Question 1

SCS-C03: All accounts in the organization, including new ones

Accepted Answer

Use the service's Organizations integration: a delegated administrator account with auto-enable for new accounts, or an SCP. Per-account setup misses accounts created later.

Question 2

SCS-C03: Prevent an action for every account

Accepted Answer

An SCP denying the action, attached to the root or OU. Config, GuardDuty and Security Hub only detect.

Question 3

SCS-C03: Least operational overhead

Accepted Answer

The managed service with built-in integration, such as GuardDuty plus EventBridge, rather than custom scripts. Custom Lambda or EC2 solutions add maintenance.

Question 4

SCS-C03: Nobody, not even root, may delete data before a date

Accepted Answer

S3 Object Lock in compliance mode (Vault Lock for Glacier vaults, Backup Vault Lock for backups). Governance mode can be overridden by users with permission.

Question 5

SCS-C03: Detect compromised instances and credential abuse without enabling logs yourself

Accepted Answer

Enable GuardDuty; it reads CloudTrail, Flow Logs and DNS logs itself. No log configuration is needed for the core detections.

Question 6

SCS-C03: Find PII in S3 buckets

Accepted Answer

Run Macie automated discovery or classification jobs on the buckets. Macie is the S3 sensitive data service.

Question 7

SCS-C03: Single view of findings from many services and accounts with compliance scores

Accepted Answer

Security Hub with a delegated admin and cross-Region aggregation. It aggregates findings and runs standards checks.

Question 8

SCS-C03: Normalised raw logs from AWS and third parties in one lake

Accepted Answer

Security Lake (OCSF, Parquet in S3), with subscribers for SIEMs. Security Hub holds findings, not raw logs.

Question 9

SCS-C03: Audit log of API calls retained for years and queryable by SQL

Accepted Answer

An organization trail to S3 queried by Athena, or a CloudTrail Lake event data store. Event history only keeps 90 days.

Question 10

SCS-C03: Alert when a specific API pattern appears in logs

Accepted Answer

CloudTrail to CloudWatch Logs, a metric filter, an alarm and SNS. Metric filters turn log patterns into metrics.

Question 11

SCS-C03: Logs from many accounts into one logging account in real time

Accepted Answer

Use CloudWatch cross-account observability or a subscription filter to a destination in the logging account. Export tasks are batch and delayed.

Question 12

SCS-C03: Compromised EC2 instance: first action

Accepted Answer

Swap to a no-traffic security group (plus NACL deny), keep it running, capture memory and snapshots, and investigate from a copy. Terminating or patching first destroys evidence.

Question 13

SCS-C03: Access key leaked in a public repository

Accepted Answer

Deactivate the key, check what it did, remove persistence, then rotate. Deleting immediately loses investigation context.

Question 14

SCS-C03: Compromised role: existing sessions must stop now

Accepted Answer

Attach a deny with an aws:TokenIssueTime condition (revoke sessions). Temporary credentials stay valid until they expire.

Question 15

SCS-C03: Find root cause and scope of a GuardDuty finding

Accepted Answer

Use Detective finding groups and entity profiles. It correlates CloudTrail, Flow Logs and findings.

Question 16

SCS-C03: Automatically respond to a finding

Accepted Answer

Route the finding through EventBridge to SSM Automation, Lambda or Step Functions. Event-driven response is the native pattern.

Question 17

SCS-C03: DDoS preparation with expert help and cost protection

Accepted Answer

Subscribe to Shield Advanced, engage the SRT, protect resources, enable layer 7 mitigation with WAF. Standard has no SRT or cost protection.

Question 18

SCS-C03: Ransomware encrypted backups in the same account

Accepted Answer

Use AWS Backup logically air-gapped vaults or Vault Lock, with copies in a separate account. Immutable, isolated copies survive credential compromise.

Question 19

SCS-C03: SQL injection and XSS on a public app

Accepted Answer

Attach a web ACL with managed rule groups to the ALB or CloudFront. WAF inspects layer 7.

Question 20

SCS-C03: One client flooding requests

Accepted Answer

Add a rate-based rule per source IP. It blocks automatically over a threshold.

Question 21

SCS-C03: Users must reach the app only through CloudFront

Accepted Answer

Use OAC for S3, and for ALB restrict to the CloudFront managed prefix list or require a secret header. Otherwise attackers hit the origin directly.

Question 22

SCS-C03: Block a known bad IP at subnet level

Accepted Answer

Add a NACL deny rule. Security groups can't deny.

Question 23

SCS-C03: Filter egress by domain name

Accepted Answer

Use Network Firewall domain-list or Suricata rules. Security groups can't match domains.

Question 24

SCS-C03: Admin access to instances with no inbound ports, audited

Accepted Answer

Use Session Manager with logging to CloudWatch or S3. No bastion, ports or keys.

