Free AWS Certified Security - Specialty (SCS-C03) Sample Questions

Correct answer: B — Create an organization trail in the delegated administrator account, configure SSE-KMS encryption using a CMK, and enable log file validation.

• A. Creating a trail in the management account is possible, but AWS best practices recommend using a delegated administrator account for security tooling to limit management account access. Additionally, SSE-S3 does not provide the same level of control, auditability, or key policy granularity as SSE-KMS with a CMK.
• B. This is the correct approach. An organization trail created in a delegated administrator account (such as a security tooling account) centralizes management across the AWS Organization. Using SSE-KMS with a Customer Managed Key (CMK) allows for granular access control and rotation, while log file validation ensures that any unauthorized changes to the logs are detectable.
• C. Creating individual trails in every member account is administratively burdensome and difficult to scale. An organization trail is the standard, centralized mechanism for capturing activity across all accounts automatically, including new accounts as they are added.
• D. While this uses an organization trail and log file validation, AWS managed keys (aws/cloudtrail) do not offer the same level of control as a Customer Managed Key (CMK). For highly sensitive audit trails, CMKs are preferred to allow for custom key policies, separation of duties, and rotation management.

Correct answer: A — The policy is missing the kms:GenerateDataKey* permission for the cloudtrail.amazonaws.com service principal.

• A. Correct. When encrypting CloudTrail logs with a KMS key, the KMS key policy must explicitly grant the 'cloudtrail.amazonaws.com' service principal the 'kms:GenerateDataKey*' and 'kms:DescribeKey' permissions. This allows CloudTrail to generate a unique data key for every log file it encrypts before uploading it to the S3 bucket.
• B. Incorrect. While the IAM user creating the trail needs permissions to manage the trail and access the KMS key (typically 'kms:DescribeKey' and 'kms:CreateGrant'), they do not need the 'kms:Encrypt' permission. The encryption operation is performed by the CloudTrail service principal, not the IAM user.
• C. Incorrect. Although CloudTrail writes logs to Amazon S3, the encryption process for CloudTrail-managed KMS encryption is handled by the CloudTrail service itself before delivery. Therefore, the S3 service principal does not require permissions to the KMS key for this specific configuration.
• D. Incorrect. The 'kms:Decrypt' permission is required for principals that need to read or process the encrypted logs (such as a security analyst or an automated tool). It is not required by the CloudTrail service principal to perform the encryption/writing of log files.

Correct answer: B — The central S3 bucket policy does not grant s3:PutObject permissions to the log delivery service (delivery.logs.amazonaws.com).

• A. Incorrect. VPC Flow Logs can be delivered to an S3 bucket in a different AWS account. This is a common and supported architectural pattern for centralized logging.
• B. Correct. When Flow Logs deliver to an S3 bucket, the destination bucket's policy must explicitly allow the AWS log delivery service principal (delivery.logs.amazonaws.com) to write objects. If the bucket is in a different account, the policy must grant s3:PutObject and s3:GetBucketAcl permissions to this principal, or log delivery will fail even if the flow log status is active.
• C. Incorrect. VPC Flow Logs are delivered by the AWS service infrastructure directly to the S3 API. They do not rely on the VPC's internal network configuration, routing tables, or VPC endpoints to reach the S3 destination.
• D. Incorrect. When delivering logs to S3, VPC Flow Logs utilize the Log Delivery service principal rather than an IAM role attached to the resource. IAM roles are primarily used when delivering VPC Flow Logs to CloudWatch Logs, but S3 delivery relies on bucket policies.

Correct answers: A, C, D — The objects are encrypted with an AWS KMS customer managed key, and the Macie service-linked role lacks `kms:Decrypt` permissions.; The objects are in an unsupported file format, such as a proprietary binary format.; The objects exceed the maximum supported file size for Macie data extraction.

• A. Correct. If S3 objects are encrypted using a customer managed AWS KMS key (CMK), the Amazon Macie service-linked role must have explicit `kms:Decrypt` permissions in the key policy. Without these permissions, Macie cannot decrypt the object content for inspection, leading to those objects being skipped.
• B. Incorrect. Amazon Macie supports scanning objects in most S3 storage classes, including S3 Standard, S3 Standard-IA, S3 One Zone-IA, and S3 Intelligent-Tiering. The storage class itself is not a reason for objects to be skipped.
• C. Correct. Macie is designed to analyze specific, supported file types (such as .csv, .json, .pdf, and .docx) that it can effectively parse for sensitive data discovery. If an object is in an unsupported or proprietary binary format, Macie will skip the content analysis for that file.
• D. Correct. Amazon Macie has specific quotas and limits regarding the size of objects it can extract and inspect (e.g., generally a maximum of 1,024 MB for most formats). If an object exceeds these size limits, it will be skipped during the scanning process.
• E. Incorrect. S3 bucket versioning status (Enabled, Suspended, or Disabled) does not prevent Macie from performing sensitive data discovery on the current versions of objects in the bucket.
• F. Incorrect. Amazon Macie is a managed AWS service that uses internal service-to-service integrations to access S3 buckets. It does not require an interface VPC endpoint or any specific network path from a VPC to perform its scanning functions.

