Free SCS-C03 Practice Test

To properly segment traffic, private subnets must not have a direct route to the internet. Instead, they should route outbound internet traffic through a NAT gateway located in a public subnet. For high availability, a NAT gateway should be provisioned in each Availability Zone's public subnet (A). The route tables associated with the private subnets must then be modified to direct all internet-bound traffic (0.0.0.0/0) to the NAT gateway in their respective Availability Zone (D).

B. NAT gateways must be placed in a public subnet to have a route to the internet gateway; placing them in a private subnet would render them non-functional.
C. The local route for the VPC CIDR is automatically added to all route tables and cannot be modified. This option is not a valid action.
E. Routing 0.0.0.0/0 from a private subnet to the internet gateway is the definition of a public subnet and is the exact misconfiguration that needs to be corrected.

1. AWS Documentation. (2024). NAT gateways. Amazon VPC User Guide. Retrieved from https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html (See section "NAT gateway basics" which states, "You must also specify a public subnet in which to create the NAT gateway.").

2. AWS Documentation. (2024). Example: VPC with servers in private subnets and NAT. Amazon VPC User Guide. Retrieved from https://docs.aws.amazon.com/vpc/latest/userguide/VPCScenario2.html (This guide details the correct configuration, including creating a NAT gateway in the public subnet and updating the private subnet's route table to point 0.0.0.0/0 to the NAT gateway).

3. AWS Documentation. (2024). Route tables for your VPC. Amazon VPC User Guide. Retrieved from https://docs.aws.amazon.com/vpc/latest/userguide/VPCRouteTables.html (See section "Route table basics" which explains the purpose of the local route and routes to gateways).

The first step in troubleshooting any permission-related failure in AWS is to investigate the logs. AWS CloudTrail captures a record of every API call made in the account. When a Service Control Policy (SCP) denies an action, CloudTrail logs an AccessDenied event with a message indicating the denial was due to an organization policy. This provides the specific API call that failed and confirms the SCP as the root cause, which is the most direct and informative initial diagnostic step.

B. Removing SCPs from a production environment is a drastic and insecure troubleshooting method. It should be avoided as a first step.
C. The IAM role's permissions are likely correct since the deployment succeeded in other OUs. The primary variable is the Production OU's different SCPs.
D. Changing SCPs is a remediation step, not a troubleshooting step. The first action should be to diagnose the specific cause of the failure.

1. AWS CloudTrail Documentation. (2023). Logging IAM and AWS STS API calls with AWS CloudTrail. AWS Documentation. Retrieved from https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html.

2. AWS Organizations Documentation. (2023). Troubleshooting SCPs. AWS Documentation. Retrieved from https://docs.aws.amazon.com/organizations/latest/userguide/orgsmanagepoliciesscpstroubleshoot.html (See section "Diagnosing SCP Denials").

3. AWS Organizations Documentation. (2023). Service control policies (SCPs). AWS Documentation. Retrieved from https://docs.aws.amazon.com/organizations/latest/userguide/orgsmanagepoliciesscps.html (See section "Effects of SCPs on permissions").

When changing the external identity provider (IdP) for IAM Identity Center, the primary task is to update the configuration to trust the new IdP and correctly interpret its SAML assertions. This involves updating the IdP's metadata and modifying the attribute mappings to align with the claims sent by the new IdP. The underlying users and groups, provisioned from Active Directory, remain the same, ensuring a seamless transition for end-users.

A. Disabling users and groups is unnecessary and disruptive; the identities provisioned from the directory service remain valid.
C. IAM roles managed by IAM Identity Center trust the IAM Identity Center service principal, not the external IdP directly.
D. While correct clock synchronization (NTP) is a prerequisite for any SAML federation, it is not the specific configuration step for changing the IdP.

1. AWS IAM Identity Center Documentation. (2023). Change your identity source. AWS IAM Identity Center User Guide. Retrieved from https://docs.aws.amazon.com/singlesignon/latest/userguide/howto-change-identity-source.html. (See section "Changing to an external identity provider").

