambda to read files
HOTSPOT -
A company is building a web application that needs to authenticate external users across multiple microservices that the company hosts on Amazon Elastic Container Service (Amazon ECS). The solution must use temporary credentials and minimize the management overhead required to maintain user databases.
Select and order the correct steps from the following list to implement a secure authentication strategy that meets these requirements. Select each step one time or not at all.
Configure Amazon Cognito user pools for user authentication.
Set up an IAM role for each microservice. Grant each role appropriate permissions.
Implement an Amazon API Gateway HTTP API with AWS Lambda authorizers to validate tokens before forwarding requests to microservices.
Create an Amazon DynamoDB table to store user credentials for each microservice. Create an Amazon Cognito application client to interact with the web application. Set up AWS IAM Identity Center to give users access to the microservices.
A
Correct Answer:
A.
An AWS account administrator created an IAM group and applied the following managed policy to require that each individual user authenticate using multi-factor authentication:
A
Change the value of aws:MultiFactorAuthPresent to true.
B
Instruct users to run the aws sts get-session-token CLI command and pass the multi-factor authentication -- serial-number and -token-code parameters. Use these resulting values to make API/CLI calls.
C
Implement federated API/CLI access using SAML 2.0, then configure the identity provider to enforce multi- factor authentication.
D
Create a role and enforce multi-factor authentication in the role trust policy. Instruct users to run the sts assume-role CLI command and pass --serial-number and --token-code parameters. Store the resulting values in environment variables. Add sts:AssumeRole to NotAction in the policy.
Correct Answer:
B. Instruct users to run the aws sts get-session-token CLI command and pass the multi-factor authentication -- serial-number and -token-code parameters. Use these resulting values to make API/CLI calls.
HOTSPOT-
A security engineer needs to implement AWS IAM Identity Center with an exlemai identity provider (IdP).
Select and order the correct steps from the following list to meet this requirement. Select each step one time or
not at all.
Configure the external IdP as the identity source in IAM Identity Center.
Create an IAM role that has a trust policy that specifics the IdP's API endpoint.
Enable automatic provisioning in IAM Identity Center settings
Enable automatic provisioning in the external IdP.
Obtain the SAML metadata from IAM Identity Center.
Obtain the SAML metadata from the external IdP.
A
Correct Answer:
A.
What is the effect of the following AWS Key Management Service (AWS KMS key policy that is attached to a
customer managed key?
A
Amazon WorkMail and Amazon Simple Email Service (Amazon SES) have delegated KMS encrypt and decrypt permissions to the ExampleRole principal in the 111122223333 account.
B
The ExampleRole principal can transparently encrypt and decrypt email exchanges specifically between ExampleRole and AWS.
C
The customer managed key can be used for encrypting and decrypting only when the principal is ExampleRole and when the request comes from Amazon WorkMail or Amazon Simple Email Service (Amazon SES) in the specified AWS Region.
D
The key policy allows Amazon WorkMail or Amazon Simple Email Service (Amazon SES) to encrypt or decrypt on behalf of the ExampleRole for any customer managed key in the account.
Correct Answer:
C. The customer managed key can be used for encrypting and decrypting only when the principal is ExampleRole and when the request comes from Amazon WorkMail or Amazon Simple Email Service (Amazon SES) in the specified AWS Region.
HOTSPOT-
A company is designing its security monitoring strategy for an existing sensitive workload on AWS. The security
team has identified several scenarios that require monitoring strategies.
Select the correct monitoring strategy from the following list for each monitoring scenario. Select each monitoring
strategy one time.
Automatically isolate Amazon EC2 distances when malware detection findings are confirmed.
Correlate security findings from multiple AWS detection services to identify multi-stage attacks.
Detect when privileged users perform an unusually high volume of resource deletion operations.
Identify patterns of more than 50 failed authentication attempts from specific IP addresses in 1 hour.
Monitor network traffic patterns especially large data transfers to external IP addresses outside normal office
hours.
