New Year Sale 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: exams65

ExamsBrite Dumps

AWS Certified Security – Specialty Question and Answers

AWS Certified Security – Specialty

Last Update Jan 14, 2026
Total Questions : 81

We are offering FREE SCS-C03 Amazon Web Services exam questions. All you do is to just go and sign up. Give your details, prepare SCS-C03 free exam questions and then go for complete pool of AWS Certified Security – Specialty test questions that will help you more.

SCS-C03 pdf

SCS-C03 PDF

$36.75  $104.99
 Add to Cart
SCS-C03 Engine

SCS-C03 Testing Engine

$43.75  $124.99
 Add to Cart
SCS-C03 PDF + Engine

SCS-C03 PDF + Testing Engine

$57.75  $164.99
 Add to Cart
Questions 1

A company has a VPC that has no internet access and has the private DNS hostnames option enabled. An Amazon Aurora database is running inside the VPC. A security engineer wants to use AWS Secrets Manager to automatically rotate the credentials for the Aurora database. The security engineer configures the Secrets Manager default AWS Lambda rotation function to run inside the same VPC that the Aurora database uses. However, the security engineer determines that the password cannot be rotated properly because the Lambda function cannot communicate with the Secrets Manager endpoint.

What is the MOST secure way that the security engineer can give the Lambda function the ability to communicate with the Secrets Manager endpoint?

Options:

A.  

Add a NAT gateway to the VPC to allow access to the Secrets Manager endpoint.

B.  

Add a gateway VPC endpoint to the VPC to allow access to the Secrets Manager endpoint.

C.  

Add an interface VPC endpoint to the VPC to allow access to the Secrets Manager endpoint.

D.  

Add an internet gateway for the VPC to allow access to the Secrets Manager endpoint.

Discussion 0
Questions 2

A company has an encrypted Amazon Aurora DB cluster in the us-east-1 Region that uses an AWS KMS customer managed key. The company must copy a DB snapshot to the us-west-1 Region but cannot access the encryption key across Regions.

What should the company do to properly encrypt the snapshot in us-west-1?

Options:

A.  

Store the customer managed key in AWS Secrets Manager in us-west-1.

B.  

Create a new customer managed key in us-west-1 and use it to encrypt the snapshot.

C.  

Create an IAM policy to allow access to the key in us-east-1 from us-west-1.

D.  

Create an IAM policy that allows RDS in us-west-1 to access the key in us-east-1.

Discussion 0
Questions 3

A company uses AWS IAM Identity Center with SAML 2.0 federation. The company decides to change its federation source from one identity provider (IdP) to another. The underlying directory for both IdPs is Active Directory.

Which solution will meet this requirement?

Options:

A.  

Disable all existing users and groups within IAM Identity Center that were part of the federation with the original IdP.

B.  

Modify the attribute mappings within the IAM Identity Center trust relationship to match information that the new IdP sends.

C.  

Reconfigure all existing IAM roles in the company's AWS accounts to explicitly trust the new IdP as the principal.

D.  

Confirm that the Network Time Protocol (NTP) clock skew is correctly set between IAM Identity Center and the new IdP endpoints.

Discussion 0
Questions 4

A company has a PHP-based web application that uses Amazon S3 as an object store for user files. The S3 bucket is configured for server-side encryption with Amazon S3 managed keys (SSE-S3). New requirements mandate full control of encryption keys.

Which combination of steps must a security engineer take to meet these requirements? (Select THREE.)

Options:

A.  

Create a new customer managed key in AWS Key Management Service (AWS KMS).

B.  

Change the SSE-S3 configuration on the S3 bucket to server-side encryption with customer-provided keys (SSE-C).

C.  

Configure the PHP SDK to use the SSE-S3 key before upload.

D.  

Create an AWS managed key for Amazon S3 in AWS KMS.

E.  

Change the SSE-S3 configuration on the S3 bucket to server-side encryption with AWS KMS managed keys (SSE-KMS).

F.  

Change all the S3 objects in the bucket to use the new encryption key.

Discussion 0
Questions 5

A company runs a global ecommerce website using Amazon CloudFront. The company must block traffic from specific countries to comply with data regulations.

Which solution will meet these requirements MOST cost-effectively?

Options:

A.  

Use AWS WAF IP match rules.

B.  

Use AWS WAF geo match rules.

C.  

Use CloudFront geo restriction to deny the countries.

D.  

Use geolocation headers in CloudFront.

Discussion 0
Questions 6

A company’s data scientists use Amazon SageMaker with datasets stored in Amazon S3. Data older than 45 days must be removed according to policy.

