Medium — SCS-C03 Practice Quiz

Question 1

A company runs an internal microservices platform on EC2 behind an internal Application Load Balancer. Security requires all service-to-service traffic to use TLS with certificates that automatically renew, are trusted only within the corporate network, and never need to be publicly resolvable or validated through DNS/email challenges. The solution must minimize operational overhead for certificate issuance and rotation. What should the security engineer implement?

Accepted Answer

Set up AWS Private CA (ACM Private Certificate Authority), issue private certificates through ACM for the internal ALB, and let ACM manage automatic renewal.

Answer

Request public certificates from AWS Certificate Manager (ACM) for each service and attach them to the internal ALB, relying on ACM managed renewal.

Answer

Store self-signed certificates in AWS Secrets Manager and use a Lambda rotation function to regenerate and redeploy them to each service every 90 days.

Answer

Purchase certificates from a third-party public CA, import them into ACM, and configure Amazon EventBridge to alert 30 days before expiration so they can be manually reimported.

Question 2

A company operates 45 AWS accounts managed under AWS Organizations. The security team wants a centralized way to view and prioritize GuardDuty threat findings, Inspector vulnerability findings, and misconfiguration findings from managed compliance standards across all accounts in one console. They also want new accounts to be automatically enrolled without manual configuration. Which approach best meets these requirements with the least ongoing operational effort?

Accepted Answer

Enable AWS Security Hub with the Organizations integration, designate a delegated administrator account, turn on auto-enable for new accounts and standards, and enable Security Hub integrations with GuardDuty and Inspector.

Answer

Enable Amazon Detective in a central account and invite all member accounts to send their GuardDuty and Inspector findings for aggregation and prioritization.

Answer

Configure Amazon EventBridge rules in each account to forward all GuardDuty and Inspector findings to an S3 bucket in a central account, then use Amazon Athena to query and prioritize them.

Answer

Enable GuardDuty with a delegated administrator and rely on the GuardDuty console to aggregate Inspector findings and compliance standard results across all accounts.

Question 3

A security engineer is performing root cause analysis for an incident that spanned three AWS accounts and two Regions. CloudTrail logs are delivered to a central S3 bucket in a dedicated log-archive account, partitioned by account, Region, and date. The engineer needs to run ad hoc SQL queries across all accounts and Regions to reconstruct the attacker's API activity timeline, while keeping query costs low and avoiding data movement. Which approach best meets these requirements?

Accepted Answer

Create an Athena table over the central S3 bucket, define partition projection on the account/Region/date keys, and run SQL queries scoped to relevant partitions.

Answer

Load all CloudTrail logs into an Amazon Redshift cluster in the log-archive account and query the events using the Redshift query editor.

Answer

Enable CloudTrail Lake in each source account and query events separately per account, then manually merge the CSV exports in a spreadsheet.

Answer

Use CloudWatch Logs Insights on each account's log group and export the correlated results to the central bucket for review.

Question 4

A healthcare company must ensure that its RDS, EFS, and DynamoDB backups cannot be deleted or shortened in retention by anyone—including the AWS account root user and administrators—for a regulatory retention period of 7 years. The security team also wants backups copied to a separate, dedicated backup account to protect against a compromised production account. Which approach meets these requirements?

Accepted Answer

Enable AWS Backup Vault Lock in compliance mode on a vault in a separate backup account, and configure a backup plan with cross-account copy into that locked vault.

Answer

Enable AWS Backup Vault Lock in governance mode on the production vault and rely on IAM policies to prevent deletion.

Answer

Enable S3 Object Lock in compliance mode on the AWS Backup service bucket and set a 7-year retention period.

Answer

Apply an SCP that denies backup:DeleteRecoveryPoint across the organization and store all backups in the production account.

Question 5

A media company serves static video assets from an S3 bucket through a CloudFront distribution. The security team discovers that users can bypass CloudFront and download objects directly using the S3 bucket's website endpoint URLs, avoiding WAF rules and geo-restrictions applied at the edge. The team wants to ensure all access to the S3 objects is only possible through CloudFront, using the most current AWS-recommended mechanism. What should they implement?

