AWS SCS-C03 Practice Questions with Explanations
Free AWS SCS-C03 practice questions. 19 of them, each with the correct answer, a full explanation, and the reason every other option is wrong. These are real questions from the SCS-C03 exam, not paraphrases, and every explanation is written out rather than just marking the right letter.
They are drawn from the same bank as the full SCS-C03 pack, which has 85 questions in total.
Get the full SCS-C03 question bank (85 questions) →
SCS-C03 practice questions
Question 1
A security engineer is troubleshooting an AWS Lambda function that is named MyLambdaFunction. The function is encountering an error when the function attempts to read the objects in an Amazon S3 bucket that is named DOC-EXAMPLE-BUCKET. The S3 bucket has the following bucket policy: Which change should the security engineer make to the policy to ensure that the Lambda function can read the bucket objects?
- A. Remove the Condition element. Change the Principal element to the following:
- B. Change the Action element to the following:
- C. Change the Resource element to "arn:aws:s3:::DOC-EXAMPLE- BUCKET/*''.
- D. Change the Resource element to "arn:aws:lambda:::function:MyLambdaFunction". Change the Principal element to the following:
Show answer and explanation ▾
Correct answer: C
Change the Resource element to "arn:aws:s3:::DOC- EXAMPLE- BUCKET/*''. The Lambda function needs to read objects within the S3 bucket, but the current Resource element only specifies the bucket itself ("arn:aws:s3:::DOC-EXAMPLE-BUCKET"). To allow the function to access and read objects inside the bucket, the Resource must include the bucket contents using the wildcard notation ("arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"). Without this, the s3:GetObject action cannot be applied to individual objects within the bucket.
Why the other options are wrong:
- A. Removing the Condition element and changing the Principal to a different service is unnecessary; the Principal already correctly identifies the Lambda function as the entity being granted permission.
- B. Adding s3:GetBucket* actions is not the issue; the problem is that the Resource specification doesn't include the objects within the bucket, preventing GetObject from applying to them.
- D. Changing the Principal to reference a Lambda function ARN is incorrect; the Principal should reference the Lambda function's execution role ARN, not the function itself, and this doesn't address the actual Resource problem.
Question 2
An AWS account administrator created an IAM group and applied the following managed policy to require that each individual user authenticate using multi-factor authentication: After implementing the policy, the administrator receives reports that users are unable to perform Amazon EC2 commands using the AWS CLI. What should the administrator do to resolve this problem while still enforcing multi-factor authentication?
- A. Change the value of aws:MultiFactorAuthPresent to true.
- B. Instruct users to run the aws sts get-session-token CLI command and pass the multi-factor authentication --serial-number and -token-code parameters. Use these resulting values to make API/CLI calls.
- C. Implement federated API/CLI access using SAML 2.0, then configure the identity provider to enforce multi-factor authentication.
- D. Create a role and enforce multi-factor authentication in the role trust policy. Instruct users to run the sts assume-role CLI command and pass --serial-number and --token-code parameters. Store the resulting values in environment variables. Add sts:AssumeRole to NotAction in the policy.
Show answer and explanation ▾
Correct answer: B
The policy shown denies EC2 actions unless MFA is present (aws:MultiFactorAuthPresent is false in the Deny condition, meaning it blocks when MFA is NOT present). However, the CLI cannot automatically provide MFA tokens with regular API calls. The solution is for users to first call aws sts get-session-token with their MFA serial number and token code, which returns temporary credentials valid for MFA-authenticated sessions. Users then use these temporary credentials for subsequent EC2 CLI commands, satisfying the policy's MFA requirement while maintaining enforcement.
Why the other options are wrong:
- A. Changing the condition to true would require MFA to be present to DENY access, which inverts the policy logic and defeats the MFA enforcement goal.
- C. Federated SAML access adds unnecessary complexity and doesn't directly solve the immediate problem of CLI users needing to provide MFA credentials with their requests.
- D. While STS assume-role is a valid MFA pattern, adding sts:AssumeRole to NotAction would actually exclude it from the policy restrictions, breaking the intended enforcement mechanism.
Question 3
What is the effect of the following AWS Key Management Service (AWS KMS} key policy that is attached to a customer managed key?
- A. Amazon WorkMail and Amazon Simple Email Service (Amazon SES) have delegated KMS encrypt and decrypt permissions to the ExampleRole principal in the 111122223333 account.