Question 25

SCS-C03: Scan container images, Lambda and EC2 for CVEs

Accepted Answer

Enable Inspector organization-wide. Continuous scanning with risk scores.

Question 26

SCS-C03: Find unintended paths from the internet to databases

Accepted Answer

Define a network access scope and review findings. Reachability Analyzer only tests one given path.

Question 27

SCS-C03: Corporate users reach private apps without a VPN, with device checks

Accepted Answer

Use AWS Verified Access with identity and device trust policies. Per-request zero trust access.

Question 28

SCS-C03: Direct Connect traffic must be encrypted

Accepted Answer

Use MACsec on supported connections or an IPsec VPN over Direct Connect. Direct Connect is private but not encrypted.

Question 29

SCS-C03: Stop prompt injection and PII leakage in a generative AI app

Accepted Answer

Apply Guardrails with prompt attack filters and sensitive information filters. Works on inputs and outputs.

Question 30

SCS-C03: Workforce SSO to many accounts from the company IdP

Accepted Answer

Connect the IdP with SAML and SCIM, assign permission sets. Central, temporary credentials.

Question 31

SCS-C03: Customers sign in to a mobile app and get AWS access

Accepted Answer

User pool for sign-in, identity pool for AWS credentials. User pools authenticate; identity pools authorise.

Question 32

SCS-C03: On-premises server needs AWS access without stored keys

Accepted Answer

X.509 certificate, trust anchor and profile. Temporary credentials only.

Question 33

SCS-C03: Developers may create roles but never exceed a limit

Accepted Answer

Allow CreateRole only with the boundary set as a condition. Prevents privilege escalation.

Question 34

SCS-C03: One policy for many teams scaling with resources

Accepted Answer

Match aws:ResourceTag to ${aws:PrincipalTag}. No new policies per project.

Question 35

SCS-C03: Find resources shared outside the organization

Accepted Answer

Create an organization analyzer and review external access findings. Uses automated reasoning over resource policies.

Question 36

SCS-C03: Why was this request denied

Accepted Answer

Read the error message and simulate policies. The message states which policy type denied.

Question 37

SCS-C03: Fine-grained authorization inside your own application

Accepted Answer

Cedar policies and IsAuthorized calls. Separates authorization from code.

Question 38

SCS-C03: Share an encrypted snapshot or AMI with another account

Accepted Answer

Share the snapshot and allow the other account in the key policy. AWS managed keys can't be shared.

Question 39

SCS-C03: Customer generates own key material and can destroy it

Accepted Answer

Create an external-origin key, import wrapped material. Imported material can be deleted at once but doesn't auto-rotate.

Question 40

SCS-C03: Keys must never be stored in AWS

Accepted Answer

Use KMS external key store with an XKS proxy. Material stays in your HSM outside AWS.

Question 41

SCS-C03: Sole control of HSMs, single-tenant

Accepted Answer

CloudHSM cluster, optionally as a KMS custom key store. Dedicated hardware you control.

Question 42

SCS-C03: Rotate database credentials automatically

Accepted Answer

Secrets Manager rotation with a Lambda function. Parameter Store has no built-in rotation.

Question 43

SCS-C03: Mask card numbers in logs

Accepted Answer

CloudWatch Logs data protection policy with managed identifiers. Masks at ingestion; unmask needs permission.

Question 44

SCS-C03: S3 access only from a VPC

Accepted Answer

Gateway endpoint with a bucket policy on aws:SourceVpce. Private path and enforced.

Question 45

SCS-C03: Deploy a baseline to every account including new ones

Accepted Answer

StackSets with Organizations and automatic deployment. New accounts are picked up automatically.

Question 46

SCS-C03: Root credentials in every member account

Accepted Answer

Enable centralised root access, remove member root credentials, use short-lived root sessions. No root passwords to guard.

Question 47

SCS-C03: Only my organization can access my S3 buckets, even via public policy

Accepted Answer

Resource control policy with aws:PrincipalOrgID. RCPs cap access to resources.

Question 48

SCS-C03: Enforce a security group baseline across accounts

Accepted Answer

Security group policies in Firewall Manager (needs Config). Central policy, auto-remediation.

Question 49

SCS-C03: Collect evidence automatically for an audit

Accepted Answer

Assessments using a prebuilt framework. Artifact only holds AWS's own reports.

Question 50

SCS-C03: Remediate non-compliant resources automatically

Accepted Answer

Config rule with an automatic remediation action. Native drift repair.

SCS-C03 question patterns

Find a pattern

In this list

Wording that decides the answer

Detection and logging

Incident response

Infrastructure security

Identity and access management

Data protection and keys

Governance and compliance