Free Amazon SCS-C03 Exam Questions

Question 1

A company is using AWS to run a long-running analysis process on data that is stored in Amazon S3 buckets. The process runs on a fleet of Amazon EC2 instances in an Auto Scaling group. The EC2 instances are deployed in a private subnet that does not have internet access. The EC2 instances access Amazon S3 through an S3 gateway endpoint that has the default access policy. Each EC2 instance uses an instance profile role that allows s3:GetObject and s3:PutObject only for required S3 buckets. The company learns that one or more EC2 instances are compromised and are exfiltrating data to an S3 bucket that isoutside the company’s AWS Organization. The processing job must continue to function. Which solution will meet these requirements?

A : Update the policy on the S3 gateway endpoint to allow S3 actions only if aws:ResourceOrgId and aws: PrincipalOrgId match the company’s organization.

B : Update the instance profile role policy to require aws:ResourceOrgId.

C : Add a network ACL rule to block outbound traffic on port 443.

D : Apply an SCP that restricts S3 actions using organization condition keys.

Answer: A

Question 2

A company needs a cloud-based, managed desktop solution for its workforce of remote employees. The company wants to ensure that the employees can access the desktops only by using company-provided devices. A security engineer must design a solution that will minimize cost and management overhead. Which solution will meet these requirements?

A : Deploy a custom virtual desktop infrastructure (VDI) solution with a restriction policy to allow access only from corporate devices.

B : Deploy a fleet of Amazon EC2 instances. Assign an instance to each employee with certificate-based device authentication that uses Windows Active Directory.

C : Deploy Amazon WorkSpaces. Set up a trusted device policy with IP blocking on the authentication gateway by using AWS Identity and Access Management (IAM).

D : Deploy Amazon WorkSpaces. Create client certificates, and deploy them to trusted devices. Enable restricted access at the directory level.

Answer: D

Question 3

A company's web application is hosted on Amazon EC2 instances running behind an Application Load Balancer (ALB) in an Auto Scaling group. An AWS WAF web ACL is associated with the ALB. AWS CloudTrail is enabled and stores logs in Amazon S3 and Amazon CloudWatch Logs. The operations team has observed some EC2 instances reboot at random. After rebooting, all access logs on the instances have been deleted. During an investigation, the operations team found that each reboot happened just after a PHP error occurred on the new-user-creation.php file. The operations team needs to view log information to determine if the company is being attacked. Which set of actions will identify the suspect attacker's IP address for future occurrences?

A : Configure VPC Flow Logs on the subnet where the ALB is located and stream the data to CloudWatch. Search for the new-user-creation.php occurrences in CloudWatch.

B : Configure the CloudWatch agent on the ALB and send application logs to CloudWatch Logs.

C : Configure the ALB to export access logs to an Amazon OpenSearch Service cluster and search for the new-user-creation.php occurrences.

D : Configure the web ACL to send logs to Amazon Data Firehose, which delivers the logs to an S3 bucket. Use Amazon Athena to query the logs and find the new-user-creation.php occurrences.

Answer: D

Question 4

A company wants to use a suite of AWS Lambda functions to automatically remediatenoncompliant resources. The company packages the suite of Lambda functions into an AWSCloudFormation template. The company wants to deploy the suite of Lambda functions to allAWS Organizations accounts. However, the company cannot use the Organizationsmanagement account for deployment.Which solution provides centralized deployment of the Lambda function suite to all accountsin the organization?

A : Register a delegated administrator for CloudFormation. Deploy the template to every account in the organization by using StackSets.

B : Create a cross-account IAM role with a unique external ID in each AWS account. Assume the cross-account role to deploy the template.

C : Package the template as an AWS Service Catalog product. Log in to each account and provision the product to each account.

D : Set up AWS CodePipeline in each account. Configure a pipeline to pull the template from an Amazon S3 bucket in the Organizations management account.

Answer: A

Question 5

A company needs to scan all AWS Lambda functions for code vulnerabilities.

A : Use Amazon Macie.

B : Enable Amazon Inspector Lambda scanning.

C : Use GuardDuty and Security Hub.

D : Use GuardDuty Lambda Protection.

Answer: B