AWS SCS-C03 Certification Exam Sample Questions
We have prepared AWS Certified Security - Specialty (SCS-C03) certification sample questions to make you aware of actual exam properties. This sample question set provides you with information about the Security Specialty exam pattern, question formate, a difficulty level of questions and time required to answer each question. To get familiar with AWS Certified Security - Specialty exam, we suggest you try our Sample AWS SCS-C03 Certification Practice Exam in simulated AWS certification exam environment.
To test your knowledge and understanding of concepts with real-time scenario based AWS SCS-C03 questions, we strongly recommend you to prepare and practice with Premium AWS Security Specialty Certification Practice Exam. The premium AWS Security Specialty certification practice exam helps you identify topics in which you are well prepared and topics in which you may need further training to achieving great score in actual AWS Certified Security - Specialty exam.
AWS SCS-C03 Sample Questions:
01. To control cost, a security engineer enables Amazon GuardDuty in a new account and leaves every optional protection plan turned off. The account has no CloudTrail trail and no VPC flow logs configured.
Which activities can GuardDuty still detect in this account?
(Choose two.)
a) Unusual GetObject activity against objects in an Amazon S3 bucket
b) Anomalous login attempts against an Amazon Aurora database from an unfamiliar IP address
c) API calls made with an IAM user's access keys from a known malicious IP address
d) An EC2 instance communicating with an IP address on a threat list
e) A reverse shell process started inside an instance's operating system
02. A company runs Amazon Macie sensitive data discovery jobs on its S3 buckets. Employee badge numbers use the internal format BDG- followed by eight digits, and Macie reports none of them. In HR exports, every badge number appears next to the label "Badge". Engineering test fixtures contain thousands of random strings in the same format with no label.
A security engineer must make Macie report the real badge numbers while keeping false positives from the test fixtures low.
Which configuration will meet these requirements?
a) Create an allow list that contains a regex for the badge format, and add the allow list to the discovery jobs.
b) Turn on automated sensitive data discovery, and rely on the managed data identifiers to detect the badge format.
c) Create a custom data identifier with a regex for the badge format and the ignore word "Badge".
d) Create a custom data identifier with a regex for the format and the keyword "Badge" within a short maximum match distance.
03. An application tier in subnet 10.0.2.0/24 connects to a SQL Server database in subnet 10.0.3.0/24 on TCP port 1433, and the security groups already allow this traffic. A security engineer associates a new custom network ACL with the database subnet. The ACL contains only its default deny rules. The application subnet keeps the default network ACL, which allows all traffic.
Which rules must the engineer add to the database subnet's network ACL so that the application can query the database?
(Choose two.)
a) Inbound: allow TCP 1433 from the application tier's security group
b) Inbound: allow TCP 1433 from 10.0.2.0/24
c) Outbound: allow TCP 1433 to 10.0.2.0/24
d) Outbound: allow TCP 1024-65535 to 10.0.2.0/24
e) Inbound: allow TCP 1024-65535 from 10.0.2.0/24
04. A security engineer configures Amazon S3 server access logging for a source bucket in account 111122223333 in eu-west-2. The destination bucket is in account 444455556666, also in eu-west-2. The destination bucket uses SSE-S3 default encryption, and its bucket policy grants the S3 logging service principal permission to write log objects. The logging configuration does not succeed.
What is the cause?
a) The destination bucket must be owned by the same account as the source bucket.
b) The destination bucket must have S3 Versioning turned on before it can receive any logs.
c) The source and destination buckets must be in different AWS Regions.
d) The source bucket must have CloudTrail data events enabled before logging is allowed.
05. A company backs up Amazon EBS volumes and Amazon RDS databases in its production accounts with AWS Backup. To protect against ransomware that compromises a production account, a security engineer adds a copy rule to the backup plan that targets a backup vault in a separate recovery account in the same organization. Every copy job fails before any data is copied. The resources are encrypted with customer managed keys that are already shared with the recovery account.
Which combination of steps will allow the copy jobs to succeed?
(Choose two.)
a) From the management account, turn on cross-account backup in the AWS Backup settings.
b) Apply AWS Backup Vault Lock in compliance mode to the production backup vault.
c) Create an Amazon Data Lifecycle Manager cross-account copy policy in the recovery account.
d) Add a vault access policy to the recovery vault that allows backup:CopyIntoBackupVault from the organization.
e) Allow backup:CopyIntoBackupVault in an identity policy on the recovery account's backup role.
