AWS Security Specialty (SCS-C03) - Full Practice Exam 1

1. A central security team receives findings from multiple tools and needs a standardized view with organization-wide administration. Which service should it use?
2. A CloudWatch alarm for failed logins never changes state. Logs arrive, but the metric filter expects a different field name than the structured event. What should be done first?
3. A company centralizes security tooling in a separate account. Why should production workloads still retain their own resource and identity controls?
4. A company exposes administration ports directly to the internet for routine EC2 maintenance. It wants audited access without inbound SSH. Which design is preferred?
5. A company has written incident runbooks but has never exercised them across security, operations, and business owners. What is the most useful next step?
6. A company must choose security controls for data with different sensitivity and retention requirements. What should come first?
7. A company must detect sensitive personal data stored in S3 and prioritize buckets with potential exposure. Which service is appropriate?
8. A company needs an emergency access path if workforce federation fails. What is the best design principle?
9. A company needs an organization-wide maximum permission boundary that prevents member accounts from disabling required security services. Which mechanism should it evaluate?
10. A company needs multi-Region disaster recovery for an application using KMS multi-Region keys. Which statement is correct?
11. A company stores CloudTrail logs centrally and wants to detect whether delivered log files were modified or deleted after delivery. Which controls provide relevant evidence? Select 2 answers.
12. A company wants downloadable AWS compliance reports to support its audit. Which service provides these documents?
13. A company wants to protect internet-facing resources against volumetric DDoS while keeping web attack inspection. Which combination is most appropriate?
14. A compromised role has active temporary sessions. The team updates its trust policy to block new assumptions. Why is further containment work needed?
15. A cross-account incident response team must investigate workloads without maintaining long-lived keys in every account. Which approach is preferred?
16. A developer is allowed to create roles but must not grant those roles more permission than an approved maximum. Which design most directly enforces that limit?
17. A long-lived IAM access key is exposed in a public repository. Which sequence best limits risk while supporting investigation?
18. A policy allows s3:GetObject on a bucket ARN but requests for objects are denied. There are no other grants or denies. What is the likely correction?
19. A policy requires encrypted resources, approved Regions, and centralized audit logs across accounts. What is the best governance design?
20. A production image contains an OS package with a newly published vulnerability. The team needs continuous supported vulnerability assessment of ECR images and EC2 instances. Which service fits?
21. A public web application needs protection against common SQL injection and cross-site scripting patterns. Which control directly inspects these request characteristics?
22. A records archive must prevent object deletion during an enforceable retention period, including by privileged account administrators. Which mode is appropriate when this is the approved requirement?
23. A resource policy uses a broad service principal to accept AWS-service requests. The team wants to reduce cross-service confused deputy exposure. Which conditions should it evaluate where supported?
24. A responder must retain evidence of suspicious S3 access with a defensible chain of custody. Which two practices are appropriate? Select 2 answers.
25. A response workflow would quarantine every instance sharing a common tag. A new finding affects one critical production system. What is the best safeguard before broad automatic containment?
26. A role identity policy allows an action, but an applicable service control policy explicitly denies it. No other grant changes the evaluation. What is the outcome?
27. A role in account A must decrypt data using a customer-managed KMS key in account B. Which permissions are required?
28. A role is trusted by an external account for a supported cross-account operation. The external user still cannot assume it. What should be checked?
29. A secret rotates successfully, but an application continues using a cached old password and loses database access. What change best addresses the failure?
30. A security dashboard reports no findings for a resource type that the configured rules do not support. How should the result be represented?
31. A security platform marks an account healthy, but a newly enabled Region has no configured detector or log collection. What is the most accurate response?
32. A security team has CloudTrail management events but cannot investigate which principal downloaded a particular sensitive S3 object last week. What collection change addresses the missing evidence for future investigations?
33. A security team requires continuous detection of instances whose security groups expose administrative ports to the internet. Which service is best suited to evaluate that configuration rule?
