SCS-C03 practice questions and answers

Correct answer: A, B — Enable MFA on the root user and store the credentials securely offline · Delete any root user access keys

Hardware or virtual MFA plus removal of root access keys are the two standard root protections. Daily use and credential sharing increase exposure, and IAM policies cannot restrict the root user within its own account.

Correct answer: A — Remove the rule and provide administrative access through Session Manager or a restricted source range

Remote administration exposed to the entire internet must be closed, and access should come through an authenticated, logged channel or a tightly scoped source range. Changing the port is security by obscurity, an ACL that allows the same traffic changes nothing, and monitoring does not remove exposure.

Correct answer: A — Whether the bucket's Block Public Access, an SCP, a VPC endpoint policy, or the KMS key policy is denying the request

Cross-account S3 access passes through several policy layers, and an explicit deny anywhere, including an SCP, an endpoint policy, or the KMS key policy for encrypted objects, wins. Versioning, storage class, and lifecycle rules do not affect authorisation.

Correct answer: A — CloudTrail Insights

CloudTrail Insights baselines normal API call rates and error rates and raises events when activity deviates, with no rules to author. Log file validation proves integrity, the Config recorder tracks configuration items, and Flow Logs capture network metadata.

Correct answer: A — A compromised workload account cannot tamper with the security tooling, logs, or findings

Separation puts the audit trail and detection capability outside the blast radius of a compromised workload, which is what makes the evidence trustworthy. It does not reduce policy count, remove the need for encryption, or lower transfer cost.

Correct answer: A — AWS WAF with managed rule groups

WAF inspects HTTP request content and managed rule groups include signatures for injection and scripting attacks. Shield Standard mitigates network and transport layer DDoS, and network ACLs and security groups filter by address and port without understanding request payloads.

Correct answer: A, B — Enable data events for the S3 bucket on the trail · Select the appropriate read and write event selectors for the resources

Object-level activity is a data event, and you must both enable data events for the bucket and choose read, write, or both in the event selector. Management events cover control plane calls only, server access logging is a separate mechanism that does not replace the trail, and Insights detects unusual API call volume rather than adding object logging.

Correct answer: A — Use an HTTPS target group so the load balancer re-encrypts traffic to the targets

End-to-end encryption requires the backend listener and target group to use HTTPS so the second hop is also protected. Plain HTTP to targets leaves that hop in the clear, EBS encryption protects data at rest, and access logs record requests.

Correct answer: A — An IAM OIDC identity provider trusting the CI system, with a role assumed via web identity and a condition on the subject claim

An OIDC trust with a condition pinning the repository and branch subject claim lets the pipeline exchange its own token for short-lived AWS credentials with no stored secret. A stored key is exactly what this removes, a wildcard trust policy would let anyone assume the role, and copying instance credentials is both fragile and unsafe.

Correct answer: A — AWS Network Firewall with a stateful rule group for domain filtering

Network Firewall supports stateful inspection including domain allow and deny lists at the VPC boundary. Security groups and network ACLs match on IP addresses and ports and cannot express domain names, and public hosted zones publish DNS records rather than filtering traffic.

Correct answer: A — IAM Identity Center permission sets assigned to directory groups per account

Permission sets are defined once and assigned to groups per account, so Identity Center provisions and maintains the underlying roles. Hand-maintained roles drift, a shared broad user destroys least privilege and attribution, and password rotation does not address authorisation.

Correct answer: A — AWS manages the underlying host, operating system, and database engine patching, while the customer manages access control, encryption choices, and data

For a managed database, AWS handles the infrastructure and engine maintenance while the customer remains responsible for who can access it, how data is encrypted, and the data itself. Customers never patch RDS hosts or secure data centres, and AWS does not author customer IAM policies.

Correct answer: A — A Condition block using aws:RequestTag or aws:ResourceTag

Attribute-based access control is expressed through condition keys that compare request or resource tags. Sid is a statement label, Version selects the policy language version, and identity-based policies do not contain a Principal element.

