Official Bank
0/179
Page
1/4
Amazon AWS Certified Security – Specialty (SCS-C03) - AWS Exam Questions
Last updated on June 20, 2026
97%
Exam Compliance
179
Total Questions
1
Question
A company has a web-based application that runs behind an Application Load Balancer (ALB). The application is experiencing a credential stuffing attack that is producing many failed login attempts. The attack is coming from many IP addresses. The login attempts are using a user agent string of a known mobile device emulator. A security engineer needs to implement a solution to mitigate the credential stuffing attack. The solution must still allow legitimate logins to the application.
Which solution will meet these requirements?
Which solution will meet these requirements?
Options
A
Modify the inbound security group on the ALB to deny traffic from the IP addresses that are involved in the attack.
B
Create an AWS WAF web ACL for the ALB. Create a custom rule that allows requests from legitimate user agent strings.
C
Create an Amazon CloudWatch alarm that reacts to login attempts that contain the specified user agent string. Add an Amazon Simple Notification Service (Amazon SNS) topic to the alarm.
D
Create an AWS WAF web ACL for the ALB. Create a custom rule that blocks requests that contain the user agent string of the device emulator.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
2
Question
A company has decided to move its fleet of Linux-based web server instances to an Amazon EC2 Auto Scaling group. Currently, the instances are static and are launched manually. When an administrator needs to view log files, the administrator uses SSH to establish a connection to the instances and retrieves the logs manually. The company often needs to query the logs to produce results about application sessions and user issues. The company does not want its new automatically scaling architecture to result in the loss of any log files when instances are scaled in.
Which combination of steps should a security engineer take to meet these requirements MOST cost- effectively? (Select TWO.)
Which combination of steps should a security engineer take to meet these requirements MOST cost- effectively? (Select TWO.)
Select 2
Options
A
Configure the instances to write the logs to an Amazon Elastic File System (Amazon EFS) volume.
B
Configure AWS Glue and Amazon Athena to query the log files.
C
Configure Amazon CloudWatch Logs Insights to query the log files.
D
Configure a cron job on the instances to forward the log files to Amazon S3 periodically.
E
Configure the Amazon CloudWatch agent on the instances to forward the logs to Amazon CloudWatch Logs.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
3
Question
A company's security engineer receives an abuse notification from AWS. The notification indicates that someone is hosting malware from the company's AWS account. After investigation, the security engineer finds a new Amazon S3 bucket that an IAM user created without authorization.
Which combination of steps should the security engineer take toMINIMIZE the consequencesof this compromise? (Select THREE.)
Which combination of steps should the security engineer take toMINIMIZE the consequencesof this compromise? (Select THREE.)
Select 3
Options
A
Change the password for all IAM users.
B
Delete any resources that are unrecognized or unauthorized.
C
Turn on Amazon GuardDuty.
D
Encrypt all AWS CloudTrail logs.
E
Rotate or delete all AWS access keys.
F
Take snapshots of all Amazon Elastic Block Store (Amazon EBS) volumes.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
4
Question
A company is investigating an increase in its AWS monthly bill. The company discovers that bad actors compromised some Amazon EC2 instances and served webpages for a large email phishing campaign. A security engineer must implement a solution to monitor for cost increases in the future to help detect malicious activity.
Which solution will offer the company the EARLIEST detection of cost increases?
Which solution will offer the company the EARLIEST detection of cost increases?
Options
A
Create a cost monitor in AWS Cost Anomaly Detection. Configure an individual alert to notify an Amazon Simple Notification Service (Amazon SNS) topic when the percentage above the expected cost exceeds a threshold.
B
Capture VPC flow logs from the VPC where the EC2 instances run. Use a third-party network analysis tool to analyze the flow logs and to detect anomalies in network traffic that might increase cost.
C
Create an Amazon EventBridge rule that invokes an AWS Lambda function hourly. Program the Lambda function to download an AWS usage report from AWS Data Exports about usage of all services. Program the Lambda function to analyze the report and to send a notification when anomalies are detected.
D
Review AWS Cost Explorer daily to detect anomalies in cost from prior months. Review the usage of any services that experience a significant cost increase from prior months.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
5
Question
A consultant agency needs to perform a security audit for a company's production AWS account. Several consultants need access to the account. The consultant agency already has its own AWS account. The company requires multi-factor authentication (MFA) for all access to its production account. The company also forbids the use of long-term credentials.
Which solution will provide the consultant agency with access that meets these requirements?
Which solution will provide the consultant agency with access that meets these requirements?
Options
A
Configure Amazon Cognito on the company’s production account to authenticate against the consultant agency's identity provider (IdP). Add MFA to a Cognito user pool.
B
Create an IAM group. Create an IAM user for each consultant. Add each user to the group. Turn on MFA for each consultant.
C
Create an IAM role in the company’s production account. Define a trust policy that requires MFA.
In the trust policy, specify the consultant agency's AWS account as the principal. Attach the trust policy to the role.
In the trust policy, specify the consultant agency's AWS account as the principal. Attach the trust policy to the role.
D
Create an IAM role in the consultant agency's AWS account. Define a trust policy that requires MFA. In the trust policy, specify the company's production account as the principal. Attach the trust policy to the role.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
Finish Practice?
Are you sure you want to finish? This will end your practice session.