34. A security team wants to reduce permissions on a role based on its observed CloudTrail activity. Which IAM capability assists with an initial policy draft that still requires review?
35. A service must temporarily use a KMS key for a supported job without repeatedly editing its key policy. Which KMS capability is designed for delegated permissions that can later be retired or revoked?
36. A stateful firewall inspects outbound traffic, but return packets bypass it and sessions fail. What change addresses the underlying problem?
37. A team deploys an interface endpoint for an AWS API. Which two controls remain necessary? Select 2 answers.
38. A team needs to prevent sensitive values from leaking through application and model-invocation logs. Which two measures are appropriate? Select 2 answers.
39. A team places a customer email address in a KMS encryption context and assumes the context is secret. What should the security engineer explain?
40. A team restores service after an incident but has not identified the root cause or improved controls. What should follow recovery?
41. A third-party vendor assumes roles in many customer accounts. A customer wants to mitigate the confused deputy risk for its role. Which trust condition is most appropriate?
42. A TLS endpoint certificate is nearing expiration. The team wants automated renewal where supported without storing its private key in source control. Which service should it use?
43. A VPC workload must reach S3 without internet egress. Which configuration provides a private service path while preserving authorization controls?
44. A web ACL managed rule blocks a legitimate business request after deployment. What is the best response while preserving protection?
45. An administrator must troubleshoot a denied API call without immediately granting administrator access. Which two steps are appropriate? Select 2 answers.
46. An administrator plans to delete a KMS key that protects retained backups. What should be verified before scheduling deletion?
47. An application encrypts a large object by generating a data key, encrypting locally, and storing the encrypted data key with the ciphertext. What is this pattern?
48. An application role may pass only one approved execution role to a particular AWS service. Which permission design is most appropriate?
49. An auditor asks which party patches the guest operating system on customer-managed EC2 instances. What is the correct interpretation of shared responsibility?
50. An automated responder receives the same finding twice. The first run isolated a resource; the second tries to apply the same change and fails. Which design improvement is best?
51. An AWS Config aggregator shows a resource as noncompliant in another account. What does aggregation alone do?
52. An EC2 application uses permanent IAM user keys in a configuration file. It only needs to read one DynamoDB table. Which migration is best?
53. An EC2 instance may be compromised. The incident plan requires containment while preserving forensic evidence. Which initial response is most appropriate?
54. An ECS application needs a database password at runtime. Security requires rotation and least-privilege retrieval rather than a secret baked into the image. Which solution is appropriate?
55. An EKS workload requires AWS API access to one S3 prefix. The team wants to avoid granting the same permissions to every pod through a broad node role. Which design is preferred?
56. An EventBridge rule forwards high-severity findings to a response queue. A permission error prevents delivery during a security incident. Which configuration most directly improves recoverability?
57. An IAM role trust policy accidentally allows an external account. The security team wants a finding for unintended external access rather than waiting for the role to be assumed. Which capability should it use?
58. An organization needs evidence that security exceptions have owners, expiration dates, and compensating controls. Which approach is most appropriate?
59. An organization uses principal and resource tags for authorization. Developers can freely modify the authorization tags on their own roles. What is the main risk?
60. An organization wants continuous detection of suspicious account activity using threat intelligence and AWS telemetry, with findings aggregated by a delegated administrator. Which service is the most direct fit?
61. An S3 application requires encrypted transport and should reject ordinary HTTP requests. Which bucket-policy condition addresses this?
62. An S3 bucket uses default SSE-KMS encryption. Older objects were written before the setting changed. What additional work may be required to meet an all-object encryption requirement?
63. Automatic rotation is enabled for an eligible symmetric KMS key. What happens to data encrypted under previous key material?
64. Employees use a corporate identity provider and need centrally managed AWS account access without individual IAM user keys. Which solution is preferred?
65. Security wants evidence that a preventive control works before rolling it out to all organizational units. Which rollout approach is best?

Comments — 0