Amazon AWS Certified Security - Specialty 2026 (SCS-C03)
Get full access to the updated question bank and confidently prepare for your exam.
Vendor
Amazon
Certification
Specialty Certifications
Content
235 Qs
Status
Verified
Updated
1 day ago
Test the Practice Engine
Experience our interactive testing environment with free demo questions
Premium Bundle
Complete Success Suite
Save $44 Instantly
-
✓Full PDF + Interactive Engine Everything you need to pass
-
✓All Advanced Question Types Drag & Drop, Hotspots, Case Studies
-
✓Priority 24/7 Expert Support Direct line to certification leads
-
✓90 Days Free Priority Updates Stay current as exams change
Success Metric
98.4% Pass Rate
Standard Simulation
Practice Engine
One-Time Payment
-
Web-Based (Zero Install)
-
Real Testing Environment Virtual & Practice Modes
-
Interactive Engine Drag & Drop, Hotspots
-
60 Days Free Updates
Compatible with All Devices
Basic Tier
PDF Study Guide
Digital Access
- ✓ Exam Questions (PDF)
- ✓ Mobile Friendly
- ✓ 60 Days Updates
Verified 47-Question Preview (SCS-C03)
Verified Community
The CertoMetrics Standard.
Recommend the #1 platform for verified Amazon certification resources.
Success Network
Help a Colleague Succeed.
Invite a peer to get their own updated SCS-C03 prep kit.
Exam Overview
The AWS Certified Security - Specialty certification validates a candidate's advanced technical skills and experience in securing the AWS platform. Achieving the SCS-C03 demonstrates expertise in designing and implementing robust security solutions, effectively managing security incidents, and adhering to compliance requirements within the AWS cloud. This credential is vital for professionals aiming to solidify their role as a trusted security expert, enabling organizations to protect critical data and applications from evolving threats. It signifies a deep understanding of AWS security services, best practices, and the shared responsibility model, opening doors to high-demand roles and elevating one's career trajectory in the rapidly expanding cloud security domain. This certification positions you as a leader in cloud security.
Questions
65
Passing Score
750/1000
Duration
170 Minutes
Difficulty
Expert
Level
Specialist
Skills Measured
Career Path
Target Roles
Common Questions
Is the material up to date?
Yes. We update our question bank weekly to match the latest Amazon standards. You get free updates for 90 days.
What format do I get?
You get instant access to both the **PDF** (for reading) and our **Premium Test Engine** (for exam simulation).
Is there a guarantee?
Absolutely. If you fail the SCS-C03 exam using our materials, we offer a full money-back guarantee.
When do I get the download?
Instantly. The download link is available in your dashboard immediately after payment is confirmed.
Free Study Guide Samples
Previewing updated SCS-C03 bank (47 Questions).
A company is developing a new serverless application that uses AWS Lambda functions. The company uses AWS CloudFormation to deploy the Lambda functions.
The company's developers are trying to debug a Lambda function that is deployed. The developers cannot debug the Lambda function because the Lambda function is
not logging its output to Amazon CloudWatch Logs.
Which combination of steps should a security engineer take to resolve this issue? (Select TWO.)
Correct Option: A,B
A Lambda function requires an IAM execution role to interact with other AWS services, including Amazon CloudWatch Logs. For the Lambda function to successfully log its output, two key components of this execution role must be correctly configured:
Option A (Correct): The execution role must have a trust policy that allows the lambda.amazonaws.com service principal to assume the role. Without this, the Lambda service cannot assume the role, and thus the function cannot utilize any of the permissions defined within it, including logging permissions.
Option B (Correct): The execution role itself must be granted the necessary permissions to write to CloudWatch Logs. This typically includes actions like logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents. If these permissions are missing, the function will fail to write logs even if it successfully assumes the role.
Why the other choices are incorrect:
- Option C is incorrect: AWS X-Ray is used for tracing requests and debugging application performance, not for enabling basic function output logging to CloudWatch Logs.
- Option D is incorrect: A resource policy attached to a Lambda function is used to grant other AWS services or accounts permission to invoke the Lambda function, not for the Lambda function itself to write to CloudWatch Logs. The function uses its execution role for outbound access to other services.