Correct answer: A — Aggregate findings in Security Hub with a delegated administrator, route them to a ticketing system, and track workflow status

Central aggregation plus integration with the team's ticketing workflow gives one queue with tracked state, which is what prevents findings from being lost. Ad hoc per-account review does not scale, disabling detection hides risk, and a quarterly spreadsheet is not a triage process.

Correct answer: A — AWS Security Hub

Security Hub ingests findings in a normalised format from AWS and partner services, aggregates across accounts, and scores against standards such as CIS and AWS Foundational Security Best Practices. Detective investigates individual findings, Config evaluates configuration compliance, and Systems Manager operates instances.

Correct answer: A — A permissions boundary required on any role the developer creates, enforced with an iam:PermissionsBoundary condition

Requiring a permissions boundary on created roles caps what those roles can ever do, which closes the privilege escalation path while still allowing delegation. A tag is metadata, notifications are detective, and MFA authenticates without limiting what the identity may grant.

Correct answer: A — Amazon Macie

Macie uses managed data identifiers, including payment card patterns, to discover and classify sensitive data in S3 at scale. Athena queries data you already understand, Glue crawlers infer schema, and Comprehend Medical extracts clinical entities from text.

Correct answer: A — AWS CloudHSM

CloudHSM gives dedicated, single-tenant HSMs where the customer controls the keys and AWS has no access to the key material. KMS is multi-tenant and managed by AWS, Secrets Manager stores secrets rather than providing an HSM, and ACM issues certificates.

Correct answer: A — AWS Control Tower

Control Tower stands up a landing zone with organisational units, logging, and mandatory guardrails implemented as SCPs and Config rules. CloudFormation and Systems Manager are building blocks, and Detective investigates findings rather than establishing governance.

Correct answer: A — The key policy, which is the primary access control for a KMS key, combined with grants

A KMS key's own resource policy governs who may use it, and grants provide fine-grained temporary delegation, which is how cross-account key usage is authorised. Rotation replaces backing key material, aliases are friendly names, and external key material concerns where the bytes come from.

Correct answer: A — AWS Certificate Manager with a public certificate

ACM issues public certificates free of charge and renews them automatically when they are attached to supported services such as ELB and CloudFront. Self-signed certificates fail browser validation, KMS keys are not TLS certificates, and Secrets Manager stores secrets rather than issuing certificates.

Correct answer: A, B — CloudTrail events filtered by the role session name and access key ID · Amazon Detective's entity profile for the role

CloudTrail records every API call with the session identity, and Detective visualises that activity over time for the entity. The policy simulator evaluates what a policy would allow rather than what happened, budget reports track cost, and public DNS query logs do not attribute AWS API activity.

Correct answer: A — Retrieve the secret at runtime from Secrets Manager using the function's execution role, with caching

Fetching from Secrets Manager under the execution role keeps the value out of the function configuration and package, allows rotation, and produces an audit trail. Environment variables are visible to anyone who can read the function configuration, and base64 is an encoding rather than protection.

Correct answer: A — aws:SourceVpce

The aws:SourceVpce key matches the VPC endpoint identifier the request came through, which is how buckets are restricted to private network paths. Principal tags express identity attributes, current time bounds a validity window, and user agent is a client-supplied string that must not be trusted for authorisation.

Correct answer: A — Enable enhanced scanning on the ECR repository and gate the pipeline on scan findings

Scanning at push time and failing the pipeline on unacceptable findings keeps vulnerable images out of production. Post-deployment scanning discovers issues too late, publisher assurances are not verification, and mutable tags make it harder to know what is actually running.

Correct answer: A — Attach an inline deny policy to the role with a condition on aws:TokenIssueTime before the current time

AWS documents a revoke-sessions policy that denies all actions for credentials issued before a chosen timestamp, which invalidates existing sessions without breaking future ones. Deleting the role disrupts legitimate workloads, the root password is unrelated, and the session duration setting only affects sessions issued after the change.