- B. The ExampleRole principal can transparently encrypt and decrypt email exchanges specifically between ExampleRole and AWS.
- C. The customer managed key can be used for encrypting and decrypting only when the principal is ExampleRole and when the request comes from Amazon WorkMail or Amazon Simple Email Service (Amazon SES) in the specified AWS Region.
- D. The key policy allows Amazon WorkMail or Amazon Simple Email Service (Amazon SES) to encrypt or decrypt on behalf of the ExampleRole for any customer managed key in the account.
Show answer and explanation ▾
Correct answer: C
The policy grants the ExampleRole principal Allow permissions for KMS actions (Encrypt, Decrypt, GenerateDataKey, CreateGrant, ListGrants) on all resources (*). However, the critical Condition element restricts these permissions: the kms:ViaService condition specifies that the request must originate from either workmail.us-west-2.amazonaws.com or ses.us-west-2.amazonaws.com. This means the key can only be used when ExampleRole makes requests through these specific AWS services in the specified region, effectively limiting access to encryption/decryption operations that come through Amazon WorkMail or SES.
Why the other options are wrong:
- A. The policy does not delegate permissions to ExampleRole; it grants permissions directly to ExampleRole as a principal, and it applies only when requests come through the specified services, not blanket delegation.
- B. The policy does not enable transparent encryption between ExampleRole and AWS; it conditions usage on requests originating from specific AWS services (WorkMail/SES), and applies to any resource, not just email exchanges.
- D. The policy allows ExampleRole to use the key through WorkMail/SES services, not the other way around-the services do not encrypt/decrypt on behalf of ExampleRole; rather, ExampleRole's actions are permitted only when channeled through these services.
Question 4
A company needs a solution to protect critical data from being permanently deleted. The data is stored in Amazon S3 buckets. The company needs to replicate the S3 objects from the company's primary AWS Region to a secondary Region to meet disaster recovery requirements. The company must also ensure that users who have administrator access cannot permanently delete the data in the secondary Region. Which solution will meet these requirements?
- A. Configure AWS Backup to perform cross-Region S3 backups. Select a backup vault in the secondary Region. Enable AWS Backup Vault Lock in governance mode for the backups in the secondary Region.
- B. Implement S3 Object Lock in compliance mode in the primary Region. Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region.
- C. Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region. Create an S3 bucket policy to deny the s3:ReplicateDelete action on the S3 bucket in the secondary Region.
- D. Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region. Configure S3 object versioning on the S3 bucket in the secondary Region.
Show answer and explanation ▾
Correct answer: B
S3 Object Lock in compliance mode is the definitive solution for preventing permanent deletion, even by administrators. When replicated to the secondary Region, the Object Lock settings are preserved, ensuring administrators cannot delete objects in either Region. This meets both the disaster recovery requirement (replication) and the immutability requirement (Object Lock compliance mode prevents all deletions until retention period expires).
Why the other options are wrong:
- A. AWS Backup Vault Lock governance mode allows privileged users to modify or delete the vault lock settings, so administrators could still delete backups.
- C. A bucket policy denying s3:ReplicateDelete does not prevent direct object deletion; administrators can still use s3:DeleteObject regardless of the policy.
- D. Versioning alone allows deletion of current versions and doesn't prevent administrators from permanently removing all versions through delete markers.
Question 5
A security engineer is responding to an incident that is affecting an AWS account. The ID of the account is 1234156789012. The attack created workloads that are distributed across multiple AWS Regions. The security engineer contains the attack. The security engineer removes all compute and storage resources from all affected Regions. However, the attacker also created an AWS KMS key. The key policy on the KMS key explicitly allows IAM principal kms:* permissions. The key was scheduled to be deleted the previous day. However, the key is still enabled and usable. The key has an ARN of arn:aws;kms:us-east- 2:123456789012:key/mrk-0bb0212cd9864fdea0dcamzo26efb5670. The security engineer must delete the key as quickly as possible. Which solution will meet this requirement?
- A. Log in to the account by using the account root user credentials. Re-issue the deletion request for the KMS key with a waiting period of 7 days.
- B. Identify the other Regions where the KMS key ID is present and schedule the key for deletion in 7 days.
- C. Update the IAM principal lo allow kms:* permissions on the KMS key ARN. Re- issue the deletion request for the KMS key with a waiting period of 7 days.
- D. Disable the KMS key. Re-issue the deletion request for the KMS key in 30 days.
