Amazon AWS Certified Security - Specialty SCS-C03 Free Practice Test - 20 Questions

Question 1

When evaluating an IAM policy, which of the following is true regarding an explicit deny?

Accepted Answer

An explicit deny overrides any allow.

Question 2

Which feature of AWS CloudTrail ensures that log files have not been tampered with after delivery?

Accepted Answer

S3 server-side encryption with AWS KMS

Question 3

Which statement about automatic KMS key rotation is correct?

Accepted Answer

Automatic rotation can be disabled after it is enabled.

Question 4

A security group is configured to allow inbound SSH traffic from a specific IP address. What happens if the security group is later modified to remove that inbound rule?

Accepted Answer

New SSH connections are allowed for 60 seconds, then blocked.

Question 5

A web application receives suspicious requests containing SQL commands embedded in URL parameters. Which AWS WAF rule type should be used to block these requests?

Accepted Answer

SQL database managed rule group

Question 6

A company wants to restrict access to an S3 bucket so that only requests originating from the company's corporate IP address range are allowed. What is the most efficient way to implement this?

Accepted Answer

Use S3 block public access and an ACL granting access to the IP range.

Question 7

Which AWS service can be used to encrypt CloudWatch Logs at rest using an AWS KMS key?

Accepted Answer

CloudWatch Logs encryption is only possible using server-side encryption with S3.

Question 8

A security team discovers that an EC2 instance in a VPC is sending outbound traffic to a known malicious IP address. Which approach will help identify the source process using existing logs?

Accepted Answer

Use AWS Config to check the security group rules.

Question 9

Amazon GuardDuty detects a finding indicating that an EC2 instance might be compromised because it is communicating with a known command-and-control server. What is the most automated way to isolate the instance?

Accepted Answer

Use EventBridge to trigger a Lambda function that modifies the security group to block all traffic.

Question 10

A company uses a centrally managed KMS key in account A to encrypt data. Account B needs to decrypt that data using the same key. What is required?

Accepted Answer

Export the key material and import it into account B's KMS.

Question 11

An application uses Amazon Cognito to authenticate users. Which Cognito component is responsible for providing temporary AWS credentials for accessing AWS resources?

Accepted Answer

Cognito sync

Question 12

An organization wants to protect an application behind an Application Load Balancer from a large-scale DDoS attack at layer 7. Which AWS service should be used?

Accepted Answer

AWS Network Firewall

Question 13

A company uses AWS Secrets Manager to store database credentials. They want to automatically rotate the credentials on a schedule. What is the simplest way to achieve this?

Accepted Answer

Enable automatic rotation in Secrets Manager and configure the Lambda rotation function.

Question 14

A security analyst needs to view a record of all AWS API calls made within an account for the past 90 days. Which service should be used?

Accepted Answer

Amazon CloudWatch Logs

Question 15

An S3 bucket is configured with default encryption using SSE-S3. A user uploads an object with a request that does not include any encryption headers. How is the object encrypted?

Accepted Answer

The object is encrypted using SSE-KMS because default encryption requires it.

Question 16

An IAM role has a trust policy that allows an EC2 instance to assume it. The role also has a permissions boundary that limits the maximum permissions. Which statement about the effective permissions is correct?

Accepted Answer

The permissions boundary is only applied to the trust policy, not the permissions policy.

Question 17

A company uses Network ACLs and security groups for subnet isolation. Which of the following is a key difference between the two?

Accepted Answer

Security groups are stateful, while network ACLs are stateless.

Question 18

Amazon Macie is used to discover sensitive data stored in S3. Which of the following can Macie detect?

Accepted Answer

Personally identifiable information (PII) in S3 objects

Question 19

A development team needs to store configuration data that includes database connection strings. The data must be stored encrypted and be accessible to EC2 instances automatically. Which service should be used?

Accepted Answer

AWS Secrets Manager

Question 20

An administrator wants to grant a user permission to use a specific KMS key but only for encrypting data, not decrypting. What is the correct approach?

Accepted Answer

Use a KMS grant with the CryptographyEncrypt operation only.

Amazon AWS Certified Security - Specialty SCS-C03 Free Practice Test - 20 Questions

The free lane is only the front row