Configure VPC Flow Logs with Amazon CloudWatch Logs Insights queries to analyze traffic volume and
destination pattems during specific time windows.
A
Correct Answer:
A.
A company needs a solution to protect critical data from being permanently deleted. The data is stored in Amazon S3 buckets.
The company needs to replicate the S3 objects from the company's primary AWS Region to a secondary Region to meet disaster recovery requirements. The company must also ensure that users who have administrator access cannot permanently delete the data in the secondary Region.
Which solution will meet these requirements?
A
Configure AWS Backup to perform cross-Region S3 backups. Select a backup vault in the secondary Region. Enable AWS Backup Vault Lock in governance mode for the backups in the secondary Region.
B
Implement S3 Object Lock in compliance mode in the primary Region. Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region.
C
Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region. Create an S3 bucket policy to deny the s3:ReplicateDelete action on the S3 bucket in the secondary Region.
D
Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region. Configure S3 object versioning on the S3 bucket in the secondary Region.
Correct Answer:
A. Configure AWS Backup to perform cross-Region S3 backups. Select a backup vault in the secondary Region. Enable AWS Backup Vault Lock in governance mode for the backups in the secondary Region.
Explanation:
Why optionA is the correct solution
Cross-Region immutable backups – AWS Backup can copy S3 objects to a backup vault in a different Region and, when VaultLock is enabled in governance mode, the backups become write-once-read-many (WORM) for the configured retention period.
Protection against accidental or malicious deletion – Even users with full IAM permissions (including administrators) cannot delete or overwrite objects that are under VaultLock protection until the retention period expires. This satisfies the requirement that “administrator access cannot permanently delete the data in the secondary Region.”
Built-in lifecycle and compliance controls – Backup plans can be scheduled, monitored, and audited centrally, providing a single-pane-of-glass management experience for disaster-recovery (DR) workloads. No additional complexity in the source bucket – The primary Region does not need to enable ObjectLock or versioning; the protection is enforced on the backup vault in the secondary Region, keeping the source environment simple.
Why the other options are less suitable
OptionB – S3 ObjectLock in compliance mode can make objects immutable, but the lock is applied only to the source bucket. Replication to the secondary Region does not automatically preserve the lock, and the lock cannot be enforced on the destination bucket after replication. Moreover, compliance mode requires a longer setup and may not be practical for DR-only workloads.
OptionC – A bucket policy that denies s3:ReplicateDelete can block replication-initiated delete events, but IAM users with full permissions can still bypass the policy (e.g., by using DeleteObject directly on the replicated objects or by disabling the replication configuration). This does not provide true immutability. OptionD – Versioning alone only keeps previous versions of an object; it does not prevent a user from deleting the current version or all versions. Without an additional lock or retention mechanism, administrators could still permanently delete the latest version, violating the “cannot permanently delete” requirement.
Conclusion – Only optionA delivers a cross-Region, immutable backup that is enforceable regardless of the privileges of users in the secondary Region, meeting both the replication and protection criteria.
s
AWS Backup – Vault Lock (governance mode):
S3 Replication and Backup integration:
These links are current and publicly accessible as of the latest AWS documentation.
A company runs several applications on Amazon Elastic Kubernetes Service (Amazon EKS). The company needs a
solution to detect any Kubernetes security risks by monitoring Amazon EKS audit logs in addition to operating
system, networking, and file events. The solution must send email alerts for any identified risks to a mailing list
that is associated with a security team.
Which solution will meet these requirements?
A
Deploy AWS Security Hub and enable security standards that contain EKS controls. Create an Amazon Simple Notification Service (Amazon SNS) topic and set the security team's mailiing list as a subscriber. Use an Amazon EventBridge rule to send relevant Security Hub events to the SNS topic.
B
Enable Amazon Inspector container image scanning. Configure Amazon Detective to analyze EKS security logs. Create Amazon CloudWatch log groups for EKS audit logs. Use an AWS Lambda function to process the logs and to send email alerts to the security team.