Correct answer: B — Convert the firewall logs into the Open Cybersecurity Schema Framework (OCSF) format, create a custom source in Amazon Security Lake, and write the logs to the designated S3 bucket.

• A. Incorrect. AWS Security Hub is a security findings aggregation service, not a log ingestion engine for raw third-party firewall logs. It does not automatically format or forward raw logs to Amazon Security Lake.
• B. Correct. To ingest logs from third-party or custom sources into Amazon Security Lake, the data must be normalized into the Open Cybersecurity Schema Framework (OCSF) format. The process involves creating a custom source in Security Lake and then writing the formatted logs to the designated S3 bucket location provided by the service.
• C. Incorrect. Amazon Security Lake does not support direct ingestion of native syslog format logs via Kinesis Data Streams. Custom logs must be converted to OCSF and follow the custom source workflow using Amazon S3.
• D. Incorrect. While CloudWatch Logs can receive logs via subscription filters, this is not the standard ingestion mechanism for custom sources in Amazon Security Lake. Security Lake requires data to be in OCSF format and stored in specific S3 locations.

Correct answer: A — Create a Route 53 health check monitoring the primary endpoint, and configure an Amazon CloudWatch Alarm on the HealthCheckStatus metric to notify an SNS topic.

• A. Correct. Route 53 health checks are the native mechanism used to determine whether the primary endpoint is reachable. When a failover routing policy is used, Route 53 switches traffic based on these health checks. Publishing the HealthCheckStatus metric to a CloudWatch alarm and notifying SNS provides immediate alerting when the primary region becomes unreachable and failover is triggered.
• B. Incorrect. AWS Shield Advanced is primarily designed for DDoS protection and mitigation. It does not monitor general endpoint reachability or network isolation events unrelated to DDoS attacks, nor does it integrate directly with Route 53 health status for failover alerting.
• C. Incorrect. While VPC Flow Logs monitor network traffic, they are not the trigger for Route 53 failover decisions. Using Anomaly Detection on traffic patterns introduces more latency and is less reliable for immediate alerting compared to the binary HealthCheckStatus metric used by Route 53.
• D. Incorrect. AWS Config is used for tracking resource configuration changes (e.g., changing the DNS record's TTL). A failover event is an operational state change of the endpoint's health, not a change to the hosted zone's configuration itself, so an AWS Config rule would not be triggered.

Correct answer: A — It normalizes findings into the AWS Security Finding Format (ASFF), eliminating the need for security teams to parse different data schemas when correlating events.

• A. Correct. AWS Security Hub normalizes findings from all integrated AWS services and third-party partners into the AWS Security Finding Format (ASFF). This provides a consistent JSON schema, allowing security teams to aggregate, search, and automate responses without the overhead of writing custom parsers for multiple disparate data formats.
• B. Incorrect. Security Hub's native format is ASFF. While the Open Cybersecurity Schema Framework (OCSF) is used by services like Amazon Security Lake to normalize logs, it is not the primary format used by Security Hub for finding ingestion and correlation.
• C. Incorrect. Standardizing findings is related to the data schema (how data is organized), not the encryption method. While data in Security Hub is encrypted at rest, the primary benefit of the standardized format is interoperability and ease of analysis.
• D. Incorrect. Security Hub can be used to trigger automation via Amazon EventBridge, but the standardized format itself does not perform remediation. Remediation logic must be configured separately using services like AWS Lambda or AWS Systems Manager Automation.

Correct answer: A — Modify the instance's Security Group to remove all inbound and outbound rules, and add a single outbound rule allowing traffic only to the forensic team's IP address.

• A. Modifying the security group to isolate the instance (often called a 'quarantine SG') is the standard AWS best practice for containment. This action immediately stops unauthorized traffic at the ENI level while keeping the instance powered on, thereby preserving volatile evidence in memory (RAM). It allows the team to surgically permit access only to authorized forensic workstations for live investigation.
• B. The primary Elastic Network Interface (ENI) of an EC2 instance cannot be detached while the instance is running. Even if it were a secondary ENI, detaching it would sever all network connectivity, preventing the forensic team from performing live analysis over the network.
• C. Stopping the instance would successfully halt the DDoS traffic, but it results in the loss of all data stored in volatile memory (RAM). This violates the requirement to keep the instance running for live forensic analysis, as critical evidence like running processes and active network connections would be wiped.
• D. VPC route tables operate at the subnet level rather than the instance level. Modifying the route table to a blackhole would affect all resources within that subnet and would also prevent the forensic team from accessing the compromised instance for their investigation.

Correct answers: A, B — Create an FIS experiment template using the aws:network:disrupt-connectivity action.; Target the specific EC2 instances in the FIS experiment using resource tags or instance IDs.

• A. Correct. The 'aws:network:disrupt-connectivity' action is a native AWS FIS action designed to simulate network-level disruptions. This allows you to test the resilience of applications by blocking traffic between specified resources, such as subnets or VPCs.
• B. Correct. Defining targets is a mandatory step in creating an FIS experiment. This identifies the specific resources (e.g., EC2 instances) that will be subject to the fault injection, scoped by using resource tags, filters, or specific ARNs/IDs.
• C. Incorrect. Users do not have access to physical AWS data center infrastructure. FIS is a managed service that injects faults at the API and software layers of AWS services.
• D. Incorrect. FIS does not typically perform tests by modifying VPC route table entries to point to an Internet Gateway. Network disruption is handled via managed FIS actions that intercept traffic at the network interface level.
• E. Incorrect. While 'aws:ec2:terminate-instances' is a valid FIS action for compute failure testing, the context of the question (implied by the other options) focuses on network connectivity disruption rather than the total loss of the compute resource.