Accepted Answer

Configure an Origin Access Control (OAC) on the CloudFront distribution and update the S3 bucket policy to allow access only from that distribution via the aws:SourceArn condition, while blocking all other principals.

Answer

Enable S3 Block Public Access on the bucket and add a bucket policy that allows the CloudFront service principal without any condition keys.

Answer

Attach a custom secret header at CloudFront and use an S3 bucket policy that validates the header value on every GetObject request.

Answer

Create a legacy Origin Access Identity (OAI), associate it with the origin, and enable the S3 static website hosting endpoint as the CloudFront origin.

Question 6

A security team operates a public web application served through Amazon CloudFront with an Application Load Balancer origin. A recent penetration test flagged that the application does not enforce HTTP Strict Transport Security (HSTS) and is missing X-Content-Type-Options and X-Frame-Options headers on responses. The development team is busy and cannot modify the application code for several sprints. The team needs a way to consistently add these security headers to all responses at the edge with minimal operational effort. Which approach best meets this requirement?

Accepted Answer

Attach a CloudFront response headers policy that includes the security headers configuration to the distribution's cache behavior.

Answer

Deploy an AWS WAF web ACL with a custom rule that injects the security headers into every HTTP response.

Answer

Configure the Application Load Balancer listener rules to add the security response headers before returning traffic to CloudFront.

Answer

Enable AWS Shield Advanced on the distribution and turn on the automatic security header enforcement feature.

Question 7

A financial services company builds internal Lambda functions and shared libraries used across dozens of AWS accounts. Recent industry incidents involving compromised open-source dependencies have prompted the security team to reduce software supply chain risk. They want to (1) ensure developers pull third-party packages only from an approved, versioned internal repository that proxies public registries, and (2) guarantee that only Lambda code artifacts signed by the organization's build pipeline can be deployed to production functions. Which combination of AWS services best meets these requirements?

Accepted Answer

Use AWS CodeArtifact as an upstream proxy for public package repositories, and configure AWS Signer with Lambda code signing configurations that reject unsigned or invalidly signed deployment packages.

Answer

Use Amazon S3 with object versioning to store all packages and enable S3 Object Lock, then use a Lambda layer to validate hashes at runtime.

Answer

Use AWS CodeArtifact for package management and enable Amazon Inspector code scanning to block deployment of any Lambda package that contains a vulnerability.

Answer

Use AWS Config rules to detect Lambda functions deployed from unapproved repositories and AWS Secrets Manager to store signing keys for the build pipeline.

Question 8

A security engineer manages an organization with 60 accounts spread across 3 AWS Regions. Each account already has AWS Config enabled recording resources, and a standardized set of Config rules is deployed to every account. The engineer's CISO wants a single, centralized, read-only view of the compliance status of all Config rules across every account and Region, without having to log into each account individually. The solution must require minimal ongoing maintenance as new accounts join the organization. What should the engineer implement?

Accepted Answer

Create an organization aggregator in a designated central account and authorize it for the entire organization, so it automatically collects Config configuration and compliance data from all current and future accounts and Regions.

Answer

Enable an AWS Config conformance pack in each member account and configure it to publish compliance results to a central S3 bucket for reporting.

Answer

Deploy an EventBridge rule in each account that forwards Config compliance change events to a central account, then build a dashboard from the collected events.

Answer

Create an individual account-level Config aggregator in the central account and manually add each of the 60 account IDs and their Regions as authorized sources.

Question 9

A security team manages compliance across a 200-account AWS Organization using a delegated administrator account for AWS Config. They deploy an organization conformance pack that includes a managed rule with automatic remediation to disable public S3 access. One member account hosts a legitimately public static website bucket that must remain accessible and should not be evaluated by this rule at all. The team wants to keep the conformance pack deployed org-wide with remediation active everywhere else, while ensuring the website account is not affected. What is the most operationally efficient way to achieve this?

