36 free AWS SCS-C03 practice questions from the CertStash pack of 143, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 36 free here, all 143 in the pack, and each step includes the one before it.
Get all 143 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
A company needs a solution to protect critical data from being permanently deleted. The data is stored in Amazon S3 buckets.
The company needs to replicate the S3 objects from the company's primary AWS Region to a secondary Region to meet disaster recovery requirements. The company must also ensure that users who have administrator access cannot permanently delete the data in the secondary Region.
Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Implement S3 Object Lock in compliance mode in the primary Region. Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region.
S3 Object Lock in compliance mode is the definitive solution for preventing permanent deletion, even by administrators. When replicated to the secondary Region, the Object Lock settings are preserved, ensuring administrators cannot delete objects in either Region. This meets both the disaster recovery requirement (replication) and the immutability requirement (Object Lock compliance mode prevents all deletions until retention period expires).
Why the other options are wrong
- A. AWS Backup Vault Lock governance mode allows privileged users to modify or delete the vault lock settings, so administrators could still delete backups.
- C. A bucket policy denying s3:ReplicateDelete does not prevent direct object deletion; administrators can still use s3:DeleteObject regardless of the policy.
- D. Versioning alone allows deletion of current versions and doesn't prevent administrators from permanently removing all versions through delete markers.
Question 2
A security engineer is responding to an incident that is affecting an AWS account. The ID of the account is 1234156789012. The attack created workloads that are distributed across multiple AWS Regions.
The security engineer contains the attack. The security engineer removes all compute and storage resources from all affected Regions. However, the attacker also created an AWS KMS key. The key policy on the KMS key explicitly allows IAM principal kms:* permissions.
The key was scheduled to be deleted the previous day. However, the key is still enabled and usable. The key has an ARN of arn:aws;kms:us-east-2:123456789012:key/mrk-0bb0212cd9864fdea0dcamzo26efb5670. The security engineer must delete the key as quickly as possible.
Which solution will meet this requirement?
Show answer and explanation
Correct answer: B. Identify the other Regions where the KMS key ID is present and schedule the key for deletion in 7 days.
The mrk-prefix in the key ID shows this is a multi-Region primary key. A primary key cannot be deleted while replica keys exist, so it stays usable until every replica is deleted. Finding the replicas in the other Regions and scheduling them for deletion with the minimum 7-day wait allows the primary to be deleted as quickly as possible.
Why the other options are wrong
- A. Root user credentials do not change the rule that a multi-Region primary key cannot be deleted while its replicas still exist.
- C. The principal already has kms:* permissions, so granting them again does not remove the blocking replica keys.
- D. Disabling the key and waiting 30 days is slower, and it still does not address the replica keys that prevent deletion.
Question 3
A company has installed a third-party application that is distributed on several Amazon EC2 instances and on-premises servers. Occasionally, the company's IT team needs to use SSH to connect to each machine to perform software maintenance tasks. Outside these time slots, the machines must be completely isolated from the rest of the network. The company does not want to maintain any SSH keys. Additionally, the company wants to pay only for machine hours when there is an SSH connection.
Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Set up AWS Systems Manager Session Manager to allow temporary connections.
AWS Systems Manager Session Manager meets all requirements: it provides secure shell access without SSH keys, allows temporary connections that can be restricted to specific time windows, works with both EC2 and on-premises servers (via Systems Manager Agent), requires no infrastructure to maintain, and charges only when sessions are active. It integrates with IAM for access control and provides audit logging.
Why the other options are wrong
- A. A bastion host requires maintaining SSH keys and keeping the bastion host running continuously, incurring constant costs rather than paying only for active connections.
- C. CloudShell provides a shell environment for AWS service management but is not designed for SSH connections to arbitrary EC2 instances or on-premises servers.
- D. VPC endpoints enable private connectivity but do not provide SSH access, authentication, or key management; they address network isolation rather than secure terminal access.
Question 4
A company runs several applications on Amazon Elastic Kubernetes Service (Amazon EKS). The company needs a solution to detect any Kubernetes security risks by monitoring Amazon EKS audit logs in addition to operating system, networking, and file events. The solution must send email alerts for any identified risks to a mailing list that is associated with a security team.
Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Enable Amazon GuardDuty Enable EKS Protection and Runtime Monitoring for Amazon EKS in GuardDuty. Create an Amazon Simple Notification Service (Amazon SNS) topic and set the security team's mailing list as a subscriber. Use an Amazon EventBridge rule to send relevant GuardDuty events to the SNS topic.
Amazon GuardDuty with EKS Protection and Runtime Monitoring is purpose-built for Kubernetes security threat detection. It monitors EKS audit logs, operating system events, network activity, and file system changes across the cluster. GuardDuty findings automatically integrate with EventBridge, enabling alerts through SNS to the security team's mailing list. This provides comprehensive coverage of all required monitoring areas.
Why the other options are wrong
- A. Security Hub is a compliance and configuration tool focused on security standards and best practices; it does not provide the runtime threat detection needed for EKS audit logs and OS-level events.
- B. This combination lacks the real-time threat detection capability; Inspector focuses on image vulnerabilities, and Detective is for post-incident investigation rather than proactive monitoring.
- D. Systems Manager Agent is not designed for EKS monitoring, and CloudWatch alarms triggered by absence of logs are not an effective security monitoring solution.
Question 5
A company allows users to download its mobile app onto their phones. The app is MQTT based and connects to AWS IoT Core lo subscribe la specific client-related topics.
Recently, the company discovered that some malicious attackers have been trying to get a Trojan horse onto legitimate mobile phones. The Trojan horse poses as the authentic application and uses a client ID with injected special characters to gain access to topics outside the client's privilege scope.
Which combination of actions should the company take to prevent this threat? (Choose two.)