2. AWS IAM Identity Center Documentation. (2023). Attribute mappings. AWS IAM Identity Center User Guide. Retrieved from https://docs.aws.amazon.com/singlesignon/latest/userguide/attributemappings.html. (This section explains the purpose of attribute mappings which need to be updated).

The most direct and efficient solution is to use an AWS WAF rate-based rule. This feature is specifically designed to track the rate of requests from individual client IP addresses over a configurable 5-minute period. When the defined threshold (10,000 requests) is breached, the rule's metric in Amazon CloudWatch is updated. A CloudWatch alarm can be configured to monitor this metric and, upon triggering, send a notification to the specified Amazon SNS topic. This approach is purpose-built for rate limiting and monitoring.

A. This is a less efficient, reactive method. It requires processing large volumes of logs to derive metrics, introducing latency and complexity compared to WAF's real-time tracking.
B. VPC Flow Logs operate at the network layer (IP packets) and lack the application-layer visibility (HTTP requests) needed to accurately count requests from a specific end-user IP to the application.
C. An ASN match rule is used to filter traffic based on the Autonomous System Number of the source IP (e.g., an ISP), not for rate-limiting individual IP addresses.

1. AWS WAF Documentation. (2023). Rate-based rules. AWS Developer Guide. "A rate-based rule tracks the rate of requests for each originating IP address... If an IP address breaches the limit, the rule action is applied to that IP address."

2. AWS WAF Documentation. (2023). Monitoring with Amazon CloudWatch. AWS Developer Guide. "AWS WAF sends metrics to Amazon CloudWatch for your web ACLs and rules... You can use these metrics to set up CloudWatch alarms."

3. Amazon CloudWatch Documentation. (2023). Using Amazon CloudWatch alarms. Amazon CloudWatch User Guide. "You can create an alarm that sends an Amazon SNS message when the alarm changes state."

This solution correctly implements a secure, cross-account access pattern. An IAM role is created in the resource-owning account (the company) and establishes a trust relationship with the external account (the consultant agency). This allows IAM users in the consultant's account to assume the role without needing long-term credentials in the company's account. The trust policy can enforce the use of Multi-Factor Authentication (MFA) upon assuming the role, satisfying all stated requirements. This is the standard AWS best practice for granting third-party account access.

A. This creates long-term credentials (IAM users) in the company's account, which is explicitly forbidden by the requirements.
C. The IAM role must be created in the account that owns the resources (the company), not the account that needs access (the consultant agency).
B. Amazon Cognito is an identity service for customer-facing web and mobile applications, not for granting AWS account access to consultants.

1. AWS Identity and Access Management User Guide. (2024). IAM roles. AWS. Retrieved from https://docs.aws.amazon.com/IAM/latest/UserGuide/idroles.html. (See section "Roles terms and concepts").

2. AWS Identity and Access Management User Guide. (2024). Tutorial: Delegate access across AWS accounts using IAM roles. AWS. Retrieved from https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorialcross-account-with-roles.html. (See Step 1: Create the Role).

3. AWS Identity and Access Management User Guide. (2024). Configuring MFA-protected API access. AWS. Retrieved from https://docs.aws.amazon.com/IAM/latest/UserGuide/MFAProtectedAPI.html. (See section "Example policies for MFA").

Amazon S3 Lifecycle is the native, most efficient feature for managing the lifecycle of objects. A lifecycle configuration is a set of rules that define actions S3 applies to groups of objects. The requirement to delete objects older than 45 days can be met by creating an expiration rule. This rule instructs S3 to automatically and permanently delete objects 45 days after their creation, directly enforcing the data retention policy without custom code or additional services.

B. A Lambda trigger on upload is inefficient for managing object age. It would require complex logic to track and delete objects across the entire bucket, rather than acting on a simple time-based policy.
C. A scheduled Lambda is more complex and costly to manage than a native S3 Lifecycle rule. It requires writing, deploying, and maintaining code to list and delete objects periodically.
D. S3 Intelligent-Tiering is a storage class that optimizes costs by moving data between access tiers. It does not, by itself, enforce a deletion policy based on a fixed object age.

