Security Specialty SCS-C03 Practice Questions & Answers • ExamPrepare

Question 1

A company stores images for a website in an Amazon S3 bucket. The company is using Amazon CloudFront to serve the images to end users. The company recently discovered that the images are being accessed from countries where the company does not have a distribution license.

Which actions should the company take to secure the images to limit their distribution? (Select TWO.)

Update the S3 bucket policy to restrict access to a CloudFront origin access control (OAC).
Update the website DNS record to use an Amazon Route 53 geolocation record deny list of countries where the company lacks a license.
Add a CloudFront geo restriction deny list of countries where the company lacks a license.
Update the S3 bucket policy with a deny list of countries where the company lacks a license.
Enable the Restrict Viewer Access option in CloudFront to create a deny list of countries where the company lacks a license.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

A company uses AWS Organizations. The company enables all features in Organizations. The company implements AWS Security Hub CSPM with a delegated administrator account.

The company wants to ensure consistency when tagging Amazon EC2 instances. All EC2 instances that have the Lifecycle tag must have a value of either Test or Production.

Which solution will meet this requirement?

Use Security Hub CSPM to enable a new security standard. Deploy the relevant controls to enforce the required tag values.
Create and deploy an RCP by using Organizations. Configure the RCP to enforce the required tag values.
Create and deploy a tag policy by using Organizations. Configure the tag policy to enforce the required tag values.
Create and deploy a declarative policy by using Security Hub CSPM. Configure the declarative policy to enforce the required tag values.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

A security engineer who was reviewing AWS KMS key policies found this statement in each key policy in the company AWS account.

{

"Sid": "Enable IAM User Permissions",

"Effect": "Allow",

"Principal": {

"AWS": "arn:aws:iam::111122223333:root”

},

"Action": "kms:*",

"Resource": "*"

}

What does the statement allow?

All principals from all AWS accounts to use the key
Only the root user from account 111122223333 to use the key
All principals from account 111122223333 to use the key but only on Amazon S3
Only principals from account 111122223333 that have an IAM policy applied that grants access to this key to use the key

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 4

A company stores infrastructure and application code in web-based, third-party, Git-compatible code repositories outside of AWS. The company wants to give the code repositories the ability to securely authenticate and assume an existing IAM role within the company's AWS account by using OpenID Connect (OIDC).

Which solution will meet these requirements?

Create an OIDC identity provider (IdP) by using IAM federation. Modify the trust policy of the IAM role to allow the code repositories to assume the IAM role.
Use IAM Roles Anywhere to create a trust anchor that uses OIDC. Modify the trust policy of the IAM role to allow the code repositories to assume the IAM role.
Set up an account instance of AWS IAM Identity Center. Configure access to the code repositories as a customer managed OIDC application. Grant the application access to the IAM role.
Use AWS Resource Access Manager (AWS RAM) to create a new resource share that uses OIDC. Limit the resource share to the specified code repositories. Grant the IAM role access to the resource share.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 5

An application team is developing an internal application in its AWS account. Employees will use the application to access their employee benefits information. The application has an Amazon S3 bucket that is encrypted with an AWS KMS customer managed key. The application team has configured an S3 gateway VPC endpoint for the application to use.

During testing, an IAM user is unable to download objects from the S3 bucket by using the AWS Management Console. However, other IAM users in the same AWS account can download objects from the S3 bucket.

Which policies or ACL should a security engineer review and modify to resolve this issue? (Select THREE.)

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 6

A security engineer creates an IAM role in AWS account 1111111111 for Company A. The security engineer provides the role ARN (arn:aws:iam::1111111111:role/DataIngestService) to a third-party service run by Company B in AWS account 2222222222. Company's B service uses this role to assume and ingest data from AWS account 1111111111.

Company B has other customers who also create roles in the customers' accounts for Company B to assume and ingest data from the accounts. Customers want only Company B's service to access the customers' data and no one else.

The role's trust policy is written as follows:

{

"Version": "2012-10-17"

"Statement": {

"Effect": "Allow",

"Principal": {

"AWS": "2222222222"

},

"Action": "sts:AssumeRole"

}

Which security issue arises from the role that the security engineer created?

Company B will be able to assume the role in Company A's account but will not be able to access any resources.
Any other customer of Company B will be able to access resources in Company A's AWS account by assuming the role from the customer's own AWS account.
Any other customer of Company B will be able to access resources in Company A's AWS account by providing Company B with the role ARN from Company A.
Any other customer of Company B who includes a condition that requires ExternalId to match Company A's AWS account ID in the customer's role will intercept requests from Company B to Company A.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.