Show answer and explanation
Correct answer: A, E. In the application, use an IoT thing name as the client ID to conned the device to AWS IoT Core; Apply an AWS IoT Core policy to the device to allow "iot:Connect" with the resource set to "client/${iot:Connection.Thing.ThingName)".
Using an IoT thing name as the client ID (option A) prevents attackers from injecting special characters and accessing unauthorized topics. Applying a policy with the principal set to the thing name (option E) ensures that only authenticated things can connect and restricts their access to resources scoped to their specific identity, preventing lateral movement. Together these enforce both application-level identity validation and policy-based access control.
Why the other options are wrong
- B. Client-side validation of special characters is insufficient because attackers with a Trojan can bypass client logic; the threat requires server-side enforcement.
- C. AWSIoTWirelessDataAccess is for wireless devices and is not applicable to MQTT-based IoT Core connections.
- D. Using client ID in the policy resource does not prevent attackers from spoofing or injecting special characters into the client ID; thing names are verified server-side.
Question 6
A security engineer wants to evaluate configuration changes to a specific AWS resource to ensure that the resource meets compliance standards.
However, the security engineer is concerned about a situation in which several configuration changes are made to the resource in quick succession. The security engineer wants to record only the latest configuration of that resource to indicate the cumulative impact of the set of changes.
Which solution will meet this requirement in the MOST operationally efficient way?
Show answer and explanation
Correct answer: B. Use AWS Config to detect the configuration changes and to record the latest configuration in case of multiple configuration changes.
AWS Config is purpose-built for tracking configuration changes and automatically records the latest state of resources. When multiple configuration changes occur in succession, Config records only the final state, capturing the cumulative impact without requiring manual correlation or filtering of multiple events. This is more operationally efficient than analyzing raw API call logs.
Why the other options are wrong
- A. CloudTrail records all API calls individually; extracting the latest state from multiple rapid changes requires manual analysis and is operationally inefficient.
- C. CloudWatch is designed for metrics and logs, not configuration tracking; it does not maintain configuration state snapshots.
- D. AWS Cloud Map is a service discovery tool, not a configuration tracking solution; it does not provide compliance evaluation or configuration change recording.
Question 7
A security engineer needs to implement a solution to create and control the keys that a company uses for cryptographic operations. The security engineer must create symmetric keys in which the key material is generated and used within a custom key store that is backed by an AWS CloudHSM cluster.
The security engineer will use symmetric and asymmetric data key pairs for local use within applications. The security engineer also must audit the use of the keys.
How can the security engineer meet these requirements?
Show answer and explanation
Correct answer: D. To create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster. For auditing, use AWS CloudTrail.
AWS KMS with custom key stores backed by CloudHSM is the correct service for generating and managing symmetric keys with key material kept within the HSM cluster. AWS CloudTrail provides comprehensive audit logging of all key usage and management operations, meeting the security and compliance requirements. This combination enables the security engineer to create, control, and audit cryptographic keys as specified.
Why the other options are wrong
- A. Amazon Athena is a query service for data analysis, not a key auditing solution; it cannot audit KMS key operations.
- B. Amazon S3 is not a key management service and cannot create or manage cryptographic keys or custom key stores.
- C. Amazon GuardDuty is a threat detection service, not an auditing tool for key usage and management operations.
Question 8
A company has a compliance requirement to encrypt all data in transit. The company recently discovered an Amazon Aurora cluster that does not meet this requirement.
How can the company enforce encryption for all connections to the Aurora cluster?
Show answer and explanation
Correct answer: A. In the Aurora cluster configuration, set the require_secure_transport DB cluster parameter to ON.
The require_secure_transport DB cluster parameter enforces SSL/TLS encryption for all connections to the Aurora database cluster. Setting this parameter to ON ensures all connections must use encrypted transport, directly meeting the compliance requirement without additional infrastructure.
Why the other options are wrong
- B. AWS Directory Service with Kerberos authentication adds complexity and does not inherently enforce encryption in transit.
- C. AWS Certificate Manager provides certificates but requires separate configuration of SSL/TLS; the require_secure_transport parameter is the direct enforcement mechanism.
- D. RDS Proxy is a connection pooling service; while it can support encryption, it is not necessary for enforcing encryption on the cluster itself.
Question 9
A company runs an application on an Amazon EC2 instance. The application generates invoices and stores them in an Amazon S3 bucket. The instance profile that is attached to the instance has appropriate access to the S3 bucket.
The company needs to share each invoice with multiple clients that do not have AWS credentials. Each client must be able to download only the client's own invoices. Clients must download their invoices within 1 hour of invoice creation. Clients must use only temporary credentials to access the company’s AWS resources.
A security engineer creates a script that runs on the EC2 instance. The script uses the instance profile to generate an S3 presigned URL for the clients. Each presigned URL expires after 1 hour.
Which additional step will meet these requirements?
Show answer and explanation
Correct answer: C. Update the script to use AWS Security Token Service (AWS STS) to obtain new credentials each time the script runs by assuming a new role that has S3 GetObject permissions. Use the credentials to generate the presigned URLs.
A presigned URL is valid only while the credentials that signed it are valid, and instance profile credentials are rotated automatically. Assuming a role with AWS STS each time the script runs gives temporary credentials with a known session length, so the presigned URLs can be signed to last the full hour with temporary credentials only. The role needs only s3:GetObject.
Why the other options are wrong
- A. A presigned URL carries the permissions of the identity that signed it, so a bucket policy for the clients does not apply, and S3:List* is not needed.
- B. A tag condition on the instance role does not change how long the presigned URLs stay valid and does not give anyone temporary credentials of their own.
- D. Embedding long-term IAM user access keys in a script uses permanent credentials, which violates the requirement to use only temporary credentials.