Correct answer: B — AWS Step Functions provide built-in wait states and can orchestrate long-running tasks that exceed Lambda's 15-minute execution timeout.

• A. Incorrect. AWS Lambda is fully capable of interacting with the Amazon EC2 API using the AWS SDK (e.g., Boto3 for Python) to create snapshots, provided it has the appropriate IAM permissions.
• B. Correct. AWS Step Functions are designed to coordinate multi-step workflows and include built-in features such as wait states, retries, and state management. Unlike AWS Lambda, which has a hard execution timeout of 15 minutes, Step Functions can manage workflows that run for up to one year, making them ideal for long-running orchestration.
• C. Incorrect. AWS Step Functions involve orchestration overhead and state transition latency, making them slower than direct Lambda execution for sub-millisecond or high-performance compute tasks. Lambda is generally preferred for short, high-speed, event-driven tasks.
• D. Incorrect. AWS Lambda is a serverless compute service that manages the underlying infrastructure automatically; it does not require a dedicated Amazon EC2 instance to run. If a script exceeds the Lambda timeout, the solution is to use Step Functions, AWS Batch, or Fargate, rather than adding an EC2 dependency to Lambda itself.

Correct answers: A, C — Add a resource-based policy to the Lambda function granting the s3.amazonaws.com service principal permission to invoke the function.; Add the dynamodb:PutItem permission to the Lambda function's execution role.

• A. Correct. To allow Amazon S3 to trigger a Lambda function, a resource-based policy must be attached to the Lambda function. This policy grants the 's3.amazonaws.com' service principal permission to perform the 'lambda:InvokeFunction' action, restricted to the specific S3 bucket's ARN.
• B. Incorrect. 's3:InvokeFunction' is not a valid IAM permission. The permission for S3 to trigger Lambda is 'lambda:InvokeFunction' and it is placed on the Lambda function's resource-based policy, not the function's execution role.
• C. Correct. The Lambda function's execution role must contain permissions for any action the function's code needs to perform. Since the function is writing metadata to DynamoDB, 'dynamodb:PutItem' is the specific IAM action required.
• D. Incorrect. While DynamoDB now supports resource-based policies, the standard and most secure method for authorizing a Lambda function to access a table within the same account is using the Lambda execution role (identity-based policy).
• E. Incorrect. S3 bucket policies control access to S3 resources (buckets and objects). They cannot be used to grant S3 permission to invoke other services; that permission must be defined on the resource being invoked (the Lambda function).

Correct answer: B — Enable Enhanced scanning in ECR, which integrates with Amazon Inspector to provide continuous scanning of images.

• A. Basic scanning in Amazon ECR uses the Clair open-source engine and only supports 'scan on push'. It does not offer continuous monitoring or automatic rescanning as new CVEs are released into the database over time.
• B. Enhanced scanning in Amazon ECR integrates with Amazon Inspector. Unlike Basic scanning, Enhanced scanning supports a 'continuous scanning' mode which monitors images for vulnerabilities and automatically rescans them whenever new CVE information is published, ensuring the security posture is up to date.
• C. While an EventBridge and Lambda solution could be custom-built to scan images periodically, it introduces significant operational overhead and complexity compared to the native, managed AWS solution provided by Enhanced scanning.
• D. Amazon GuardDuty is a threat detection service that monitors for malicious activity or unauthorized behavior in an AWS environment. It is not a vulnerability scanner for container images and does not provide CVE monitoring for ECR.

Correct answer: C — Deploy an AWS Transit Gateway, attach all 50 VPCs, and route all inter-VPC traffic to a centralized Inspection VPC containing the AWS Network Firewall.

• A. Deploying an AWS Network Firewall endpoint in every subnet of each VPC would create massive operational overhead and be extremely difficult to manage at scale across 50 VPCs. It does not provide a centralized inspection model, which is preferred for scalability and simplified routing.
• B. Full-mesh VPC peering is not scalable for 50 VPCs due to the management complexity and service limits. Additionally, a NAT Gateway is designed for outbound internet access (Egress) and does not provide the stateful deep packet inspection capabilities of AWS Network Firewall required for East/West traffic.
• C. AWS Transit Gateway is the most scalable method for connecting many VPCs. Using a hub-and-spoke architecture with a centralized Inspection VPC allows for consistent policy enforcement and significantly reduces operational overhead by centralizing the AWS Network Firewall endpoints and management.
• D. AWS WAF is a web application firewall designed for Layer 7 (HTTP/HTTPS) protection and is not suitable for general East/West network traffic inspection. Furthermore, Gateway Load Balancer is typically used to integrate third-party virtual appliances rather than AWS WAF for this use case.