Show answer and explanation ▾
Correct answer: A
The root user account credentials have unrestricted permissions that override all key policies and IAM restrictions. The KMS key deletion has a mandatory 7-day waiting period that cannot be bypassed, but the root user can immediately re-issue the deletion request, scheduling it for the minimum 7-day period. This is the fastest way to delete the compromised key when standard IAM permissions are blocked by the overly permissive key policy.
Why the other options are wrong:
- B. The ARN indicates this is a multi-Region key (mrk prefix), but identifying other Regions does not help deletion; the key must be deleted in each Region with the same 7-day minimum waiting period, making this no faster.
- C. The principal already has kms:* permissions according to the problem statement; updating permissions does not help when they are already unrestricted.
- D. Disabling the key does not delete it, and scheduling deletion in 30 days is slower than the 7-day minimum waiting period available with root user credentials.
Question 6
A company has installed a third-party application that is distributed on several Amazon EC2 instances and on-premises servers. Occasionally, the company's IT team needs to use SSH to connect to each machine to perform software maintenance tasks. Outside these time slots, the machines must be completely isolated from the rest of the network. The company does not want to maintain any SSH keys. Additionally, the company wants to pay only for machine hours when there is an SSH connection. Which solution will meet these requirements?
- A. Create a bastion host with port forwarding to connect to the machines.
- B. Set up AWS Systems Manager Session Manager to allow temporary connections.
- C. Use AWS CloudShell to create serverless connections.
- D. Set up an interface VPC endpoint for each machine for private connection.
Show answer and explanation ▾
Correct answer: B
AWS Systems Manager Session Manager meets all requirements: it provides secure shell access without SSH keys, allows temporary connections that can be restricted to specific time windows, works with both EC2 and on-premises servers (via Systems Manager Agent), requires no infrastructure to maintain, and charges only when sessions are active. It integrates with IAM for access control and provides audit logging.
Why the other options are wrong:
- A. A bastion host requires maintaining SSH keys and keeping the bastion host running continuously, incurring constant costs rather than paying only for active connections.
- C. CloudShell provides a shell environment for AWS service management but is not designed for SSH connections to arbitrary EC2 instances or on-premises servers.
- D. VPC endpoints enable private connectivity but do not provide SSH access, authentication, or key management; they address network isolation rather than secure terminal access.
Question 7
A company runs several applications on Amazon Elastic Kubernetes Service (Amazon EKS). The company needs a solution to detect any Kubernetes security risks by monitoring Amazon EKS audit logs in addition to operating system, networking, and file events. The solution must send email alerts for any identified risks to a mailing list that is associated with a security team. Which solution will meet these requirements?
- A. Deploy AWS Security Hub and enable security standards that contain EKS controls. Create an Amazon Simple Notification Service (Amazon SNS) topic and set the security team's mailiing list as a subscriber. Use an Amazon EventBridge rule to send relevant Security Hub events to the SNS topic.
- B. Enable Amazon Inspector container image scanning. Configure Amazon Detective to analyze EKS security logs. Create Amazon CloudWatch log groups for EKS audit logs. Use an AWS Lambda function to process the logs and to send email alerts to the security team.
- C. Enable Amazon GuardDuty Enable EKS Protection and Runtime Monitoring for Amazon EKS in GuardDuty. Create an Amazon Simple Notification Service (Amazon SNS) topic and set the security team's mailing list as a subscriber. Use an Amazon EventBridge rule to send relevant GuardDuty events to the SNS topic.
- D. Install the AWS Systems Manager Agent (SSM Agent) on all EKS nodes. Configure Amazon CloudWatch Logs lo collect EKS audit logs. Create an Amazon Simple Notification Service (Amazon SNS) topic and set the security team's mailing list as a subscriber. Configure a CloudWatch alarm to publish a message to the SNS topic when now audit logs are generated.
Show answer and explanation ▾
Correct answer: C
Amazon GuardDuty with EKS Protection and Runtime Monitoring is purpose-built for Kubernetes security threat detection. It monitors EKS audit logs, operating system events, network activity, and file system changes across the cluster. GuardDuty findings automatically integrate with EventBridge, enabling alerts through SNS to the security team's mailing list. This provides comprehensive coverage of all required monitoring areas.
Why the other options are wrong:
- A. Security Hub is a compliance and configuration tool focused on security standards and best practices; it does not provide the runtime threat detection needed for EKS audit logs and OS-level events.