Question 10
A security engineer is designing security controls for a fleet of Amazon EC2 instances that run sensitive workloads in a VPC. The security engineer needs to implement a solution to detect and mitigate software vulnerabilities on the EC2 instances.
Which solution will meet this requirement?
Show answer and explanation
Correct answer: A. Scan the EC2 instances by using Amazon Inspector. Apply security patches and updates by using AWS Systems Manager Patch Manager.
Amazon Inspector is the AWS service purpose-built to detect software vulnerabilities on EC2 instances by analyzing packages, network reachability, and configuration. AWS Systems Manager Patch Manager applies security patches and updates automatically. Together, these services provide vulnerability detection and remediation, directly addressing the requirement to detect and mitigate software vulnerabilities.
Why the other options are wrong
- B. Host-based firewall and antivirus are detection tools but do not address vulnerability scanning or systematic patching; this approach requires manual maintenance.
- C. CloudWatch and EventBridge are monitoring and alerting tools, not vulnerability scanning tools; they cannot detect or mitigate vulnerabilities.
- D. GuardDuty Malware Protection detects malware, not software vulnerabilities; it is not the appropriate tool for vulnerability assessment.
What people say about the full SCS-C03 pack 5.0 from 7
Unbelievable! Thank you guys. Amazing dump for Amazon
After completing my SCS-C03 exam, I found it easy because of your great online questions. I passed my test. Thanks!
I highly recommend the Cert Stash pdf dumps file. I learnt in no time. Scored 98% marks in the Amazon SCS-C03 exam.
Question 11
A company uses Amazon API Gateway to present REST APIs to users. An API developer wants to analyze API access patterns without the need to parse the log files.
Which combination of steps will meet these requirements with the LEAST effort? (Choose two.)
Show answer and explanation
Correct answer: A, D. Configure access logging for the required API stage; Use Amazon CloudWatch Logs Insights to analyze API access information.
Option A (access logging) captures API access data, and Option D (CloudWatch Logs Insights) provides direct querying and analysis of those logs with minimal setup. Together they enable analysis without parsing log files manually. Option B uses CloudTrail which tracks API calls about the API (management plane) not access through the API. Option C requires additional S3 configuration and Athena setup. Option E provides metrics but not detailed access pattern analysis.
Why the other options are wrong
- B. CloudTrail tracks management events about the API, not user access through the API; it does not capture API request details needed for access pattern analysis.
- C. While viable, this requires more effort: configuring S3 destination, managing data exports, and writing Athena queries compared to using CloudWatch Logs Insights directly.
- E. CloudWatch Metrics provide aggregated statistics but lack the granular request-level detail needed to analyze specific access patterns.
Question 12
A development team is creating an open source toolset to manage a company's software as a service (SaaS) application. The company stores the code in a public repository so that anyone can view and download the toolset's code.
The company discovers that the code contains an IAM access key and secret key that provide access to internal resources in the company’s AWS environment A security engineer must implement a solution to identify whether unauthorized usage of the exposed credentials has occurred. The solution also must prevent any additional usage of the exposed credentials.
Which combination of steps will meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: B, E. Deactivate the exposed IAM access key from the user’s IAM account.; Generate an IAM credential report. Check the report to determine when the user that owns the access key last logged in.
Deactivating the exposed access key immediately stops anyone from using it (B). The IAM credential report lists, for each access key, when it was last used and for which service and Region, which shows whether the key was used after it was exposed (E).
Why the other options are wrong
- A. IAM Access Analyzer reports resources shared outside the account. It does not show who used a specific access key.
- C. GuardDuty cannot be given a rule that blocks a specific access key.
- D. Creating a new access key does not identify misuse and is not needed to stop the exposed key, because deactivating the old key does that.
Question 13
A company's public website consists of an Application Load Balancer (ALB), a set of Amazon EC2 instances that run a stateless application behind the ALB, and an Amazon DynamoDB table from which the application reads data. The company is concerned about malicious scanning and DDoS attacks. The company wants to impose a restriction in which each client IP address can read the data only 3 times in any 5-minute period.
Which solution will meet this requirement with the LEAST effort?
Show answer and explanation
Correct answer: A. Set up AWS WAF in front of the ALB. Create a rule that blocks requests that exceed the limit of 3 requests in any 5-minute period for each IP address.
AWS WAF is specifically designed to protect web applications and can enforce rate-based rules that limit requests from each IP address within a rolling time window. A WAF rule can be configured to block requests exceeding 3 reads in 5 minutes per IP address with minimal effort and no application changes, directly addressing the requirement.
Why the other options are wrong
- B. CloudWatch does not provide request counting; Lambda would be invoked for every request, creating performance overhead and complexity.
- C. Modifying application code to track rolling 5-minute windows per IP requires significant development effort and introduces state management complexity.
- D. DynamoDB TTL and throughput settings do not provide request rate limiting; this approach does not enforce per-IP-address rate limits.
Question 14
A security engineer for a company needs to design an incident response plan that addresses compromised IAM user account credentials. The company uses an organization in AWS Organizations and AWS IAM
Identify Center to manage user access. The company uses a delegated administrator account to implement AWS Security Hub. The delegated administrator account contains an organizational trail in AWS CloudTrail that logs all events to an Amazon S3 bucket. The company has also configured an organizational event data store that captures all events from the trail.
The incident response plan must provide steps that the security engineer can take to immediately disable any compromised IAM user when the security engineer receives a notification of a security incident.
The plan must prevent the IAM user from being used in any AWS account. The plan must also collect all AWS actions that the compromised IAM user performed across all accounts in the previous 7 days.
Which solution will meet these requirements?
Show answer and explanation
Correct answer: D. Disable the IAM user's access in IAM Identity Center. Use CloudTrail to query the organizational event data store for actions that the IAM user performed in the previous 7 days.
