[Q116-Q135] Free SCS-C03 Exam Files Downloaded Instantly UPDATED [2026]

4.5/5 - (2 votes)

Free SCS-C03 Exam Files Downloaded Instantly UPDATED [2026]

100% Pass Guaranteed Free SCS-C03 Exam Dumps

QUESTION 116
A company is developing a new serverless application that uses AWS Lambda functions. The company uses AWS CloudFormation to deploy the Lambda functions.
The company’s developers are trying to debug a Lambda function that is deployed. The developers cannot debug the Lambda function because the Lambda function is not logging its output to Amazon CloudWatch Logs.
Which combination of steps should a security engineer take to resolve this issue? (Choose two.)

Check the role that is defined in the CloudFormation template and is passed to the Lambda function. Ensure that the role has a trust policy that allows the sts:AssumeRole action by the service principal lambda amazonaws.com.

Check the execution role that is configured in the CloudFormation template for the Lambda function. Ensure that the execution role has the necessary permissions to write to CloudWatch Logs.

Check the Lambda function configuration in the CloudFormation template. Ensure that the Lambda function has an AWS X-Ray tracing configuration that is set to Active mode or PassThrough mode.

Check the resource policy that is configured in the CloudFormation template for the Lambda function. Ensure that the resource policy has the necessary permissions to write to CloudWatch Logs.

Check the role that the developers use to debug the Lambda function. Ensure that the role has a trust policy that allows the sts:AssumeRole action by the service principal lambda.amazonaws.com.

QUESTION 117
A company uses an organization in AWS Organizations to manage multiple AWS accounts.
Users access AWS accounts by using IAM users and secret access keys. A security team requires all access to accounts to use temporary security credentials that expire after 60 minutes.
Users must use a SAML-based identity provider (IdP) to access the accounts.
Which solution will meet these requirements?

Enable access to the AWS Security Token Service (AWS STS). Ensure that users run the get- session-token AWS CLI command with an appropriate duration. Require users to use STS temporary credentials to access AWS accounts.

Set up AWS IAM Identity Center and configure an external IdP. Configure permission sets that allow the access that the users require. Configure a session duration limit. Require the users to retrieve SSO credentials by using the AWS CLI. Remove the IAM users from the AWS accounts.

Set up AWS Secrets Manager and Amazon Cognito in each AWS account. Configure a Cognito identity pool to use an external IdP and connect to Secrets Manager. Enable managed secret rotation in Secrets Manager. Ensure that the users run the get-secret-value AWS CLI command to access the AWS accounts.

Enable AWS IAM Roles Anywhere in the organization management account. Ensure that users install the credential helper tool. Configure IAM roles within the management account with an appropriate session duration. Ensure that the users retrieve temporary credentials from the credential helper tool to access the AWS accounts.

QUESTION 118
A company runs an application on an Amazon EC2 instance. The application generates invoices and stores them in an Amazon S3 bucket. The instance profile that is attached to the instance has appropriate access to the S3 bucket. The company needs to share each invoice with multiple clients that do not have AWS credentials. Each client must be able to download only the client’s own invoices. Clients must download their invoices within 1 hour of invoice creation. Clients must use only temporary credentials to access the company’s AWS resources. Which additional step will meet these requirements?

Update the S3 bucket policy to ensure that clients that use pre-signed URLs have the S3:Get* permission and the S3:List* permission to access S3 objects in the bucket.

Add a StringEquals condition to the IAM role policy for the EC2 instance profile. Configure the policy condition to restrict access based on the s3:ResourceTag/ClientId tag of each invoice. Tag each generated invoice with the ID of its corresponding client.

Update the script to use AWS Security Token Service (AWS STS) to obtain new credentials each time the script runs by assuming a new role that has S3:GetObject permissions. Use the credentials to generate the pre-signed URLs.

Generate an access key and a secret key for an IAM user that has S3:GetObject permissions on the S3 bucket. Embed the keys into the script. Use the keys to generate the pre-signed URLs.

QUESTION 119
A company is using an organization in AWS Organizations that contains 100 accounts. The company has configured trusted access for Amazon GuardDuty to AWS Organizations within the management account. The company has designated a member account to be the GuardDuty administrator for the organization.
GuardDuty is working properly and reports findings for the organization in the GuardDuty console.
The company wants a SecOps team to receive real-time email alerts from any GuardDuty finding within the organization that is high severity according to GuardDuty severity levels.
Which solution will meet these requirements?

In the management account, create a rule in Amazon EventBridge that will react to a GuardDuty finding that has a high severity level. Configure the rule to notify an Amazon SNS topic. Subscribe the SecOps team’s email addresses to the SNS topic.

