SCS-C03 sample questions with answers
The other 280 questions are in the practice tool, with answers revealed as you go.
Start 20 questionsThreat detection and monitoring
- A container platform team notices a shell process spawned inside a running pod that opened an outbound connection to an unknown host, which is typical of an attacker gaining interactive access. Which threat detection capability watches process and file behavior inside running workloads to catch this?
- A development VPC needs flow records only for denied traffic, stored as cheaply as possible, and the team will query them occasionally with SQL. Which delivery configuration is most economical?
- A security team must retain CloudTrail management events for seven years in a queryable store while minimizing operational overhead. Which approach best meets this requirement?
- A company enabled a CloudTrail organization trail. Where are management events from member accounts delivered?
- CloudTrail log files in S3 are being read by an unexpected IAM principal. Which log source reveals the GetObject calls against the CloudTrail bucket?
- GuardDuty raises a finding that temporary credentials issued to an EC2 instance are being used from an address outside AWS. The security team wants the source address blocked and the stolen sessions invalidated without human delay. What is the recommended approach?
- An analyst needs to filter millions of stored CloudTrail records by principal, event name and time range while investigating an incident. Which approach is most efficient?
- A security team is comparing Amazon Inspector v2 with the original Inspector service. Which capability is newly available in v2 rather than carried over from the classic service?
Incident response
- Responders need a playbook for a compromised workload. It must pause for an analyst's approval before revoking the instance role's active sessions and isolating the host, and it must record each step for audit. Which combination best models this?
- A SOC lead must brief the team on the sequence of phases to follow when a confirmed compromise of an EC2 instance is under investigation. Which listing gives the correct order?
- A company needs pages to reach the right on-call engineer based on incident severity, with escalation when nobody acknowledges. Which service should they configure?
- A company wants the ability to cut a suspected instance off from the network within seconds during an incident, without engineering the steps at 3 a.m. What should they prepare in advance?
- Which capability lets a team run a repeatable, auditable process that gathers memory, disk, logs and network state from an instance during an incident?
- An attacker with stolen credentials encrypted objects in an S3 bucket. Which recovery path is most reliable if the right safeguards were in place beforehand?
- Several EC2 instances were compromised, and the team must determine where the attacker first entered and how the activity spread. Which service gives the most useful timeline?
Infrastructure security
- A media company streams video from a private S3 bucket through a CloudFront distribution. The bucket uses KMS encryption. The team wants direct requests to the bucket endpoint to fail unless they come from that distribution, signed with SigV4. Which setup achieves this?
- A company runs several microservices on an Amazon EKS cluster. Each microservice needs read access to one S3 prefix, and no service should inherit access that belongs to another. The team also wants no static keys stored anywhere in the cluster or the images. Which design meets these goals?
- A company must block one known malicious address from reaching any resource in a VPC. Which control accomplishes that?
- A team needs a managed firewall for their VPC that supports custom Suricata-compatible rules and stateful inspection of traffic between subnets. Which service should they deploy?
- A company wants to inspect incoming HTTP requests to a public web application and block injection attempts using AWS-managed rule groups before the requests reach the application. Which service should they put in front of the app?
- A web application is absorbing a large DDoS attack. The team wants managed volumetric mitigation plus application-layer rate limiting and bot controls they can tune themselves. Which combination provides both?
- A company needs a private, dedicated connection between its data center and AWS that bypasses the public internet entirely. Which service should they order?
- A team runs workloads on Amazon EKS and must protect Kubernetes Secrets stored in etcd. Which feature should they turn on?
- A security team wants to block unsigned container images from being deployed to Amazon ECS. Which approach provides image signing plus verification before a task starts?
Identity and access management
- A partner's integration generates a presigned download link using its own IAM role. The partner downloads over plain HTTP and receives AccessDenied. The link has not expired, and the role holds s3:GetObject permission. What explains the denial?
- Auditors require that privileged administrators who make sensitive IAM changes, whether from the console or the CLI, must have authenticated with a second factor. Which control enforces this across administrative roles?
- A vendor's consultant needs read access and a few narrow write actions in one application account for about two weeks. Security wants access to end automatically, MFA required for every session, and no long-lived credentials. Which design fits?
- An application on an EC2 instance needs to read from an S3 bucket. Which credential approach should be used?
- Developers should be able to manage only the EC2 instances tagged with their own department. Which condition setup expresses that?
- Which statement correctly describes the second factors that can be registered for an IAM user in AWS?
Data protection
- A company in Account A encrypts its analytics reports with a customer managed KMS key. A data science team in Account B must decrypt those reports, and Account B can already read the bucket that holds them. What must be in place for Account B's decryption calls to succeed?
- An analytics pipeline writes millions of small objects per hour to a bucket encrypted with a customer managed KMS key. KMS request charges and throttling are rising. Which bucket setting cuts the number of KMS requests while keeping the same customer key?
- A healthcare analytics firm keeps research datasets in S3. Its regulator requires that the cloud provider never be able to read plaintext, and the firm must keep the key material in a location it alone controls. Which design satisfies this?
- Amazon Macie reports high-severity sensitive personal data in a production bucket that receives customer uploads. The response must start within minutes, keep a copy of the evidence, and require no manual steps. Which design is best?
- A regulated enterprise with 200 accounts must keep security logs from CloudTrail, Config, VPC flow logs and application logs. The logs must be protected so that no one, including administrators in the workload accounts, can alter or delete them before retention ends. Which design meets this?
- A platform team runs many internal services that authenticate each other with mutual TLS. The certificates should come from the company's own private certificate hierarchy and do not need to be trusted by public browsers. Which AWS service fits?
- Which statement about automatic rotation of a customer managed symmetric KMS key is accurate?
- A team needs to suspend all cryptographic use of a KMS key without destroying it, so it can be restored later if archived data must be read. Which action should they take?
- Which AWS service provides centralized, policy-driven backup across services such as EBS, RDS, DynamoDB, and EFS?
- How does server-side encryption work for Amazon SQS queues?
- Which encryption options are available for Amazon EFS?
- How is data protected when a company uses AWS Storage Gateway?
Security foundations and governance
- A company is moving its reporting database from a self-managed server to Amazon RDS. After the migration, which security responsibility remains with the company?
- A network team owns a central Transit Gateway in a shared services account and wants member accounts to attach their VPCs to it, without copying the gateway into each account. Which service enables this?
- A governance group needs S3 buckets that drift out of compliance to be corrected automatically, with the security distribution list alerted each time. The rules must be deployed uniformly across every account in the organization. Which approach fits?
- Which AWS Organizations feature applies permission guardrails across many AWS accounts at once?
- Which AWS service continuously gathers audit evidence and maps AWS usage to the controls of a chosen compliance framework?
- Which AWS service can renew and deploy SSL/TLS certificates automatically before they expire?
- Which Systems Manager feature keeps instances in a defined configuration and re-applies it when drift is detected?
- Which AWS feature can send alerts when cost or usage exceeds a defined threshold?