- Option E is incorrect: This option refers to the IAM role used by the developers for debugging, not the Lambda function's execution role. The developers' permissions do not dictate the Lambda function's ability to write logs during its execution.
Reference: https://docs.aws.amazon.com/lambda/latest/dg/lambda-intro-execution-role.html
A company has an organization with all features enabled in AWS Organizations. The company recently started separating workloads into member accounts that are
managed by the organization's management account. The company has set up an external identity provider (IdP) that supports SAML and OpenID Connect (OIDC).
The company needs to use the IdP as a central IdP for AWS authentication. The company must grant access to the member accounts throughout the organization.
Which solution will meet these requirements?
Correct Option: C
AWS IAM Identity Center (formerly AWS SSO) is specifically designed to provide centralized access management across multiple AWS accounts within an organization. It integrates seamlessly with external identity providers (IdPs) that support SAML for authentication. The solution allows for SCIM provisioning to automatically synchronize users and groups from the external IdP to IAM Identity Center. Permission sets define the specific AWS permissions, and these sets can be assigned to users and groups, granting them federated access to designated member accounts throughout the AWS Organization. This directly fulfills the requirement for a central IdP for AWS authentication and managing access to member accounts.
Reference: https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html
A company uses AWS Organizations to manage the company's AWS accounts. The company's security team needs to implement preventive controls to deny the use of
account-level root credentials. The solution must minimize the risk that an AWS account root user could be compromised. The solution must also minimize the effort needed
to manage root access.
Which solution will meet these requirements?
Correct Option: D
Option D provides the most effective and scalable solution for managing root user access across an organization. Configuring an AWS Organizations Service Control Policy (SCP) to explicitly deny most actions when the principal is the root user of a member account is a powerful preventive control. This minimizes the operational use of root credentials, thereby significantly reducing the attack surface and risk of compromise. While a few critical tasks (like account closure or support plan changes) might require root, an SCP can be crafted to allow only these. Additionally, requiring Multi-Factor Authentication (MFA) for root users adds a crucial layer of security, protecting against unauthorized console access. Requiring credential rotation, especially for any root access keys that might exist (though generally discouraged), further enhances security. This centralized approach through Organizations minimizes management effort compared to individual account configurations.
Reference: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scp.html
A company has two web applications that run on Amazon EC2 and Amazon S3. The applications failed an HTTP security audit, and users are reporting latency issues.
The applications need to deliver web content at low latencies while improving security and privacy for users and content providers. The company must implement a solution
that does not require changes to the application code,
Which combination of actions should the company take to meet these requirements? (Select TWO.)
Correct Option: C,D
The company needs to address two main issues: low latency for web content delivery and improved security/privacy, specifically HTTP security audit failures. The solution must not require application code changes.
- Option D: Configure Amazon CloudFront. Create a distribution for the EC2 and S3 origins. CloudFront is a Content Delivery Network (CDN) service that caches content at edge locations globally, significantly reducing latency for users accessing web applications. It also enhances security by providing HTTPS termination at the edge, DDoS protection, and integration with AWS WAF, all without requiring changes to the origin applications on EC2 or S3. This directly addresses the latency and general security requirements.
- Option C: Write a Lambda@Edge function to add HTTP security headers on origin responses. Lambda@Edge functions run in conjunction with CloudFront and allow customization of content delivered via CloudFront. A Lambda@Edge function can be triggered at various points in the CloudFront request/response cycle to inspect and modify HTTP headers. By writing a function to add HTTP security headers (e.g., Strict-Transport-Security, X-Frame-Options, Content-Security-Policy) to origin responses, the company can resolve the HTTP security audit failures and improve security without altering the application code on EC2 or S3.
Together, CloudFront provides low-latency content delivery and foundational security, while Lambda@Edge addresses the specific requirement for HTTP security headers without touching the application code.