C
Enable Amazon GuardDuty Enable EKS Protection and Runtime Monitoring for Amazon EKS in GuardRuty
Create an Amazon Simple Notification Service (Amazon SNS) topic and set the security team's mailing list as a
subscriber. Use an Amazon EventBridge rule to send relevant GuardDuty events to the SNS topic.
D
Install the AWS Systems Manager Agent (SSM Agent) on all EKS nodes. Configure Amazon CloudWatch
Logs lo collect EKS audit logs. Create an Amazon Simple Notification Service (Amazon SNS) topic and set the
security team's mailing list as a subscriber. Configure a CloudWatch alarm to publish a message to the SNS
topic when now audit logs are generated.
Correct Answer:
C. Enable Amazon GuardDuty Enable EKS Protection and Runtime Monitoring for Amazon EKS in GuardRuty
Create an Amazon Simple Notification Service (Amazon SNS) topic and set the security team's mailing list as a
subscriber. Use an Amazon EventBridge rule to send relevant GuardDuty events to the SNS topic.
Explanation:
Why optionC is the correct solution
GuardDutyEKS Protection & Runtime Monitoring continuously analyses EKS control-plane and worker-node activity, correlating API calls, audit-log events, and runtime behaviours against known malicious patterns. When GuardDuty identifies a finding (e.g.,privilege escalation, container escape, compromised image), it can publish the finding to EventBridge.
An EventBridge rule can route those findings to an SNS topic that has the security-team mailing list subscribed, delivering immediate email notifications.
This native integration provides end-to-end detection (OS, networking, file, and API-level) without requiring custom log-parsing pipelines or additional services.
Why the other options are less suitable
OptionA – Security Hub aggregates findings but does not perform deep EKS-specific runtime analysis; it relies on other services (e.g., Inspector, InspectorECR) for vulnerability scanning and lacks built-in EKS audit-log ingestion.
OptionB – Inspector image scanning only evaluates container images; it does not monitor live EKS audit logs or runtime events. Adding Detective or a custom Lambda adds complexity and does not provide the same out-of-the-box detection coverage.
OptionD – CloudWatch alarms can only react to absence of logs (i.e., “no logs generated”), which does not meet the requirement to detect security risks within the logs themselves. It also does not provide any native detection logic for malicious activity.
GuardDuty – EKS Protection & Runtime Monitoring:
Amazon SNS – Subscribing Email Notifications:
A company allows users to download its mobile app onto their phones. The app is MQTT based and connects to
AWS loT Core lo subscribe la specific client-related topics.
Recently, the company discovered that some malicious attackers have been trying to get a Trojan horse onto
legitimate mobile phones. The Trojan horse poses as the authentic application and uses a client ID with injected
special characters to gain access to topics outside the client's privilege scope.
Which combination of actions should the company take to prevent this threat? (Choose two.)
A
In the application, use an loT thing name as the client ID to conned the device to AWS loT Core.
B
In the application, add a client ID check. Disconnect from the server if any special character is detected.
C
Apply an AWS loT Core policy that allows "AWSloTWirelessDataAccess" with the principal set to "client/$
iot:Connection. Thing. ThingName "
D
Apply an AWS loT Core policy to the device to allow "iot Connect" with the resource set to "client/$
jot Clientld".
E
Apply an AWS loT Core policy to the device to allow "iot Connect" with the resource set to "client/$
jot Connection Thing ThingName)".
Correct Answer:
A. In the application, use an loT thing name as the client ID to conned the device to AWS loT Core.
Explanation:
Why the correct choice (A+E) is the best solution
A – Use an IoTThing name as the client ID – By binding the MQTT client ID to the registered Thing name, the identifier is controlled by the Thing registry and cannot be arbitrarily altered by an attacker. This eliminates the ability to inject malicious characters into the client ID that would otherwise be used to target unintended topics.