Which action should enforce this policy?

Options:

A.  

Configure an S3 Lifecycle rule to delete objects after 45 days.

B.  

Create a Lambda function triggered on object upload to delete old data.

C.  

Create a scheduled Lambda function to delete old objects monthly.

D.  

Configure S3 Intelligent-Tiering.

Discussion 0
Questions 7

A company is planning to migrate its applications to AWS in a single AWS Region. The company’s applications will use a combination of Amazon EC2 instances, Elastic Load Balancing (ELB) load balancers, and Amazon S3 buckets. The company wants to complete the migration as quickly as possible. All the applications must meet the following requirements:

• Data must be encrypted at rest.

• Data must be encrypted in transit.

• Endpoints must be monitored for anomalous network traffic.

Which combination of steps should a security engineer take to meet these requirements with the LEAST effort? (Select THREE.)

Options:

A.  

Install the Amazon Inspector agent on EC2 instances by using AWS Systems Manager Automation.

B.  

Enable Amazon GuardDuty in all AWS accounts.

C.  

Create VPC endpoints for Amazon EC2 and Amazon S3. Update VPC route tables to use only the secure VPC endpoints.

D.  

Configure AWS Certificate Manager (ACM). Configure the load balancers to use certificates from ACM.

E.  

Use AWS Key Management Service (AWS KMS) for key management. Create an S3 bucket policy to deny any PutObject command with a condition for x-amz-meta-side-encryption.

F.  

Use AWS Key Management Service (AWS KMS) for key management. Create an S3 bucket policy to deny any PutObject command with a condition for x-amz-server-side-encryption.

Discussion 0
Questions 8

A consultant agency needs to perform a security audit for a company's production AWS account. Several consultants need access to the account. The consultant agency already has its own AWS account. The company requires multi-factor authentication (MFA) for all access to its production account. The company also forbids the use of long-term credentials.

Which solution will provide the consultant agency with access that meets these requirements?

Options:

A.  

Create an IAM group. Create an IAM user for each consultant. Add each user to the group. Turn on MFA for each consultant.

B.  

Configure Amazon Cognito on the company’s production account to authenticate against the consultant agency's identity provider (IdP). Add MFA to a Cognito user pool.

C.  

Create an IAM role in the consultant agency's AWS account. Define a trust policy that requires MFA. In the trust policy, specify the company's production account as the principal. Attach the trust policy to the role.

D.  

Create an IAM role in the company’s production account. Define a trust policy that requires MFA. In the trust policy, specify the consultant agency's AWS account as the principal. Attach the trust policy to the role.

Discussion 0
Questions 9

A company runs an application on an Amazon EC2 instance. The application generates invoices and stores them in an Amazon S3 bucket. The instance profile that is attached to the instance has appropriate access to the S3 bucket. The company needs to share each invoice with multiple clients that do not have AWS credentials. Each client must be able to download only the client's own invoices. Clients must download their invoices within 1 hour of invoice creation. Clients must use only temporary credentials to access the company's AWS resources.

Which additional step will meet these requirements?

Options:

A.  

Update the S3 bucket policy to ensure that clients that use pre-signed URLs have the S3:Get* permission and the S3:List* permission to access S3 objects in the bucket.

B.  

Add a StringEquals condition to the IAM role policy for the EC2 instance profile. Configure the policy condition to restrict access based on the s3:ResourceTag/ClientId tag of each invoice. Tag each generated invoice with the ID of its corresponding client.

C.  

Update the script to use AWS Security Token Service (AWS STS) to obtain new credentials each time the script runs by assuming a new role that has S3:GetObject permissions. Use the credentials to generate the pre-signed URLs.

D.  

Generate an access key and a secret key for an IAM user that has S3:GetObject permissions on the S3 bucket. Embed the keys into the script. Use the keys to generate the pre-signed URLs.

Discussion 0
Questions 10

A company is building a secure solution that relies on an AWS Key Management Service (AWS KMS) customer managed key. The company wants to allow AWS Lambda to use the KMS key. However, the company wants to prevent Amazon EC2 from using the key.

Which solution will meet these requirements?

Options:

A.  

Use IAM explicit deny for EC2 instance profiles and allow for Lambda roles.

B.  

Use a KMS key policy with kms:ViaService conditions to allow Lambda usage and deny EC2 usage.

C.  

Use aws:SourceIp and aws:AuthorizedService condition keys in the KMS key policy.

D.  

Use an SCP to deny EC2 and allow Lambda.