Configure trusted access for AWS Config within the organization. Create a rule in AWS Config to monitor for any non-archived findings in GuardDuty. Create a rule in Amazon EventBridge that will react if AWS Config detects a compliance change for the AWS Config rule. Configure the EventBridge rule to target an Amazon SNS topic. Subscribe the SecOps team’s email addresses to the SNS topic.

In the GuardDuty delegated administrator account, configure a rule in Amazon EventBridge that will react to a GuardDuty finding that has a high severity level. Configure the rule to notify an Amazon SNS topic. Subscribe the SecOps team’s email addresses to the SNS topic.

Configure AWS CloudTrail for the organization in the management account. Create a rule in Amazon EventBridge that will run on a ListFindings API call. Configure the rule to notify an Amazon SNS topic. Subscribe the SecOps team’s email addresses to the SNS topic.

QUESTION 120
A company is running a new workload across accounts in an organization in AWS Organizations.
All running resources must have a tag of CostCenter, and the tag must have one of three approved values. The company must enforce this policy and must prevent any changes of the CostCenter tag to a non-approved value. Which solution will meet these requirements?

Use AWS Config custom policy rule and an SCP to deny non-approved
aws:RequestTag/CostCenter values.

Use CloudTrail + EventBridge + Lambda to block creation.

Enable tag policies, define allowed values, enforce noncompliant operations, and use an SCP to deny creation when aws:RequestTag/CostCenter is null.

Enable tag policies and use EventBridge + Lambda to block changes.

QUESTION 121
A company stores infrastructure and application code in web-based, third-party, Git-compatible code repositories outside of AWS. The company wants to give the code repositories the ability to securely authenticate and assume an existing IAM role within the company’s AWS account by using OpenID Connect (OIDC). Which solution will meet these requirements?

Create an OIDC identity provider (IdP) by using AWS Identity and Access Management (IAM) federation. Modify the trust policy of the IAM role to allow the code repositories to assume the IAM role.

Use AWS Identity and Access Management (IAM) Roles Anywhere to create a trust anchor that uses OIDC. Modify the trust policy of the IAM role to allow the code repositories to assume the IAM role.

Set up an account instance of AWS IAM Identity Center. Configure access to the code repositories as a customer managed OIDC application. Grant the application access to the IAM role.

Use AWS Resource Access Manager (AWS RAM) to create a new resource share that uses OIDC. Limit the resource share to the specified code repositories. Grant the IAM role access to the resource share.

QUESTION 122
Notify when IAM roles are modified.

Use Amazon Detective.

Use EventBridge with CloudTrail events.

Use CloudWatch metric filters.

Use CloudWatch subscription filters.

QUESTION 123
A security engineer needs to implement a solution to identify any sensitive data that is stored in an Amazon S3 bucket. The solution must report on sensitive data in the S3 bucket by using an existing Amazon Simple Notification Service (Amazon SNS) topic. Which solution will meet these requirements with the LEAST implementation effort?

Enable AWS Config. Configure AWS Config to monitor for sensitive data in the S3 bucket and to send notifications to the SNS topic.

Create an AWS Lambda function to scan the S3 bucket for sensitive data that matches a pattern.
Program the Lambda function to send notifications to the SNS topic.

Configure Amazon Macie to use managed data identifiers to identify and categorize sensitive data. Create an Amazon EventBridge rule to send notifications to the SNS topic.

Enable Amazon GuardDuty. Configure AWS CloudTrail S3 data events. Create an Amazon CloudWatch alarm that reacts to GuardDuty findings and sends notifications to the SNS topic.

QUESTION 124
A company uses AWS to run a web application that manages ticket sales in several countries.
The company recently migrated the application to an architecture that includes Amazon API Gateway, AWS Lambda, and Amazon Aurora Serverless. The company needs the application to comply with Payment Card Industry Data Security Standard (PCI DSS) v4.0. A security engineer must generate a report that shows the effectiveness of the PCI DSS v4.0 controls that apply to the application. The company’s compliance team must be able to add manual evidence to the report. Which solution will meet these requirements?

Enable AWS Trusted Advisor. Configure all the Trusted Advisor checks. Manually map the checks against the PCI DSS v4.0 standard to generate the report.

Enable and configure AWS Config. Deploy the Operational Best Practices for PCI DSS conformance pack in AWS Config. Use AWS Config to generate the report.

Enable AWS Security Hub. Enable the Security Hub PCI DSS security standard. Use the AWS Management Console to download the report from the security standard.

Create an AWS Audit Manager assessment that uses the AWS managed PCI DSS v4.0 standard framework. Add all evidence to the assessment. Generate the report in Audit Manager for download.