Correct answer: D — AWS Network Access Analyzer

• A. Amazon Inspector network reachability rules utilize automated reasoning to identify potential network vulnerabilities and misconfigurations. While it helps identify paths to instances, it is primarily a vulnerability assessment tool and is less suited than Network Access Analyzer for providing a comprehensive, auditor-ready mathematical proof of isolation across complex network topologies.
• B. Amazon VPC Flow Logs record network traffic patterns and can be queried via Athena to see if internet-originated traffic reached a subnet. However, this only shows observed traffic; it does not provide a mathematical guarantee that no path exists. For auditors, the absence of traffic in logs is not equivalent to a proof of network segmentation.
• C. AWS Config rules such as restricted-ssh check for specific security group or NACL configurations. While they assist with compliance monitoring, they do not perform end-to-end path analysis and cannot provide definitive proof of isolation in environments involving multiple hops like Transit Gateways and peering connections.
• D. AWS Network Access Analyzer uses automated reasoning (a form of mathematical logic) to perform path analysis across your entire AWS network environment. It allows you to specify network access scopes and produces a formal verification of network reachability or isolation, making it the ideal tool to provide mathematical proof of network segmentation to auditors.

Correct answer: B — Configure Origin Access Control (OAC) for the CloudFront distribution. Update the S3 bucket policy to allow s3:GetObject for the CloudFront service principal. Update the KMS key policy to allow kms:Decrypt for the CloudFront service principal.

• A. Incorrect. Origin Access Identity (OAI) is a legacy feature that does not support S3 buckets encrypted with SSE-KMS. OAI only supports unencrypted objects or objects encrypted with SSE-S3.
• B. Correct. Origin Access Control (OAC) is the recommended method for securing CloudFront access to S3 origins. OAC supports SSE-KMS by allowing the CloudFront service principal (cloudfront.amazonaws.com) to be used in resource-based policies. To function, the S3 bucket policy must allow s3:GetObject and the KMS key policy must allow kms:Decrypt for the CloudFront service principal.
• C. Incorrect. Although S3 Block Public Access is a valid security control, this option fails because it uses SSE-S3 encryption instead of the required AWS KMS customer managed keys.
• D. Incorrect. You cannot attach an IAM role directly to a CloudFront distribution to grant it permissions for origin access. Furthermore, OAI (as mentioned in this option) does not support SSE-KMS.

Correct answer: A — Create a CloudFront Response Headers Policy with the required security headers and attach it to the CloudFront distribution's cache behavior.

• A. Correct. CloudFront Response Headers Policies are a native, managed feature specifically designed to add, modify, or remove headers in responses (including HSTS and X-Frame-Options) without modifying application code. This is the most operationally efficient method as it requires no custom code management or additional compute resources.
• B. Incorrect. While Lambda@Edge (specifically on the Origin Response or Viewer Response events) can be used to inject headers, it involves writing, deploying, and maintaining custom code. This introduces more operational complexity and cost than using native CloudFront Response Headers Policies. Additionally, the 'Origin Request' trigger is the wrong stage for modifying a response.
• C. Incorrect. AWS WAF Custom Responses are used to return specific status codes or custom bodies when a request is blocked by a WAF rule. They cannot be used to append or modify headers for requests that are allowed through to the origin.
• D. Incorrect. Amazon Route 53 is a DNS service. DNS TXT records are used for domain verification and other metadata but have no impact on HTTP response headers, which are part of the application layer (Layer 7).

Correct answer: B — Import a Certificate Revocation List (CRL) into IAM Roles Anywhere and update it.

• A. Deleting the trust anchor disables the root of trust for the entire environment. This would revoke access for all certificates issued by that Certificate Authority (CA), which contradicts the requirement to only affect the compromised server.
• B. IAM Roles Anywhere supports the use of Certificate Revocation Lists (CRLs) to invalidate specific certificates. By importing a CRL that contains the serial number of the compromised certificate, you can effectively revoke access for that specific server without impacting other valid certificates issued by the same trust anchor.
• C. Deleting the IAM role would prevent all authorized servers and entities associated with the IAM Roles Anywhere profile from obtaining temporary credentials, making it an overly broad and disruptive action.
• D. While IAM policies support conditional access based on principal tags derived from certificate attributes, the standard and recommended mechanism for certificate-level revocation in IAM Roles Anywhere is through the use of CRLs, not by manually blacklisting serial numbers in a role trust policy.

Correct answer: B — Add an aws:SourceIp condition to the trust policy of the DBAdminRole.

• A. Adding an aws:SourceIp condition to identity-based policies is decentralized and difficult to manage. It would require updating the policies of every potential user who might assume the role. Furthermore, it does not provide a centralized control at the target resource (the role) level.
• B. The role's trust policy is a resource-based policy that defines which principals are allowed to assume the role and under what conditions. Adding an aws:SourceIp condition to the trust policy is the most effective and centralized way to ensure that the sts:AssumeRole action is only successful when originating from the specific corporate VPN IP range.
• C. A VPC endpoint for STS facilitates private connectivity from within a VPC to the STS service. While endpoint policies can restrict access, they are intended to control traffic through the endpoint itself, rather than serving as the primary mechanism for restricting specific role assumption based on source IP.
• D. Permissions boundaries are used to set the maximum permissions that an IAM entity can have. They do not govern the trust relationship or determine who is allowed to assume a role; they only limit the actions the role can perform after it has already been assumed.

