SCS-C03 sample exam questions

HOTSPOT
A company is building a web application that needs to authenticate external users across multiple microservices that the company hosts on Amazon Elastic Container Service (Amazon ECS). The solution must use temporary credentials and minimize the management overhead required to maintain user databases.
Select and order the correct steps from the following list to implement a secure authentication strategy that meets these requirements. Select each step one time or not at all.
Configure Amazon Cognito user pools for user authentication.
Set up an IAM role for each microservice. Grant each role appropriate permissions.
Implement an Amazon API Gateway HTTP API with AWS Lambda authorizers to validate tokens before forwarding requests to microservices.
Create an Amazon DynamoDB table to store user credentials for each microservice.
Create an Amazon Cognito application client to interact with the web application.
Set up AWS IAM Identity Center to give users access to the microservices.

Arrange 3 of these in the correct order:

• Configure Amazon Cognito user pools for user authentication.
• Set up an IAM role for each microservice. Grant each role appropriate permissions.
• Implement an Amazon API Gateway HTTP API with AWS Lambda authorizers to validate tokens before forwarding requests to microservices.
• Create an Amazon DynamoDB table to store user credentials for each microservice.
• Create an Amazon Cognito application client to interact with the web application.
• Set up AWS IAM Identity Center to give users access to the microservices.

An AWS account administrator created an IAM group and applied the following managed policy to require that each individual user authenticate using multi-factor authentication:

After implementing the policy, the administrator receives reports that users are unable to perform Amazon EC2 commands using the AWS CLI.
What should the administrator do to resolve this problem while still enforcing multi-factor authentication?

1. A
   Change the value of aws:MultiFactorAuthPresent to true.
2. B
   Instruct users to run the aws sts get-session-token CLI command and pass the multi-factor authentication --serial-number and -token-code parameters. Use these resulting values to make API/CLI calls.
3. C
   Implement federated API/CLI access using SAML 2.0, then configure the identity provider to enforce multi-factor authentication.
4. D
   Create a role and enforce multi-factor authentication in the role trust policy. Instruct users to run the sts assume-role CLI command and pass --serial-number and --token-code parameters. Store the resulting values in environment variables. Add sts:AssumeRole to NotAction in the policy.

HOTSPOT
A security engineer needs to implement AWS IAM Identity Center with an exlemai identity provider (IdP).
Select and order the correct steps from the following list to meet this requirement. Select each step one time or not at all.
Configure the external IdP as the identity source in IAM Identity Center.
Create an IAM role that has a trust policy that specifics the IdP's API endpoint.
Enable automatic provisioning in IAM Identity Center settings
Enable automatic provisioning in the external IdP.
Obtain the SAML metadata from IAM Identity Center.
Obtain the SAML metadata from the external IdP.

Arrange 3 of these in the correct order:

• Configure the external IdP as the identity source in IAM Identity Center.
• Create an IAM role that has a trust policy that specifics the IdP's API endpoint.
• Enable automatic provisioning in IAM Identity Center settings
• Enable automatic provisioning in the external IdP.
• Obtain the SAML metadata from IAM Identity Center.
• Obtain the SAML metadata from the external IdP.

HOTSPOT
A company is designing its security monitoring strategy for an existing sensitive workload on AWS. The security team has identified several scenarios that require monitoring strategies.
Select the correct monitoring strategy from the following list for each monitoring scenario. Select each monitoring strategy one time.
Automatically isolate Amazon EC2 distances when malware detection findings are confirmed.
Correlate security findings from multiple AWS detection services to identify multi-stage attacks.
Detect when privileged users perform an unusually high volume of resource deletion operations.
Identify patterns of more than 50 failed authentication attempts from specific IP addresses in 1 hour.
Monitor network traffic patterns especially large data transfers to external IP addresses outside normal office hours.
Configure VPC Flow Logs with Amazon CloudWatch Logs Insights queries to analyze traffic volume and destination patterns during specific time windows.

Move each item to the matching row:

• Automatically isolate Amazon EC2 distances when malware detection findings are confirmed.
• Correlate security findings from multiple AWS detection services to identify multi-stage attacks.
• Detect when privileged users perform an unusually high volume of resource deletion operations.
• Identify patterns of more than 50 failed authentication attempts from specific IP addresses in 1 hour.
• Monitor network traffic patterns especially large data transfers to external IP addresses outside normal office hours.