Discussion 0
Questions 11

A company needs a cloud-based, managed desktop solution for its workforce of remote employees. The company wants to ensure that the employees can access the desktops only by using company-provided devices. A security engineer must design a solution that will minimize cost and management overhead.

Which solution will meet these requirements?

Options:

A.  

Deploy a custom virtual desktop infrastructure (VDI) solution with a restriction policy to allow access only from corporate devices.

B.  

Deploy a fleet of Amazon EC2 instances. Assign an instance to each employee with certificate-based device authentication that uses Windows Active Directory.

C.  

Deploy Amazon WorkSpaces. Set up a trusted device policy with IP blocking on the authentication gateway by using AWS Identity and Access Management (IAM).

D.  

Deploy Amazon WorkSpaces. Create client certificates, and deploy them to trusted devices. Enable restricted access at the directory level.

Discussion 0
Questions 12

A company is running a new workload across accounts in an organization in AWS Organizations. All running resources must have a tag of CostCenter, and the tag must have one of three approved values. The company must enforce this policy and must prevent any changes of the CostCenter tag to a non-approved value.

Which solution will meet these requirements?

Options:

A.  

Use AWS Config custom policy rule and an SCP to deny non-approved aws:RequestTag/CostCenter values.

B.  

Use CloudTrail + EventBridge + Lambda to block creation.

C.  

Enable tag policies, define allowed values, enforce noncompliant operations, and use an SCP to deny creation when aws:RequestTag/CostCenter is null.

D.  

Enable tag policies and use EventBridge + Lambda to block changes.

Discussion 0
Questions 13

Notify when IAM roles are modified.

Options:

A.  

Use Amazon Detective.

B.  

Use EventBridge with CloudTrail events.

C.  

Use CloudWatch metric filters.

D.  

Use CloudWatch subscription filters.

Discussion 0
Questions 14

A company must inventory sensitive data across all Amazon S3 buckets in all accounts from a single security account.

Options:

A.  

Delegate Amazon Macie and Security Hub administration.

B.  

Use Amazon Inspector with Security Hub.

C.  

Use Inspector with Trusted Advisor.

D.  

Use Macie with Trusted Advisor.

Discussion 0
Questions 15

A company uses AWS IAM Identity Center to manage access to its AWS accounts. The accounts are in an organization in AWS Organizations. A security engineer needs to set up delegated administration of IAM Identity Center in the organization’s management account.

Which combination of steps should the security engineer perform in IAM Identity Center before configuring delegated administration? (Select THREE.)

Options:

A.  

Grant least privilege access to the organization's management account.

B.  

Create a new IAM Identity Center directory in the organization's management account.

C.  

Set up a second AWS Region in the organization’s management account.

D.  

Create permission sets for use only in the organization's management account.

E.  

Create IAM users for use only in the organization's management account.

F.  

Create user assignments only in the organization's management account.

Discussion 0
Questions 16

A company needs to build a code-signing solution using an AWS KMS asymmetric key and must store immutable evidence of key creation and usage for compliance and audit purposes.

Which solution meets these requirements?

Options:

A.  

Create an Amazon S3 bucket with S3 Object Lock enabled. Create an AWS CloudTrail trail with log file validation enabled for KMS events. Store logs in the bucket and grant auditors access.

B.  

Log application events to Amazon CloudWatch Logs and export them.

C.  

Capture KMS API calls using EventBridge and store them in DynamoDB.

D.  

Track KMS usage with CloudWatch metrics and dashboards.

Discussion 0
Questions 17

CloudFormation stack deployments fail for some users due to permission inconsistencies.

Which combination of steps will ensure consistent deployments MOST securely? (Select THREE.)

Options:

A.  

Create a composite principal service role.

B.  

Create a service role with cloudformation.amazonaws.com as the principal.

C.  

Attach scoped policies to the service role.

D.  

Attach service ARNs in policy resources.

E.  

Update each stack to use the service role.

F.  

Allow iam:PassRole to the service role.

Discussion 0
Questions 18

A company experienced a security incident caused by a vulnerable container image that was pushed from an external CI/CD pipeline into Amazon ECR.

Which solution will prevent vulnerable images from being pushed?

Options:

A.  

Enable ECR enhanced scanning with Lambda blocking.

B.  

Use Amazon Inspector with EventBridge and Lambda.

C.  

Integrate Amazon Inspector into the CI/CD pipeline using SBOM generation and fail the pipeline on critical findings.

D.  

Enable basic continuous ECR scanning.