Accepted Answer

Use the excluded accounts parameter when deploying the organization conformance pack to omit the website account from the deployment.

Answer

Add the website account's bucket ARN to the conformance pack rule's resource exclusion list so remediation skips that resource.

Answer

Attach an SCP to the website account that denies AWS Config from evaluating S3 resources in that account.

Answer

Disable AWS Config in the website account so the conformance pack rules produce no findings for its resources.

Question 10

A financial services company must produce audit-ready evidence for a SOC 2 examination across 40 AWS accounts in an organization. The security team already uses AWS Config with organization conformance packs to continuously evaluate resource compliance. Auditors now require a consolidated package that maps collected evidence to specific SOC 2 control requirements, automatically gathers supporting data (Config rule results, CloudTrail activity, and resource configurations), and can be exported as an assessment report for the examiners. Which approach best meets this requirement with the least custom development?

Accepted Answer

Enable AWS Audit Manager, launch an assessment from the SOC 2 framework, and select the organization accounts and Config data sources as automated evidence collectors.

Answer

Create additional Config conformance packs mapped to SOC 2 controls and export the compliance dashboard from the Config console for each account.

Answer

Enable Security Hub with the AWS Foundational Security Best Practices standard and export the findings summary as the SOC 2 evidence package.

Answer

Configure an Athena query against centralized CloudTrail logs and build a QuickSight dashboard that maps API activity to SOC 2 control IDs.

Question 11

A financial services company must produce quarterly evidence packages mapped to the PCI DSS control framework for external auditors. The security team already uses AWS Config rules across all accounts in an AWS Organizations setup. Auditors require a repeatable, framework-organized collection of evidence (configuration snapshots, compliance check results, and CloudTrail activity) that maps individual controls to the underlying AWS resource data, with the ability to delegate manual attestation for controls that AWS services cannot automatically assess. Which approach best meets these requirements with the least custom development?

Accepted Answer

Deploy AWS Audit Manager with the prebuilt PCI DSS framework, enabling it to collect evidence automatically from AWS Config, CloudTrail, and other sources while allowing manual evidence uploads for controls requiring attestation.

Answer

Deploy an AWS Config conformance pack aligned to PCI DSS across the organization and export the compliance scores to an S3 bucket for auditors to review.

Answer

Enable the Security Hub PCI DSS standard in all accounts and use the security score dashboard as the evidence package for auditors.

Answer

Build a custom Lambda solution that queries Config, CloudTrail, and Security Hub APIs, then compiles the results into framework-mapped reports stored in S3.

Question 12

A financial services company runs a large AWS Organization with 200+ accounts managed via AWS Control Tower. The security team has discovered that development teams occasionally launch EC2 instances from unvetted, publicly shared Amazon Machine Images (AMIs), introducing software supply chain risk. Leadership requires a solution that PREVENTS the launch of any instance from an AMI unless the AMI is owned by a designated internal 'golden image' account. The control must be enforced organization-wide and cannot be bypassed by account administrators, including those with full EC2 permissions. Which approach meets these requirements?

Accepted Answer

Attach a service control policy (SCP) to the organization root that denies ec2:RunInstances unless the ec2:Owner condition key matches the approved golden image account ID.

Answer

Deploy an AWS Config conformance pack with a managed rule that flags instances launched from unapproved AMIs and triggers automatic remediation to terminate them.

Answer

Enable a Security Hub control that continuously evaluates running instances against a list of approved AMI IDs and generates critical findings for violations.

Answer

Create a Control Tower detective guardrail that monitors AMI usage across accounts and notifies the security team when an unapproved AMI is used.

Question 13

A security governance team must continuously evaluate all member accounts in an AWS Organization against a well-defined internal baseline of 40 specific resource configuration rules (e.g., required EBS encryption, mandatory tags, prohibited public RDS instances). They want the entire ruleset deployed and version-controlled as a single, reusable YAML artifact that includes automatic remediation actions, and they want the same package applied uniformly across all accounts via the delegated administrator. Which approach best meets these requirements?