• Configure VPC Flow Logs with Amazon CloudWatch Logs Insights queries to analyze traffic volume and destination patterns during specific time windows.
• Create Amazon CloudWatch metric filters on application logs to track authentication failure rates for each source IP address with hourly aggregation.
• Enable AWS CloudTrail Insights for API call rate analysis to establish baselines and then detect anomalous API activity patterns.
• Implement AWS Security Hub custom insights with Amazon EventBridge rules to invoke automated AWS Lambda functions for coordinated incident response.
• Fifth strategy (the question repeats the VPC Flow Logs wording here)

1. A
   Within the Auto Scaling lifecycle, add a hook to create and attach an Amazon Elastic Block Store (Amazon EBS) log volume each time an EC2 instance is created. When the instance is terminated, the EBS volume can be reattached to another instance for log review.
2. B
   Create an Amazon Elastic File System (Amazon EFS) file system and add a command in the user data section of the Auto Scaling launch template to mount the EFS file system during EC2 instance creation. Configure a process on the instance to copy the logs once a day from an instance Amazon Elastic Block Store (Amazon EBS) volume to a directory in the EFS file system.
3. C
   Add an Amazon CloudWatch agent into the AMI used in the Auto Scaling group. Configure the CloudWatch agent to send the logs to Amazon CloudWatch Logs for review.
4. D
   Within the Auto Scaling lifecycle, add a lifecycle hook at the terminating state transition and alert the engineering team by using a lifecycle notification to Amazon Simple Notification Service (Amazon SNS). Configure the hook to remain in the Terminating:Wait state for 1 hour to allow manual review of the security logs prior to instance termination.

1. A
   Configure S3 Cross-Region Replication (CRR) on the S3 buckets to replicate the objects to a second AWS Region. Configure Macie in the second Region to scan the replicated objects daily.
2. B
   Create an AWS Lambda function as an S3 event destination for the S3 buckets. Configure the Lambda function to start a Macie scan of an object when the object is uploaded to an S3 bucket.
3. C
   Configure Macie automated discovery to continuously sample data from the S3 buckets. Perform full scans of the S3 buckets where Macie discovers sensitive data.
4. D
   Configure Macie scans to run on the S3 buckets. Aggregate the results of the scans in an Amazon DynamoDB table. Use the DynamoDB table for queries.

1. A
   Create an AWS Config Custom Policy rule by using AWS CloudFormatlon Guard. Include the tag key of CostCenter and the approved values. Create an SCP that denies the creation of resources when the value of the aws:RequestTagCostCenter condition key is not one of the three approved values.
2. B
   Create an AWS CloudTrail trail. Create an Amazon EventBridge rule that includes a rule statement that matches the creation of new resources. Configure the EventBridge rule to invoke an AWS Lambda function that checks for the CostCenter tag. Program the Lambda function to block creation in case of a noncompliant value.
3. C
   Enable tag policies for the organization. Create a tag policy that specifies a tag key of CostCenter and the approved values. Configure the policy to enforce noncompliant operations. Create an SCP that denies the creation of resources when the aws:RequestTag.CostCenter condition key has a null value.
4. D
   Enable tag policies for the organization. Create a tag policy that specifies a tag key of CostCenter and the approved values. Create an Amazon EventBridge rule that invokes an AWS Lambda function when a noncompliant tag is created. Program the Lambda function to block changes to the tag.

1. A
   Use AWS Audit Manager to create a new assessment based on AWS Operational Best Practices in the production account. After the assessments are finished, provide the auditor with direct access to the reports.
2. B
   Review the architecture by using the AWS Well-Architected Tool. Use the Well-Architected Framework and focus on the Operational Excellence, Security, and Reliability pillars. Document and implement mitigations for the identified risks. Provide the documentation to the auditor.
3. C
   Use Amazon Inspector with a multi-account environment to assess the production account workloads for vulnerabilities. Create a CIS scan in Amazon Inspector. Configure the CIS scan as a one time scan with Benchmark Level 2. After the scan is finished, download the PDF report and provide the report to the auditor.
4. D
   Use the AWS Fault Injection Service to create experiments in the development account for each workload. Adjust the configuration and architecture of the workloads to improve resilience. Run the experiments again. Download the PDF reports and provide the reports to the auditor.