Discussion 0
Questions 19

A company detects bot activity targeting Amazon Cognito user pool endpoints. The solution must block malicious requests while maintaining access for legitimate users.

Which solution meets these requirements?

Options:

A.  

Enable Amazon Cognito threat protection.

B.  

Restrict access to authenticated users only.

C.  

Associate AWS WAF with the Cognito user pool.

D.  

Monitor requests with CloudWatch.

Discussion 0
Questions 20

A security engineer wants to forward custom application-security logs from an Amazon EC2 instance to Amazon CloudWatch. The security engineer installs the CloudWatch agent on the EC2 instance and adds the path of the logs to the CloudWatch configuration file.

However, CloudWatch does not receive the logs. The security engineer verifies that the awslogs service is running on the EC2 instance.

What should the security engineer do next to resolve the issue?

Options:

A.  

Add AWS CloudTrail to the trust policy of the EC2 instance. Send the custom logs to CloudTrail instead of CloudWatch.

B.  

Add Amazon S3 to the trust policy of the EC2 instance. Configure the application to write the custom logs to an S3 bucket that CloudWatch can use to ingest the logs.

C.  

Add Amazon Inspector to the trust policy of the EC2 instance. Use Amazon Inspector instead of the CloudWatch agent to collect the custom logs.

D.  

Attach the CloudWatchAgentServerPolicy AWS managed policy to the EC2 instance role.

Discussion 0
Questions 21

A company is planning to deploy a new log analysis environment. The company needs to analyze logs from multiple AWS services in near real time. The solution must provide the ability to search the logs and must send alerts to an existing Amazon Simple Notification Service (Amazon SNS) topic when specific logs match detection rules.

Which solution will meet these requirements?

Options:

A.  

Analyze the logs by using Amazon OpenSearch Service. Search the logs from the OpenSearch API. Use OpenSearch Service Security Analytics to match logs with detection rules and to send alerts to the SNS topic.

B.  

Analyze the logs by using AWS Security Hub. Search the logs from the Findings page in Security Hub. Create custom actions to match logs with detection rules and to send alerts to the SNS topic.

C.  

Analyze the logs by using Amazon CloudWatch Logs. Use a subscription filter to match logs with detection rules and to send alerts to the SNS topic. Search the logs manually by using CloudWatch Logs Insights.

D.  

Analyze the logs by using Amazon QuickSight. Search the logs by listing the query results in a dashboard. Run queries to match logs with detection rules and to send alerts to the SNS topic.

Discussion 0
Questions 22

AWS Config cannot deliver configuration snapshots to Amazon S3.

Which TWO actions will remediate this issue?

Options:

A.  

Verify the S3 bucket policy allows config.amazonaws.com.

B.  

Verify the IAM role has s3:GetBucketAcl and s3:PutObject permissions.

C.  

Verify the S3 bucket can assume the IAM role.

D.  

Verify IAM policy allows AWS Config to write logs.

E.  

Modify AWS Config API permissions.

Discussion 0
Questions 23

A company’s developers are using AWS Lambda function URLs to invoke functions directly. The company must ensure that developers cannot configure or deploy unauthenticated functions inproduction accounts. The company wants to meet this requirement by using AWS Organizations. The solution must not require additional work for the developers.

Which solution will meet these requirements?

Options:

A.  

Require the developers to configure all function URLs to support cross-origin resource sharing (CORS) when the functions are called from a different domain.

B.  

Use an AWS WAF delegated administrator account to view and block unauthenticated access to function URLs in production accounts, based on the OU of accounts that are using the functions.

C.  

Use SCPs to allow all lambda:CreateFunctionUrlConfig and lambda:UpdateFunctionUrlConfig actions that have a lambda:FunctionUrlAuthType condition key value of AWS_IAM.

D.  

Use SCPs to deny all lambda:CreateFunctionUrlConfig and lambda:UpdateFunctionUrlConfig actions that have a lambda:FunctionUrlAuthType condition key value of NONE.

Discussion 0
Questions 24

A company uses AWS Organizations and has an SCP at the root that prevents sharing resources with external accounts. The company now needs to allow only the marketing account to share resources externally while preventing all other accounts from doing so. All accounts are in the same OU.

Which solution will meet these requirements?

Options:

A.  

Create a new SCP in the marketing account to explicitly allow sharing.

B.  

Edit the existing SCP to add a condition that excludes the marketing account.

C.  

Edit the SCP to include an Allow statement for the marketing account.

D.  

Use a permissions boundary in the marketing account.

Discussion 0