IAM Identity Center manages user access across the organization, so disabling a user there immediately blocks them across all accounts. CloudTrail's organizational event data store is specifically designed for querying events across the entire organization through the CloudTrail API, making it the appropriate tool for collecting 7 days of user actions. This solution addresses both immediate remediation and investigation requirements.
Why the other options are wrong
- A. Disabling a user only in the management account does not prevent their use in member accounts; Athena requires manual S3 queries which is less efficient than CloudTrail's API.
- B. Removing IAM policies does not prevent the user from being used if new policies are attached; Security Hub is not a CloudTrail query tool.
- C. Removing permission sets only affects IAM Identity Center managed users, not traditional IAM users; CloudWatch Logs Insights is not the proper tool for querying CloudTrail logs in S3.
Question 15
A company uses AWS Organizations to manage its AWS accounts. The company has a development account and a production account. An auditor has requested evidence that the production account workloads are resilient to disruption. The company needs a solution that improves the resilience of each production account workload.
Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Review the architecture by using the AWS Well-Architected Tool. Use the Well-Architected Framework and focus on the Operational Excellence, Security, and Reliability pillars. Document and implement mitigations for the identified risks. Provide the documentation to the auditor.
The AWS Well-Architected Tool directly addresses resilience improvements across the Reliability pillar and relates to Operational Excellence and Security. It provides a structured framework to identify architectural weaknesses, document findings, and implement mitigations, directly improving production workload resilience while providing auditable evidence of the improvement process. The solution moves beyond assessment to actual implementation and documentation of risk mitigations.
Why the other options are wrong
- A. Audit Manager provides compliance assessment but does not actively improve resilience or provide actionable guidance for architectural improvements.
- C. Amazon Inspector focuses on vulnerability scanning, not workload resilience or disruption resistance.
- D. Fault Injection Service is best used in the production account (not development) to test actual resilience, and only provides experimental results without systematic framework-based improvements.
Question 16
A company has contracted with a third party to audit several AWS accounts. To enable the audit, cross-account IAM roles have been created in each account targeted for audit. The auditor is having trouble accessing some of the accounts.
Which of the following may be causing this problem? (Choose three.)
Show answer and explanation
Correct answer: A, C, F. The external ID used by the auditor is missing or incorrect; The auditor has not been granted sts:AssumeRole for the role in the destination account; The role ARN used by the auditor is missing or incorrect.
When assuming cross-account roles, an incorrect or missing external ID causes assumption failure (A), an incorrect or missing role ARN prevents targeting the correct role (F), and missing sts:AssumeRole permissions in the trust policy prevent the auditor's principal from assuming the role (C). Passwords (B) and secret keys (E) are IAM user credentials unrelated to role assumption. EC2 roles (D) are instance-level identities and cannot be manually set by the auditor.
Why the other options are wrong
- B. Passwords are used for AWS Management Console access, not for programmatic role assumption via STS.
- D. EC2 roles are automatically attached to instances; they cannot be manually set by an external auditor and are not relevant to cross-account role assumption.
- E. Secret keys are credentials for a specific IAM user; incorrect keys would cause authentication failure, but role assumption uses STS tokens from an existing authenticated principal.
Question 17
A public subnet contains two Amazon EC2 instances. The subnet has a custom network ACL. A security engineer is designing a solution to improve the subnet security.
The solution must allow outbound traffic to an internet service that uses TLS through port 443. The solution also must deny inbound traffic that is destined for MySQL port 3306.
Which network ACL rule set meets these requirements?
Show answer and explanation
Correct answer: B. Use inbound rule 100 to deny traffic on TCP port 3306. Use inbound rule 200 to allow traffic on TCP port range 1024-65535. Use outbound rule 100 to allow traffic on TCP port 443.
The requirements are to allow outbound TLS traffic on port 443 and deny inbound MySQL traffic on port 3306. Option B correctly denies inbound port 3306 in rule 100, allows inbound ephemeral ports (1024-65535) in rule 200 to permit response traffic from outbound connections, and allows outbound port 443. The ephemeral port range is critical because when an EC2 instance initiates outbound connections on port 443, the remote server responds on an ephemeral port, which must be permitted inbound. Without this, outbound HTTPS connections would fail.
Why the other options are wrong
- A. Allows inbound traffic on port 443, which is unnecessary for the requirement of allowing outbound TLS traffic and doesn't account for return traffic on ephemeral ports.
- C. Allows inbound traffic on all ephemeral ports (1024-65535) before denying port 3306, but rule 100 processing means the deny on 3306 would never be evaluated since 3306 falls within the ephemeral range.
- D. Allows inbound traffic on port 443, which contradicts the requirement to deny inbound MySQL traffic and doesn't properly permit return traffic for outbound connections.
Question 18
A security team manages a company's AWS Key Management Service (AWS KMS) customer managed keys. Only members of the security learn can administer the KMS keys. The company’s application team has a software process that needs temporary access to the keys occasionally. The security team needs to provide the application team's software process with access to the keys.
Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: C. Create a key grant to allow the application team to use the KMS keys. Revoke the grant when the application team no longer needs access.
KMS grants provide temporary, programmatic access to keys with automatic expiration or explicit revocation without modifying key policies. This meets the requirement for temporary access with minimal overhead. Option A exports key material, eliminating KMS security controls. Option B requires manual key policy editing and reversion, creating operational burden. Option D involves importing key material frequently, which is overly complex and inefficient.
Why the other options are wrong
- A. Exporting key material to on-premises HSM removes the security benefits of managed KMS and creates compliance risks.
- B. Editing and reverting key policies manually for temporary access is operationally intensive and error-prone compared to automated grants.