- B. This combination lacks the real-time threat detection capability; Inspector focuses on image vulnerabilities, and Detective is for post-incident investigation rather than proactive monitoring.
- D. Systems Manager Agent is not designed for EKS monitoring, and CloudWatch alarms triggered by absence of logs are not an effective security monitoring solution.
Question 8
A security engineer wants to evaluate configuration changes to a specific AWS resource to ensure that the resource meets compliance standards. However, the security engineer is concerned about a situation in which several configuration changes are made to the resource in quick succession. The security engineer wants to record only the latest configuration of that resource to indicate the cumulative impact of the set of changes. Which solution will meet this requirement in the MOST operationally efficient way?
- A. Use AWS CloudTrail to detect the configuration changes by filtering API calls to monitor the changes. Use the most recent API call to indicate the cumulative impact of multiple calls.
- B. Use AWS Config to detect the configuration changes and to record the latest configuration in case of multiple configuration changes.
- C. Use Amazon CloudWatch to detect the configuration changes by filtering API calls to monitor the changes. Use the most recent API call to indicate the cumulative impact of multiple calls.
- D. Use AWS Cloud Map to detect the configuration changes. Generate a report of configuration changes from AWS Cloud Map to track the latest state by using a sliding time window.
Show answer and explanation ▾
Correct answer: B
AWS Config is purpose-built for tracking configuration changes and automatically records the latest state of resources. When multiple configuration changes occur in succession, Config records only the final state, capturing the cumulative impact without requiring manual correlation or filtering of multiple events. This is more operationally efficient than analyzing raw API call logs.
Why the other options are wrong:
- A. CloudTrail records all API calls individually; extracting the latest state from multiple rapid changes requires manual analysis and is operationally inefficient.
- C. CloudWatch is designed for metrics and logs, not configuration tracking; it does not maintain configuration state snapshots.
- D. AWS Cloud Map is a service discovery tool, not a configuration tracking solution; it does not provide compliance evaluation or configuration change recording.
Question 9
A security engineer needs to implement a solution to create and control the keys that a company uses for cryptographic operations. The security engineer must create symmetric keys in which the key material is generated and used within a custom key store that is backed by an AWS CloudHSM cluster. The security engineer will use symmetric and asymmetric data key pairs for local use within applications. The security engineer also must audit the use of the keys. How can the security engineer meet these requirements?
- A. To create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster. For auditing, use Amazon Athena.
- B. To create the keys, use Amazon S3 and the custom key stores with the CloudHSM cluster. For auditing, use AWS CloudTrail.
- C. To create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster. For auditing, use Amazon GuardDuty.
- D. To create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster. For auditing, use AWS CloudTrail.
Show answer and explanation ▾
Correct answer: D
AWS KMS with custom key stores backed by CloudHSM is the correct service for generating and managing symmetric keys with key material kept within the HSM cluster. AWS CloudTrail provides comprehensive audit logging of all key usage and management operations, meeting the security and compliance requirements. This combination enables the security engineer to create, control, and audit cryptographic keys as specified.
Why the other options are wrong:
- A. Amazon Athena is a query service for data analysis, not a key auditing solution; it cannot audit KMS key operations.
- B. Amazon S3 is not a key management service and cannot create or manage cryptographic keys or custom key stores.
- C. Amazon GuardDuty is a threat detection service, not an auditing tool for key usage and management operations.
Question 10
A company is running an application on Amazon EC2 instances in an Auto Scaling group. The application stores logs locally. A security engineer noticed that logs were lost after a scale-in event. The security engineer needs to recommend a solution to ensure the durability and availability of log data. All logs must be kept for a minimum of 1 year for auditing purposes. What should the security engineer recommend?
- A. Within the Auto Scaling lifecycle, add a hook to create and attach an Amazon Elastic Block Store (Amazon EBS) log volume each time an EC2 instance is created. When the instance is terminated, the EBS volume can be reattached to another instance for log review.
- B. Create an Amazon Elastic File System (Amazon EFS) file system and add a command in the user data section of the Auto Scaling launch template to mount the EFS file system during EC2 instance creation. Configure a process on the instance to copy the logs once a day from an instance Amazon Elastic Block Store (Amazon EBS) volume to a directory in the EFS file system.
- C. Add an Amazon CloudWatch agent into the AMI used in the Auto Scaling group. Configure the CloudWatch agent to send the logs to Amazon CloudWatch Logs for review.
