Amazon SCS-C03 Online Practice Questions and Exam Preparation

Amazon SCS-C03 Online Questions & Answers

• Question 251:

  Notify when IAM roles are modified.

  A. Use Amazon Detective.
  B. Use EventBridge with CloudTrail events.
  C. Use CloudWatch metric filters.
  D. Use CloudWatch subscription filters.
  A. Use Amazon Detective.

  ---

  Explanation

  Notify IAM roles modified EventBridge makes Use EventBridge with CloudTrail events, the strongest match, because modified EventBridge CloudTrail events Detective asks for a managed AWS capability which is important when security controls must be repeatable. modified EventBridge CloudTrail events Detective depends on Use EventBridge with CloudTrail events, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. events Detective CloudWatch metric filters is reinforced by Notify when IAM roles are modified,, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

  metric filters CloudWatch subscription Notify also supports Use EventBridge with CloudTrail events,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. subscription filters Notify IAM roles would be weaker with Use Amazon Detective,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. Notify IAM roles modified EventBridge separates Use CloudWatch metric filters, and Use CloudWatch subscription filters, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. Notify IAM roles modified EventBridge points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

• Question 252:

  A web application is protected by AWS WAF. The security team wants to determine whether an increase in traffic is caused by application-layer attacks. Analysts need to run repeatable queries over request fields such as action, rule match, source address, and URI.

  A. Enable AWS WAF logging to an Amazon S3 destination and query the logs with Amazon Athena.
  B. Use AWS CloudTrail management events to query each web request that AWS WAF inspected.
  C. Enable VPC Flow Logs on the subnets and query payload fields from the flow records.
  D. Use Amazon Inspector to scan the Application Load Balancer for malicious HTTP requests.
  A. Enable AWS WAF logging to an Amazon S3 destination and query the logs with Amazon Athena.

  ---

  Explanation

  web application protected WAF team makes Enable AWS WAF logging to an Amazon S3 destination and query the logs with Amazon Athena, the strongest match, because WAF team wants determine whether asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain.

  WAF team wants determine whether depends on Enable AWS WAF logging to an Amazon S3 destination and query the logs with Amazon Athena, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. determine whether increase traffic caused is reinforced by A web application is protected by AWS WAF, The security team wants to determine, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable. traffic caused application layer attacks also supports Enable AWS WAF logging to an Amazon S3 destination and query the logs with Amazon Athena,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. layer attacks Analysts need run would be weaker with Use AWS CloudTrail management events to query each web request that AWS WAF inspected,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. need run repeatable queries over separates Enable VPC Flow Logs on the subnets and query payload fields from the flow records, and Use Amazon Inspector to scan the Application Load Balancer for malicious HTTP requests, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. queries over request fields such points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

• Question 253:

  A company is using an organization in AWS Organizations that contains 100 accounts. The company has configured trusted access for Amazon GuardDuty to AWS Organizations within the management account.

  The company has designated a member account to be the GuardDuty administrator for the organization.

  GuardDuty is working properly and reports findings for the organization in the GuardDuty console. The company wants a SecOps team to receive real-time email alerts from any GuardDuty finding within the organization that is high severity according to GuardDuty severity levels.

  Which solution will meet these requirements?

  A. In the management account, create a rule in Amazon EventBridge that will react to a GuardDuty finding that has a high severity level. Configure the rule to notify an Amazon SNS topic. Subscribe the SecOps team's email addresses to the SNS topic.
  B. Configure trusted access for AWS Config within the organization. Create a rule in AWS Config to monitor for any non-archived findings in GuardDuty. Create a rule in Amazon EventBridge that will react if AWS Config detects a compliance change for the AWS Config rule. Configure the EventBridge rule to target an Amazon SNS topic. Subscribe the SecOps team's email addresses to the SNS topic.
  C. In the GuardDuty delegated administrator account, configure a rule in Amazon EventBridge that will react to a GuardDuty finding that has a high severity level. Configure the rule to notify an Amazon SNS topic. Subscribe the SecOps team's email addresses to the SNS topic.
  D. Configure AWS CloudTrail for the organization in the management account. Create a rule in Amazon EventBridge that will run on a ListFindings API call. Configure the rule to notify an Amazon SNS topic. Subscribe the SecOps team's email addresses to the SNS topic.
  A. In the management account, create a rule in Amazon EventBridge that will react to a GuardDuty finding that has a high severity level. Configure the rule to notify an Amazon SNS topic. Subscribe the SecOps team's email addresses to the SNS topic.