- D. Generating, importing, and managing key material on-premises for temporary access is far more complex than using grants.
Question 19
A security engineer recently rotated the host keys for an Amazon EC2 instance. The security engineer is trying to access the EC2 instance by using the EC2 Instance Connect feature. However, the security engineer receives an error for failed host key validation. Before the rotation of the host keys, EC2 Instance Connect worked correctly with this EC2 instance.
What should the security engineer do lo resolve this error?
Show answer and explanation
Correct answer: B. Manually upload the new host key to the AWS trusted host keys database
After rotating host keys on an EC2 instance, the new host keys must be uploaded to AWS's trusted host keys database for EC2 Instance Connect to validate them. EC2 Instance Connect maintains a database of trusted host keys, and rotating the instance's keys requires updating this database with the new keys.
Why the other options are wrong
- A. Importing key material into KMS is unrelated to EC2 Instance Connect host key validation.
- C. AmazonSSMManagedInstanceCore relates to Systems Manager Session Manager, not EC2 Instance Connect.
- D. Creating a new SSH key pair is unrelated to host key rotation issues with EC2 Instance Connect.
Question 20
A company sands Amazon RDS snapshots to two accounts as part of its disaster recovery (DR) plan. The snapshots must be encrypted. However, each account needs to be able to decrypt the snapshots in case of a DR event.
Which solution will meet these requirements?
Show answer and explanation
Correct answer: D. Use an AWS Key Management Service (AWS KMS) customer managed key to generate the snapshots. Share the KMS key with the two accounts by using an IAM principal that has the proper KMS permissions in each account.
A customer managed KMS key provides better control and security than the default key. The proper way to enable cross-account access is to share the KMS key with the two accounts by modifying the key policy to grant appropriate permissions to IAM principals in those accounts. This allows each account to decrypt snapshots when needed without copying or importing keys.
Why the other options are wrong
- A. The default AWS KMS key is account-specific and cannot be used across accounts; Lambda cannot copy KMS keys between accounts.
- B. KMS keys cannot be imported to other accounts; this approach is not supported by AWS KMS.
- C. The default KMS key cannot be shared across accounts due to account-specific constraints.
Question 21
A company's security engineer is designing an isolation procedure for Amazon EC2 instances as part of an incident response plan. The security engineer needs to isolate a target instance to block any traffic to and from the target instance, except for traffic from the company's forensics team. Each of the company's EC2 instances has its own dedicated security group. The EC2 instances are deployed in subnets of a VPC. A subnet can contain multiple instances.
The security engineer is testing the procedure for EC2 isolation and opens an SSH session to the target instance. The procedure starts to simulate access to the target instance by an attacker. The security engineer removes the existing security group rules and adds security group rules to give the forensics team access to the target instance on port 22.
After these changes, the security engineer notices that the SSH connection is still active and usable.
When the security engineer runs a ping command to the public IP address of the target instance, the ping command is blocked.
What should the security engineer do to isolate the target instance?
Show answer and explanation
Correct answer: B. Remove the port 22 security group rule. Attach an instance role policy that allows AWS Systems Manager Session Manager connections so that the forensics team can access the target instance.
The SSH connection remains active because it was established before the security group rules were modified, existing connections are not affected by security group changes. To properly isolate the instance, the forensics team should use AWS Systems Manager Session Manager (which operates through the SSM agent and IAM, independent of security group rules) instead of relying on port 22 SSH access. This removes the need for an open inbound security group rule while maintaining forensic access.
Why the other options are wrong
- A. Adding and deleting rules does not change the behavior of existing connections or close the active SSH session.
- C. Network ACLs only filter traffic at the subnet boundary and will not isolate a single instance within that subnet.
- D. A host-level firewall is complex and does not leverage AWS native isolation mechanisms already in place.
Question 22
A company runs an application on a fleet of Amazon EC2 instances. The company can remove instances from the fleet without risk to the application. All EC2 instances use the same security group named ProdFleet. Amazon GuardDuty and AWS Config are active in the company's AWS account.
A security engineer needs to provide a solution that will prevent an EC2 instance from sending outbound traffic if GuardDuty generates a cryptocurrency finding event. The security engineer creates a new security group named isolate that contains no outbound rules. The security engineer configures an AWS Lambda function to remove an EC2 instance from the ProdFleet security group and add it to the isolate security group.
Which additional step will meet this requirement?
Show answer and explanation
Correct answer: C. Configure an Amazon EventBridge rule that invokes the Lambda function if GuardDuty generates a CryptoCurrency:EC2/* finding event.
EventBridge can ingest GuardDuty findings directly and trigger Lambda functions based on specific finding types like CryptoCurrency:EC2/*. This is the standard AWS pattern for automated response to security findings. EventBridge provides real-time event-driven automation that connects GuardDuty's detection to the Lambda-based remediation action.
Why the other options are wrong
- A. GuardDuty cannot directly invoke Lambda functions; it publishes findings to EventBridge for downstream automation.
- B. AWS Config rules respond to configuration changes, not GuardDuty security findings, these are separate event sources.
- D. AWS Config does not detect CryptoCurrency findings; only GuardDuty generates these security findings.
Question 23
A company is running a new workload across accounts that are in an organization in AWS Organizations. All running resources must have a tag of CostCenter, and the tag must have one of three approved values. The company must enforce this policy and must prevent any changes of the CostCenter tag to a non-approved value.
Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Enable tag policies for the organization. Create a tag policy that specifies a tag key of CostCenter and the approved values. Configure the policy to enforce noncompliant operations. Create an SCP that denies the creation of resources when the aws:RequestTag.CostCenter condition key has a null value.