QUESTION 125
A company uses several AWS CloudFormation stacks to handle the deployment of a suite of applications. The leader of the company’s application development team notices that the stack deployments fail with permission errors when some team members try to deploy the stacks.
However, other team members can deploy the stacks successfully.
The team members access the account by assuming a role that has a specific set of permissions.
All team members have permissions to perform operations on the stacks.
Which combination of steps will ensure consistent deployment of the stacks MOST securely?
(Select THREE.)

Create a service role that has a composite principal that contains each service that needs the necessary permissions.

Create a service role that has cloudformation.amazonaws.com as the service principal.

Add policies that reference each CloudFormation stack ARN.

Add policies that reference the ARNs of each AWS service that requires permissions.

Update each stack to use the service role.

Add a policy to each member role to allow the iam:PassRole action for the service role.

QUESTION 126
A company’s application team needs a new AWS Key Management Service (AWS KMS) customer managed key to use with Amazon S3. The company’s security policy requires separate keys for different AWS services to limit security exposure. How can a security engineer limit the KMS customer managed key to work with only Amazon S3?

Configure the key policy to allow only Amazon S3 to perform the kms:Encrypt action.

Configure the key policy to allow KMS actions only when the value for the kms:ViaService condition key matches the Amazon S3 service name.

Configure the application’s IAM role policy to allow Amazon S3 to perform the iam:PassRole action.

Configure the application’s IAM role policy to allow only S3 operations when the operations are combined with the KMS customer managed key.

QUESTION 127
A security engineer must investigate an Amazon GuardDuty finding. The finding indicates potential cryptocurrency mining activity on an Amazon EC2 instance. The security engineer must validate the finding and assess the impact.
Which data sources should the security engineer analyze to meet these requirements?

Check the instance’s CPU utilization metrics in Amazon CloudWatch. Examine the finding’s MITRE ATT & CK tactic classification. Review any associated IAM role permissions.

Count the number of GuardDuty findings associated with the instance. Verify the instance’s launch time. Check AWS Security Hub CSPM for any related alerts.

Review the instance’s process details that relate to the finding. Examine DNS queries to known mining domains. Analyze the instance’s outbound network connections by using VPC Flow Logs.

Examine the instance’s AWS Systems Manager session history. Verify Amazon Route 53 DNS records.Review GuardDuty severity levels.

QUESTION 128
A company needs centralized log monitoring with automatic detection across hundreds of AWS accounts.
Which solution meets these requirements with the LEAST operational effort?

Designate a GuardDuty administrator account and enable protections.

Centralize CloudWatch logs and use Inspector.

Centralize CloudTrail logs and query with Athena.

Stream logs to Kinesis and process with Lambda.

QUESTION 129
A company’s security team wants to receive near-real-time email notifications about AWS abuse reports related to DoS attacks. An Amazon SNS topic already exists and is subscribed to by the security team. What should the security engineer do next?

Poll Trusted Advisor for abuse notifications by using a Lambda function.

Create an Amazon EventBridge rule that matches AWS Health events for AWS_ABUSE_DOS_REPORT and publishes to SNS.

Poll the AWS Support API for abuse cases by using a Lambda function.

Detect abuse reports by using CloudTrail logs and CloudWatch alarms.

QUESTION 130
A company has a PHP-based web application that uses Amazon S3 as an object store for user files. The S3 bucket is configured for server-side encryption with Amazon S3 managed keys (SSE-S3). New requirements mandate full control of encryption keys.
Which combination of steps must a security engineer take to meet these requirements? (Select THREE.)

Create a new customer managed key in AWS Key Management Service (AWS KMS).

Change the SSE-S3 configuration on the S3 bucket to server-side encryption with customer-provided keys (SSE-C).

Configure the PHP SDK to use the SSE-S3 key before upload.

Create an AWS managed key for Amazon S3 in AWS KMS.

Change the SSE-S3 configuration on the S3 bucket to server-side encryption with AWS KMS managed keys (SSE-KMS).

Change all the S3 objects in the bucket to use the new encryption key.

QUESTION 131
A company’s data scientists want to create artificial intelligence and machine learning (AI/ML) training models by using Amazon SageMaker. The training models will use large datasets in an Amazon S3 bucket.
The datasets contain sensitive information.
On average, the data scientists need 30 days to train models. The S3 bucket has been secured appropriately.
The company’s data retention policy states that all data that is older than 45 days must be removed from the S3 bucket.
Which action should a security engineer take to enforce this data retention policy?

Configure an S3 Lifecycle rule on the S3 bucket to delete objects after 45 days.

Create an AWS Lambda function to check the last-modified date of the S3 objects and delete objects that are older than 45 days. Create an S3 event notification to invoke the Lambda function for each PutObject operation.

