Official Bank
0/179
Page
1/4
Amazon AWS Certified Security – Specialty (SCS-C03) - AWS Exam Questions
Last updated on June 20, 2026
97%
Exam Compliance
179
Total Questions
1
Question
A company uses AWS Organizations to manage an organization that consists of three workload OUs: Production, Development, and Testing. The company uses AWS CloudFormation templates to define and deploy workload infrastructure in AWS accounts that are associated with the OUs. Different SCPs are attached to each workload OU. The company successfully deployed a CloudFormation stack update to workloads in the Development OU and the Testing OU. When the company uses the same CloudFormation template to deploy the stack update in an account in the Production OU, the update fails. The error message reports insufficient IAM permissions.
What is the FIRST step that a security engineer should take to troubleshoot this issue?
What is the FIRST step that a security engineer should take to troubleshoot this issue?
Options
A
Remove all the SCPs that are attached to the Production OU. Rerun the CloudFormation stack
update to determine if the SCPs were preventing the CloudFormation API calls.
update to determine if the SCPs were preventing the CloudFormation API calls.
B
Make all the SCPs that are attached to the Production OU the same as the SCPs that are attached to the Testing OU.
C
Review the AWS CloudTrail logs in the account in the Production OU. Search for any failed API calls
from CloudFormation during the deployment attempt.
from CloudFormation during the deployment attempt.
D
Confirm that the role used by CloudFormation has sufficient permissions to create, update, and
delete the resources that are referenced in the CloudFormation template.
delete the resources that are referenced in the CloudFormation template.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
2
Question
A company stores infrastructure and application code in web-based, third-party, Git-compatible code repositories outside of AWS. The company wants to give the code repositories the ability to securely authenticate and assume an existing IAM role within the company's AWS account by using OpenID Connect (OIDC).
Which solution will meet these requirements?
Which solution will meet these requirements?
Options
A
Use AWS Resource Access Manager (AWS RAM) to create a new resource share that uses OIDC.
Limit the resource share to the specified code repositories. Grant the IAM role access to the resource share.
Limit the resource share to the specified code repositories. Grant the IAM role access to the resource share.
B
Create an OIDC identity provider (IdP) by using AWS Identity and Access Management (IAM) federation. Modify the trust policy of the IAM role to allow the code repositories to assume the IAM role.
C
Use AWS Identity and Access Management (IAM) Roles Anywhere to create a trust anchor that uses OIDC. Modify the trust policy of the IAM role to allow the code repositories to assume the IAM role.
D
Set up an account instance of AWS IAM Identity Center. Configure access to the code repositories as a customer managed OIDC application. Grant the application access to the IAM role.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
3
Question
A company has a single AWS account and uses an Amazon EC2 instance to test application code. The company recently discovered that the instance was compromised and was serving malware. Analysis showed that the instance was compromised 35 days ago. A security engineer must implement a continuous monitoring solution that automatically notifies the security team by email for high severity findings as soon as possible.
Which combination of steps should the security engineer take to meet these requirements? (Select THREE.)
Which combination of steps should the security engineer take to meet these requirements? (Select THREE.)
Select 3
Options
A
Enable AWS Security Hub in the AWS account.
B
Create an Amazon EventBridge rule for Security Hub findings of high severity. Configure the rule to publish a message to the queue.
C
Create an Amazon Simple Queue Service (Amazon SQS) queue. Subscribe the security team's email distribution list to the queue.
D
Create an Amazon EventBridge rule for GuardDuty findings of high severity. Configure the rule to publish a message to the topic.
E
Enable Amazon GuardDuty in the AWS account.
F
Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the security team's email distribution list to the topic.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
4
Question
A company has security requirements for Amazon Aurora MySQL databases regarding encryption, deletion protection, public access, and audit logging. The company needs continuous monitoring and real-time visibility into compliance status.
Which solution will meet these requirements?
Which solution will meet these requirements?
Options
A
Use EventBridge and Lambda with custom metrics.
B
Use AWS Audit Manager with a custom framework.
C
Enable AWS Config and use managed rules to monitor Aurora MySQL compliance.
D
Use AWS Security Hub configuration policies.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
5
Question
A company has decided to move its fleet of Linux-based web server instances to an Amazon EC2 Auto Scaling group. Currently, the instances are static and are launched manually. When an administrator needs to view log files, the administrator uses SSH to establish a connection to the instances and retrieves the logs manually. The company often needs to query the logs to produce results about application sessions and user issues. The company does not want its new automatically scaling architecture to result in the loss of any log files when instances are scaled in.
Which combination of steps should a security engineer take to meet these requirements MOST cost- effectively? (Select TWO.)
Which combination of steps should a security engineer take to meet these requirements MOST cost- effectively? (Select TWO.)
Select 2
Options
A
Configure the instances to write the logs to an Amazon Elastic File System (Amazon EFS) volume.
B
Configure AWS Glue and Amazon Athena to query the log files.
C
Configure Amazon CloudWatch Logs Insights to query the log files.
D
Configure a cron job on the instances to forward the log files to Amazon S3 periodically.
E
Configure the Amazon CloudWatch agent on the instances to forward the logs to Amazon CloudWatch Logs.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
Finish Practice?
Are you sure you want to finish? This will end your practice session.