1
AWS Certified Security – Specialty
(SCS-C03) Practice Exam 150
Advanced Multiple-Choice
Questions with Detailed
Explanations a well detailed one
written and graded
A+ upgraded
Domain 1: Detection (16%)
Question 1
A Security Engineer is designing a centralized logging architecture for a multi-account AWS
Organization. The organization has 50 accounts and requires that all CloudTrail logs, VPC Flow
Logs, and DNS query logs be aggregated into a single account for analysis. The solution must
ensure logs are immutable for compliance purposes and must minimize operational overhead.
Which approach should the Engineer implement?
A) Configure each account to deliver logs to individual S3 buckets, then use S3 replication to
copy logs to the central account
, 2
B) Create an organization trail in AWS CloudTrail that delivers logs to an S3 bucket in the central
account with S3 Object Lock enabled
C) Configure Amazon CloudWatch Logs in each account with a subscription filter to stream logs
to a central Kinesis Data Firehose delivery stream
D) Use AWS Lambda functions in each account to periodically copy logs to a central S3 bucket
Correct Answer: B
Rationale: An organization trail in CloudTrail automatically delivers logs from all accounts in an
AWS Organization to a single S3 bucket. S3 Object Lock provides Write-Once-Read-Many
(WORM) protection, ensuring logs cannot be altered or deleted for compliance and forensic
analysis. This approach minimizes operational overhead by eliminating per-account
configuration.
Question 2
Which AWS service provides continuous threat detection by analyzing CloudTrail event logs, VPC
Flow Logs, and DNS query logs to generate security findings?
A) AWS Config
B) Amazon GuardDuty
C) AWS Security Hub
D) Amazon Detective
Correct Answer: B
Rationale: Amazon GuardDuty is a threat detection service that continuously monitors for
malicious activity and unauthorized behavior. It ingests and analyzes CloudTrail event logs, VPC
Flow Logs, and DNS query logs to generate findings.
Question 3
A Security Engineer needs to detect when an IAM user's access keys are older than 90 days and
automatically trigger a remediation workflow. Which combination of AWS services should be
used?
A) AWS Config with custom rule and Amazon EventBridge
B) Amazon GuardDuty with AWS Lambda
C) AWS Trusted Advisor with Amazon SNS
D) AWS CloudTrail with Amazon CloudWatch Logs
Correct Answer: A
Rationale: AWS Config can evaluate IAM user access key age against a custom rule. When a
, 3
non-compliant resource is detected, AWS Config can send events to Amazon EventBridge, which
can then trigger automated remediation workflows via AWS Lambda or Systems Manager
Automation.
Question 4
A company has enabled Amazon GuardDuty in all AWS regions. The security team receives a
high volume of GuardDuty findings, making it difficult to prioritize critical threats. What is the
MOST effective approach to centralize and prioritize these findings?
A) Configure GuardDuty to send all findings to Amazon S3 and use Athena for query analysis
B) Enable AWS Security Hub to aggregate GuardDuty findings and use its insight features for
prioritization
C) Create CloudWatch alarms for each GuardDuty finding type
D) Use AWS Config to evaluate GuardDuty findings against compliance rules
Correct Answer: B
Rationale: AWS Security Hub aggregates findings from GuardDuty and other AWS security
services into a single dashboard. Its insight features allow security teams to identify trends and
prioritize findings based on severity and other criteria. Security Hub provides a centralized view
and automated compliance checks.
Question 5
A Security Engineer needs to monitor for unauthorized API calls made from outside the
company's corporate IP range. Which approach provides the MOST comprehensive detection
capability?
A) Configure AWS CloudTrail with a trail that delivers logs to CloudWatch Logs and create metric
filters for API calls from non-corporate IPs
B) Enable Amazon GuardDuty and review the findings for unauthorized access patterns
C) Create a custom AWS Config rule that evaluates CloudTrail logs for source IP addresses
D) Use AWS Trusted Advisor to monitor for unusual API activity
Correct Answer: A
Rationale: CloudTrail logs contain source IP information for every API call. By delivering
CloudTrail logs to CloudWatch Logs and creating metric filters that match API calls from IP
addresses outside the corporate range, security teams can create alarms and trigger automated
responses. This provides granular, customizable detection.
, 4
Question 6
An organization uses AWS Organizations and wants to detect when new IAM users are created
in any member account. Which service combination provides the MOST effective detection?
A) AWS Config with an organization-level rule
B) AWS CloudTrail with organization trail and CloudWatch Events
C) Amazon GuardDuty with threat intelligence feeds
D) AWS Security Hub with custom insight
Correct Answer: B
Rationale: An organization trail in CloudTrail records API calls across all member accounts.
The CreateUser API call in IAM can be detected by creating a CloudWatch Events rule (now
EventBridge) that matches this event pattern. This provides real-time detection of user creation
events across the entire organization.
Question 7
A Security Engineer needs to detect configuration drift in Amazon EC2 security groups. The
solution must identify security groups that allow unrestricted inbound access (0.0.0.0/0) on port
22. Which AWS service should be used?
A) Amazon GuardDuty
B) AWS Config
C) AWS Trusted Advisor
D) Amazon Inspector
Correct Answer: B
Rationale: AWS Config continuously monitors resource configurations and can evaluate them
against rules. A managed rule or custom rule can check whether security group inbound rules
allow 0.0.0.0/0 on SSH port 22. When a non-compliant security group is detected, AWS Config
can trigger notifications and remediation.
Question 8
A company has deployed Amazon GuardDuty and notices that no findings are being generated
for a specific region. What is the MOST likely cause?