Reference: https://docs.aws.amazon.com/cloudfront/latest/dg/cloudfront-what-is-cloudfront.html, https://docs.aws.amazon.com/lambda/latest/dg/lambda-edge.html
A company runs an application on a fleet of Amazon EC2 instances. The company can remove instances from the fleet without risk to the application. All EC2 instances use
the same security group named ProdFleet. Amazon GuardDuty and AWS Config are active in the company's AWS account.
A security engineer needs to provide a solution that will prevent an EC2 instance from sending outbound traffic if GuardDuty generates a cryptocurrency finding event. The
security engineer creates a new security group named Isolate that contains no outbound rules. The security engineer configures an AWS Lambda function to remove an
EC2 instance from the ProdFleet security group and add it to the Isolate security group.
Which additional step will meet this requirement?
Correct Option: C
GuardDuty publishes its findings as events to Amazon EventBridge. An EventBridge rule can be configured with an event pattern to specifically detect 'CryptoCurrency:EC2/*' findings from GuardDuty. This rule can then invoke the pre-configured AWS Lambda function as a target. The Lambda function will perform the necessary security group modification, effectively isolating the compromised EC2 instance by moving it to the 'Isolate' security group with no outbound rules. This is the standard and recommended architecture for automating responses to GuardDuty findings.
Reference: https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_integration_eventbridge.html
A company wants to grant a technology partner access to Amazon EC2 instances in an Amazon VPC. The instances run Amazon Linux. The instances are accessible only
by using AWS Systems Manager Session Manager The technology partner does not use AWS.
A security engineer needs to design a solution to provide the technology partner with credentials. The technology partner must be able to access the EC2 instances
without introducing any new security risks.
Which solution will meet these requirements?
Correct Option: B
AWS Systems Manager Session Manager allows secure access to EC2 instances without opening inbound ports or managing SSH keys. When a technology partner does not use AWS, a robust solution is required to grant temporary, secure access. IAM Roles Anywhere is designed for this exact scenario, allowing external identities (e.g., a partner with their own Public Key Infrastructure) to use X.509 certificates to assume an IAM role and obtain temporary AWS credentials (AWS STS tokens). This method is significantly more secure than sharing long-lived IAM user access keys, as it leverages existing certificate infrastructure, provides temporary credentials, and avoids exposing the instances directly over the internet.
Reference: https://docs.aws.amazon.com/rolesanywhere/latest/userguide/introduction.html
An audit reveals that a company has multiple applications that are susceptible to SQL injection attacks. The company wants a formal penetration testing program as soon as
possible to identify future risks in applications that are deployed on AWS.
The company's legal department is concerned that such testing might create AWS abuse notifications and violate the AWS Acceptable Use policy, The company must
ensure compliance in these areas.
Which testing procedures are allowed on AWS as part of a penetration testing strategy? (Select TWO.)
Correct Option: A,C
The company wants to perform penetration testing on its applications deployed on AWS while ensuring compliance with the AWS Acceptable Use Policy and avoiding abuse notifications. This means the testing must target the company's own resources and not impact AWS infrastructure or other customers.
✅ Option A: Port scanning inside the company's VPC is allowed. AWS permits customers to perform security assessments, including port scanning, against their own Amazon EC2 instances within their VPC without prior approval. This targets the customer's owned resources.
✅ Option C: Use of a SQL injection tool on the company's web application against an Amazon RDS for PostgreSQL DB instance is allowed. SQL injection is an application-layer vulnerability test. As long as the web application and the RDS instance belong to the company, this is a permitted test against their own application and database resources.
❌ Why the other choices are incorrect:
- Option B is incorrect: Brute force testing of the Amazon S3 bucket namespace is generally prohibited. Attempting to enumerate or discover other customers' S3 buckets violates the AWS Acceptable Use Policy as it constitutes unauthorized probing of AWS services beyond the customer's owned resources.
- Option D is incorrect: Packet flooding (a type of Denial of Service - DoS attack) on the company's web application is not allowed without prior explicit approval from AWS. Such activities can impact shared infrastructure and are generally prohibited under the AWS Penetration Testing Policy.
