Free Amazon SCS-C03 Exam Questions
Absolute Free SCS-C03 Exam Practice for Comprehensive Preparation
-
Amazon SCS-C03 Exam Questions
-
Provided By: Amazon
- Exam: AWS Certified Security - Specialty
- Certification: AWS Certified Security
-
Total Questions: 178
-
Updated On: Jul 25, 2026
-
Rated: 4.9 |
-
Online Users: 356
-
Question 1
-
An ecommerce website was down for 1 hour following a DDoS attack. Users were unable to connectto the website during the attack period. The ecommerce company's security team is worried aboutfuture potential attacks and wants to prepare for such events. The company needs to minimizedowntime in its response to similar attacks in the future.Which steps would help achieve this? (Select TWO.)
Answer: B,E
-
An ecommerce website was down for 1 hour following a DDoS attack. Users were unable to connectto the website during the attack period. The ecommerce company's security team is worried aboutfuture potential attacks and wants to prepare for such events. The company needs to minimizedowntime in its response to similar attacks in the future.Which steps would help achieve this? (Select TWO.)
-
Question 2
-
A company hosts its public website on Amazon EC2 instances behind an Application Load Balancer (ALB).
The website is experiencing a global DDoS attack by a specific IoT device brand that has a unique user agent.
A security engineer is creating an AWS WAF web ACL and will associate the web ACL with the ALB. The
security engineer must implement a rule statement as part of the web ACL to block the requests. The rule
statement must mitigate the current attack and future attacks from these IoT devices without blocking requests
from customers.
Which rule statement will meet these requirements?
Answer: D
-
A company hosts its public website on Amazon EC2 instances behind an Application Load Balancer (ALB).
The website is experiencing a global DDoS attack by a specific IoT device brand that has a unique user agent.
A security engineer is creating an AWS WAF web ACL and will associate the web ACL with the ALB. The
security engineer must implement a rule statement as part of the web ACL to block the requests. The rule
statement must mitigate the current attack and future attacks from these IoT devices without blocking requests
from customers.
Which rule statement will meet these requirements?
-
Question 3
-
A company is running a new workload across accounts in an organization in AWS Organizations. All running
resources must have a tag of CostCenter, and the tag must have one of three approved values. The company
must enforce this policy and must prevent any changes of the CostCenter tag to a non-approved value.
Which solution will meet these requirements?
Answer: C
-
A company is running a new workload across accounts in an organization in AWS Organizations. All running
resources must have a tag of CostCenter, and the tag must have one of three approved values. The company
must enforce this policy and must prevent any changes of the CostCenter tag to a non-approved value.
Which solution will meet these requirements?
-
Question 4
-
A company uses an organization in AWS Organizations to manage multiple AWS accounts. A securityengineer creates a WAF policy in AWS Firewall Manager in the us-east-1 Region. The securityengineer sets the policy scope to apply to resources that are tagged withWAF-protected:truein oneof the member accounts in the organization. The security engineer sets up a configuration toautomatically remediate any noncompliant resources.In a member account, the security engineer attempts to protect an Amazon API Gateway REST API inthe us-east-1 Region by using a web ACL. However, after several minutes, the REST API is still notassociated with the web ACL.What is the likely cause of this issue?
Answer: B
-
A company uses an organization in AWS Organizations to manage multiple AWS accounts. A securityengineer creates a WAF policy in AWS Firewall Manager in the us-east-1 Region. The securityengineer sets the policy scope to apply to resources that are tagged withWAF-protected:truein oneof the member accounts in the organization. The security engineer sets up a configuration toautomatically remediate any noncompliant resources.In a member account, the security engineer attempts to protect an Amazon API Gateway REST API inthe us-east-1 Region by using a web ACL. However, after several minutes, the REST API is still notassociated with the web ACL.What is the likely cause of this issue?
-
Question 5
-
A company is using AWS to run a long-running analysis process on data that is stored in Amazon S3 buckets.
The process runs on a fleet of Amazon EC2 instances in an Auto Scaling group. The EC2 instances are
deployed in a private subnet that does not have internet access.
The EC2 instances access Amazon S3 through an S3 gateway endpoint that has the default access policy.
Each EC2 instance uses an instance profile role that allows s3:GetObject and s3:PutObject only for required
S3 buckets.
The company learns that one or more EC2 instances are compromised and are exfiltrating data to an S3
bucket that isoutside the company’s AWS Organization. The processing job must continue to function.
Which solution will meet these requirements?
Answer: A
-
A company is using AWS to run a long-running analysis process on data that is stored in Amazon S3 buckets.
The process runs on a fleet of Amazon EC2 instances in an Auto Scaling group. The EC2 instances are
deployed in a private subnet that does not have internet access.
The EC2 instances access Amazon S3 through an S3 gateway endpoint that has the default access policy.
Each EC2 instance uses an instance profile role that allows s3:GetObject and s3:PutObject only for required
S3 buckets.
The company learns that one or more EC2 instances are compromised and are exfiltrating data to an S3
bucket that isoutside the company’s AWS Organization. The processing job must continue to function.
Which solution will meet these requirements?