Correct answer: A — The identity-based policy must also allow the KMS action unless the key policy delegates to IAM

Access to a KMS key requires both the key policy and, unless the key policy delegates authority to IAM for the account, an identity-based allow on the calling principal. Roles can absolutely use KMS keys, rotation is unrelated to authorisation, and KMS keys are not subnet-scoped.

Correct answer: A — IAM Access Analyzer external access findings

Access Analyzer uses automated reasoning over resource policies to report which resources are reachable by principals outside the defined zone of trust. Trusted Advisor cost checks look at spend, Inspector scans workloads for vulnerabilities, and the Config recorder captures configuration state without this analysis.

Correct answer: A — Start from a narrow policy, then use IAM Access Analyzer policy generation from CloudTrail activity to refine it

Generating a policy from observed CloudTrail activity produces a grant that matches what the workload actually does, and starting narrow avoids over-permission in the meantime. Administrator access, wildcards, and reusing an unrelated team's policy all grant far more than the application needs.

Correct answer: A — A preventive control such as an SCP condition on the create API

Blocking creation is by definition preventive, and an SCP condition on the API call is the mechanism that stops the action. A Config rule reports non-compliance after the fact, runbooks respond to incidents, and documentation does not enforce anything.

Correct answer: A, B — Provide AWS Artifact reports covering AWS's own controls · Provide AWS Audit Manager assessment reports for the customer-managed controls

Artifact supplies AWS's third-party attestations and Audit Manager collects evidence continuously for the customer's own control set. Granting administrator access, emailing screenshots, and sharing root credentials are unacceptable in an audit context.

Correct answer: A — Deactivate and delete the exposed keys, then review CloudTrail for their use and rotate anything they touched

An exposed credential must be revoked immediately and its activity reviewed to scope the incident. IP conditions and MFA do not stop a key already in an attacker's hands from being used within allowed contexts, and there is no automatic rotation of IAM access keys.

Correct answer: A — The request is denied, because an explicit deny always overrides an allow

AWS policy evaluation applies explicit deny with absolute precedence over any allow, regardless of specificity or attachment order. There is no partial success outcome in this evaluation.

Correct answer: A — S3 Versioning, so previous object versions can be restored

Versioning keeps the previous object versions when a key is overwritten, so the clean copies remain retrievable. Transfer Acceleration speeds transfers, Intelligent-Tiering optimises storage cost, and Requester Pays changes who is billed.

Correct answer: A — All new objects are encrypted at rest by default with server-side encryption, and a bucket can specify SSE-KMS with a chosen key

Amazon S3 applies server-side encryption to new objects by default and a bucket can be configured to use a specified KMS key instead of the S3 managed key. It does not require a client header, it does not re-encrypt objects that already exist, and it is unrelated to cross-account authorisation.

Correct answer: A — Delegate a GuardDuty administrator account and enable auto-enable for new organisation accounts

A delegated administrator with auto-enable turns GuardDuty on in every member account, including ones created later, from a single place. Manual enablement drifts, the management account alone leaves members unmonitored, and Security Hub aggregates findings rather than enabling the source services.

Correct answer: A — Client-side envelope encryption with the AWS Encryption SDK and a KMS key the DBA cannot use

Field-level client-side encryption means the database only ever holds ciphertext, so the DBA cannot read the values without KMS permission on the key. Storage encryption is transparent to anyone with query access, TLS protects only the network hop, and backups do not restrict readability.

Correct answer: A, B — Shield Standard is automatically enabled for all AWS customers at no extra cost · Shield Advanced adds cost protection and access to the Shield Response Team

Shield Standard is included for everyone and Shield Advanced adds DDoS cost protection plus expert response support. Shield Advanced complements rather than replaces WAF for application layer rules, Shield Standard does not perform layer 7 content inspection, and the service is not confined to a single Region.

Correct answer: A — AWS Firewall Manager

Firewall Manager applies WAF, Shield Advanced, security group, and Network Firewall policies organisation-wide and automatically covers newly created in-scope resources. Per-account WAF configuration drifts, GuardDuty detects threats, and a Config aggregator only collects data.