Correct answer: B — Create an Amazon Cognito Identity Pool, configure Google as an authentication provider, and map authenticated users to an IAM role.

• A. Amazon Cognito User Pools are primarily for user management (authentication) and can federate with external providers like Google. however, User Pools by themselves do not issue temporary AWS credentials for direct service access (like DynamoDB). You must use an Identity Pool to obtain AWS credentials.
• B. This is the AWS-recommended best practice for mobile and web applications. Amazon Cognito Identity Pools (Federated Identities) enable you to exchange an authentication token from an external provider (like Google) for temporary, limited-privilege AWS credentials via an IAM role.
• C. While IAM supports OIDC identity providers, Cognito Identity Pools provide a more managed and scalable orchestration layer specifically for mobile and web app scenarios. Additionally, managing the low-level OIDC exchange manually in mobile code is more complex and error-prone compared to using the Cognito SDK.
• D. This approach is highly insecure. Issuing long-term IAM access keys to mobile devices violates the principle of least privilege and security best practices. Mobile applications should always use temporary credentials provided by AWS Security Token Service (STS) or Amazon Cognito.

Correct answer: B — AWS IAM Roles Anywhere

• A. AWS Systems Manager Session Manager provides secure, auditable instance management (similar to SSH or RDP) without the need for inbound ports or bastion hosts. However, it does not provide a mechanism for on-premises servers to programmatically obtain temporary AWS API credentials.
• B. AWS IAM Roles Anywhere is specifically designed for workloads running outside of AWS, such as on-premises servers, to obtain temporary AWS credentials. It uses X.509 digital certificates from your own Certificate Authority (CA) to establish trust and allow the server to assume an IAM role, thereby eliminating the need for long-term IAM access keys.
• C. AWS Directory Service AD Connector is a directory gateway used to proxy authentication requests to an on-premises Active Directory. While it helps with identity integration for AWS applications (like WorkSpaces), it does not issue temporary AWS API credentials to servers.
• D. Amazon Cognito Identity Pools are primarily used to provide temporary AWS credentials to mobile and web application users. While they support federation, they are not the recommended or standard solution for server-to-server programmatic access from on-premises environments compared to IAM Roles Anywhere.

Correct answers: A, B — Add a condition in the S3 bucket policy to deny `s3:GetObject` if `aws:SourceIp` is not the corporate IP range.; Add a condition in the S3 bucket policy to deny `s3:GetObject` if `aws:SecureTransport` is false.

• A. S3 bucket policies are evaluated at the time a presigned URL is used. By adding an explicit Deny statement with an `aws:SourceIp` condition that excludes the corporate range, AWS will block any request originating from outside that range, even if the URL signature is technically valid.
• B. The `aws:SecureTransport` condition key allows you to check if a request is made over HTTPS. An S3 bucket policy with an explicit Deny when `aws:SecureTransport` is false ensures that all access, including that via presigned URLs, must occur over an encrypted connection.
• C. Standard S3 presigned URLs for GET requests do not support embedding arbitrary IAM condition keys (like IP addresses) as signed parameters within the URL string itself. These restrictions must be handled via identity-based or resource-based policies.
• D. Presigned POST is used for browser-based uploads to S3. While it uses a policy document, it does not replace the need for resource-level enforcement of IP and HTTPS restrictions for object access.
• E. Applying the restriction to the IAM user generating the URL is less effective for resource-level security. While an IAM 'Deny' would apply to URLs they sign, the standard and most robust way to enforce bucket-wide security requirements (IP and HTTPS) is through the S3 bucket policy.

Correct answer: C — { "Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": "arn:aws:s3:::my-bucket/*", "Condition": { "Bool": { "aws:SecureTransport": "false" } } }

• A. This statement permits requests made over HTTPS (where aws:SecureTransport is true), but it does not provide enforcement because it lacks an explicit Deny. In AWS IAM and bucket policies, an Allow alone does not block non-secure (HTTP) traffic that might be permitted by other policy statements or default behaviors.
• B. This statement relates to encryption at rest. The condition key 's3:x-amz-server-side-encryption' checks for the headers associated with Server-Side Encryption (SSE-S3). It does not monitor or enforce the protocol (HTTP vs HTTPS) used to transfer data.
• C. This is the correct and standard AWS security pattern for enforcing encryption in transit. Using an explicit Deny statement where 'aws:SecureTransport' is 'false' ensures that any request made over unencrypted HTTP is rejected, forcing all clients to use HTTPS (TLS).
• D. While this policy attempts to restrict connections based on TLS version, it is not the standard method for enforcing encryption in transit. The 'aws:SecureTransport' key is the global and most direct mechanism to ensure that the transport layer itself is secure (HTTPS vs HTTP).

Correct answer: B — Create a Network Load Balancer, configure a VPC Endpoint Service, and have customers create an Interface VPC Endpoint.