  ---

  Explanation

  organization Organizations contains 100 configured makes In the GuardDuty delegated administrator account, configure a rule in Amazon EventBridge that will react to a GuardDuty finding that has a high severity level, Configure the strongest match, because 100 configured trusted access GuardDuty asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. 100 configured trusted access GuardDuty depends on In the GuardDuty delegated administrator account, configure a rule in Amazon EventBridge that will react to a GuardDuty finding that has a high severity level, Configure to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. access GuardDuty Organizations management designated is reinforced by A company is using an organization in AWS Organizations that contains 100 accounts, The, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

  management designated member GuardDuty administrator also supports In the GuardDuty delegated administrator account, configure a rule in Amazon EventBridge that will react to a GuardDuty finding that has a high severity level, Configure, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. GuardDuty administrator organization working properly would be weaker with In the management account, create a rule in Amazon EventBridge that will react to a GuardDuty finding that has a high severity level, Configure the rule, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. GuardDuty working properly reports findings separates Configure trusted access for AWS Config within the organization, Create a rule in AWS Config to monitor for any non-archived findings in GuardDuty, Create a rule and Configure AWS CloudTrail

  for the organization in the management account, Create a rule in Amazon EventBridge that will run on a ListFindings API call, Configure the from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. reports findings organization GuardDuty console points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

• Question 254:

  A company ' s security team wants to receive near-real-time email notifications about AWS abuse reports related to DoS attacks. An Amazon SNS topic already exists and is subscribed to by the security team.

  What should the security engineer do next?

  A. Poll Trusted Advisor for abuse notifications by using a Lambda function.
  B. Create an Amazon EventBridge rule that matches AWS Health events for AWS_ABUSE_DOS_REPORT and publishes to SNS.
  C. Poll the AWS Support API for abuse cases by using a Lambda function.
  D. Detect abuse reports by using CloudTrail logs and CloudWatch alarms.
  A. Poll Trusted Advisor for abuse notifications by using a Lambda function.

  ---

  Explanation

  team wants receive near real makes Create an Amazon EventBridge rule that matches AWS Health events for AWS_ABUSE_DOS_REPORT and publishes to SNS, the strongest match, because near real time email notifications asks for a managed AWS capability and the design remains easier to govern across the environment. near real time email notifications depends on Create an Amazon EventBridge rule that matches AWS Health events for AWS_ABUSE_DOS_REPORT and publishes to SNS, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. email notifications about abuse reports is reinforced by A company ' s security team wants to receive near-real-time email notifications about AWS, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround. abuse reports related DoS attacks also supports Create an Amazon EventBridge rule that matches AWS Health events for AWS_ABUSE_DOS_REPORT and publishes to SNS,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. DoS attacks SNS topic already would be weaker with Poll Trusted Advisor for abuse notifications by using a Lambda function,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. topic already exists subscribed team separates Poll the AWS Support API for abuse cases by using a Lambda function, and Detect abuse reports by using CloudTrail logs and CloudWatch alarms, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. subscribed team.

  What should next points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

• Question 255:

  A company uses AWS Organizations. The company has teams that use an AWS CloudHSM hardware security module (HSM) that is hosted in a central AWS account. One of the teams creates its own new dedicated AWS account and wants to use the HSM that is hosted in the central account.

  How should a security engineer share the HSM that is hosted in the central account with the new dedicated account?

  A. Use AWS Resource Access Manager (AWS RAM) to share the VPC subnet ID of the HSM that is hosted in the central account with the new dedicated account. Configure the CloudHSM security group to accept inbound traffic from the private IP addresses of client instances in the new dedicated account.
  B. Use AWS Identity and Access Management (IAM) to create a cross-account role to access the CloudHSM cluster that is in the central account. Create a new IAM user in the new dedicated account. Assign the cross-account role to the new IAM user.
  C. Use AWS IAM Identity Center to create an AWS Security Token Service (AWS STS) token to authenticate from the new dedicated account to the central account. Use the cross-account permissions that are assigned to the STS token to invoke an operation on the HSM in the central account.
  D. Use AWS Resource Access Manager (AWS RAM) to share the ID of the HSM that is hosted in the central account with the new dedicated account. Configure the CloudHSM security group to accept inbound traffic from the private IP addresses of client instances in the new dedicated account.
  A. Use AWS Resource Access Manager (AWS RAM) to share the VPC subnet ID of the HSM that is hosted in the central account with the new dedicated account. Configure the CloudHSM security group to accept inbound traffic from the private IP addresses of client instances in the new dedicated account.

  ---

  Explanation

  Organizations teams CloudHSM hardware module makes Use AWS Resource Access Manager (AWS RAM) to share the ID of the HSM that is hosted in the central account with the new dedicated account, the strongest match, because hardware module HSM hosted central asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities. hardware module HSM hosted central depends on Use AWS Resource Access Manager (AWS RAM) to share the ID of the HSM that is hosted in the central account with the new dedicated account, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. hosted central teams creates own is reinforced by A company uses AWS Organizations, The company has teams that use an AWS CloudHSM, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation.

  creates own new dedicated wants also supports Use AWS Resource Access Manager (AWS RAM) to share the ID of the HSM that is hosted in the central account with the new dedicated account,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated AWS boundary. dedicated wants HSM hosted central would be weaker with Use AWS Resource Access Manager (AWS RAM) to share the VPC subnet ID of the HSM that is hosted in the central account with the new, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without tracing a custom chain. hosted central should share HSM separates Use AWS Identity and Access Management (IAM) to create a cross-account role to access the CloudHSM cluster that is in the central account, Create a new and Use AWS IAM Identity Center to create an AWS Security Token Service (AWS STS) token to authenticate from the new dedicated account to the central account, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment. share HSM hosted central new points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.

