Amazon SCS C03
Q: 1
CloudFormation stack deployments fail for some users due to permission inconsistencies.
Which combination of steps will ensure consistent deployments MOST securely? (Select THREE.)
Options
Q: 2
A company uploads data files as objects into an Amazon S3 bucket. A vendor downloads the objects
to perform data processing.
A security engineer must implement a solution that prevents objects from residing in the S3 bucket
for longer than 72 hours.
Options
Q: 3
A company must inventory sensitive data across all Amazon S3 buckets in all accounts from a single
security account.
Options
Q: 4
A security engineer receives a notice about suspicious activity from a Linux-based Amazon EC2
instance that uses Amazon Elastic Block Store (Amazon EBS)-based storage. The instance is making
connections to known malicious addresses.
The instance is in a development account within a VPC that is in the us-east-1 Region. The VPC
contains an internet gateway and has a subnet in us-east-1a and us-east-1b. Each subnet is
associated with a route table that uses the internet gateway as a default route. Each subnet also uses
the default network ACL. The suspicious EC2 instance runs within the us-east-1b subnet. During an
initial investigation, a security engineer discovers that the suspicious instance is the only instance
that runs in the subnet.
Which response will immediately mitigate the attack and help investigate the root cause?
Options
Q: 5
A security team manages a company’s AWS Key Management Service (AWS KMS) customer managed
keys. Only members of the security team can administer the KMS keys. The company's application
team has a software process that needs temporary access to the keys occasionally. The security team
needs to provide the application team's software process with access to the keys.
Which solution will meet these requirements with the LEAST operational overhead?
Options
Q: 6
A company must capture AWS CloudTrail data events and must retain the logs for 7 years. The logs
must be immutable and must be available to be searched by complex queries. The company also
needs to visualize the data from the logs.
Which solution will meet these requirements MOST cost-effectively?
Options
Q: 7
A company has a VPC that has no internet access and has the private DNS hostnames option
enabled. An Amazon Aurora database is running inside the VPC. A security engineer wants to use
AWS Secrets Manager to automatically rotate the credentials for the Aurora database. The security
engineer configures the Secrets Manager default AWS Lambda rotation function to run inside the
same VPC that the Aurora database uses. However, the security engineer determines that the
password cannot be rotated properly because the Lambda function cannot communicate with the
Secrets Manager endpoint.
What is the MOST secure way that the security engineer can give the Lambda function the ability to
communicate with the Secrets Manager endpoint?
Options
Q: 8
A company needs centralized log monitoring with automatic detection across hundreds of AWS
accounts.
Which solution meets these requirements with the LEAST operational effort?
Options
Q: 9
A security engineer is designing a solution that will provide end-to-end encryption between clients
and Docker containers running in Amazon Elastic Container Service (Amazon ECS). This solution must
also handle volatile traffic patterns.
Which solution would have the MOST scalability and LOWEST latency?
Options
Q: 10
A company creates AWS Lambda functions from container images that are stored in Amazon Elastic
Container Registry (Amazon ECR). The company needs to identify any software vulnerabilities in the
container images and any code vulnerabilities in the Lambda functions.
Which solution will meet these requirements?
Options
Question 1 of 10
