SCS-C03 practice questions with answers

null Troubleshoot security monitoring, logging, and alerting solutions

A company uses the unified CloudWatch agent on Amazon EC2 instances to collect operating system security logs. After a least-privilege IAM policy update, agent metrics continue to arrive, but newly launched instances do not deliver logs to the existing /security/linux log group. The agent reports AccessDeniedException for logs:CreateLogStream. The agent uses the instance profile role. The role's only statement granting logs:CreateLogStream and logs:PutLogEvents allows both actions with this Resource value: arn:aws:logs:us-east-1:111122223333:log-group:/security/linux The configured log group and Region are correct. Network connectivity and local file permissions have been verified, and no other policies restrict these actions. Which change will restore log delivery while maintaining least privilege?

null Respond to security events

An incident response team stores original system and application log archives in a versioned Amazon S3 evidence bucket. Each object version has a 90-day S3 Object Lock compliance-mode retention period. Lifecycle rules expire current objects and permanently delete eligible noncurrent versions after the approved retention period. Legal counsel identifies specific object version IDs that must be preserved for litigation. Their retention periods expire tomorrow, but the litigation has no known end date. Unrelated evidence must continue through normal disposal. After counsel authorizes release, the selected versions must become eligible for normal disposal without an additional fixed retention period. Automated cleanup roles can delete object versions but cannot change Object Lock retention settings or legal holds. Which action meets these requirements?

null Design, implement, and troubleshoot security controls for compute workloads

A manufacturer uses an Amazon SageMaker AI real-time endpoint to summarize confidential engineering documents. The model must receive the complete documents to produce useful summaries. The endpoint has data capture enabled for requests and responses, and the application also writes request and response bodies to diagnostic logs. A security review finds confidential document text in both telemetry destinations. Company policy permits processing this text during inference but prohibits storing it in inference-monitoring data or diagnostic logs. Operations engineers must retain request correlation IDs, latency measurements, response status codes, and token counts. They do not require document text or generated summaries. Which change meets these requirements?

null Design, implement, and troubleshoot authorization strategies

A company uses one shared IAM role for application operators. Each operator session has trusted Project and Environment principal tags that operators cannot change. EC2 instances have corresponding resource tags maintained by a provisioning service. Some legacy instances are missing one or both tags. Operators must be able to reboot an instance only when BOTH instance tag values match the corresponding principal tag values. Instances missing either tag must remain inaccessible. Operators cannot modify instance tags, assume other roles, or change IAM policies. The role currently has no EC2 permissions, and no other policies grant or restrict the requested access. A security engineer will scope all new statements to EC2 instance ARNs in the approved account and Region. Which policy configuration meets these requirements?

null Design and implement controls for data at rest

A company stores sensitive daily exports in an S3 bucket and uses S3 Cross-Region Replication to copy them to a disaster recovery bucket. Both buckets have versioning enabled. Each export uses a unique key and is never overwritten. All replication operations complete successfully before the exports reach their retention limits. Neither bucket uses Object Lock. The approved retention schedule makes current objects eligible for expiration 365 days after creation and their noncurrent versions eligible for permanent deletion 1 day after becoming noncurrent. The source bucket already has S3 Lifecycle rules implementing this schedule and cleaning up expired object delete markers. The destination bucket has no Lifecycle rules, and an audit finds that old replicas remain there after their source versions have been permanently deleted. Which change will apply the approved automatic disposal schedule to both existing and future replicas with the least operational overhead?

null Develop a strategy to centrally deploy and manage AWS accounts

A company uses an AWS Control Tower landing zone to govern its AWS accounts. The security team has developed a CloudFormation template that deploys a company-specific AWS Config rule and its supporting resources without modifying Control Tower-managed resources. Platform operators must be able to select this approved security customization and its version when creating workload accounts through the Control Tower console. The customization must be deployed as part of the account provisioning workflow. The company does not want to modify the Control Tower-managed Account Factory product or maintain a separate post-provisioning automation pipeline. Which solution meets these requirements?