Correct answer: A — An SCP using the aws:RequestedRegion condition key

The aws:RequestedRegion condition in an SCP denies API calls targeting unapproved Regions for all principals in scope. Tag policies standardise tags, backup policies govern AWS Backup, and an alarm only observes.

Correct answer: A — Conformance packs deployed through the organisation

Conformance packs bundle Config rules and remediation actions into a single deployable unit that can be applied organisation-wide. A rule in one account evaluates only that account, aggregators collect data without evaluating, and advanced queries search existing configuration data.

Correct answer: A — A break-glass incident response role in each member account, trusted by the security account and monitored by CloudTrail alerts on assumption

A trusted role assumed on demand gives privileged access only when needed and generates an auditable signal every time it is used. Standing administrator users and shared root credentials are permanent risk, and an SCP that denies everything would block the responders as well.

Correct answer: A — Amazon Detective

Detective builds a behaviour graph from CloudTrail, VPC Flow Logs, and GuardDuty findings so you can pivot through an entity's activity over time without writing queries. Trusted Advisor gives best-practice checks, Budgets tracks spend, and Macie classifies sensitive data in S3.

Correct answer: A, B — An EC2 instance that needs to call AWS APIs · A federated employee signing in through the corporate identity provider

Roles deliver temporary credentials to workloads and federated humans, which removes long-lived secrets from both paths. The remaining options describe credential handling practices that should never occur.

Correct answer: A — The action is denied because the SCP does not permit it

An action must be permitted by both the SCP ceiling and an IAM policy, so anything outside the SCP is denied regardless of IAM grants. Console versus API access does not change policy evaluation, and MFA is a separate condition.

Correct answer: A — The snapshot must be shared and re-encrypted with a KMS key the forensics account can use

Snapshots encrypted with a customer managed key can be shared and copied, but the destination account needs permission on a key it can use, so the copy is re-encrypted appropriately. Decrypting the volume weakens protection, the forensics account need not be the management account, and public snapshots would expose the evidence.

Correct answer: A — A Backdoor or CryptoCurrency finding based on DNS and network activity

GuardDuty analyses DNS queries and VPC Flow Logs against threat intelligence, so contact with known malicious infrastructure surfaces as a backdoor or cryptocurrency finding type. Public access and policy compliance are Config or Access Analyzer concerns, and cost anomalies come from the billing service.

Correct answer: A — A metric filter that publishes a custom metric, with a CloudWatch alarm on it

Metric filters count matching log events into a CloudWatch metric that an alarm can then evaluate and notify on. Subscription filters stream data elsewhere without alarming, dashboards display, and retention policies control how long logs are kept.

Correct answer: A — Gateway Load Balancer with GENEVE encapsulation and endpoint routing

Gateway Load Balancer plus its VPC endpoints let route tables steer traffic through a scalable fleet of inline appliances without changing the application. The application and network load balancers terminate or proxy connections to targets, and CloudFront is a content delivery service.

Correct answer: A — An EventBridge rule on the GuardDuty finding invoking a Systems Manager Automation runbook or Lambda that applies an isolation security group

GuardDuty findings are delivered to EventBridge, which can trigger automation that quarantines the instance in seconds. Email alone waits on a human, a daily script is far too slow, and a dashboard does not act.

Correct answer: A — Amazon Inspector

Inspector continuously scans EC2 instances, ECR images, and Lambda functions for CVEs and evaluates network reachability. GuardDuty detects active threats rather than vulnerabilities, Firewall Manager centralises firewall policy, and Artifact provides compliance documents.

Correct answer: A — The IAM policy simulator

The policy simulator evaluates a policy against specified actions and resources and reports allow or deny with the deciding statement, which is a pre-deployment check. CloudTrail Insights and the Config timeline describe what already happened, and Cost Explorer forecasts spend.

