Official Bank
0/179
Page
1/4
Amazon AWS Certified Security – Specialty (SCS-C03) - AWS Exam Questions
Last updated on June 20, 2026
97%
Exam Compliance
179
Total Questions
1
Question
A company has decided to move its fleet of Linux-based web server instances to an Amazon EC2 Auto Scaling group. Currently, the instances are static and are launched manually. When an administrator needs to view log files, the administrator uses SSH to establish a connection to the instances and retrieves the logs manually. The company often needs to query the logs to produce results about application sessions and user issues. The company does not want its new automatically scaling architecture to result in the loss of any log files when instances are scaled in.
Which combination of steps should a security engineer take to meet these requirements MOST cost- effectively? (Select TWO.)
Which combination of steps should a security engineer take to meet these requirements MOST cost- effectively? (Select TWO.)
Select 2
Options
A
Configure the instances to write the logs to an Amazon Elastic File System (Amazon EFS) volume.
B
Configure AWS Glue and Amazon Athena to query the log files.
C
Configure Amazon CloudWatch Logs Insights to query the log files.
D
Configure a cron job on the instances to forward the log files to Amazon S3 periodically.
E
Configure the Amazon CloudWatch agent on the instances to forward the logs to Amazon CloudWatch Logs.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
2
Question
A company uses an organization in AWS Organizations to manage multiple AWS accounts. The company wants to centrally give users the ability to access Amazon Q Developer.
Which solution will meet this requirement?
Which solution will meet this requirement?
Options
A
Enable Amazon Cognito and create a new identity pool for Amazon Q Developer.
B
Enable AWS IAM Identity Center and set up Amazon Q Developer as an AWS managed application.
C
Enable AWS IAM Identity Center and create a new identity pool for Amazon Q Developer.
D
Enable Amazon Cognito and set up Amazon Q Developer as an AWS managed application.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
3
Question
A company runs several applications on Amazon Elastic Kubernetes Service (Amazon EKS). The company needs a solution to detect any Kubernetes security risks by monitoring Amazon EKS audit logs in addition to operating system, networking, and file events. The solution must send email alerts
for any identified risks to a mailing list that is associated with a security team.
Which solution will meet these requirements?
for any identified risks to a mailing list that is associated with a security team.
Which solution will meet these requirements?
Options
A
Install the AWS Systems Manager Agent (SSM Agent) on all EKS nodes. Configure Amazon CloudWatch Logs to collect EKS audit logs. Create an Amazon Simple Notification Service (Amazon SNS) topic and set the security team's mailing list as a subscriber. Configure a CloudWatch alarm to publish a message to the SNS topic when new audit logs are generated.
B
Enable Amazon Inspector container image scanning. Configure Amazon Detective to analyze EKS security logs. Create Amazon CloudWatch log groups for EKS audit logs. Use an AWS Lambda function to process the logs and to send email alerts to the security team.
C
Deploy AWS Security Hub and enable security standards that contain EKS controls. Create an Amazon Simple Notification Service (Amazon SNS) topic and set the security team’s mailing list as a subscriber. Use an Amazon EventBridge rule to send relevant Security Hub events to the SNS topic.
D
Enable Amazon GuardDuty. Enable EKS Protection and Runtime Monitoring for Amazon EKS in GuardDuty. Create an Amazon Simple Notification Service (Amazon SNS) topic and set the security team's mailing list as a subscriber. Use an Amazon EventBridge rule to send relevant GuardDuty events to the SNS topic.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
4
Question
A company has a web-based application that runs behind an Application Load Balancer (ALB). The application is experiencing a credential stuffing attack that is producing many failed login attempts. The attack is coming from many IP addresses. The login attempts are using a user agent string of a known mobile device emulator. A security engineer needs to implement a solution to mitigate the credential stuffing attack. The solution must still allow legitimate logins to the application.
Which solution will meet these requirements?
Which solution will meet these requirements?
Options
A
Modify the inbound security group on the ALB to deny traffic from the IP addresses that are involved in the attack.
B
Create an AWS WAF web ACL for the ALB. Create a custom rule that allows requests from legitimate user agent strings.
C
Create an Amazon CloudWatch alarm that reacts to login attempts that contain the specified user agent string. Add an Amazon Simple Notification Service (Amazon SNS) topic to the alarm.
D
Create an AWS WAF web ACL for the ALB. Create a custom rule that blocks requests that contain the user agent string of the device emulator.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
5
Question
A company runs an application on an Amazon EC2 instance. The application generates invoices and stores them in an Amazon S3 bucket. The instance profile that is attached to the instance has appropriate access to the S3 bucket. The company needs to share each invoice with multiple clients that do not have AWS credentials. Each client must be able to download only the client's own invoices. Clients must download their invoices within 1 hour of invoice creation. Clients must use only temporary credentials to access the company's AWS resources.
Which additional step will meet these requirements?
Which additional step will meet these requirements?
Options
A
Generate an access key and a secret key for an IAM user that has S3:GetObject permissions on the S3 bucket. Embed the keys into the script. Use the keys to generate the pre-signed URLs.
B
Add a StringEquals condition to the IAM role policy for the EC2 instance profile. Configure the policy condition to restrict access based on the s3:ResourceTag/ClientId tag of each invoice. Tag each generated invoice with the ID of its corresponding client.
C
Update the S3 bucket policy to ensure that clients that use pre-signed URLs have the S3:Get*
permission and the S3:List* permission to access S3 objects in the bucket.
permission and the S3:List* permission to access S3 objects in the bucket.
D
Update the script to use AWS Security Token Service (AWS STS) to obtain new credentials each
time the script runs by assuming a new role that has S3:GetObject permissions. Use the credentials to generate the pre-signed URLs.
time the script runs by assuming a new role that has S3:GetObject permissions. Use the credentials to generate the pre-signed URLs.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
Finish Practice?
Are you sure you want to finish? This will end your practice session.