Free Amazon SCS-C03 Practice Test Questions

Question 1

A company uses an organization in AWS Organizations to manage multiple AWS accounts. A securityengineer creates a WAF policy in AWS Firewall Manager in the us-east-1 Region. The securityengineer sets the policy scope to apply to resources that are tagged withWAF-protected:truein oneof the member accounts in the organization. The security engineer sets up a configuration toautomatically remediate any noncompliant resources.In a member account, the security engineer attempts to protect an Amazon API Gateway REST API inthe us-east-1 Region by using a web ACL. However, after several minutes, the REST API is still notassociated with the web ACL.What is the likely cause of this issue?

A : Web ACLs cannot be applied to REST APIs.

B : The REST API is missing a tag that includes theWAF-protectedkey and a value oftrue.

C : The web ACL is already associated with another REST API.

D : The web ACL is already associated with an Amazon CloudFront distribution.

Answer: B

Question 2

A company is using AWS to run a long-running analysis process on data that is stored in Amazon S3 buckets. The process runs on a fleet of Amazon EC2 instances in an Auto Scaling group. The EC2 instances are deployed in a private subnet that does not have internet access. The EC2 instances access Amazon S3 through an S3 gateway endpoint that has the default access policy. Each EC2 instance uses an instance profile role that allows s3:GetObject and s3:PutObject only for required S3 buckets. The company learns that one or more EC2 instances are compromised and are exfiltrating data to an S3 bucket that isoutside the company’s AWS Organization. The processing job must continue to function. Which solution will meet these requirements?

A : Update the policy on the S3 gateway endpoint to allow S3 actions only if aws:ResourceOrgId and aws: PrincipalOrgId match the company’s organization.

B : Update the instance profile role policy to require aws:ResourceOrgId.

C : Add a network ACL rule to block outbound traffic on port 443.

D : Apply an SCP that restricts S3 actions using organization condition keys.

Answer: A

Question 3

A company is using AWS to run a long-running analysis process on data that is stored in Amazon S3 buckets. The process runs on a fleet of Amazon EC2 instances in an Auto Scaling group. The EC2 instances are deployed in a private subnet that does not have internet access. The EC2 instances access Amazon S3 through an S3 gateway endpoint that has the default access policy. Each EC2 instance uses an instance profile role that allows s3:GetObject and s3:PutObject only for required S3 buckets. The company learns that one or more EC2 instances are compromised and are exfiltrating data to an S3 bucket that isoutside the company’s AWS Organization. The processing job must continue to function. Which solution will meet these requirements?

A : Update the policy on the S3 gateway endpoint to allow S3 actions only if aws:ResourceOrgId and aws: PrincipalOrgId match the company’s organization.

B : Update the instance profile role policy to require aws:ResourceOrgId.

C : Add a network ACL rule to block outbound traffic on port 443.

D : Apply an SCP that restricts S3 actions using organization condition keys.

Answer: A

Question 4

A company is running a new workload across accounts in an organization in AWS Organizations. All running resources must have a tag of CostCenter, and the tag must have one of three approved values. The company must enforce this policy and must prevent any changes of the CostCenter tag to a non-approved value. Which solution will meet these requirements?

A : Use AWS Config custom policy rule and an SCP to deny non-approved aws:RequestTag/CostCenter values.

B : Use CloudTrail + EventBridge + Lambda to block creation.

C : Enable tag policies, define allowed values, enforce noncompliant operations, and use an SCP to deny creation when aws:RequestTag/CostCenter is null.

D : Enable tag policies and use EventBridge + Lambda to block changes.

Answer: C

Question 5

A company has several Amazon S3 buckets that do not enforce encryption in transit. A security engineer must implement a solution that enforces encryption in transit for all the company's existing and future S3 buckets. Which solution will meet these requirements?

A : Enable AWS Config. Create a proactive AWS Config Custom Policy rule. Create a Guard clause to evaluate the S3 bucket policies to check for a value of True for the aws:SecureTransport condition key. If the AWS Config rule evaluates to NON_COMPLIANT, block resource creation.

B : Enable AWS Config. Configure the s3-bucket-ssl-requests-only AWS Config managed rule and set the rule trigger type to Hybrid. Create an AWS Systems Manager Automation runbook that applies a bucket policy to deny requests when the value of the aws:SecureTransport condition key is False. Configure automatic remediation. Set the runbook as the target of the rule.

C : Enable Amazon Inspector. Create a custom AWS Lambda rule. Create a Lambda function that applies a bucket policy to deny requests when the value of the aws:SecureTransport condition key is False. Set the Lambda function as the target of the rule.

D : Create an AWS CloudTrail trail. Enable S3 data events on the trail. Create an AWS Lambda function that applies a bucket policy to deny requests when the value of the aws:SecureTransport condition key is False. Configure the CloudTrail trail to invoke the Lambda function.

Answer: B

Free Amazon SCS-C03 Exam Practice Questions 2026