Correct answer: A — Interface VPC endpoints with an endpoint policy using the aws:PrincipalOrgID condition

Interface endpoints keep API traffic private, and an endpoint policy can restrict which principals and organisations may use the endpoint. NAT gateways and internet gateways route to the internet, and a Transit Gateway routes between networks rather than restricting AWS API access.

Correct answer: A — AWS Systems Manager Session Manager with session logging to S3 or CloudWatch Logs

Session Manager connects through the SSM agent with no inbound ports, no bastion, and IAM-controlled access, and it can record full session transcripts. Every other option keeps SSH, key distribution, and an exposed listener in the design.

Correct answer: A — AWS Shield Advanced

Shield Advanced provides enhanced DDoS protection plus cost protection credits for scaling charges caused by an attack, along with response team access. Rate-based WAF rules help at layer 7 but carry no cost protection, GuardDuty detects rather than mitigates, and Budgets only alert on spend.

Correct answer: A — Isolate with a restrictive security group, take an EBS snapshot and memory capture, then investigate before terminating

Containment before eradication preserves the forensic record: an isolation security group cuts communication while snapshots and memory capture retain evidence. Terminating destroys evidence, rebooting may wipe volatile memory and does not contain anything, and leaving the instance reachable fails to contain it.

Correct answer: A, B — They are stateful, so return traffic for an allowed connection is permitted automatically · They can reference another security group as a source

Security groups track connection state and can use another security group as a source, which is how tiered architectures are expressed without hardcoding addresses. They contain allow rules only, have no rule ordering, and attach to network interfaces rather than subnets.

Correct answer: A — Pre-provisioned forensic tooling, a dedicated response role, and rehearsed runbooks

Response speed comes from having access, tools, and practised procedures ready before the event. A document nobody has rehearsed slows the response, standing administrator access is a risk in itself, and disabling logging destroys the evidence responders depend on.

Correct answer: A — An EventBridge rule matching the CloudTrail event, targeting an SNS topic

CloudTrail management events flow to EventBridge in near real time, so a rule matching the API call can notify within minutes. Weekly log review and daily Config evaluation are far too slow, and cost anomaly detection watches spend rather than identity actions.

Correct answer: A — A bucket policy denying PutObject when s3:x-amz-server-side-encryption-aws-kms-key-id does not match the approved key ARN

A deny condition on the encryption header rejects any upload that does not name the approved key, which enforces the requirement at write time. Versioning, acceleration, and lifecycle rules do not constrain how objects are encrypted.

Correct answer: A — AWS Backup Vault Lock in compliance mode

Vault Lock in compliance mode makes the retention policy immutable so recovery points cannot be deleted early by any principal. A retention setting alone can be changed, a single IAM deny leaves other identities unconstrained, and cross-Region copies improve durability without preventing deletion.

Correct answer: A, B — S3 Block Public Access enabled at the account level · An SCP denying s3:PutBucketPublicAccessBlock changes that weaken the setting

Account-level Block Public Access overrides permissive bucket settings, and an SCP prevents anyone from turning that protection off. Acceleration, Requester Pays, and storage class choices have no effect on public exposure.

Correct answer: A — Amazon Cognito identity pools issuing role-based temporary credentials

Cognito identity pools exchange a federated identity token for scoped temporary AWS credentials, which is the supported pattern for mobile clients. Per-device IAM users do not scale, embedding keys in an app leaks them immediately, and instance profiles apply to EC2 rather than mobile clients.

Correct answer: A — CloudTrail records who made an API call, while Config records the resulting resource configuration state over time

The two are complementary: CloudTrail answers who did what and when, and Config answers what the resource looked like at any point and whether it complies. Their roles are not reversed, they are not redundant, and both support organisation-wide aggregation.

Correct answer: A, B — Automatic rotation creates new backing key material while the key ID and ARN stay the same · Data encrypted before rotation remains decryptable using the retained older key material

Rotation swaps the backing material transparently and KMS retains previous material so old ciphertext still decrypts. It does not re-encrypt existing data, the key identifiers are unchanged, and AWS owned keys are not customer-configurable.