- Option E is incorrect: DNS zone walking through Amazon Route 53 hosted zones, especially if it implies enumerating or probing hosted zones not owned by the company, is generally not permitted. Testing efforts must be limited to the customer's own AWS resources, and broad enumeration of shared services can violate policy.
Reference: https://aws.amazon.com/security/penetration-testing/
A security engineer needs to centralize logging from VPC Flow Logs and AWS CloudTrail. The security engineer also needs to query the log data after an incident occurs.
Which solution will meet these requirements?
Correct Option: D
✅ Option D (Correct)
Reasoning: This solution effectively addresses both requirements. Both VPC Flow Logs and AWS CloudTrail can be configured to deliver their log data to an Amazon S3 bucket, which provides centralized, durable, and cost-effective storage. Amazon Athena is a serverless interactive query service that allows security engineers to query data directly in S3 using standard SQL. This combination is ideal for analyzing large volumes of log data after an incident, offering flexibility and powerful querying capabilities without managing any infrastructure.
❌ Why the other choices are incorrect:
- Option A is incorrect: While VPC Flow Logs and CloudTrail can send logs to Amazon CloudWatch Logs for centralization, CloudWatch metric filters are used to extract numerical metrics from logs, not to perform ad-hoc queries of the raw log data for incident investigation. CloudWatch Logs Insights would be the appropriate tool for querying within CloudWatch Logs.
- Option B is incorrect: Similar to option A, sending logs to CloudWatch Logs is viable for centralization. However, CloudWatch subscription filters are designed to stream log data to other services (e.g., Lambda, Kinesis) for real-time processing or analysis, not for querying historical log data directly within CloudWatch Logs for incident response.
- Option C is incorrect: Neither VPC Flow Logs nor CloudTrail natively supports sending logs directly to Amazon DynamoDB. DynamoDB is a NoSQL database optimized for specific use cases (key-value, document data) and is not typically used as a centralized log aggregation and querying platform for the volume and nature of security logs like Flow Logs and CloudTrail. This approach would be complex, inefficient, and unsupported by direct integrations.
Reference: https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html; https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-s3-log-files.html; https://docs.aws.amazon.com/athena/latest/ug/what-is-athena.html
A company wants to use a suite of AWS Lambda functions to automatically remediate noncompliant resources. The company packages the suite of Lambda functions into
an AWS CloudFormation template. The company wants to deploy the suite of Lambda functions to all AWS Organizations accounts. However, the company cannot use the
Organizations management account for deployment.
Which solution provides centralized deployment of the Lambda function suite to all accounts in the organization?
Correct Option: A
✅ Option A is correct: AWS CloudFormation StackSets are designed for deploying CloudFormation stacks to multiple AWS accounts and regions from a single administrator account. When integrated with AWS Organizations, StackSets can deploy to all accounts within specific Organizational Units (OUs) or the entire organization. The ability to register a delegated administrator for CloudFormation allows a member account to manage StackSets across the organization, satisfying the requirement that the Organizations management account cannot be used for deployment. This provides a centralized mechanism to deploy the Lambda function suite to all target accounts.
❌ Option B is incorrect: While creating cross-account IAM roles is necessary for programmatic access, it does not provide a centralized deployment mechanism like StackSets. This approach would still require iterating through each account to assume the role and deploy the template, which is not a single, centralized operation.
❌ Option C is incorrect: AWS Service Catalog allows administrators to create and manage catalogs of IT services that are approved for use on AWS. While products can be shared across accounts, provisioning them still typically involves users or automated processes initiating the provision in each target account. It doesn't offer the centralized 'deploy to all accounts' functionality of StackSets for a single administrative operation.
❌ Option D is incorrect: Setting up AWS CodePipeline in each account would lead to a decentralized and complex deployment architecture. The requirement is for 'centralized deployment,' which CodePipeline in each account does not provide. It would significantly increase management overhead.
Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-delegated-admin.html
A security engineer needs to automate the management of data that is stored in several Amazon S3 buckets. The data is rarely used after 90 days- When the data is
accessed, the data must be available within a few hours. The data must be deleted after 2 years.
Which solution will meet these requirements?