• Question 256:

  A security engineer receives a notice about suspicious activity from a Linux-based Amazon EC2 instance that uses Amazon Elastic Block Store (Amazon EBS)-based storage. The instance is making connections to known malicious addresses.

  The instance is in a development account within a VPC that is in the us-east-1 Region. The VPC contains an internet gateway and has a subnet in us-east-1a and us-east-1b. Each subnet is associated with a route table that uses the internet gateway as a default route. Each subnet also uses the default network ACL.

  The suspicious EC2 instance runs within the us-east-1b subnet. During an initial investigation, a security engineer discovers that the suspicious instance is the only instance that runs in the subnet.

  Which response will immediately mitigate the attack and help investigate the root cause?

  A. Log in to the suspicious instance and use the netstat command to identify remote connections. Use the IP addresses from these remote connections to create deny rules in the security group of the instance. Install diagnostic tools on the instance for investigation. Update the outbound network ACL for the subnet in us-east-1b to explicitly deny all connections as the first rule during the investigation of the instance.
  B. Update the outbound network ACL for the subnet in us-east-1b to explicitly deny all connections as the first rule. Replace the security group with a new security group that allows connections only from a diagnostics security group. Update the outbound network ACL for the us-east-1b subnet to remove the deny all rule. Launch a new EC2 instance that has diagnostic tools. Assign the new security group to the new EC2 instance. Use the new EC2 instance to investigate the suspicious instance.
  C. Ensure that the Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the suspicious EC2 instance will not delete upon termination. Terminate the instance. Launch a new EC2 instance in us-east-1a that has diagnostic tools. Mount the EBS volumes from the terminated instance for investigation.
  D. Create an AWS WAF web ACL that denies traffic to and from the suspicious instance. Attach the AWS WAF web ACL to the instance to mitigate the attack. Log in to the instance and install diagnostic tools to investigate the instance.
  A. Log in to the suspicious instance and use the netstat command to identify remote connections. Use the IP addresses from these remote connections to create deny rules in the security group of the instance. Install diagnostic tools on the instance for investigation. Update the outbound network ACL for the subnet in us-east-1b to explicitly deny all connections as the first rule during the investigation of the instance.

  ---

  Explanation

  receives notice about suspicious activity makes Ensure that the Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the suspicious EC2 instance will not delete upon termination, Terminate the instance, the strongest match, because suspicious activity Linux based EC2 asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. suspicious activity Linux based EC2 depends on Ensure that the Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the suspicious EC2 instance will not delete upon termination, Terminate the instance, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. based EC2 instance Elastic Block is reinforced by A security engineer receives a notice about suspicious activity from a Linux-based Amazon EC2, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

  Elastic Block Store EBS based also supports Ensure that the Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the suspicious EC2 instance will not delete upon termination, Terminate the instance,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation.

  EBS based storage instance making would be weaker with Log in to the suspicious instance and use the netstat command to identify remote connections, Use the IP addresses from these remote connections to create deny, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. instance making connections known malicious separates Update the outbound network ACL for the subnet in us-east-1b to explicitly deny all connections as the first rule, Replace the security group with a new and Create an AWS WAF web ACL that denies traffic to and from the suspicious instance, Attach the AWS WAF web ACL to the instance to mitigate from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. known malicious addresses instance development points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

• Question 257:

  An AWS Lambda function was misused to alter data, and a security engineer must identify who invoked the function and what output was produced. The engineer cannot find any logs created by the Lambda function in Amazon CloudWatch Logs.

  Which of the following explains why the logs are not available?

  A. The execution role for the Lambda function did not grant permissions to write log data to CloudWatch Logs.
  B. The Lambda function was invoked by using Amazon API Gateway, so the logs are not stored in CloudWatch Logs.
  C. The execution role for the Lambda function did not grant permissions to write to the Amazon S3 bucket where CloudWatch Logs stores the logs.
  D. The version of the Lambda function that was invoked was not current.
  A. The execution role for the Lambda function did not grant permissions to write log data to CloudWatch Logs.

  ---

  Explanation

  Lambda function was misused alter makes.

  The execution role for the Lambda function did not grant permissions to write log data to CloudWatch Logs, the strongest match, because misused alter data identify invoked asks for a managed AWS capability and the design remains easier to govern across the environment. misused alter data identify invoked depends on The execution role for the Lambda function did not grant permissions to write log data to CloudWatch Logs, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. identify invoked function what output is reinforced by An AWS Lambda function was misused to alter data, and a security engineer must, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround. what output was produced cannot also supports.

  The execution role for the Lambda function did not grant permissions to write log data to CloudWatch Logs,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. produced cannot find any logs would be weaker with The Lambda function was invoked by using Amazon API Gateway, so the logs are not stored in CloudWatch Logs,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. any logs created Lambda function separates.

  The execution role for the Lambda function did not grant permissions to write to the Amazon S3 bucket where CloudWatch Logs stores the logs, and The version of the Lambda function that was invoked was not current, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. Lambda function CloudWatch Logs explains points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.