1. A
   Configure GuardDuty to directly invoke the Lambda function if GuardDuty generates a CryptoCurrency:EC2/* finding event.
2. B
   Configure an AWS Config rule that invokes the Lambda function if a CryptoCurroncy:EC2/* configuration change event occurs for an EC2 instance.
3. C
   Configure an Amazon EventBridge rule that invokes the Lambda function if GuardDuty generates a CryptoCurrency:EC2/* finding event.
4. D
   Configure an Amazon EventBridge rule that invokes the Lambda function if AWS Config detects a CryptoCurrency:ЕС2/* configuration change event for an EC2 instance.

1. A
   Disable termination protection for the EC2 instance if termination protection has not been disabled.
2. B
   Enable termination protection for the EC2 instance if termination protection has not been enabled.
3. C
   Take snapshots of the Amazon Elastic Block Store (Amazon EBS) data volumes that are attached to the EC2 instance.
4. D
   Remove all snapshots of the Amazon Elastic Block Store (Amazon EBS) data volumes that are attached to the EC2 instance.
5. E
   Capture the EC2 instance metadata, and then tag the EC2 instance as under quarantine.
6. F
   Immediately remove any entries in the EC2 instance metadata that contain sensitive information.

1. A
   Create a pre sign-up AWS Lambda trigger. Associate the Amazon Cognito function with the Amazon Cognito user pool.
2. B
   Use a geographic match rule statement to configure an AWS WAF web ACL. Associate the web ACL with the Amazon Cognito user pool.
3. C
   Configure an app client for the application’s Amazon Cognito user pool. Use the app client ID to validate the requests in the hosted UI.
4. D
   Update the application’s Amazon Cognito user pool to configure a geographic restriction setting.
5. E
   Use Amazon Cognito to configure a social identity provider (IdP) to validate the requests on the hosted UI.

1. A
   Set up an AWS Direct Connect connection and create a VPN connection to a VPC that has access to VPC endpoints for the required services.
2. B
   Set up the on-premises systems to use AWS IAM Roles Anywhere to authenticate.
3. C
   Use AWS Private Certificate Authority to issue SSL certificates to give on-premises systems access to resources on AWS.
4. D
   Create an IAM user that has permission to temporarily assume an IAM role and to use temporarily assumed role credentials to access the required resources.

HOTSPOT

A company is developing an incident response process to quarantine Amazon EC2 hosts that become infected by malware. The company uses an organization in AWS Organizations to manage multiple AWS accounts. The company configures AWS Security Hub in the organization to receive findings from multiple accounts that run across multiple AWS Regions. A security engineer develops an AWS Lambda function to remove all the rules from all security groups for any EC2 instance the company suspects might be infected by malware.

Select and order the correct steps from the following list to deploy and use the Lambda function as a custom action in Security Hub. Select each step one time or not at all. (Select and order THREE.)

• Create a custom action that uses the Lambda function in Security Hub.
• Create and apply a filter set to the Amazon EventBridge rule in Security Hub.
• Define a rule in Amazon EventBridge.
• Select the custom action in Security Hub for EC2 host findings.
• Select the custom action in Security Hub for security group findings.

Arrange 3 of these in the correct order:

• Create a custom action that uses the Lambda function in Security Hub.
• Create and apply a filter set to the Amazon EventBridge rule in Security Hub.
• Define a rule in Amazon EventBridge.
• Select the custom action in Security Hub for EC2 host findings.
• Select the custom action in Security Hub for security group findings.

1. A
   Enable AWS Shield Advanced on the CloudFront distribution. Configure alerts in Amazon CloudWatch for DDoS indicators.
2. B
   Enable AWS Shield Advanced and configure proactive engagement with the AWS DDoS Response Team.
3. C
   Deploy AWS Network Firewall in the VPCreate security policies that detect DDoS indicators. Create an AWS Lambda function to automatically update the web ACL rules during an attack.
4. D
   Add a rate-based rule to the web ACL. Enable AWS Shield Advanced. Enable automatic application layer DDoS mitigation on the CloudFront distribution.