Tag policies combined with an SCP provides enforcement across the organization. Option C uses tag policies (which specifically govern tag values) to specify approved CostCenter values and enforce compliance, while the SCP denies resource creation when the tag is missing. This prevents both non-approved values and missing tags. Option A misuses CloudFormation Guard for tag policies. Option B relies on reactive Lambda analysis rather than preventive controls. Option D combines policies with reactive Lambda rather than preventive enforcement.
Why the other options are wrong
- A. CloudFormation Guard is a policy-as-code tool for templates, not for runtime tag enforcement across organizations; this mixes tools inappropriately.
- B. EventBridge and Lambda provide reactive detection only; they cannot prevent noncompliant resource creation, only detect it after the fact.
- D. Relies on reactive Lambda remediation rather than preventive enforcement; EventBridge rules detect violations after they occur, not preventing them.
Question 24
A company runs workloads in an AWS account. A security engineer observes some unusual findings in Amazon GuardDuty. The security engineer wants to investigate a specific IAM role and generate an investigation report. The report must contain details about anomalous behavior and any indicators of compromise.
Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Use Amazon Detective to perform an investigation on the IAM role.
Amazon Detective is specifically designed to investigate security findings and anomalies in AWS environments. It can analyze an IAM role to generate detailed investigation reports containing information about anomalous behavior, entity relationships, and indicators of compromise. Detective integrates with GuardDuty findings to provide deeper analysis and context.
Why the other options are wrong
- B. AWS Audit Manager is for compliance and governance audits, not for investigating security incidents or anomalous behavior.
- C. Amazon Inspector performs vulnerability assessments on resources like EC2 instances and container images, not investigation of IAM role behavior.
- D. Amazon Inspector performs vulnerability scans, not investigations of IAM roles or anomalous behavior analysis.
Question 25
A company has hundreds of AWS accounts in an organization in AWS Organizations. The company operates out of a single AWS Region. The company has a dedicated security tooling AWS account in the organization. The security tooling account is configured as the organization's delegated administrator for Amazon GuardDuty and AWS Security Hub. The company has configured the environment to automatically enable GuardDuty and Security Hub for existing AWS accounts and new AWS accounts.
The company is performing control tests on specific GuardDuty findings to make sure that the company's security team can detect and respond to security events. The security team launched an Amazon EC2 instance and attempted to run DNS requests against a test domain, example.com, to generate a DNS finding. However, the GuardDuty finding was never created in the Security Hub delegated administrator account.
Why was the finding was not created in the Security Hub delegated administrator account?
Show answer and explanation
Correct answer: B. The VPC where the EC2 instance was launched had the DHCP option configured for a custom OpenDNS resolver.
GuardDuty detects malicious DNS queries by analyzing DNS traffic from the default AWS DNS resolver (169.254.169.253). When a VPC's DHCP options are configured to use a custom DNS resolver (such as OpenDNS), DNS queries bypass the default resolver and GuardDuty cannot intercept or analyze them. Therefore, the DNS finding was never generated because GuardDuty had no visibility into the DNS requests being made to example.com.
Why the other options are wrong
- A. VPC Flow Logs are not required for GuardDuty DNS findings; GuardDuty uses DNS query logs from the default resolver, not VPC Flow Logs.
- C. GuardDuty integration with Security Hub is a requirement, but the finding wasn't generated in the source account in the first place, so integration is not the root cause.
- D. Cross-Region aggregation is only necessary if findings are in different regions; the company operates in a single region, so this is not the issue.
Question 26
A company has a platform that is divided into 12 AWS accounts under the same organization in AWS Organizations. Many of these accounts use Amazon API Gateway to expose APIs to the company's frontend applications. The company needs to protect the ousting APIs and any resources that will be deployed in the future against common SQL injection and bot attacks.
Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: B. Use AWS Firewall Manager to create an AWS WAF policy. Configure the policy to include the AWS Bot Control and SQL database managed rule groups. Set the policy scope to include the API Gateway stage as the resource type.
AWS Firewall Manager is designed specifically for managing WAF policies across multiple accounts and resources at scale. It allows creation of a single policy with AWS Bot Control and SQL injection managed rule groups that automatically applies to all API Gateway stages across the 12 accounts in the organization, eliminating the need to manually manage individual WAF ACLs for each resource.
Why the other options are wrong
- A. Manually creating WAF ACLs for each API in each account requires significant operational overhead and ongoing manual enforcement.
- C. AWS Service Catalog requires manual provisioning and Config remediation, which is more complex than Firewall Manager's automatic policy application.
- D. Security Hub with Lambda remediation is more complex and requires custom automation compared to Firewall Manager's built-in multi-account capabilities.
Question 27
An IAM user receives an Access Denied message when the user attempts to access objects in an Amazon S3 bucket. The user and the S3 bucket are in the same AWS account. The S3 bucket is configured to use server-side encryption with AWS KMS keys (SSE-KMS) to encrypt all of its objects at rest by using a customer managed key from the same AWS account. The S3 bucket has no bucket policy defined. The IAM user has been granted permissions through an IAM policy that allows the kms:Decrypt permission to the customer managed key. The IAM policy also allows the s3:List* and s3:Get* permissions for the S3 bucket and its objects.
Which of the following is a possible reason that the IAM user cannot access the objects in the S3 bucket?
Show answer and explanation
Correct answer: D. The KMS key policy has been edited to remove the ability for the AWS account to have full access to the key.
Even though the IAM user has kms:Decrypt permission and appropriate S3 permissions, access can still be denied if the KMS key policy explicitly denies the AWS account full access to the key. KMS key policies are separate from IAM policies, and the key policy must allow the account principal to use the key. If the key policy is modified to remove account-level permissions, the IAM user cannot decrypt objects even with proper IAM permissions.
Why the other options are wrong
- A. kms:DescribeKey is not required for decryption operations; kms:Decrypt is sufficient.