Accepted Answer

Author an AWS Config conformance pack template containing the 40 managed and custom rules plus remediation configurations, and deploy it organization-wide from the Config delegated administrator account.

Answer

Enable the AWS Foundational Security Best Practices standard in Security Hub and rely on its controls to evaluate the 40 rules.

Answer

Create 40 individual AWS Config rules manually in each account and configure SSM Automation remediation per rule.

Answer

Define the 40 rules as a service control policy attached to the organization root to prevent noncompliant resource creation.

Question 14

A security engineer must continuously evaluate whether all Amazon EC2 instances across the organization carry a mandatory 'CostCenter' tag AND that the tag value matches one of a dynamic list of approved cost centers maintained in an external DynamoDB table. AWS Config is already enabled org-wide via a delegated administrator account. Which approach meets these requirements with the least ongoing operational overhead while remaining evaluable by AWS Config?

Accepted Answer

Author a custom AWS Config rule backed by a Lambda function that reads the approved cost-center list from the DynamoDB table and returns COMPLIANT/NON_COMPLIANT for each EC2 configuration item, deployed org-wide as an organization Config rule.

Answer

Deploy the AWS Config managed rule 'required-tags' via a conformance pack to all accounts, specifying the CostCenter tag key and a static comma-separated list of approved values.

Answer

Create an SCP that denies ec2:RunInstances unless a CostCenter tag condition key is present, and rely on the deny to enforce compliance.

Answer

Enable Security Hub's Foundational Security Best Practices standard, which includes a control that validates required resource tags against an external data source.

Question 15

A financial services company uses AWS Control Tower to govern 120 accounts across multiple OUs. The security team wants every NEW account created through Account Factory to automatically have a standardized set of baseline resources deployed — a hardened VPC configuration, a centralized logging IAM role, and an AWS Config custom rule — as part of the account provisioning process, without requiring manual steps after account creation. Which approach best meets this requirement?

Accepted Answer

Implement Account Factory for Terraform (AFT) with account customizations so the baseline resources are deployed automatically during the account provisioning pipeline

Answer

Attach a service control policy (SCP) to the OU that denies all actions until the required baseline resources exist in the account

Answer

Deploy a Config conformance pack to the organization so that the baseline resources are created in each new account when it is enrolled

Answer

Enable additional Control Tower mandatory guardrails that provision the VPC, IAM role, and Config rule automatically in every account

Question 16

A financial services company uses AWS Control Tower to manage a multi-account environment. The security team must ensure that every newly vaccounted through Account Factory automatically has a standardized security baseline applied, including a mandatory detective control that flags any S3 bucket configured with public read access. This control must be reported centrally without preventing the provisioning of the account. The team wants to use Control Tower's native capability rather than building custom automation. Which approach meets these requirements?

Accepted Answer

Enable a Control Tower detective guardrail (managed by AWS Config rules) that detects publicly accessible S3 buckets; compliance status is aggregated in the Control Tower dashboard for all enrolled accounts.

Answer

Attach a preventive SCP to the organizational unit that denies the s3:PutBucketPublicAccessBlock action so buckets can never be made public.

Answer

Create a custom Lambda function triggered by Account Factory that scans S3 buckets and blocks account provisioning if a public bucket is found.

Answer

Enable a Control Tower proactive guardrail using AWS CloudFormation hooks to reject any account creation that includes public S3 buckets.

Question 17

A financial services company currently manages 12 AWS accounts under AWS Organizations, created manually over the past two years. Each account was set up inconsistently — some lack baseline CloudTrail configuration, centralized logging, or standardized IAM roles. The security team must scale to over 100 accounts in the next year and needs every new account to be provisioned with a consistent, pre-approved security baseline (centralized logging to a dedicated log archive account, mandatory guardrails, and a standard network configuration) with minimal manual effort. Which approach best meets these requirements?