Create an AWS Lambda function to check the last-modified date of the S3 objects and delete objects that are older than 45 days. Create an Amazon EventBridge rule to invoke the Lambda function each month.

Configure S3 Intelligent-Tiering on the S3 bucket to automatically transition objects to another storage class.

QUESTION 132
A company runs a web application on a fleet of Amazon EC2 instances that are in an Auto Scaling group. The EC2 instances are in the same VPC subnet as other workloads.
A security engineer deploys an Amazon GuardDuty detector in the same AWS Region as the EC2 instances and integrates GuardDuty with AWS Security Hub.
The security engineer needs to implement an automated solution to detect and appropriately respond to anomalous traffic patterns for the web application. The solution must comply with AWS best practices for initial response to security incidents and must minimize disruption to the web application.
Which solution will meet these requirements?

Disable the EC2 instance profile credentials by using AWS Lambda.

Create an Amazon EventBridge rule that invokes an AWS Lambda function when GuardDuty detects anomalous traffic. Configure the function to remove the affected instance from the Auto Scaling group and attach a restricted security group.

Update the subnet network ACL to block traffic from the detected source IP addresses.

Send GuardDuty findings to Amazon SNS for email notification.

QUESTION 133
A company uses an incident response team to troubleshoot incidents. The incident response team must use temporary credentials from AWS STS for cross-account IAM role access when troubleshooting. Occasionally, each team member will need to respond to multiple different types of incidents simultaneously. Based on the type of incident, the company wants to dynamically assign minimal permissions to whichever team member responds.
Which solution will meet these requirements?

Attach a policy to the cross-account role that grants the appropriate permissions for all types of incidents. Reduce the scope of those permissions by using a session policy.

Attach a policy to the cross-account role that grants the appropriate permissions for all types of incidents. Reduce the scope of those permissions by using a permissions boundary.

Do not assign any permissions to the cross-account role initially. Assign a session policy to the role being assumed with the required permission for that type of incident.

Use an AWS Lambda function for each incident. Configure the function to create a temporary cross- account role that uses the AWS managed policy AWSSecurityIncidentResponseServiceRolePolicy.Reduce the scope of those permissions by using a permissions boundary.

QUESTION 134
A company needs the ability to identify the root cause of security findings in an AWS account. The company has enabled VPC Flow Logs, Amazon GuardDuty, and AWS CloudTrail. The company must investigate any IAM roles that are involved in the security findings and must visualize the findings.
Which solution will meet these requirements?

Use Amazon Detective to run investigations on the IAM roles and to visualize the findings.

Use Amazon Inspector to run investigations on the IAM roles and visualize the findings.

Export GuardDuty findings to Amazon S3 and analyze them with Amazon Athena.

Enable AWS Security Hub and use custom actions to investigate IAM roles.

QUESTION 135
A recent security audit identified that a company’s application team injects database credentials into the environment variables of an AWS Fargate task. The company’s security policy mandates that all sensitive data be encrypted at rest and in transit.
Which combination of actions should the security team take to make the application compliant with the security policy? (Select THREE.)

Store the credentials securely in a file in an Amazon S3 bucket with restricted access to the application team IAM role. Ask the application team to read the credentials from the S3 object instead.

Create an AWS Secrets Manager secret and specify the key-value pairs to be stored in this secret.

Modify the application to pull credentials from the AWS Secrets Manager secret instead of the environment variables.

Add a policy statement to the container instance IAM role that allows ssm:GetParameters, secretsmanager:GetSecretValue, and kms:Decrypt for the required secret and KMS key.

Add a policy statement to the task role or task execution role that allows ssm:GetParameters, secretsmanager:GetSecretValue, and kms:Decrypt for the required secret and KMS key.

Log in to the AWS Fargate instance, create a script to read the secret value from AWS Secrets Manager, and inject the environment variables. Ask the application team to redeploy the application.

Amazon SCS-C03 Exam Syllabus Topics:

Topic	Details
Topic 1	Data Protection: This domain centers on protecting data at rest and in transit through encryption, key management, data classification, secure storage, and backup mechanisms.
Topic 2	Identity and Access Management: This domain deals with controlling authentication and authorization through user identity management, role-based access, federation, and implementing least privilege principles.
Topic 3	Infrastructure Security: This domain focuses on securing AWS infrastructure including networks, compute resources, and edge services through secure architectures, protection mechanisms, and hardened configurations.
Topic 4	Security Foundations and Governance: This domain addresses foundational security practices including policies, compliance frameworks, risk management, security automation, and audit procedures for AWS environments.

Latest SCS-C03 dumps – Instant Download PDF: https://www.testsimulate.com/SCS-C03-study-materials.html

Amazon SCS-C03 Exam Syllabus Topics:

Leave a Reply Cancel reply