Correct Option: C
The security engineer needs to manage S3 data lifecycle with specific requirements:
- Data rarely used after 90 days, implying a transition to a lower-cost storage class.
- Data must be available within a few hours when accessed.
- Data must be deleted after 2 years.
Let's evaluate the options:
- A and B are incorrect: Amazon Data Lifecycle Manager (DLM) is used for managing the lifecycle of Amazon EBS snapshots and AMIs, not Amazon S3 objects. S3 Lifecycle configurations are the correct mechanism for S3.
- D is incorrect: While S3 Lifecycle configurations are the correct service, transitioning objects to S3 Glacier Deep Archive is not suitable. S3 Glacier Deep Archive has retrieval times ranging from 12 to 48 hours, which does not meet the requirement for data to be available "within a few hours."
- C is correct:
- Creating an S3 Lifecycle configuration for each S3 bucket is the correct approach for managing object lifecycles in S3.
- Adding a rule to transition objects to S3 Glacier Flexible Retrieval after 90 days meets the requirement for rarely used data. S3 Glacier Flexible Retrieval (formerly S3 Glacier) offers retrieval options that include Expedited (1-5 minutes), Standard (3-5 hours), and Bulk (5-12 hours). The Standard retrieval option fits perfectly within the "within a few hours" requirement.
- Adding another rule to expire objects after 2 years ensures the data is deleted as required.
Reference: https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lifecycle-mgmt.html
A company wants to monitor the deletion of AWS KMS customer managed keys. A security engineer needs to create an alarm that will notify the company before a KMS key
is deleted. The security engineer has configured the integration of AWS CloudTrail with Amazon CloudWatch.
What should the security engineer do next to meet these requirements?
Premium Solution Locked
Unlock all 235 answers & explanations
A company is using AWS Organizations. A member account in the organization has an AWS KMS customer managed key that is used to encrypt data in an application that
runs on an Amazon EC2 instance.
The KMS customer managed key and the EC2 instance exist in the same account and the same AWS Region. When the company created the key, the company configured
the key with the default key policy and configured automatic rotation. The application receives access to use the key through an EC2 instance profile that is attached to the
EC2 instance.
The company discovers that the EC2 instance can no longer access the key. A security engineer verifies that the EC2 instance profile has the proper IAM policy attached to
use and access the key.
Which reasons explain why the EC2 instance cannot access the key? (Select TWO.)
Premium Solution Locked
Unlock all 235 answers & explanations
A company has an IAM group. All of the IAM users in the group have been assigned a multi-factor authentication (MFA) device and have full access to Amazon S3.
The company needs to ensure that users in the group can perform S3 actions only after the users authenticate with MFA. A security engineer must design a solution that
accomplishes this goal with the least maintenance overhead,
Which combination of actions will meet these requirements? (Select TWO.)
Premium Solution Locked
Unlock all 235 answers & explanations
A security engineer must investigate an Amazon GuardDuty finding. The finding indicates potential cryptocurrency mining activity on an Amazon EC2 instance. The security
engineer must validate the finding and assess the impact.
Which data sources should the security engineer analyze to meet these requirements?
Premium Solution Locked
Unlock all 235 answers & explanations
A company is using AWS Organizations to manage multiple accounts. The company needs to allow an IAM user to use a role to access resources that are in another
organization's AWS account.
Which combination of steps must the company perform to meet this requirement? (Select TWO.)
Premium Solution Locked
Unlock all 235 answers & explanations
A software development company runs an internal web application. The application experiences an Amazon S3 signed URL issue. A security engineer must troubleshoot the issue. The URL should allow an internal end user to download an object. However, the end user says that the URL is not working.
What is the reason for this issue?
Premium Solution Locked
Unlock all 235 answers & explanations
A company has a standalone AWS account that the company uses as a pilot environment. A security engineer needs to create a solution that allows developers to create
their own least privilege IAM roles and policies.
The solution must prevent the developers from increasing their permissions to creation of these new resources. The solution also must define a maximum set of permissions
that developers can give their IAM roles.
Which solution will meet these requirements?
