support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. Amazon
  4. AWS Certified Security - Specialty SCS-C03

Free AWS Certified Security - Specialty SCS-C03 Exam Braindumps
AWS Certified Security - Specialty SCS-C03 Questions 11–15 (page: 4)

Updated On: 10-Feb-2026
Page 4 of 14
PDF with 85 Questions

A company has installed a third-party application that is distributed on several Amazon EC2 instances and on- premises servers. Occasionally, the company's IT team needs to use SSH to connect to each machine to perform software maintenance tasks. Outside these time slots, the machines must be completely isolated from the rest of the network. The company does not want to maintain any SSH keys. Additionally, the company wants to pay only for machine hours when there is an SSH connection.

Which solution will meet these requirements?

  1. Create a bastion host with port forwarding to connect to the machines.
  2. Set up AWS Systems Manager Session Manager to allow temporary connections.
  3. Use AWS CloudShell to create serverless connections.
  4. Set up an interface VPC endpoint for each machine for private connection.

Answer(s): B

Explanation:

Systems Manager Session Manager provides browser/CLI-based interactive shell access without SSH keys and can be tightly controlled through IAM and Session Manager preferences. Instances can remain network- isolated (no inbound SSH, no public access), and access is enabled only when a session is started.



A company runs several applications on Amazon Elastic Kubernetes Service (Amazon EKS). The company needs a solution to detect any Kubernetes security risks by monitoring Amazon EKS audit logs in addition to operating system, networking, and file events. The solution must send email alerts for any identified risks to a mailing list that is associated with a security team.

Which solution will meet these requirements?

  1. Deploy AWS Security Hub and enable security standards that contain EKS controls. Create an Amazon Simple Notification Service (Amazon SNS) topic and set the security team's mailiing list as a subscriber.
    Use an Amazon EventBridge rule to send relevant Security Hub events to the SNS topic.
  2. Enable Amazon Inspector container image scanning. Configure Amazon Detective to analyze EKS security logs. Create Amazon CloudWatch log groups for EKS audit logs. Use an AWS Lambda function to process the logs and to send email alerts to the security team.
  3. Enable Amazon GuardDuty Enable EKS Protection and Runtime Monitoring for Amazon EKS in GuardDuty.
    Create an Amazon Simple Notification Service (Amazon SNS) topic and set the security team's mailing list as a subscriber. Use an Amazon EventBridge rule to send relevant GuardDuty events to the SNS topic.
  4. Install the AWS Systems Manager Agent (SSM Agent) on all EKS nodes. Configure Amazon CloudWatch Logs lo collect EKS audit logs. Create an Amazon Simple Notification Service (Amazon SNS) topic and set the security team's mailing list as a subscriber. Configure a CloudWatch alarm to publish a message to the SNS topic when now audit logs are generated.

Answer(s): C

Explanation:

GuardDuty EKS Protection analyzes EKS audit logs for Kubernetes threats, and GuardDuty Runtime Monitoring covers operating system, network, and file activity at runtime. EventBridge can route GuardDuty findings to an SNS topic that emails the security team's mailing list.



A company allows users to download its mobile app onto their phones. The app is MQTT based and connects to AWS IoT Core lo subscribe la specific client-related topics.

Recently, the company discovered that some malicious attackers have been trying to get a Trojan horse onto legitimate mobile phones. The Trojan horse poses as the authentic application and uses a client ID with injected special characters to gain access to topics outside the client's privilege scope.

Which combination of actions should the company take to prevent this threat? (Choose two.)

  1. In the application, use an IoT thing name as the client ID to conned the device to AWS IoT Core.
  2. In the application, add a client ID check. Disconnect from the server if any special character is detected.
  3. Apply an AWS IoT Core policy that allows "AWSIoTWirelessDataAccess" with the principal set to "client/${iot:Connection.Thing.ThingName}"
  4. Apply an AWS IoT Core policy to the device to allow "iot:Connect" with the resource set to "client/${iot:ClientId}".
  5. Apply an AWS IoT Core policy to the device to allow "iot:Connect" with the resource set to "client/${iot:Connection.Thing.ThingName)".

Answer(s): A,E

Explanation:

Using the IoT thing name as the client ID ensures a fixed, known identifier that cannot be manipulated with injected characters. Binding the iot:Connect permission in the IoT policy to the thing name enforces that only a client whose client ID exactly matches the associated thing name can connect, preventing unauthorized topic access through crafted client IDs.



A security engineer wants to evaluate configuration changes to a specific AWS resource to ensure that the resource meets compliance standards. However, the security engineer is concerned about a situation in which several configuration changes are made to the resource in quick succession. The security engineer wants to record only the latest configuration of that resource to indicate the cumulative impact of the set of changes.

Which solution will meet this requirement in the MOST operationally efficient way?

  1. Use AWS CloudTrail to detect the configuration changes by filtering API calls to monitor the changes. Use the most recent API call to indicate the cumulative impact of multiple calls.
  2. Use AWS Config to detect the configuration changes and to record the latest configuration in case of multiple configuration changes.
  3. Use Amazon CloudWatch to detect the configuration changes by filtering API calls to monitor the changes.
    Use the most recent API call to indicate the cumulative impact of multiple calls.
  4. Use AWS Cloud Map to detect the configuration changes. Generate a report of configuration changes from AWS Cloud Map to track the latest state by using a sliding time window.

Answer(s): B

Explanation:

AWS Config continuously evaluates and records the configuration state of AWS resources and maintains the latest configuration snapshot, even when multiple changes occur in rapid succession. This allows assessment of the final, cumulative configuration state in the most operationally efficient manner.



A security engineer needs to implement a solution to create and control the keys that a company uses for cryptographic operations. The security engineer must create symmetric keys in which the key material is generated and used within a custom key store that is backed by an AWS CloudHSM cluster.

The security engineer will use symmetric and asymmetric data key pairs for local use within applications. The security engineer also must audit the use of the keys.

How can the security engineer meet these requirements?

  1. To create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster. For auditing, use Amazon Athena.
  2. To create the keys, use Amazon S3 and the custom key stores with the CloudHSM cluster. For auditing, use AWS CloudTrail.
  3. To create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster. For auditing, use Amazon GuardDuty.
  4. To create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster. For auditing, use AWS CloudTrail.

Answer(s): D

Explanation:

AWS KMS with a custom key store backed by an AWS CloudHSM cluster creates and uses symmetric CMKs with key material generated and retained within the CloudHSMs. KMS also supports generating data keys and data key pairs for local application use, and AWS CloudTrail provides the required audit logging for KMS key usage and management events.



  PDF
Viewing page 4 of 14
Viewing questions 16 - 20 out of 85 questions


Post your Comments and Discuss Amazon AWS Certified Security - Specialty SCS-C03 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!