Accepted Answer

Deploy AWS Control Tower on the existing organization and use Account Factory to provision new accounts from a standardized blueprint that applies guardrails and the logging baseline automatically.

Answer

Write a custom CloudFormation template and manually run it in each new member account after creating the account through the AWS Organizations console.

Answer

Attach a service control policy at the organization root that forces new accounts to enable CloudTrail and centralized logging when they are created.

Answer

Enable AWS Config conformance packs in every account and rely on auto-remediation to bring newly created accounts into compliance with the baseline.

Question 18

A financial services company uses AWS Control Tower to govern 40 member accounts across multiple OUs. The security team has a compliance requirement: developers must never be able to disable AWS CloudTrail logging in any account, and any account that has an S3 bucket without server-side encryption must be flagged for review (but not blocked). The team wants to implement both requirements using Control Tower guardrails with the least operational overhead. Which combination of guardrails should they apply?

Accepted Answer

Apply a preventive guardrail (SCP-based) to stop CloudTrail from being disabled, and a detective guardrail (AWS Config rule-based) to identify S3 buckets without encryption.

Answer

Apply a detective guardrail for both requirements, relying on AWS Config rules to detect and automatically remediate any violations.

Answer

Apply a preventive guardrail for both requirements, using SCPs to block CloudTrail disabling and to reject unencrypted S3 bucket creation.

Answer

Apply a proactive guardrail using CloudFormation hooks for CloudTrail and a detective guardrail for S3 encryption reporting.

Question 19

A financial services company uses AWS Control Tower to manage a multi-account landing zone across 40 accounts. During a routine audit, the security team discovers that an administrator in a workload account manually modified a CloudTrail trail that Control Tower had configured, disabling log file validation. The security team wants a supported, automated way to detect that the account has diverged from the Control Tower baseline and to bring it back into compliance. Which approach should they use?

Accepted Answer

Detect the change as drift in the Control Tower console or via the landing zone status, then re-register the OU or use the account update/repair action to re-apply the baseline configuration.

Answer

Create a custom AWS Config rule in every account that recreates the CloudTrail trail whenever validation is disabled, bypassing Control Tower entirely.

Answer

Attach an SCP to the workload OU that denies cloudtrail:UpdateTrail, which will automatically restore the deleted validation setting.

Answer

Delete and recreate the entire Control Tower landing zone so that all governed accounts receive a fresh baseline configuration.

Question 20

A financial services company manages 120 accounts through AWS Control Tower with all accounts in a well-structured OU hierarchy. The security team wants to guarantee that no member account can ever disable AWS CloudTrail logging, and they need this protection to be impossible to bypass — even by a user who has full administrative IAM permissions in a member account. Which approach meets this requirement with the least ongoing operational effort?

Accepted Answer

Ensure the Control Tower mandatory preventive guardrail that denies CloudTrail configuration changes is applied, which Control Tower implements as a service control policy on the OUs.

Answer

Enable a detective guardrail in Control Tower backed by an AWS Config rule that flags any account where CloudTrail is disabled, then configure an EventBridge rule to re-enable it automatically.

Answer

Deploy an AWS Config conformance pack across the organization that includes the cloudtrail-enabled managed rule with an SSM automatic remediation action.

Answer

Create a permission boundary attached to all IAM roles in member accounts that denies the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions.

Question 21

A financial services company runs AWS Control Tower with a multi-account landing zone. The central security team wants to run advanced, custom Security Hub and GuardDuty administration across all member accounts, but the company's compliance policy forbids using the Organizations management account for any day-to-day operational security work. The team needs to grant a dedicated Audit account the ability to centrally manage these security services organization-wide. What is the recommended approach to meet this requirement while following AWS best practices?

Accepted Answer

Register the Audit account as a delegated administrator for Security Hub and GuardDuty from the Organizations management account, then perform all central security operations from the Audit account.

Answer

Create an IAM role in the management account with full administrative permissions and have the security team assume it whenever they need to manage security services.

