Free AWS Certified Security - Specialty (SCS-C03) Practice Questions

Sample SCS-C03 Practice Questions

Browse all 10 free AWS Certified Security - Specialty practice questions below.

1. A security architect needs to understand how GuardDuty generates severity scores for findings. What factors influence the severity level assigned to a GuardDuty finding?

   • The time of day the activity occurred - activity outside business hours is considered more severe.
   • The type of activity detected - certain finding types are inherently more severe than others.
   • The confidence level of the detection - higher confidence in malicious activity increases severity.
   • The cost of the affected AWS resources - more expensive resources generate higher severity findings.
   • The potential impact of the detected activity on the affected resources and data.

2. A company needs to implement a break-glass procedure that allows emergency access to production accounts when the normal access mechanisms are unavailable. The access should be logged and require multiple approvals. What solution should they implement?

   • Store AWS root user credentials in Secrets Manager with an automatic rotation policy, restrict retrieval to a dedicated emergency IAM role, and retrieve the credentials during declared incidents.
   • Configure IAM Identity Center with a dedicated break-glass permission set scoped to emergency operations, and require multi-party approval through an access request workflow before elevated sessions are granted.
   • Create a dedicated break-glass IAM user in each account with MFA. Store the MFA device and credentials in a physical safe that requires multiple keyholders to open. Enable CloudTrail to log all activities.
   • Use AWS Organizations SCPs to define an emergency-access policy that the security team attaches to the affected accounts through a central console when an incident is declared and detaches once service is restored.

3. A security team is investigating unusual CloudTrail events showing API calls from an assumed role. The calls originated from an IP address outside the company's known ranges. What investigation steps should they take to determine if this is a security incident?

   • Check GuardDuty for findings related to the suspicious activity, as GuardDuty may have already flagged this as a potential threat.
   • Review the sourceIPAddress field in CloudTrail events to identify all API calls from the suspicious IP address and the roles/identities involved.
   • Examine the userIdentity.sessionContext in CloudTrail events to identify the original principal that assumed the role and how the session was obtained.
   • Use Amazon Detective to visualize the role's activity patterns and identify deviations from normal behavior.
   • Immediately revoke the role's active sessions and detach its permissions policies before completing the investigation, stopping any ongoing unauthorized access as quickly as possible.

4. A company wants to correlate network events with CloudTrail events to investigate potential security incidents. They're considering Amazon Detective. What should they understand about Detective's correlation capabilities?

   • Detective uses machine learning to establish behavioral baselines and highlight deviations that might indicate security issues.
   • Detective builds entity profiles that show relationships between IAM principals, EC2 instances, IP addresses, and the resources they accessed.
   • Detective can correlate events across different AWS accounts in the same behavior graph.
   • Detective requires the CloudWatch Logs agent on EC2 instances to ingest operating system events into the behavior graph for correlation.
   • Detective automatically correlates VPC Flow Logs with CloudTrail events, linking network connections to the API calls that initiated them.

5. A security engineer is writing AWS Verified Access policies using Cedar to control access to an internal HR application. They need to ensure that only users in the 'HR-Admins' group with devices that have a risk score below 'medium' can access the application. Additionally, all POST requests should be restricted to users with an 'Administrator' role. Which TWO statements about Cedar policies in Verified Access are correct? (Select TWO.)

   • Cedar policies are written in JSON format and must be validated through AWS CloudFormation change sets before they can be deployed to Verified Access endpoints.
   • Cedar policies access user identity claims and device posture data through the trust provider context, such as context.identity.groups and context.device.risk_score, to make access decisions.
   • Cedar policies can reference HTTP request attributes like the request method (GET, POST) through context.http_request.http_method, which Verified Access includes by default in all policy evaluations.
   • Cedar policies in Verified Access must define explicit principal, action, and resource values in the policy scope, similar to IAM policy structure with Effect, Action, and Resource elements.
   • Cedar policies use an explicit deny model where if any 'forbid' policy matches a request, the request is denied regardless of any matching 'permit' policies, and if no policy matches, the request is implicitly denied.

6. A security team needs to ensure that GuardDuty is enabled in all accounts and regions across their organization. How can they verify and enforce this requirement?

   • Create an SCP that prevents accounts from disabling GuardDuty once it's enabled.
   • Turn on the GuardDuty self-healing feature so detectors automatically re-enable themselves if disabled in any account.
   • Enable GuardDuty organization integration with auto-enable for new accounts, which automatically enables GuardDuty in all existing and new member accounts.
   • Use AWS Config with the guardduty-enabled-centralized rule to monitor GuardDuty status across all accounts.
   • Deploy GuardDuty detectors to every existing Region and account using CloudFormation StackSets with drift detection.

7. A company needs to ensure that their security tools are protected from being disabled by an attacker who gains administrative access to a member account. Which controls prevent an attacker from disabling security monitoring?

   • Store security logs in a separate log archive account with cross-account write-only access.
   • Create SCPs that deny actions to disable GuardDuty, Security Hub, Config, and CloudTrail in all member accounts.
   • Attach IAM permission boundaries to administrator roles in member accounts that exclude security service modifications.
   • Configure security services as organization-managed from a delegated administrator account, not individual accounts.
   • Require MFA for every administrator user in member accounts using an IAM policy condition on all actions.

8. A financial services company is implementing a privileged access management (PAM) solution for their AWS environment. Administrators should only be able to assume high-privilege roles for a limited time after approval, and all sessions must be recorded. Which AWS services combination provides these capabilities?

   • Use AWS IAM Identity Center with permission sets that have maximum session duration limits. Integrate with an external approval workflow before granting temporary access.
   • Configure IAM role trust policies with conditions requiring MFA for high-privilege role assumption.
   • Configure AWS Systems Manager Session Manager with CloudWatch Logs integration to record all terminal sessions. Enable KMS encryption for session logs.
   • Use CloudTrail to log all AssumeRole API calls for high-privilege roles. Create EventBridge rules to alert when these roles are assumed.
   • Implement AWS Config rules to detect when administrators assume high-privilege roles and automatically terminate sessions exceeding time limits.

9. A company uses AWS Secrets Manager to store database credentials and wants to ensure that secrets can only be created with automatic rotation enabled. How should they enforce this requirement?

   • Enable the account-level Secrets Manager setting that makes rotation mandatory by default for every secret created in the account.
   • Attach IAM permission boundaries to all principals requiring rotation parameters to be present in CreateSecret requests.
   • Deploy an AWS Config managed rule that detects secrets without rotation and flags them as non-compliant for remediation.
   • Create an SCP that denies secretsmanager:CreateSecret unless the request includes rotation configuration parameters.

10. A company is evaluating encryption options for sensitive data processing. They need to perform computations on encrypted data without ever decrypting it on the server side. Which approach enables this capability?

    • Use client-side encryption with the AWS Encryption SDK and KMS-generated data keys so that plaintext data never exists on any AWS server at rest or in transit.
    • Run open-source homomorphic encryption libraries on EC2 instances with the key material generated and managed in AWS CloudHSM.
    • Use AWS Nitro Enclaves to create isolated compute environments where sensitive data is decrypted only within the enclave, never exposed to the parent instance.
    • Use AWS Clean Rooms, which lets multiple parties run joint SQL analyses on combined datasets while privacy controls prevent any party from viewing another party's raw row-level data.