- D. Within the Auto Scaling lifecycle, add a lifecycle hook at the terminating state transition and alert the engineering team by using a lifecycle notification to Amazon Simple Notification Service (Amazon SNS). Configure the hook to remain in the Terminating:Wait state for 1 hour to allow manual review of the security logs prior to instance termination.
Show answer and explanation ▾
Correct answer: C
CloudWatch Logs agent automatically collects logs from EC2 instances and stores them in a managed, durable service that persists beyond instance termination. This ensures logs are retained for the required 1-year audit period without manual intervention or complex lifecycle management. CloudWatch Logs automatically handles replication and backup, providing high durability and availability.
Why the other options are wrong:
- A. Manually creating and reattaching EBS volumes is operationally complex and does not provide automated durability; logs are still lost if the volume attachment fails.
- B. This approach requires daily manual copying and EBS volumes are still lost at termination; it is error-prone and operationally inefficient.
- D. A 1-hour lifecycle hook window is insufficient for safe log review, and this only delays termination rather than ensuring log preservation for 1-year audit requirements.
Question 11
A company is using AWS to run a long-running analysis process on data that is stored in Amazon S3 buckets. The process runs on a fleet of Amazon EC2 instances that are in an Auto Scaling group. The EC2 instances are deployed in a private subnet of a VPC that does not have internet access. The EC2 instances and the S3 buckets are in the same AWS account. The EC2 instances access the S3 buckets through an S3 gateway endpoint that has the default access policy. Each EC2 instance is associated with an instance profile role that has a policy that explicitly allows the s3:GetObject action and the s3:PutObject action for only the required S3 buckets. The company learns that one or more of the EC2 instances are compromised and are exfiltrating data to an S3 bucket that is outside the company's organization in AWS Organizations. A security engineer must implement a solution to stop this exfiltration of data and to keep the EC2 processing job functional. Which solution will meet these requirements?
- A. Update the policy on the S3 gateway endpoint to allow the S3 actions only if the values of the aws:ResourceOrgID and aws:PrincipalOrgID condition keys match the company's values.
- B. Update the policy on the instance profile role to allow the S3 actions only if the value of the aws:ResourceOrgID condition key matches the company's value.
- C. Add a network ACL rule to the subnet of the EC2 instances to block outgoing connections on port 443.
- D. Apply an SCP on the AWS account to allow the S3 actions only if the values of the aws:ResourceOrgID and aws:PrincipalOrgID condition keys match the company's values.
Show answer and explanation ▾
Correct answer: B
The instance profile role is the appropriate place to enforce organizational boundaries for S3 access. By adding an aws:ResourceOrgID condition key to the existing s3:GetObject and s3:PutObject policy, you prevent the compromised EC2 instances from writing to S3 buckets outside the organization while maintaining functionality for legitimate operations. This solution works at the IAM level where permissions are evaluated, directly controlling what the instance can access regardless of compromise.
Why the other options are wrong:
- A. S3 gateway endpoint policies cannot use aws:PrincipalOrgID condition keys effectively for this use case, and modifying the endpoint policy affects all traffic through it.
- C. Blocking port 443 would break legitimate S3 API calls that the EC2 instances need for their normal processing job.
- D. SCPs operate at the account level and cannot distinguish between different S3 buckets; they would block all S3 access if configured to block external bucket access.
Question 12
A company recently experienced a malicious attack on its cloud-based environment. The company successfully contained and eradicated the attack A security engineer is performing incident response work. The security engineer needs to recover an Amazon RDS database cluster to the last known good version. The database cluster is configured to generate automated backups with a retention period of 14 days. The initial attack occurred 5 days ago at exactly 3:15 PM Which solution will meet this requirement?
- A. Identify the Regional duster ARN for the database. Use the ARN to restore the Regional cluster by using the Restore to point in time feature. Set a target time 5 days ago at 3:14 PM.
- B. Identify the Regional cluster ARN for the database. List snapshots that have been taken of the cluster. Restore the database by using the snapshot that has a creation time that is closest to 5 days ago at 3:14 PM.
- C. List all snapshots that have been taken of all the company's RDS databases. Identify the snapshot that was taken closest to 5 days ago at 3:14 PM and restore it.
- D. Identify the Regional cluster ARN for the database. Use the ARN to restore the Regional cluster by using the Restore to point in time feature. Set a target time 14 days ago.