• A. AWS Resource Access Manager (RAM) is used to share resources like subnets, Transit Gateways, or License Manager configurations. It cannot be used to share an Application Load Balancer to provide private, cross-account service access in the manner required for a SaaS delivery model.
• B. This architecture describes AWS PrivateLink. By creating a VPC Endpoint Service fronted by a Network Load Balancer (NLB), the provider allows customers to create Interface VPC Endpoints in their own accounts. This establishes private connectivity over the AWS network backbone, satisfying the security requirement to avoid the public internet while overcoming CIDR overlap and scaling issues.
• C. While VPC Peering provides private connectivity, it is not recommended for a SaaS model with many customers. It requires managing individual peering connections for each customer, and it cannot function if there are overlapping IP CIDR blocks between the provider and the customer VPCs.
• D. A private API Gateway endpoint requires customers to have an Interface VPC Endpoint for execute-api in their VPCs to reach it. However, the sharing of an API key is an authentication/authorization mechanism and does not, by itself, establish the underlying private network architecture required for cross-account access.

Correct answer: B — It must be enabled during domain creation and cannot be disabled later.

• A. Incorrect. Enabling node-to-node encryption on an existing domain is not a simple, zero-impact toggle; it triggers a blue/green deployment, which involves creating a new environment and migrating the cluster. It cannot be described as a change without downtime or architectural impact.
• B. Correct. Node-to-node encryption is a security feature that protects data as it moves between nodes in the cluster using TLS 1.2. While modern OpenSearch versions allow enabling it on existing domains via a blue/green deployment, the critical constraint is that once it is enabled, it cannot be disabled. In the context of the SCS-C03 exam, this option correctly identifies the permanent nature of the setting.
• C. Incorrect. Amazon OpenSearch Service is a managed service. AWS automatically provisions, manages, and rotates the certificates used for node-to-node encryption. Manual installation via Systems Manager or other tools is not required or supported for this internal cluster traffic.
• D. Incorrect. Node-to-node encryption utilizes Transport Layer Security (TLS) certificates for protecting data in transit. AWS Key Management Service (KMS) symmetric keys are used for encryption at rest (encrypting the data stored on disk), not for the encryption of the network transport layer itself.

Correct answer: C — Client-side encryption using the Amazon S3 Encryption Client

• A. Server-Side Encryption with AWS KMS (SSE-KMS) encrypts data at rest within Amazon S3. Because the encryption process occurs at the storage destination (the S3 server), the data remains in plaintext within the application memory and during transmission (though protected by TLS), which violates the requirement to encrypt it before it leaves application memory.
• B. Server-Side Encryption with Customer-Provided Keys (SSE-C) requires the client to provide the encryption key in the request, but the encryption process itself is still handled by Amazon S3 on the server side. This does not meet the requirement to encrypt data within the application memory prior to transmission.
• C. Client-side encryption using the Amazon S3 Encryption Client allows the application to encrypt the data directly on the EC2 instance before it is sent over the network. This client integrates seamlessly with AWS KMS for data key management, fulfilling both the requirement for in-memory encryption and the use of KMS.
• D. AWS Certificate Manager (ACM) is utilized for managing, provisioning, and deploying SSL/TLS certificates to establish secure transport layers. It is not designed for encrypting application data or managing data keys for S3 object encryption.

Correct answer: B — AWS Signer

• A. AWS Key Management Service (AWS KMS) can be used to create and control encryption keys, including asymmetric keys for digital signatures. However, it is a low-level cryptographic service and does not provide a managed workflow for code signing, certificate lifecycle management for code, or the specific integrations required for verifying code integrity at scale across IoT devices as effectively as AWS Signer.
• B. AWS Signer is a fully managed code-signing service that ensures the authenticity and integrity of code. It allows security engineers to cryptographically sign code (such as firmware images) and provides a way for devices to verify that the code originated from a trusted source and has not been tampered with during transit or storage.
• C. Amazon S3 Object Lock is used to achieve data immutability by preventing objects from being deleted or overwritten for a specific period (WORM). While it protects data at rest in S3, it does not provide cryptographic signatures that a device can use to verify the origin and integrity of the firmware binary before installation.
• D. AWS Certificate Manager (ACM) is primarily used for provisioning and managing SSL/TLS certificates for web applications and services like Elastic Load Balancing or Amazon CloudFront. It is not designed for signing software packages or firmware images for code integrity verification.

Correct answer: A — secretsmanager:UpdateSecretVersionStage

• A. Correct. The rotation process consists of four steps: createSecret, setSecret, testSecret, and finishSecret. In the final step (finishSecret), Secrets Manager moves the AWSCURRENT staging label from the old version to the new version. The permission required to move or update staging labels is secretsmanager:UpdateSecretVersionStage. If this is missing, the secret will never be marked as active/current.
• B. Incorrect. The secretsmanager:PutSecretValue permission is used during the createSecret step to add a new version of the secret to the container. Since the scenario states the function successfully generated a new key, this step likely succeeded.
• C. Incorrect. The secretsmanager:GetSecretValue permission allows the Lambda function to retrieve the current secret value. While necessary for the function to read the existing secret during the rotation process, it is not used to mark a new version as active.
• D. Incorrect. The secretsmanager:RotateSecret permission is used to configure or manually initiate the rotation of a secret. The Lambda execution role needs permissions to modify the secret's versions and stages (CRUD operations), not the permission to trigger the rotation itself.