Premium Solution Locked
Unlock all 235 answers & explanations
A large company wants to use Amazon Security Lake to improve its incident response capabilities. A security team must be able to search and correlate logs during security
incidents across hundreds of AWS accounts. The accounts are part of an organization in AWS Organizations.
Which solution will meet these requirements?
Premium Solution Locked
Unlock all 235 answers & explanations
A company needs to analyze access logs for an Application Load Balancer (ALB). The ALB directs traffic to the company's online login portal. The company needs to use
visualizations to identify login attempts by bots from a list of known IP sources.
Which solution will meet these requirements?
Premium Solution Locked
Unlock all 235 answers & explanations
A company manages multiple AWS accounts across an organization in AWS Organizations. The company controls user access by using IAM users and groups for the accounts in the organization. The company uses a single external identity provider (IdP) for workforce SSO.
The company needs a solution that provides a single management portal to access accounts within the organization. The solution must support the external IdP as a federation source.
Which solution will meet these requirements with the LEAST operational overhead?
Premium Solution Locked
Unlock all 235 answers & explanations
A security engineer for a company wants to maintain all IAM users and roles according to the principle of least privilege. The security engineer plans to audit the IAM permissions once every 365 days. The security engineer must view the permissions that each IAM identity used in the last 365 days and must remove any unused permissions.
Which solution will meet these requirements?
Premium Solution Locked
Unlock all 235 answers & explanations
A company uses AWS Lambda functions to implement application logic. The company uses an organization in AWS Organizations to manage hundreds of AWS accounts.
The company needs to implement a solution to continuously monitor the Lambda functions for vulnerabilities in all accounts. The solution must publish detected issues to a dashboard. Lambda functions that are being tested or are in development must not appear on the dashboard.
Which combination of steps will meet these requirements? (Select TWO.)
Premium Solution Locked
Unlock all 235 answers & explanations
A company that builds document management systems recently performed a security review of its application on AWS. The review showed that uploads of documents through signed URLs into Amazon S3 could occur in the application without encryption in transit. A security engineer must implement a solution that prevents uploads that are not encrypted in transit.
Which solution will meet this requirement?
Premium Solution Locked
Unlock all 235 answers & explanations
A company uses AWS Organizations. The company subscribes to AWS Shield Advanced. The company must share third-party firewall logs from all its accounts with the Shield Response Team. The company stores the logs in an Amazon S3 bucket that uses server-side encryption with S3 managed keys (SSE-S3).
Which combination of steps will meet these requirements? (Select TWO.)
Premium Solution Locked
Unlock all 235 answers & explanations
A company's application uses standard tier secure string parameters from AWS Systems Manager Parameter Store. The application is receiving error messages when the company tries to update a parameter. The parameter uses an AWS KMS customer managed key for encryption and decryption.
What are the reasons for the error messages? (Select TWO.)
Premium Solution Locked
Unlock all 235 answers & explanations
A company operates a web application that runs on Amazon EC2 instances. The application listens on port 80 and port 443. The company uses an Application Load Balancer (ALB) with AWS WAF to terminate SSL and to forward traffic to the application instances only on port 80.
The ALB is in public subnets that are associated with a network ACL that is named NACL1. The application instances are in dedicated private subnets that are associated with a network ACL that is named NACL2. An Amazon RDS for PostgreSQL DB instance that uses port 5432 is in a dedicated private subnet that is associated with a network ACL that is named NACL3. All the network ACLs currently allow all inbound and outbound traffic.
Which set of network ACL changes will increase the security of the application while ensuring functionality?
Premium Solution Locked
Unlock all 235 answers & explanations
A company wants to remove all SSH keys permanently from a specific subset of its Amazon Linux 2 Amazon EC2 instances that are using the same IAM instance profile. However, three individuals who have IAM user accounts will need to access these instances by using an SSH session to perform critical duties.
How can a security engineer provide the access to meet these requirements?
Premium Solution Locked
Unlock all 235 answers & explanations
A company is running a dynamic website by using an Application Load Balancer (ALB). A security engineer notices that bots from different IP addresses are using brute-force attacks to invoke a service endpoint frequently.
What is the FASTEST way to mitigate this problem?