Show answer and explanation ▾
Correct answer: A
RDS point-in-time recovery (PITR) allows restoration to any specific moment within the backup retention period. Since the attack occurred 5 days ago at 3:15 PM and the retention is 14 days, you can restore to 3:14 PM (one minute before the attack started) to recover the last known good state. This is more precise than snapshot-based recovery and is the standard approach for this scenario.
Why the other options are wrong:
- B. While snapshots could work, they provide only discrete recovery points, not the precise one-minute granularity of PITR needed to recover to the last good state.
- C. Searching across all company snapshots is inefficient and error-prone; you should target the specific database cluster.
- D. Setting the target time to 14 days ago would restore an unnecessarily old version, losing up to 9 days of valid work since the attack was only 5 days ago.
Question 13
A security engineer for a company needs to design an incident response plan that addresses compromised IAM user account credentials. The company uses an organization in AWS Organizations and AWS IAM Identify Center to manage user access. The company uses a delegated administrator account to implement AWS Security Hub. The delegated administrator account contains an organizational trail in AWS CloudTrail that logs all events to an Amazon S3 bucket. The company has also configured an organizational event data store that captures all events from the trail. The incident response plan must provide steps that the security engineer can take to immediately disable any compromised IAM user when the security engineer receives a notification of a security incident. The plan must prevent the IAM user from being used in any AWS account. The plan must also collect all AWS actions that the compromised IAM user performed across all accounts in the previous 7 days. Which solution will meet these requirements?
- A. Disable the compromised IAM user in the organization management account. Use Amazon Athena to query the organizational CloudTrail logs in the S3 bucket for actions that the IAM user performed in the previous 7 days.
- B. Remove all IAM policies that are attached to the IAM user in the organization management account. Use Security Hub to query the CloudTrail logs for actions that the IAM user performed in the previous 7 days.
- C. Remove any permission sets that arc assigned to the IAM user in IAM Identity Center. Use Amazon CloudWatch Logs Insights to directly query the organizational CloudTrail logs in the S3 bucket for actions that the IAM user performed m the previous 7 days.
- D. Disable the IAM user's access in IAM Identity Center. Use CloudTrail to query the organizational event data store for actions that the IAM user performed in the previous 7 days.
Show answer and explanation ▾
Correct answer: D
IAM Identity Center manages user access across the organization, so disabling a user there immediately blocks them across all accounts. CloudTrail's organizational event data store is specifically designed for querying events across the entire organization through the CloudTrail API, making it the appropriate tool for collecting 7 days of user actions. This solution addresses both immediate remediation and investigation requirements.
Why the other options are wrong:
- A. Disabling a user only in the management account does not prevent their use in member accounts; Athena requires manual S3 queries which is less efficient than CloudTrail's API.
- B. Removing IAM policies does not prevent the user from being used if new policies are attached; Security Hub is not a CloudTrail query tool.
- C. Removing permission sets only affects IAM Identity Center managed users, not traditional IAM users; CloudWatch Logs Insights is not the proper tool for querying CloudTrail logs in S3.
Question 14
A security engineer is designing security controls for a fleet of Amazon EC2 instances that run sensitive workloads in a VPC. The security engineer needs to implement a solution to detect and mitigate software vulnerabilities on the EC2 instances. Which solution will meet this requirement?
- A. Scan the EC2 instances by using Amazon Inspector. Apply security patches and updates by using AWS Systems Manager Patch Manager.
- B. Install host-based firewall and antivirus software on each EC2 instance. Use AWS Systems Manager Run Command to update the firewall and antivirus software.
- C. Install the Amazon CloudWatch agent on the EC2 instances. Enable detailed logging. Use Amazon EventBridge to review the software logs for anomalies.
- D. Scan the EC2 instances by using Amazon GuardDuty Malware Protection. Apply security patches and updates by using AWS Systems Manager Patch Manager.
Show answer and explanation ▾
Correct answer: A
Amazon Inspector is the AWS service purpose-built to detect software vulnerabilities on EC2 instances by analyzing packages, network reachability, and configuration. AWS Systems Manager Patch Manager applies security patches and updates automatically. Together, these services provide vulnerability detection and remediation, directly addressing the requirement to detect and mitigate software vulnerabilities.
Why the other options are wrong:
- B. Host-based firewall and antivirus are detection tools but do not address vulnerability scanning or systematic patching; this approach requires manual maintenance.
- C. CloudWatch and EventBridge are monitoring and alerting tools, not vulnerability scanning tools; they cannot detect or mitigate vulnerabilities.