Correct answer: B — Use AWS Resource Access Manager (AWS RAM) to share the Private CA with the developer account.

• A. Exporting the Private CA's private key is a major security risk and is not a supported operation for managed AWS Private CA. Private CA keys are securely stored within AWS-managed Hardware Security Modules (HSMs) and cannot be exported to be imported into ACM in another account.
• B. AWS Resource Access Manager (AWS RAM) is the native AWS service designed for sharing resources across accounts or within an organization. By sharing the Private CA with the developer account via RAM, developers can use AWS Certificate Manager (ACM) in their own account to request, renew, and manage private certificates signed by the central CA. This is the AWS-recommended architecture for centralized PKI management.
• C. Creating a cross-account IAM role for acm:ExportCertificate is incorrect because that action is used to export a certificate's material (body, chain, and private key) from ACM for use on resources outside of AWS, not to grant permission to issue new certificates from a Private CA. The standard cross-account issuance workflow relies on RAM.
• D. Network-level connectivity like VPC peering is irrelevant for authorizing the issuance of certificates via ACM. Access to the Private CA for certificate issuance is managed through service-to-service integration and RAM sharing permissions, not via network-layer routing to API endpoints.

Correct answers: A, B — The Lambda function is in a private subnet without a NAT Gateway or VPC endpoint for Secrets Manager.; The RDS security group does not allow inbound traffic from the Lambda function's security group.

• A. Correct. When a Lambda function is configured to run inside a VPC, it loses its default internet access. To rotate a secret, the Lambda must communicate with the Secrets Manager service endpoint to retrieve and update the secret. If the private subnet lacks a NAT Gateway (for internet access) or an Interface VPC Endpoint for Secrets Manager, the API calls will hang and eventually time out.
• B. Correct. To perform the rotation, the Lambda function must establish a network connection to the RDS instance to execute the password change (e.g., via SQL). If the RDS security group does not explicitly allow inbound traffic on the database port from the Lambda function's security group, the connection request will be dropped, causing the Lambda function to time out while waiting for a response.
• C. Incorrect. While resource tagging is a best practice, Secrets Manager does not use a tag named 'RotationEnabled' to control the rotation logic. Rotation is enabled and managed through the secret's specific rotation configuration settings.
• D. Incorrect. The 'rds:ModifyDBInstance' permission is generally used for modifying instance-level attributes like instance class or storage. Rotating a database user's password is done via a database connection using SQL commands, not through the RDS API. Additionally, a missing IAM permission would result in an immediate AccessDenied error rather than a timeout.
• E. Incorrect. If the Secrets Manager service principal (secretsmanager.amazonaws.com) lacked the 'lambda:InvokeFunction' permission in the Lambda's resource-based policy, the rotation would fail immediately with an invocation error. The prompt states the function times out during execution, which implies it was successfully invoked.

Correct answers: A, B, C — AWS Organizations must be enabled with All Features.; AWS Config must be enabled across all accounts and regions in the Organization.; An AWS Firewall Manager default administrator account must be designated.

• A. Correct. AWS Firewall Manager requires AWS Organizations to be enabled with 'All Features' (not just consolidated billing) to allow the service to centrally manage and apply security policies across member accounts.
• B. Correct. AWS Config must be enabled for every account in the organization and for every Region where you want Firewall Manager to protect resources. Firewall Manager relies on AWS Config to discover new resources and to monitor resource compliance against the defined policies.
• C. Correct. Before you can create Firewall Manager policies, you must associate a member account with Firewall Manager as the default administrator. This account is designated from the AWS Organizations management account and is responsible for managing security policies organization-wide.
• D. Incorrect. While Amazon GuardDuty is a powerful threat detection service, it is not a prerequisite for using AWS Firewall Manager to manage AWS WAF rules.
• E. Incorrect. AWS Shield Advanced is only a prerequisite if you specifically want Firewall Manager to manage Shield Advanced protections. It is not a prerequisite for managing AWS WAF rules through Firewall Manager.
• F. Incorrect. AWS Resource Access Manager (AWS RAM) is not a required prerequisite for Firewall Manager. Firewall Manager utilizes the trust relationship within AWS Organizations and the data from AWS Config to perform its functions.

Correct answer: A — Store the state file in an Amazon S3 bucket with versioning enabled, server-side encryption, and strict IAM/bucket policies.

• A. Correct. Storing the state file in an Amazon S3 bucket with versioning, server-side encryption, and strict IAM/bucket policies is the AWS-recommended best practice for Terraform remote backends. Versioning allows for recovery from accidental deletion or corruption, server-side encryption protects sensitive data at rest, and granular policies ensure only authorized principals and CI/CD pipelines can access the state.
• B. Incorrect. AWS Secrets Manager is designed for storing and rotating individual secrets like credentials or API keys. It is not suitable for storing entire IaC state files, which can be large, contain complex metadata, and require specific backend handling (like state locking) that Secrets Manager does not provide.
• C. Incorrect. Attaching an EBS volume to a public bastion host increases the attack surface significantly. Furthermore, an EBS volume is not an appropriate shared, durable backend for a team-based IaC environment, and managing access to it is more complex and less secure than using a managed service like Amazon S3.
• D. Incorrect. Committing the state file to source control (even private repositories like CodeCommit) is a major security risk. State files often contain plaintext secrets which would be permanently retained in the repository's git history, making them accessible to anyone with repository access and increasing the risk of exposure.