06. Several teams create Amazon S3 presigned URLs to share reports from the bucket example-reports. Some URLs were created with a 7-day expiration and forwarded outside the company.
Policy now requires that no presigned URL for this bucket be usable more than 10 minutes after it was signed, whoever creates it and whatever expiration they set.
Which solution enforces this requirement?
a) Add a bucket policy statement that denies s3:GetObject when aws:TokenIssueTime is more than 10 minutes old.
b) Require every team to pass --expires-in 600 whenever it runs the aws s3 presign command to create a URL.
c) Add a bucket policy statement that denies s3:* when s3:signatureAge is greater than 600000.
d) Add an S3 Lifecycle rule that expires each report object 10 minutes after it is uploaded to the bucket.
07. A company issues signed firmware manifests to device manufacturers. The manufacturers have no AWS accounts and must verify the signatures offline. The signing key must never leave AWS KMS in plaintext, and the company's build service must be the only principal that can sign.
Which solution will meet these requirements?
a) Create an asymmetric signing KMS key, allow kms:Sign only for the build role, and distribute the public key.
b) Create an HMAC KMS key, allow kms:GenerateMac only for the build role, and have manufacturers verify with kms:VerifyMac.
c) Create an asymmetric signing KMS key and give each manufacturer an exported copy of its private key.
d) Create a symmetric encryption KMS key, encrypt a hash of each manifest with it, and give manufacturers the key ID.
08. Amazon GuardDuty findings show that Amazon EC2 instances in several VPCs of one account are trying to reach known botnet command-and-control domains. While the instances are investigated, a security engineer must stop instances in all these VPCs from resolving such domains through the Amazon-provided DNS resolver, using a threat list that AWS maintains.
Which solution meets these requirements with the LEAST operational overhead?
a) Deploy AWS Network Firewall in each VPC with a stateful domain list rule that the team populates from a threat feed.
b) Upload the domains to GuardDuty as a threat list and set the detector to block DNS queries that match it.
c) Add a network ACL outbound rule in each subnet that denies UDP and TCP port 53.
d) Associate each VPC with a Route 53 Resolver DNS Firewall rule group that blocks the AWS managed botnet command-and-control domain list.
09. Workloads in a company VPC call AWS KMS through an interface VPC endpoint. The VPC has no internet gateway or NAT gateway. All company accounts belong to one organization in AWS Organizations.
A security review warns that a compromised instance could still use the endpoint with credentials from an outside AWS account, or could encrypt company data under a KMS key that an outside account owns. A security engineer must close both paths at the endpoint.
Which actions should the engineer take?
(Choose two.)
a) Add an aws:SourceVpce condition naming the endpoint to the company KMS key policies.
b) Add an aws:PrincipalOrgID condition with the organization ID to the endpoint policy.
c) Add an aws:SourceVpc condition with the VPC ID to the endpoint policy.
d) Add an aws:ResourceOrgID condition with the organization ID to the endpoint policy.
e) Allow inbound HTTPS only from the application subnets in the endpoint security group.
10. A data team in account 111122223333 uploads reports to an Amazon S3 bucket without naming a KMS key. The bucket's default encryption is SSE-KMS with no key specified, so the reports are encrypted with the AWS managed key aws/s3. A partner role in account 444455556666 is allowed s3:GetObject by the bucket policy and kms:Decrypt by its own IAM policy, yet every download fails with AccessDenied.
Which change will let the partner role read new reports while they stay encrypted with SSE-KMS?
a) Edit the key policy of aws/s3 to allow kms:Decrypt for the partner account's role
b) Set default encryption to a customer managed key whose key policy admits the partner account
c) Add a kms:ViaService condition for Amazon S3 to the kms:Decrypt statement in the partner role's IAM policy
d) Enable an S3 Bucket Key on the bucket so that the partner can read reports without calling AWS KMS
Answers:
|
Question: 01 |
Question: 02 |
Question: 03 |
Question: 04 |
Question: 05 |
|
Question: 06 |
Question: 07 |
Question: 08 |
Question: 09 |
Question: 10 |
Note: Please update us by writing an email on feedback@vmexam.com for any error in AWS Certified Security - Specialty certification exam sample questions