- D. GuardDuty Malware Protection detects malware, not software vulnerabilities; it is not the appropriate tool for vulnerability assessment.
Question 15
A security engineer uses Amazon Macie to scan a company's Amazon S3 buckets for sensitive data. The company has many S3 buckets and many objects stored in the S3 buckets. The security engineer must identify S3 buckets that contain sensitive data and must perform additional scanning on those S3 buckets. Which solution will meet these requirements with the LEAST administrative overhead?
- A. Configure S3 Cross-Region Replication (CRR) on the S3 buckets to replicate the objects to a second AWS Region. Configure Macie in the second Region to scan the replicated objects daily.
- B. Create an AWS Lambda function as an S3 event destination for the S3 buckets. Configure the Lambda function to start a Macie scan of an object when the object is uploaded to an S3 bucket.
- C. Configure Macie automated discovery to continuously sample data from the S3 buckets. Perform full scans of the S3 buckets where Macie discovers sensitive data.
- D. Configure Macie scans to run on the S3 buckets. Aggregate the results of the scans in an Amazon DynamoDB table. Use the DynamoDB table for queries.
Show answer and explanation ▾
Correct answer: C
Macie's automated discovery feature continuously samples data from S3 buckets with minimal configuration overhead, identifying which buckets contain sensitive data. Once sensitive buckets are identified, full scans can be performed only on those buckets, optimizing scanning resources and reducing administrative burden. This is more efficient than scanning all buckets equally.
Why the other options are wrong:
- A. Cross-Region Replication adds complexity and cost without reducing administrative overhead; scanning replicated data in a second region is inefficient.
- B. Lambda event-based scanning would trigger on every upload, causing excessive scanning overhead and Lambda invocations.
- D. Aggregating scan results in DynamoDB adds a manual step without addressing the core problem of identifying which buckets to scan; it does not reduce overhead.
Question 16
A company sands Amazon RDS snapshots to two accounts as part of its disaster recovery (DR) plan. The snapshots must be encrypted. However, each account needs to be able to decrypt the snapshots in case of a DR event. Which solution will meet these requirements?
- A. Use the default AWS Key Management Sen/ice (AWS KMS) key to generate the snapshots. Create an AWS Lambda function that copies the KMS encryption key to the two accounts.
- B. Use an AWS Key Management Service (AWS KMS) customer managed key to generate the snapshots. Create an AWS Lambda function that imports the KMS key in the two accounts.
- C. Use the default AWS Key Management Service (AWS KMS) key to generate the snapshots. Share the KMS key with the two accounts by using an IAM principal that has the proper KMS permissions in each account.
- D. Use an AWS Key Management Service (AWS KMS) customer managed key to generate the snapshots. Share the KMS key with the two accounts by using an IAM principal that has the proper KMS permissions in each account.
Show answer and explanation ▾
Correct answer: D
A customer managed KMS key provides better control and security than the default key. The proper way to enable cross-account access is to share the KMS key with the two accounts by modifying the key policy to grant appropriate permissions to IAM principals in those accounts. This allows each account to decrypt snapshots when needed without copying or importing keys.
Why the other options are wrong:
- A. The default AWS KMS key is account-specific and cannot be used across accounts; Lambda cannot copy KMS keys between accounts.
- B. KMS keys cannot be imported to other accounts; this approach is not supported by AWS KMS.
- C. The default KMS key cannot be shared across accounts due to account-specific constraints.
Question 17
A company has a compliance requirement to encrypt all data in transit. The company recently discovered an Amazon Aurora cluster that does not meet this requirement. How can the company enforce encryption for all connections to the Aurora cluster?
- A. In the Aurora cluster configuration, set the require_secure_transport DB cluster parameter to ON.
- B. Use AWS Directory Service for Microsoft Active Directory to create a user directory and to enforce Kerberos authentication with Aurora.
- C. Configure the Aurora cluster to use AWS Certificate Manager (ACM) to provide encryption certificates.
- D. Create an Amazon RDS proxy. Connect the proxy to the Aurora cluster to enable encryption.
Show answer and explanation ▾
Correct answer: A
The require_secure_transport DB cluster parameter enforces SSL/TLS encryption for all connections to the Aurora database cluster. Setting this parameter to ON ensures all connections must use encrypted transport, directly meeting the compliance requirement without additional infrastructure.
Why the other options are wrong:
- B. AWS Directory Service with Kerberos authentication adds complexity and does not inherently enforce encryption in transit.