Premium Solution Locked
Unlock all 235 answers & explanations
A company uses AWS Config rules to identify Amazon S3 buckets that are not compliant with the company’s data protection policy. The S3 buckets are hosted in several AWS Regions and several AWS accounts. The accounts are in an organization in AWS Organizations.
The company needs a solution to remediate the organization's existing noncompliant S3 buckets and any noncompliant S3 buckets that are created in the future.
Which solution will meet these requirements?
Premium Solution Locked
Unlock all 235 answers & explanations
A company is using AWS Organizations with nested OUs to manage AWS accounts. The company has a custom compliance monitoring service for the accounts. The monitoring service runs as an AWS Lambda function and is invoked by Amazon EventBridge Scheduler.
The company needs to deploy the monitoring service in all existing and future accounts in the organization. The company must avoid using the organization's management account when the management account is not required.
Which solution will meet these requirements?
Premium Solution Locked
Unlock all 235 answers & explanations
A company is using Amazon Made, AWS Firewall Manager. Amazon Inspector, and AWS Shield Advanced in its AWS account. The company wants to receive alerts if a DDoS attack occurs against the account.Which solution will meet this requirement?
Premium Solution Locked
Unlock all 235 answers & explanations
A company runs business-critical applications in the AWS Cloud. Regulations require the company to regularly conduct realistic disaster recovery tests in the AWS environment. The tests must show that the high availability configuration meets defined criteria. As tests are conducted in the live environment, the company needs a way to stop the tests if critical issues are found.
Which solution will meet these requirements?
Premium Solution Locked
Unlock all 235 answers & explanations
An ecommerce website was down for 1 hour following a DDoS attack. Users were unable to connect to the website during the attack period. The ecommerce company's security team is worried about future potential attacks and wants to prepare for such events. The company needs to minimize downtime in its response to similar attacks in the future.Which steps would help achieve this? (Choose two.)
Premium Solution Locked
Unlock all 235 answers & explanations
A company uses an Amazon RDS for MySQL database for production workloads. The company's security team needs to demonstrate that new and existing RDS snapshots are not public. If a snapshot is public, the security team needs to identify when the snapshot was made public and who made the change.
Which solution will meet these requirements?
Premium Solution Locked
Unlock all 235 answers & explanations
A company has two AWS accounts: Account A and Account B. Each account has a VPC. An application that runs in the VPC in Account A needs to write to an Amazon S3 bucket in Account B. The application in Account A already has permission to write to the S3 bucket in Account B. The application and the S3 bucket are in the same AWS Region. The company cannot send network traffic over the public internet. Which solution will meet these requirements?
Premium Solution Locked
Unlock all 235 answers & explanations
A company's security team needs to receive a notification whenever an AWS access key has not been rotated in 90 or more days. A security engineer must develop a solution that provides these notifications automatically.
Which solution will meet these requirements with the LEAST amount of effort?
Premium Solution Locked
Unlock all 235 answers & explanations
A company runs a global ecommerce website that is hosted on AWS. The company uses Amazon CloudFront to serve content to its user base. The company wants to block inbound traffic from a specific set of countries to comply with recent data regulation policies.
Which solution will meet these requirements MOST cost-effectively?
Premium Solution Locked
Unlock all 235 answers & explanations
A security engineer needs to build a solution to turn AWS CloudTrail back on in multiple AWS Regions in case it is ever turned off.What is the MOST efficient way to implement this solution?
Premium Solution Locked
Unlock all 235 answers & explanations
A company is using Amazon EC2 instances to host an application in a private subnet in a VPC. The application needs to use AWS KMS.
What is the MOST secure way for a security engineer to meet this requirement?
Premium Solution Locked
Unlock all 235 answers & explanations
A security engineer needs to control access to data that is encrypted with an AWS Key Management Service (AWS KMS) customer managed key. The security engineer also needs to use additional authenticated data (AAD) to prevent tampering with ciphertext.
Which solution will meet these requirements?