Answer

Attach an SCP to the Audit account's OU that grants Security Hub and GuardDuty administrative permissions to the security team.

Answer

Move all security service administration into the Control Tower Audit account by enabling AWS Config aggregation only, since delegated administration is not supported with Control Tower.

Question 22

A security engineer at a company with 40 AWS accounts under AWS Organizations wants to reduce the time analysts spend correlating logs during investigations. Analysts currently pull VPC Flow Logs, CloudTrail events, and GuardDuty findings manually from each account to understand the scope of suspicious activity. The engineer needs a service that automatically ingests these data sources across all member accounts and presents an interactive visualization showing relationships between entities such as IAM roles, IP addresses, and EC2 instances over time. Which approach meets this requirement with the least ongoing operational effort?

Accepted Answer

Enable Amazon Detective from the delegated administrator account so it automatically ingests CloudTrail, VPC Flow Logs, and GuardDuty findings across the organization into a behavior graph.

Answer

Build an Amazon Athena workgroup that queries a centralized S3 bucket of CloudTrail and VPC Flow Logs, and visualize the results in Amazon QuickSight dashboards.

Answer

Configure AWS Security Hub as the delegated administrator and use its findings aggregation to correlate log data across accounts automatically.

Answer

Deploy an Amazon OpenSearch Service cluster and stream logs from each account with Kinesis Data Firehose, then use OpenSearch Dashboards to graph entity relationships.

Question 23

A security analyst receives a GuardDuty finding indicating that an EC2 instance in the production account is communicating with a known cryptocurrency-mining IP address. Before deciding whether to isolate the instance, the analyst needs to understand whether this behavior is new, which IAM entities and API calls were involved, and how the affected resource's activity has changed over the past several weeks. Which AWS service is purpose-built to help the analyst perform this root-cause investigation with the least setup effort?

Accepted Answer

Amazon Detective, using its entity behavior graphs and interactive visualizations built from GuardDuty findings, VPC Flow Logs, and CloudTrail data

Answer

AWS Security Hub, by reviewing the aggregated finding severity scores and compliance standard checks

Answer

Amazon Inspector, by running a network reachability and software vulnerability assessment on the EC2 instance

Answer

Amazon Athena, by manually writing SQL queries against CloudTrail logs stored in an S3 bucket

Question 24

A security analyst uses Amazon Detective in a delegated administrator account to investigate a GuardDuty finding indicating that an EC2 instance made connections to a known cryptocurrency mining domain. The analyst needs to quickly understand whether the same behavior appeared across other resources, identify the earliest occurrence of the activity, and gather evidence to support an incident report — without manually correlating data from CloudTrail and VPC Flow Logs. Which Detective capability best supports this need?

Accepted Answer

Use Detective's finding group and investigation report features, which automatically cluster related findings and summarize impacted entities, involved IAM roles, and a timeline of activity

Answer

Enable Detective malware scanning on the affected EBS volume to confirm the mining binary before generating the report

Answer

Export the GuardDuty finding to Security Hub and rely on its automation rules to generate a consolidated incident timeline

Answer

Query Detective's behavior graph directly with Amazon Athena to join CloudTrail and VPC Flow Log tables and build a custom timeline

Question 25

A financial services company stores sensitive transaction records in an Amazon DynamoDB table. Compliance requires that the company be able to prove exactly when the encryption key was used, control key rotation on its own schedule, and be able to immediately deny all access to the data by disabling the key without deleting the table. The team currently uses the default AWS owned key for the table. Which change should the security engineer make to meet all of these requirements?

Accepted Answer

Update the table to use a customer managed KMS key so that key usage is logged in CloudTrail and the key can be rotated and disabled on demand.

Answer

Recreate the table using an AWS managed key (aws/dynamodb) and enable automatic annual key rotation.

Answer

Recreate the table using a customer managed KMS key, and rely on DynamoDB's client-side encryption library for auditing.

Answer

Keep the AWS owned key and enable AWS CloudTrail data events on the DynamoDB table to capture key usage.