- B. The question explicitly states the bucket uses customer managed keys for SSE-KMS encryption.
- C. No bucket policy is needed when the IAM user and bucket are in the same account and the user has appropriate IAM permissions.
Question 28
A company in France uses Amazon Cognito with the Cognito Hosted UI as an identity broker for sign-in and sign-up processes. The company is marketing an application and expects that all the application's users will come from France.
When the company launches the application, the company’s security team observes fraudulent sign-ups for the application. Most of the fraudulent registrations are from users outside of France.
The security team needs a solution to perform custom validation at sign-up. Based on the results of the validation, the solution must accept or deny the registration request.
Which combination of steps will meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: A, B. Create a pre sign-up AWS Lambda trigger. Associate the Amazon Cognito function with the Amazon Cognito user pool; Use a geographic match rule statement to configure an AWS WAF web ACL. Associate the web ACL with the Amazon Cognito user pool.
A pre sign-up Lambda trigger allows custom validation logic to be executed during registration, enabling geographic validation and acceptance/denial of sign-ups. AWS WAF with geographic match rules can be associated with Cognito to enforce location-based restrictions at the web layer. Together, these provide defense-in-depth with both application-level and network-level geographic controls.
Why the other options are wrong
- C. App client configuration does not provide validation capabilities; it is only for managing application access to Cognito.
- D. Cognito does not have a native geographic restriction setting feature; geographic enforcement must be done through Lambda triggers or WAF.
- E. Social identity providers validate external identities but do not provide geographic validation for sign-ups; they also don't provide custom validation logic.
Question 29
A company has a web-based application that runs behind an Application Load Balancer (ALB). The application is experiencing a credential stuffing attack that is producing many failed login attempts. The attack is coming from many IP addresses. The login attempts are using a user agent string of a known mobile device emulator.
A security engineer needs to implement a solution to mitigate the credential stuffing attack. The solution must still allow legitimate logins to the application.
Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Create an AWS WAF web ACL for the ALB Create a custom rule that blocks requests that contain the user agent string of the device emulator.
AWS WAF with a custom rule blocking the known mobile device emulator user agent string is the most direct and effective solution. It will block the attack traffic while allowing legitimate users with different user agents to access the application. This approach specifically targets the attack pattern identified (user agent string) without affecting legitimate login attempts from real users or different devices.
Why the other options are wrong
- A. CloudWatch alarms with SNS notifications only alert but do not actively block the attack traffic.
- B. Denying traffic from specific IP addresses is ineffective because the attack is coming from many different IP addresses.
- D. Allowing only legitimate user agent strings would be overly restrictive and could block legitimate users with unexpected or newer user agents.
Question 30
A security engineer discovers that a company’s user passwords have no required minimum length. The company is using the following two identity providers (IdPs):
AWS Identity and Access Management (IAM) federated with on-premises Active Directory Amazon Cognito user pools that contain the user database for an AWS Cloud application that the company developed
Which combination of actions should the security engineer take to implement a required minimum length for the passwords? (Choose two.)
Show answer and explanation
Correct answer: B, C. Update the password length policy in the Cognito configuration; Update the password length policy in the on-premises Active Directory configuration
The company uses two separate identity providers with different policy mechanisms. For IAM federated with on-premises Active Directory, password policies must be configured in Active Directory itself (option C), as IAM password policies only apply to native IAM users. For Amazon Cognito user pools (option B), password policies are configured directly in Cognito's user pool settings. SCPs and IAM policies cannot enforce password length requirements across these federated and Cognito-based systems.
Why the other options are wrong
- A. IAM password policies only apply to native IAM users, not to federated users from Active Directory, so this doesn't address the on-premises AD requirement.
- D. SCPs control AWS service and API permissions at the organization level; they cannot enforce local password policies in Active Directory or Cognito.
- E. IAM policies cannot enforce password length requirements; they control API access permissions, not password policies for identity providers.
Question 31
A company uses AWS IAM Identity Center to manage access to its AWS accounts. The accounts are in an organization in AWS Organizations.
A security engineer needs to set up delegated administration of IAM Identity Center in the organization's management account.
Which combination of steps should the security engineer perform in IAM Identity Center before configuring delegated administration? (Choose three.)
Show answer and explanation
Correct answer: B, D, F. Create a new IAM Identity Center directory in the organization's management account; Create permission sets for use only in the organization's management account; Create user assignments only in the organization’s management account.
Before configuring delegated administration, the organization must have a new IAM Identity Center directory created (B), permission sets established for the management account (D), and user assignments configured in the management account (F). These foundational elements establish the identity and access framework that delegated administration builds upon.
Why the other options are wrong
- A. Least privilege access configuration is an ongoing security practice, not a prerequisite specific to delegated administration setup.
- C. Setting up a second AWS Region is not a prerequisite for delegated administration of IAM Identity Center.
- E. IAM users are legacy identity management; IAM Identity Center does not use traditional IAM users for its own administration.
Question 32
A company uses AWS Organizations. The company has learns that use an AWS CloudHSM hardware security module (HSM) that is hosted in a central AWS account. One of the teams creates its own new dedicated AWS account and wants to use the HSM that is hosted in the central account.
How should a security engineer share the HSM that is hosted in the central account with the new dedicated account?
Show answer and explanation
Correct answer: D. Use AWS Resource Access Manager (AWS RAM) to share the ID of the HSM that is hosted in the central account with the new dedicated account. Configure the CloudHSM security group to accept inbound traffic from the private IP addresses of client instances in the now dedicated account.
AWS RAM shares the CloudHSM cluster ID (the actual resource) with the new account, while the security group configuration allows network access. Option A incorrectly shares the VPC subnet ID instead of the HSM resource itself. Option B uses IAM roles, which don't provide network access to the CloudHSM cluster. Option C uses STS tokens for authentication but doesn't address network access through VPC security groups.