Premium Solution Locked
Unlock all 235 answers & explanations
A company maintains both on-premises legacy systems and resources in AWS. The AWS resources include an Amazon DynamoDB table and an Amazon S3 bucket. The on-premises legacy systems need to connect to DynamoDB and Amazon S3 on a regular basis.The company currently uses a bastion host in a public subnet in a VPC. The company connects to the bastion host by using an SSH private key that the company stores on-premises. The instance profile that is assigned to the bastion host has full access to Amazon S3 and DynamoDB.A security team issues a new internal policy that requires all bastion hosts to be removed. The policy requires all systems to authenticate by using certificate-based authentication.Which solution will meet these requirements?
Premium Solution Locked
Unlock all 235 answers & explanations
A company is using an organization in AWS Organizations that contains 100 accounts. The company has configured trusted access for Amazon GuardDuty to AWS Organizations within the management account. The company has designated a member account to be the GuardDuty administrator for the organization.
GuardDuty is working properly and reports findings for the organization in the GuardDuty console. The company wants a SecOps team to receive real-time email alerts from any GuardDuty finding within the organization that is high severity according to the GuardDuty severity levels.
Which solution will meet these requirements?
Premium Solution Locked
Unlock all 235 answers & explanations
A company runs container-based workloads outside of AWS. The company wants the workloads to obtain temporary security credentials to securely access the company’s AWS account The company currently uses AWS IAM Identity Centre to manage user access to the company's AWS resources.
Which solution will meet this requirement?
Premium Solution Locked
Unlock all 235 answers & explanations
A company is developing an incident response process to quarantine Amazon EC2 hosts that become infected by malware. The company uses an organization in AWS Organizations to manage multiple AWS accounts. The company configures AWS Security Hub in the organization to receive findings from multiple accounts that run across multiple AWS Regions. A security engineer develops an AWS Lambda function to remove all the rules from all security groups for any EC2 instance the company suspects might be infected by malware.Select and order the correct steps from the following list to deploy and use the Lambda function as a custom action in Security Hub. Select each step one time or not at all. (Select and order THREE.)• Create a custom action that uses the Lambda function in Security Hub.• Create and apply a filter set to the Amazon EventBridge rule in Security Hub.• Define a rule in Amazon EventBridge.• Select the custom action in Security Hub for EC2 host findings.• Select the custom action in Security Hub for security group findings.
Premium Solution Locked
Unlock all 235 answers & explanations
A company uses SAML federation to grant users access to AWS accounts. A company workload that is in an isolated AWS account runs on immutable infrastructure with no human access to Amazon EC2. The company requires a specialized user known as a break glass user to have access to the workload AWS account and instances in the case of SAML errors. A recent audit discovered that the company did not create the break glass user for the AWS account that contains the workload.
The company must create the break glass user. The company must log any activities of the break glass user and send the logs to a security team.
Which combination of solutions will meet these requirements? (Select TWO.)
Premium Solution Locked
Unlock all 235 answers & explanations
A consultant agency needs to perform a security audit for a company's production AWS account Several consultants need access to the account. The consultant agency already has its own AWS account
The company requires multi-factor authentication (MFA) for all access to its production account. The company also forbids the use of long-term credentials.
Which solution will provide the consultant agency with access that meets these requirements?
Premium Solution Locked
Unlock all 235 answers & explanations
A company with 50 AWS accounts managed through AWS Organizations needs to set up a centralized threat detection solution. The solution must identify suspicious and potentially malicious activity across all accounts in the organization.The company uses AWS Control Tower and wants to centralize security findings into an audit account. A security team must receive email alerts within 5 minutes of any new security findings.Which solution will meet these requirements?
Premium Solution Locked
Unlock all 235 answers & explanations
Full Question Bank Locked
You have reached the end of the free study guide preview. Upgrade now to unlock all 235 questions and the full simulation engine.
Certification Path
Related Certifications
Customer Reviews
Global Community Feedback
David M.
"The practice engine is incredible. It feels exactly like the real testing environment and helped me build so much confidence."
Sarah J.
"The PDF is very well organized and the explanations for the answers are actually helpful, not just random text."
Michael C.
"I was skeptical, but the content is high quality and definitely worth the price. I passed on my first try!"