A) GuardDuty does not support that region
B) GuardDuty must be enabled in each region where the company has resources
C) There are no threats in that region
D) The region lacks CloudTrail integration
AWS Certified Security – Specialty
(SCS-C03) Practice Exam 150
Advanced Multiple-Choice
Questions with Detailed
Explanations a well detailed one
written and graded
A+ upgraded
Domain 1: Detection (16%)
Question 1
A Security Engineer is designing a centralized logging architecture for a multi-account AWS
Organization. The organization has 50 accounts and requires that all CloudTrail logs, VPC Flow
Logs, and DNS query logs be aggregated into a single account for analysis. The solution must
ensure logs are immutable for compliance purposes and must minimize operational overhead.
Which approach should the Engineer implement?
A) Configure each account to deliver logs to individual S3 buckets, then use S3 replication to
copy logs to the central account
, 2
B) Create an organization trail in AWS CloudTrail that delivers logs to an S3 bucket in the central
account with S3 Object Lock enabled
C) Configure Amazon CloudWatch Logs in each account with a subscription filter to stream logs
to a central Kinesis Data Firehose delivery stream
D) Use AWS Lambda functions in each account to periodically copy logs to a central S3 bucket
Correct Answer: B
Rationale: An organization trail in CloudTrail automatically delivers logs from all accounts in an
AWS Organization to a single S3 bucket. S3 Object Lock provides Write-Once-Read-Many
(WORM) protection, ensuring logs cannot be altered or deleted for compliance and forensic
analysis. This approach minimizes operational overhead by eliminating per-account
configuration.
Question 2
Which AWS service provides continuous threat detection by analyzing CloudTrail event logs, VPC
Flow Logs, and DNS query logs to generate security findings?
A) AWS Config
B) Amazon GuardDuty
C) AWS Security Hub
D) Amazon Detective
Correct Answer: B
Rationale: Amazon GuardDuty is a threat detection service that continuously monitors for
malicious activity and unauthorized behavior. It ingests and analyzes CloudTrail event logs, VPC
Flow Logs, and DNS query logs to generate findings.
Question 3
A Security Engineer needs to detect when an IAM user's access keys are older than 90 days and
automatically trigger a remediation workflow. Which combination of AWS services should be
used?
A) AWS Config with custom rule and Amazon EventBridge
B) Amazon GuardDuty with AWS Lambda
C) AWS Trusted Advisor with Amazon SNS
D) AWS CloudTrail with Amazon CloudWatch Logs
Correct Answer: A
Rationale: AWS Config can evaluate IAM user access key age against a custom rule. When a
, 3
non-compliant resource is detected, AWS Config can send events to Amazon EventBridge, which
can then trigger automated remediation workflows via AWS Lambda or Systems Manager
Automation.
Question 4
A company has enabled Amazon GuardDuty in all AWS regions. The security team receives a
high volume of GuardDuty findings, making it difficult to prioritize critical threats. What is the
MOST effective approach to centralize and prioritize these findings?
A) Configure GuardDuty to send all findings to Amazon S3 and use Athena for query analysis
B) Enable AWS Security Hub to aggregate GuardDuty findings and use its insight features for
prioritization
C) Create CloudWatch alarms for each GuardDuty finding type
D) Use AWS Config to evaluate GuardDuty findings against compliance rules
Correct Answer: B
Rationale: AWS Security Hub aggregates findings from GuardDuty and other AWS security
services into a single dashboard. Its insight features allow security teams to identify trends and
prioritize findings based on severity and other criteria. Security Hub provides a centralized view
and automated compliance checks.
Question 5
A Security Engineer needs to monitor for unauthorized API calls made from outside the
company's corporate IP range. Which approach provides the MOST comprehensive detection
capability?
A) Configure AWS CloudTrail with a trail that delivers logs to CloudWatch Logs and create metric
filters for API calls from non-corporate IPs
B) Enable Amazon GuardDuty and review the findings for unauthorized access patterns
C) Create a custom AWS Config rule that evaluates CloudTrail logs for source IP addresses
D) Use AWS Trusted Advisor to monitor for unusual API activity
Correct Answer: A
Rationale: CloudTrail logs contain source IP information for every API call. By delivering
CloudTrail logs to CloudWatch Logs and creating metric filters that match API calls from IP
addresses outside the corporate range, security teams can create alarms and trigger automated
responses. This provides granular, customizable detection.
, 4
Question 6
An organization uses AWS Organizations and wants to detect when new IAM users are created
in any member account. Which service combination provides the MOST effective detection?
A) AWS Config with an organization-level rule
B) AWS CloudTrail with organization trail and CloudWatch Events
C) Amazon GuardDuty with threat intelligence feeds
D) AWS Security Hub with custom insight
Correct Answer: B
Rationale: An organization trail in CloudTrail records API calls across all member accounts.
The CreateUser API call in IAM can be detected by creating a CloudWatch Events rule (now
EventBridge) that matches this event pattern. This provides real-time detection of user creation
events across the entire organization.
Question 7
A Security Engineer needs to detect configuration drift in Amazon EC2 security groups. The
solution must identify security groups that allow unrestricted inbound access (0.0.0.0/0) on port
22. Which AWS service should be used?
A) Amazon GuardDuty
B) AWS Config
C) AWS Trusted Advisor
D) Amazon Inspector
Correct Answer: B
Rationale: AWS Config continuously monitors resource configurations and can evaluate them
against rules. A managed rule or custom rule can check whether security group inbound rules
allow 0.0.0.0/0 on SSH port 22. When a non-compliant security group is detected, AWS Config
can trigger notifications and remediation.
Question 8
A company has deployed Amazon GuardDuty and notices that no findings are being generated
for a specific region. What is the MOST likely cause?
A) GuardDuty does not support that region
B) GuardDuty must be enabled in each region where the company has resources
C) There are no threats in that region
D) The region lacks CloudTrail integration