E – Policy that allows iot:Connect only for client/$ iot:Connection.Thing.ThingName – The policy’s resource element evaluates the actual Thing name at connection time. Even if an attacker tries to craft a client ID with special characters, the policy will only permit connections where the evaluated value matches the legitimate Thing name. This ties the permission to the immutable Thing identity, preventing privilege-escalation via malformed client IDs.
Why the other options are unsuitable
B – Disconnect on detection of special characters – Checking the client ID for illegal characters is a fragile, client-side control that can be bypassed (e.g., by encoding or by using allowed characters). It does not enforce a secure identity model and adds unnecessary runtime overhead.
C – Allow AWSIoTWirelessDataAccess with client/$ iot:Connection.Thing.ThingName – This permission concerns data publishing/subscribing, not the initial Connect step. It does not stop an attacker from establishing a connection with a forged client ID; it only limits what they can do after connecting.
D – Allow iot:Connect with client/$ iot:ClientId – Using $ iot:ClientId directly references the raw client
identifier, which an attacker can manipulate. This policy would permit connections from any client ID, including malicious ones, and therefore does not mitigate the injection threat.
Resulting defense
Combining A (binding the client ID to a controlled Thing name) with E (restricting the Connect action to that same identity) creates a strong, identity-based access control that prevents unauthorized topic access, even when attackers attempt to inject special characters into client IDs.
s
AWS IoT Core – Using Thing Names as Client IDs:
A security engineer wants to evaluate configuration changes to a specific AWS resource to ensure that the
resource meets compliance standards. However, the security engineer is concerned about a situation in which
several configuration changes are made to the resource in quick succession. The security engineer wants to record
only the latest configuration of that resource to indicate the cumulative impact of the set of changes.
Which solution will meet this requirement in the MOST operationally efficient way?
A
Use AWS CloudTrail to detect the configuration changes by filtering API calls to monitor the changes.
B
Use AWS Config to detect the configuration changes and to record the latest configuration in case of multiple configuration changes.
C
Use Amazon CloudWatch to detect the configuration changes by filtering API calls to monitor the changes. Use the most recent API call to indicate the cumulative impact of multiple calls.
D
Use AWS Cloud Map to detect the configuration changes. Generate a report of configuration changes from AWS Cloud Map to track the latest state by using a sliding time window.
Correct Answer:
B. Use AWS Config to detect the configuration changes and to record the latest configuration in case of multiple configuration changes.
Explanation:
Why optionB is the correct and most operationally efficient choice
AWS Config continuously watches the desired state of supported AWS resources and automatically records every configuration change.
When multiple changes occur in rapid succession, Config stores the most recent configuration snapshot in its configuration history, which can be queried or exported to show the cumulative effect of the entire change set.
The service is purpose-built for compliance-oriented audits; it can be combined with Config Rules, Aggregators, and Security Hub to produce compliance reports without additional custom code. Operationally, Config requires only a one-time setup (enable the service, select the resource types, and optionally configure an S3 bucket for delivery). No continuous polling, API-call parsing, or custom dashboards are needed, making it the most efficient solution.
Why the other options are less suitable A – CloudTrail for API-call filtering
CloudTrail logs API activity but does not capture the actual resource configuration. To infer the cumulative configuration you would need to reconstruct state from many separate events, which is complex, error-prone, and not operationally efficient for a compliance-focused audit.
C – CloudWatch for API-call monitoring
CloudWatch is designed for metrics, logs, and alarms on operational performance. It does not retain or aggregate resource configuration data, so it cannot provide a reliable “latest configuration” view after multiple rapid changes.
D – AWS Cloud Map for configuration tracking
Cloud Map is a service-discovery tool for managing DNS-like routing of microservices. It has no capability to monitor or record AWS resource configuration changes, making it irrelevant for compliance-driven audits.
Conclusion – AWS Config directly satisfies the requirement of recording the latest configuration after multiple rapid changes, offering a native, low-overhead, compliance-ready solution.
AWS Config – What Is AWS Config?
Configuring AWS Config to Record Configuration Changes
Questions: 1-10 out of 85
Continue Full Practice..
GET ALL 85 QUESTIONS