Correct answer: B — The SSM Automation execution role specified in the remediation configuration lacks the necessary permissions to modify the EBS volume.

• A. The AWS Config service-linked role is used by AWS Config to record resource configurations and evaluate them against rules, but it does not directly execute remediation actions. Remediation is delegated to AWS Systems Manager.
• B. When configuring remediation in AWS Config using SSM Automation, you must specify an IAM execution role. This role must have the permissions required to perform the actions defined in the SSM document (such as ec2:ModifyVolume, ec2:CopySnapshot, or ec2:CreateVolume). If this role is missing the necessary permissions or the trust relationship to allow SSM to assume it, the remediation will fail.
• C. This is logically inconsistent because the scenario states the EBS volumes are unencrypted. Furthermore, the failure in remediation is typically related to the execution role's permissions rather than the Config service's access to KMS keys.
• D. AWS Config natively supports remediation via SSM Automation documents as well as AWS Lambda functions. Using SSM is a standard and supported method for remediation.

Correct answer: A — Create a Security Hub Custom Action. Create an Amazon EventBridge rule that matches the Custom Action ARN and targets the Lambda function.

• A. Correct. Security Hub Custom Actions are designed to allow analysts to manually initiate workflows for specific findings directly from the Security Hub console. When an analyst selects findings and chooses a custom action, Security Hub emits an event to Amazon EventBridge. You can then create an EventBridge rule that matches the specific Custom Action ARN and sets the AWS Lambda function as the target to perform the remediation or isolation.
• B. Incorrect. Matching all Security Hub findings in EventBridge would automate the processing of every finding rather than allowing for the manual selection required. Furthermore, adding tags to findings is not the standard mechanism for invoking a manual, console-initiated remediation workflow.
• C. Incorrect. Security Hub Insights are used for aggregating and visualizing findings based on specific attributes (e.g., grouped by resource ID or severity). They do not support the direct attachment of Lambda functions for remediation purposes.
• D. Incorrect. While AWS Systems Manager Incident Manager is used for incident response and management, it is not the native mechanism for manual 'point-and-click' remediation of findings within the Security Hub console. The specific pattern for manual console-based remediation is the use of Custom Actions.

Correct answers: A, B, C — Designate the central security account as the Macie delegated administrator from the Organizations management account.; In the delegated administrator account, enable Macie and add all member accounts as Macie members.; Enable the 'Auto-enable' feature in the Macie delegated administrator account to automatically enroll new accounts.

• A. Correct. The AWS Organizations management account must designate a delegated administrator for Macie. This allows a specific security account to manage Macie across all member accounts in the organization, following the best practice of least privilege for the management account.
• B. Correct. Once the delegated administrator is designated, it must enable Macie and add existing AWS accounts in the organization as members. This allows the administrator to view and manage findings from those accounts centrally.
• C. Correct. Enabling the 'Auto-enable' setting in the Macie delegated administrator account ensures that any new accounts added to the AWS Organization in the future are automatically enrolled as Macie member accounts without manual intervention.
• D. Incorrect. While an SCP is a good security control to prevent users from disabling Macie, it is not a step for enabling the service or aggregating findings centrally.
• E. Incorrect. AWS CloudTrail is used for logging API activity, not for aggregating service findings. Macie findings are aggregated through the Macie service itself to the delegated administrator account.
• F. Incorrect. AWS Resource Access Manager (RAM) is used to share specific AWS resources like subnets or transit gateways. It is not used for managing Macie classification jobs or member account administration.

Correct answers: A, B — Create an SCP that denies s3:DeleteBucket and attach it to the organization root.; Create an RCP that denies s3:* for all principals where aws:PrincipalOrgID does not match the company's Organization ID.

• A. Correct. Service Control Policies (SCPs) are the primary mechanism for setting permission guardrails across an AWS Organization. Attaching an SCP to the root that denies 's3:DeleteBucket' ensures that no IAM user or role within any member account can perform that action, satisfying the first requirement.
• B. Correct. Resource Control Policies (RCPs) are a feature in AWS Organizations used to centrally manage resource-based policies. Unlike SCPs, which govern what identities (users/roles) in your org can do, RCPs govern access to the resources in your org. By using a 'Deny' with the 'aws:PrincipalOrgID' condition, you can effectively block all external principals from accessing your S3 buckets, even if a bucket-level policy is misconfigured to allow public or cross-account access.
• C. Incorrect. SCPs only apply to principals (IAM users and roles) within the accounts of the organization. They cannot control or block access from principals belonging to external AWS accounts to resources inside your organization.
• D. Incorrect. While an RCP can restrict actions on resources, Option A is the more standard identity-governance approach for the requirement that 'IAM users cannot delete buckets'. More importantly, Option B is the specific configuration needed to satisfy the requirement of blocking external account access.
• E. Incorrect. AWS Resource Access Manager (RAM) is designed to share resources like Subnets, Transit Gateways, or License Manager configurations across accounts. It is not used to create a security perimeter or restrict access to S3 buckets.