Amazon SCS-C03 Practice Questions

The latest changes and updates from the administration for this exam.

verified

Latest Update: Jun 01 2026

All questions are working fine.

All Questions (248)bookmarkBookmarked (0)

All248Show all accessible questions in this exam.Missed248Questions you haven't attempted yet.Incorrect0Questions you answered incorrectly on your last attempt.

Question 71

It is observed during a security event that certain Amazon EC2 instances are not submitting Amazon CloudWatch logs.

Which measures may be taken by the Security Engineer to resolve this issue? (Select two.)

Select all that apply

A. Connect to the EC2 instances that are not sending the appropriate logs and verify that the CloudWatch Logs agent is running.

B. Log in to the AWS account and select CloudWatch Logs. Check for any monitored EC2 instances that are in the "Alerting" state and restart them using the EC2 console.

C. Verify that the EC2 instances have a route to the public AWS API endpoints.

D. Connect to the EC2 instances that are not sending logs. Use the command prompt to verify that the right permission have been set for the Amazon SNS topic.

E. Verify that the network access control lists and security groups of the EC2 instances have the access to send logs over SNMP.

Question 72

A security engineer learns that developers have been modifying security groups to allow SSH and RDP traffic from 0.0.0.0/0 rather than the organization's firewall IP.

What is the most efficient method of mitigating the risk associated with this activity?

A. Delete the internet gateway associated with the VPC.

B. Use network access control lists to block source IP addresses matching 0.0.0.0/0.

C. Use a host-based firewall to prevent access from all but the organization's firewall IP.

D. Use AWS Config rules to detect 0.0.0.0/0 and invoke an AWS Lambda function to update the security group with the organization's firewall IP.

Question 73

A Security Engineer has configured an Amazon CloudFront distribution for an Amazon S3 bucket in response to previous DDoS assault experiences. Concerns have been expressed that some users may circumvent the CloudFront distribution and directly access the S3 bucket.

What must be done to prevent people from directly accessing S3 items through URLs?

A. Change the S3 bucket/object permission so that only the bucket owner has access.

B. Set up a CloudFront origin access identity (OAI), and change the S3 bucket/object permission so that only the OAI has access.

C. Create IAM roles for CloudFront, and change the S3 bucket/object permission so that only the IAM role has access.

D. Redirect S3 bucket access to the corresponding CloudFront distribution.

Question 74

A business intends to migrate the majority of its IT infrastructure to AWS. The firm wishes to use its on-premises Active Directory as an AWS identity provider.

Which actions should be followed to authenticate to AWS services utilizing the on-premises Active Directory of the organization? (Select three.)

Select all that apply

A. Create IAM roles with permissions corresponding to each Active Directory group.

B. Create IAM groups with permissions corresponding to each Active Directory group.

C. Create a SAML provider with IAM.

D. Create a SAML provider with Amazon Cloud Directory.

E. Configure AWS as a trusted relying party for the Active Directory

F. Configure IAM as a trusted relying party for Amazon Cloud Directory.

Question 75

A Security Analyst sought to resolve a monitoring issue involving suspicious security group modifications. The Analyst was informed that these AWS CloudTrail log events are being monitored through an Amazon CloudWatch alert. The Analyst validated the monitoring settings by making a modification to the security group's configuration, but received no warnings.

Which of the following troubleshooting procedures should be performed by the Analyst?

A. Ensure that CloudTrail and S3 bucket access logging is enabled for the Analyst's AWS account. B. Verify that a metric filter was created and then mapped to an alarm. Check the alarm notification action.

B. Check the CloudWatch dashboards to ensure that there is a metric configured with an appropriate dimension for security group changes.

C. Verify that the Analyst's account is mapped to an IAM policy that includes permissions for cloudwatch: GetMetricStatistics and Cloudwatch: ListMetrics.

Question 76

On Amazon EC2 instances, Example.com maintains its internal document repository. The program is hosted on Amazon EC2 instances, and the papers were previously kept on encrypted Amazon EBS volumes. Example.com has migrated the files to Amazon S3 to optimize the program for growth. The security team has instructed that all files on the EBS volume be safely erased, and it must guarantee that the data is unreadable prior to releasing the underlying disks.

Which of the following approaches will assure that no one else can read the data?

A. Change the volume encryption on the EBS volume to use a different encryption mechanism. Then, release the EBS volumes back to AWS.

B. Release the volumes back to AWS. AWS immediately wipes the disk after it is deprovisioned.

C. Delete the encryption key used to encrypt the EBS volume. Then, release the EBS volumes back to AWS.

D. Delete the data by using the operating system delete commands. Run Quick Format on the drive and then release the EBS volumes back to AWS.

Question 77

A Systems Administrator has written the following Amazon S3 bucket policy designed to allow access to an S3 bucket for only an authorized AWS IAM user from the IP address range 10.10.10.0/24:

When trying to download an object from the S3 bucket from 10.10.10.40, the IAM user receives an access denied message.

What does the Administrator need to change to grant access to the user?

A. Change the "Resource" from "arn: aws:s3:::Bucket" to "arn:aws:s3:::Bucket/*".

B. Change the "Principal" from "*" to {AWS:"arn:aws:iam: : account-number: user/username"}

C. Change the "Version" from "2012-10-17" to the last revised date of the policy

D. Change the "Action" from ["s3:*"] to ["s3:GetObject","s3:ListBucket"]

Question 78

The Security Engineer observed that a new application that handles with very sensitive data is storing Amazon S3 objects with the following key pattern, which includes extremely sensitive data.

Pattern:

"randomID_datestamp_PII.csv"

Example:

"1234567_12302017_000-00-0000 csv"

The bucket in which these things are kept is encrypted on the server side (SSE).

Which method is the safest and most cost-effective way to safeguard sensitive data?

A. Remove the sensitive data from the object name, and store the sensitive data using S3 user-defined metadata.

B. Add an S3 bucket policy that denies the action s3:GetObject

C. Use a random and unique S3 object key, and create an S3 metadata index in Amazon DynamoDB using client-side encrypted attributes.

D. Store all sensitive objects in Binary Large Objects (BLOBS) in an encrypted Amazon RDS instance.

Question 79

AWS CloudTrail is used to track API calls made inside an organization. CloudTrail is not delivering events to Amazon S3 as planned, according to an audit.

What first steps should be made to enable CloudTrail event delivery to S3? (Select two.)

Select all that apply

A. Verify that the S3 bucket policy allow CloudTrail to write objects.

B. Verify that the IAM role used by CloudTrail has access to write to Amazon CloudWatch Logs.

C. Remove any lifecycle policies on the S3 bucket that are archiving objects to Amazon Glacier.

D. Verify that the S3 bucket defined in CloudTrail exists.

E. Verify that the log file prefix defined in CloudTrail exists in the S3 bucket.

Question 80

Due to new compliance requirements, a Security Engineer must enable encryption with customer-provided keys on corporate data that is stored in DynamoDB.

The company wants to retain full control of the encryption keys.

Which DynamoDB feature should the Engineer use to achieve compliance'?

A. Use AWS Certificate Manager to request a certificate. Use that certificate to encrypt data prior to uploading it to DynamoDB.

B. Enable S3 server-side encryption with the customer-provided keys. Upload the data to Amazon S3, and then use S3Copy to move all data to DynamoDB

C. Create a KMS master key. Generate per-record data keys and use them to encrypt data prior to uploading it to DynamoDS. Dispose of the cleartext and encrypted data keys after encryption without storing.

D. Use the DynamoDB Java encryption client to encrypt data prior to uploading it to DynamoDB.

Update History

Update History