support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. Amazon
  4. AWS Certified Security - Specialty SCS-C03

Free AWS Certified Security - Specialty SCS-C03 Exam Braindumps
AWS Certified Security - Specialty SCS-C03 Questions 6–10 (page: 3)

Updated On: 10-Feb-2026
Page 3 of 14
PDF with 85 Questions

What is the effect of the following AWS Key Management Service (AWS KMS} key policy that is attached to a customer managed key?

  1. Amazon WorkMail and Amazon Simple Email Service (Amazon SES) have delegated KMS encrypt and decrypt permissions to the ExampleRole principal in the 111122223333 account.
  2. The ExampleRole principal can transparently encrypt and decrypt email exchanges specifically between ExampleRole and AWS.
  3. The customer managed key can be used for encrypting and decrypting only when the principal is ExampleRole and when the request comes from Amazon WorkMail or Amazon Simple Email Service (Amazon SES) in the specified AWS Region.
  4. The key policy allows Amazon WorkMail or Amazon Simple Email Service (Amazon SES) to encrypt or decrypt on behalf of the ExampleRole for any customer managed key in the account.

Answer(s): C

Explanation:

The key policy allows the specified IAM role to use the customer managed key for cryptographic operations only when the request is made through Amazon WorkMail or Amazon SES in the specified Region, as enforced by the kms:ViaService condition.



A company wants to deny a specific federated user named Bob access to an Amazon S3 bucket named DOC- EXAMPLE-BUCKET. The company wants to meet this requirement by using a bucket policy. The company also needs to ensure that this bucket policy affects Bob's S3 permissions only. Any other permissions that Bob has must remain intact.

Which policy should the company use to meet these requirements?





Answer(s): B

Explanation:

This policy uses an explicit deny that targets only the federated user session ARN for Bob. Because the deny is scoped to the specified S3 bucket resource, it blocks Bob's access to that bucket while leaving any of Bob's other permissions outside this bucket unaffected.



HOTSPOT (Drag and Drop is not supported)

A company is designing its security monitoring strategy for an existing sensitive workload on AWS. The security team has identified several scenarios that require monitoring strategies. Select the correct monitoring strategy from the following list for each monitoring scenario. Select each monitoring strategy one time.

Automatically isolate Amazon EC2 distances when malware detection findings are confirmed.

Correlate security findings from multiple AWS detection services to identify multi-stage attacks.

Detect when privileged users perform an unusually high volume of resource deletion operations.

Identify patterns of more than 50 failed authentication attempts from specific IP addresses in 1 hour.

Monitor network traffic patterns especially large data transfers to external IP addresses outside normal office hours.

Configure VPC Flow Logs with Amazon CloudWatch Logs Insights queries to analyze traffic volume and destination patterns during specific time windows.

Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:




Configure VPC Flow Logs with Amazon CloudWatch Logs Insights queries to analyze traffic volume and destination patterns during specific time windows.

Answer; Monitor network traffic patterns especially large data transfers to external IP addresses outside normal office hours.
Explanation; VPC Flow Logs analyzed with Logs Insights can be queried by time window, destination IP, and bytes transferred to identify abnormal outbound data movement patterns.

Create Amazon CloudWatch metric filters on application logs to track authentication failure rates for each source IP address with hourly aggregation.

Answer; Identify patterns of more than 50 failed authentication attempts from specific IP addresses in 1 hour.
Explanation; Metric filters can count repeated authentication failures per source IP and aggregate them hourly to detect brute-force patterns.

Enable AWS CloudTrail Insights for API call rate analysis to establish baselines and then detect anomalous API activity patterns.

Answer; Detect when privileged users perform an unusually high volume of resource deletion operations.
Explanation; CloudTrail Insights detects unusual spikes in API call rates (including destructive actions), helping flag abnormal deletion bursts by privileged identities.

Implement AWS Security Hub custom insights with Amazon EventBridge rules to invoke automated AWS Lambda functions for coordinated incident response.

Answer; Automatically isolate Amazon EC2 instances when malware detection findings are confirmed.
Explanation; Security Hub can surface high-confidence malware-related findings and EventBridge can trigger Lambda-based remediation to quarantine affected instances.

Configure VPC Flow Logs with Amazon CloudWatch Logs Insights queries to analyze traffic volume and destination patterns during specific time windows.

Answer; Correlate security findings from multiple AWS detection services to identify multi-stage attacks.
Explanation; This requirement is met by aggregating and correlating findings across services (for example through a central findings service and insights), rather than by network-flow analysis alone.



A company needs a solution to protect critical data from being permanently deleted. The data is stored in Amazon S3 buckets.

The company needs to replicate the S3 objects from the company's primary AWS Region to a secondary Region to meet disaster recovery requirements. The company must also ensure that users who have administrator access cannot permanently delete the data in the secondary Region.

Which solution will meet these requirements?

  1. Configure AWS Backup to perform cross-Region S3 backups. Select a backup vault in the secondary Region. Enable AWS Backup Vault Lock in governance mode for the backups in the secondary Region.
  2. Implement S3 Object Lock in compliance mode in the primary Region. Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region.
  3. Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region. Create an S3 bucket policy to deny the s3:ReplicateDelete action on the S3 bucket in the secondary Region.
  4. Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region. Configure S3 object versioning on the S3 bucket in the secondary Region.

Answer(s): A

Explanation:

AWS Backup with cross-Region backups provides replication to a secondary Region, and enabling Backup Vault Lock in governance mode prevents even administrators from permanently deleting backup data, ensuring immutability and meeting disaster recovery and data protection requirements.



A security engineer is responding to an incident that is affecting an AWS account. The ID of the account is 1234156789012. The attack created workloads that are distributed across multiple AWS Regions.

The security engineer contains the attack. The security engineer removes all compute and storage resources from all affected Regions. However, the attacker also created an AWS KMS key. The key policy on the KMS key explicitly allows IAM principal kms:* permissions.

The key was scheduled to be deleted the previous day. However, the key is still enabled and usable. The key has an ARN of arn:aws;kms:us-east-2:123456789012:key/mrk-0bb0212cd9864fdea0dcamzo26efb5670. The security engineer must delete the key as quickly as possible.

Which solution will meet this requirement?

  1. Log in to the account by using the account root user credentials. Re-issue the deletion request for the KMS key with a waiting period of 7 days.
  2. Identify the other Regions where the KMS key ID is present and schedule the key for deletion in 7 days.
  3. Update the IAM principal lo allow kms:* permissions on the KMS key ARN. Re-issue the deletion request for the KMS key with a waiting period of 7 days.
  4. Disable the KMS key. Re-issue the deletion request for the KMS key in 30 days.

Answer(s): B

Explanation:

The ARN indicates a multi-Region KMS key (the mrk- prefix). A multi-Region key has related key material in each replicated Region, and scheduling deletion must be done for the key in each Region where it exists.
Deleting it everywhere is the fastest way to ensure the key is no longer usable across Regions.



  PDF
Viewing page 3 of 14
Viewing questions 11 - 15 out of 85 questions


Post your Comments and Discuss Amazon AWS Certified Security - Specialty SCS-C03 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!