Why the other options are wrong
- A. Sharing the VPC subnet ID does not grant access to the CloudHSM cluster resource; RAM requires sharing the actual CloudHSM cluster ID.
- B. IAM cross-account roles handle permissions but do not enable network access to CloudHSM, which requires VPC networking and security group configuration.
- C. STS tokens provide authentication but not resource access; CloudHSM access requires sharing the cluster resource via RAM and proper network configuration.
Question 33
A healthcare company stares mare than 1 million patient records in an Amazon S3 bucket. The patient records include personally identifiable information (Pit). The S3 bucket contains hundreds of terabytes of data.
A security engineer receives an alert that was triggered by an Amazon GuardDuty Exfiltration:S3/AnomalousBehavior finding. The security engineer confirms that an attacker is using temporary credentials that were obtained from a compromised Amazon EC2 instance that has s3:GetObject permissions for the S3 bucket. The attacker has begun downloading the contents of the bucket. The security engineer contacts a development team. The development team will require 4 hours to implement and deploy a fix.
The security engineer must take immediate action to prevent the attacker from downloading more data from the S3 bucket.
Which solution will moot this requirement?
Show answer and explanation
Correct answer: A. Revoke the temporary session that is associated with the instance profile that is attached to the EC2 instance.
Revoking the temporary session associated with the instance profile immediately invalidates all existing credentials derived from that EC2 instance role. This instantly stops the attacker's ability to download data since their temporary credentials become invalid, providing immediate protection while the development team works on a permanent fix.
Why the other options are wrong
- B. Quarantining the instance prevents future compromise but does not invalidate the temporary credentials the attacker already obtained.
- C. Enabling Macie and S3 Object Lock are detection and protection mechanisms that do not stop an attacker who already has valid temporary credentials.
- D. Denying access via bucket policy is effective but takes time to propagate and requires identifying all principals; revoking credentials is faster and more direct.
Question 34
A corporate cloud security policy slates that communications between the company's VPC and KMS must travel entirely within the AWS network and not use public service endpoints.
Which combination of the following actions MOST satisfies this requirement? (Choose two.)
Show answer and explanation
Correct answer: A, C. Add the aws:sourceVpce condition to the AWS KMS key policy referencing the company’s VPC endpoint ID; Create a VPC endpoint for AWS KMS with private DNS enabled.
Option A ensures that KMS API calls can only originate from the company's VPC endpoint by restricting the KMS key policy to accept requests only from that specific VPC endpoint ID, keeping traffic within AWS network. Option C creates a private VPC endpoint for KMS with private DNS enabled, allowing the VPC to communicate with KMS entirely through private connectivity without traversing the public internet. Together, these ensure that all communications between the VPC and KMS travel through AWS's private network infrastructure.
Why the other options are wrong
- B. Removing an internet gateway and adding a virtual private gateway doesn't prevent traffic to KMS from routing through public endpoints; it only affects VPN connectivity.
- D. The KMS Import Key feature is for importing external key material and is unrelated to securing communications between VPC and KMS.
- E. Using a private IP address range condition is ineffective because KMS service endpoints use AWS-owned IP addresses, not customer VPC IP addresses, and wouldn't actually restrict traffic to private endpoints.
Question 35
A company recently set up Amazon GuardDuty and is receiving a high number of findings from IP addresses within the company. A security engineer has verified that these IP addresses are trusted and allowed.
Which combination of steps should the security engineer take to configure GuardDuty so that it does not produce findings for these IP addresses?
(Choose two.)
Show answer and explanation
Correct answer: A, D. Create a plaintext configuration file that contains the trusted IP addresses.; Upload the configuration file to Amazon S3. Add a new trusted IP list to GuardDuty that points to the file.
A GuardDuty trusted IP list is a file stored in Amazon S3 in a supported format such as plaintext (TXT), STIX or OTX CSV. Create the file with the trusted IP addresses (A), upload it to S3, and add a trusted IP list in GuardDuty that points to the S3 location of the file (D). GuardDuty then stops generating findings for activity from those addresses.
Why the other options are wrong
- B. JSON is not a supported trusted IP list format. The supported formats are TXT, STIX, OTX CSV, ALIEN_VAULT, PROOF_POINT and FIRE_EYE.
- C. GuardDuty does not accept a direct file upload. The list must be stored in Amazon S3.
- E. GuardDuty has no field to paste list data into. The list is referenced by its S3 location.
Question 36
A company finds that one of its Amazon EC2 instances suddenly has a high CPU usage. The company does not know whether the EC2 instance is compromised or whether the operating system is performing background cleanup.
Which combination of steps should a security engineer take before investigating the issue? (Choose three.)
Show answer and explanation
Correct answer: B, C, E. Enable termination protection for the EC2 instance if termination protection has not been enabled; Take snapshots of the Amazon Elastic Block Store (Amazon EBS) data volumes that are attached to the EC2 instance; Capture the EC2 instance metadata, and then tag the EC2 instance as under quarantine.
Before investigating, enable termination protection (B) to prevent accidental instance deletion during forensics. Take snapshots of EBS volumes (C) to preserve data for forensic analysis and enable recovery. Capture instance metadata and tag as quarantine (E) to document the incident state and control access. These steps preserve evidence and prevent data loss before investigation begins.
Why the other options are wrong
- A. Disabling termination protection removes a safeguard and risks data loss during investigation.
- D. Removing existing snapshots destroys potential evidence and recovery options.
- F. Modifying instance metadata deletes evidence and compromises forensic integrity.
That was 36 of 143.
The full AWS SCS-C03 pack has all 143 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 42 free as one PDF by email. Get the Half Pack →