- C. AWS Certificate Manager provides certificates but requires separate configuration of SSL/TLS; the require_secure_transport parameter is the direct enforcement mechanism.
- D. RDS Proxy is a connection pooling service; while it can support encryption, it is not necessary for enforcing encryption on the cluster itself.
Question 18
A company's public website consists of an Application Load Balancer (ALB), a set of Amazon EC2 instances that run a stateless application behind the ALB, and an Amazon DynamoDB table from which the application reads data. The company is concerned about malicious scanning and DDoS attacks. The company wants to impose a restriction in which each client IP address can read the data only 3 times in any 5-minute period. Which solution will meet this requirement with the LEAST effort?
- A. Set up AWS WAF in front of the ALB. Create a rule that blocks requests that exceed the limit of 3 requests in any 5-minute period for each IP address.
- B. Create an AWS Lambda function based on an Amazon CloudWatch request. Configure the Lambda function to count the requests for each IP address in rolling 5- minute intervals and to provide notification if the count exceeds 3.
- C. Modify the EC2 application to count the source IP address of requests and calculate a rolling 5-minute sum. Return an error message if the count sum is greater than 3.
- D. Add source IP address and request time to the DynamoDB table. Add a 5-minute TTL setting based on request time. Change the read capacity of the DynamoDB table throughput to 3.
Show answer and explanation ▾
Correct answer: A
AWS WAF is specifically designed to protect web applications and can enforce rate-based rules that limit requests from each IP address within a rolling time window. A WAF rule can be configured to block requests exceeding 3 reads in 5 minutes per IP address with minimal effort and no application changes, directly addressing the requirement.
Why the other options are wrong:
- B. CloudWatch does not provide request counting; Lambda would be invoked for every request, creating performance overhead and complexity.
- C. Modifying application code to track rolling 5-minute windows per IP requires significant development effort and introduces state management complexity.
- D. DynamoDB TTL and throughput settings do not provide request rate limiting; this approach does not enforce per-IP-address rate limits.
Question 19
A public subnet contains two Amazon EC2 instances. The subnet has a custom network ACL. A security engineer is designing a solution to improve the subnet security. The solution must allow outbound traffic to an internet service that uses TLS through port 443. The solution also must deny inbound traffic that is destined for MySQL port 3306. Which network ACL rule set meets these requirements?
- A. Use inbound rule 100 to allow traffic on TCP port 443. Use inbound rule 200 to deny traffic on TCP port 3306. Use outbound rule 100 to allow traffic on TCP port 443.
- B. Use inbound rule 100 to deny traffic on TCP port 3306. Use inbound rule 200 to allow traffic on TCP port range 1024-65535. Use outbound rule 100 to allow traffic on TCP port 443.
- C. Use inbound rule 100 to allow traffic on TCP port range 1024-65535. Use inbound rule 200 to deny traffic on TCP port 3306. Use outbound rule 100 to allow traffic on TCP port 443.
- D. Use inbound rule 100 to deny traffic on TCP port 3306. Use inbound rule 200 to allow traffic on TCP port 443. Use outbound rule 100 to allow traffic on TCP port 443.
Show answer and explanation ▾
Correct answer: B
The requirements are to allow outbound TLS traffic on port 443 and deny inbound MySQL traffic on port 3306. Option B correctly denies inbound port 3306 in rule 100, allows inbound ephemeral ports (1024-65535) in rule 200 to permit response traffic from outbound connections, and allows outbound port 443. The ephemeral port range is critical because when an EC2 instance initiates outbound connections on port 443, the remote server responds on an ephemeral port, which must be permitted inbound. Without this, outbound HTTPS connections would fail.
Why the other options are wrong:
- A. Allows inbound traffic on port 443, which is unnecessary for the requirement of allowing outbound TLS traffic and doesn't account for return traffic on ephemeral ports.
- C. Allows inbound traffic on all ephemeral ports (1024-65535) before denying port 3306, but rule 100 processing means the deny on 3306 would never be evaluated since 3306 falls within the ephemeral range.
- D. Allows inbound traffic on port 443, which contradicts the requirement to deny inbound MySQL traffic and doesn't properly permit return traffic for outbound connections.
Get the complete SCS-C03 bank
These 19 questions are roughly 30% of the bank. The full pack has 85 real SCS-C03 questions, each with the same depth of explanation, plus a questions-only PDF for timed practice and free updates forever.
View the full AWS SCS-C03 question bank →