Free Amazon SCS-C03 Exam Questions

Become Amazon Certified with updated SCS-C03 exam questions and correct answers

Page: 1 / 48

Total 236 Questions | Updated On: Oct 27, 2026

Add To Cart

Question 1

A company is using Amazon Macie, AWS Firewall Manager, Amazon Inspector, and AWS ShieldAdvanced in its AWS account. The company wants to receive alerts if a DDoS attack occurs against theaccount.Which solution will meet this requirement?

A : Use Amazon Macie to detect an active DDoS event and create Amazon CloudWatch alarms thatrespond to Macie findings.

B : Use Amazon Inspector to review resources and invoke Amazon CloudWatch alarms for anyresources that are vulnerable to DDoS attacks.

C : Create an Amazon CloudWatch alarm that monitors AWS Firewall Manager metrics for an activeDDoS event.

D : Create an Amazon CloudWatch alarm that monitors AWS Shield Advanced metrics for an activeDDoS event.

Answer: D

Question 2

A company has a web-based application that runs behind an Application Load Balancer (ALB). Theapplication is experiencing a credential stuffing attack that is producing many failed login attempts.The attack is coming from many IP addresses. The login attempts are using a user agent string of aknown mobile device emulator. A security engineer needs to implement a solution to mitigate thecredential stuffing attack. The solution must still allow legitimate logins to the application.Which solution will meet these requirements?

A : Create an Amazon CloudWatch alarm that reacts to login attempts that contain the specified useragent string. Add an Amazon Simple Notification Service (Amazon SNS) topic to the alarm.

B : Modify the inbound security group on the ALB to deny traffic from the IP addresses that areinvolved in the attack.

C : Create an AWS WAF web ACL for the ALB. Create a custom rule that blocks requests that containthe user agent string of the device emulator.

D : Create an AWS WAF web ACL for the ALB. Create a custom rule that allows requests fromlegitimate user agent strings.

Answer: C

Question 3

Which team member is actively involved and interested in all phases of the project?

A : Contractors

B : Owners

C : Architects/engineers

D : Manufacturers/suppliers

Answer: B

Question 4

During the schematic design phase, a contingency line item in the estimate would be included to cover which of the following?

A : Allowances

B : Unit prices

C : Unknown factors

D : Alternates

Answer: C

Question 5

A company wants to deploy an application in a private VPC that will not be connected to theinternet. The companyâ€™s security team will not allow bastion hosts or methods using SSH tolog in to Amazon EC2 instances. The application team plans to use AWS Systems ManagerSession Manager to connect to and manage the EC2 instances.Which combination of steps should the security team take? (Select THREE.)

A : Make sure the Systems Manager Agent is installed and running on all EC2 instances inside the VPC.

B : Ensure the IAM role attached to the EC2 instances in the VPC allows access to Systems Manager.

C : Create an SCP that prevents the creation of SSH key pairs.

D : Launch a NAT gateway in the VPC. Update the routing policies to forward traffic to this NAT gateway.

E : Ensure proper VPC endpoints are in place for Systems Manager and Amazon EC2.

F : Ensure the VPC has a transit gateway attachment. Update the routing policies to forward traffic to this transit gateway.

Answer: A,B,E

Page: 1 / 48

Total 236 Questions | Updated On: Oct 27, 2026

Add To Cart