1. AWS Documentation, S3 User Guide, "Managing your storage lifecycle," Section: "Lifecycle configuration elements." It states, "You can define rules to... specify actions that you want Amazon S3 to take during an object's lifetime (for example, transitioning objects to another storage class, archiving them, or deleting them after a specified period)."

2. AWS Documentation, S3 User Guide, "Tutorial: Configuring a lifecycle configuration to delete objects." This tutorial provides a step-by-step guide for setting up a rule to expire objects after a specified number of days.

The requirement is to secure S3 data, reduce unintended exposure, and prevent misconfiguration with the least operational overhead for a new AWS account. Applying the S3 Block Public Access feature at the AWS account level is the most efficient solution. This setting acts as a global guardrail, automatically applying to all existing and future S3 buckets within the account. It prevents public access policies or ACLs from being applied, thereby minimizing the risk of accidental data exposure through misconfiguration with a single, account-wide setting.

B. S3 Block Public Access is configured at the bucket or account level, not on individual objects. Applying settings object-by-object would be maximum operational overhead, not the least.
C. Deactivating ACLs is a good practice for simplifying access management but does not, by itself, block public access. A bucket policy could still grant public access.
D. AWS PrivateLink provides private connectivity to S3 but does not prevent a bucket from being configured for public access. It also adds overhead by requiring VPC endpoint configuration.

1. AWS Documentation, "Blocking public access to your Amazon S3 storage," Amazon S3 User Guide. Section: "Setting block public access settings for your account." This section states, "You can apply Block Public Access settings to all buckets in your account. The settings apply account-wide to all current and future buckets."

2. AWS Documentation, "Amazon S3 Block Public Access," AWS Identity and Access Management User Guide. This guide explains that account-level settings provide a centralized way to prevent variations in security configuration.

AWS Audit Manager is the service specifically designed to automate evidence collection for compliance and audits. It provides pre-built standard frameworks, including PCI DSS v4.0, which map AWS resource configurations and CloudTrail logs to specific PCI controls. Crucially, it allows compliance teams to upload and attach manual evidence (e.g., policy documents, screenshots) to the relevant controls. Finally, it generates detailed, audit-ready assessment reports that consolidate both automated and manual evidence, directly meeting all the stated requirements.

A. AWS Trusted Advisor provides best-practice recommendations but is not a compliance management tool and does not generate audit-ready reports or support manual evidence attachment.
B. AWS Config assesses resource configurations against rules but lacks the comprehensive reporting, workflow management, and manual evidence attachment capabilities of Audit Manager.
C. AWS Security Hub is a security posture management service that aggregates findings. It is not designed for creating detailed audit reports with manually attached, non-AWS evidence.

1. AWS Audit Manager Documentation. (2023). What Is AWS Audit Manager?. AWS Audit Manager User Guide. "AWS Audit Manager helps you continuously audit your AWS usage to simplify how you assess risk and compliance with regulations and industry standards... You can also customize frameworks and controls to meet your unique business requirements."

2. AWS Audit Manager Documentation. (2023). Supported frameworks. AWS Audit Manager User Guide. Lists "Payment Card Industry Data Security Standard (PCI DSS) v4.0" as a standard framework.

3. AWS Audit Manager Documentation. (2023). Working with evidence. AWS Audit Manager User Guide. "You can add manual evidence to a control in your assessment... After you upload your manual evidence, you can add it to your assessment report."

AWS CloudTrail Lake is a managed, purpose-built solution for capturing, storing, accessing, and analyzing CloudTrail events. It meets all requirements cost-effectively: it can retain data for up to 7 years (and beyond), ensures log immutability, allows for complex SQL-based queries, and includes integrated dashboards for visualization. As a single, managed service, it eliminates the operational overhead and potentially higher costs of building a multi-service solution.

B. The CloudTrail Event History feature only retains management events for 90 days and does not meet the 7-year retention requirement.
C. A persistent Amazon EMR cluster is very expensive for querying logs; this solution is complex and not cost-effective compared to the managed CloudTrail Lake.
D. Ingesting and storing high-volume data events in both CloudWatch Logs and OpenSearch Service for 7 years is typically more expensive than CloudTrail Lake's pricing model.

1. AWS CloudTrail Documentation. (2023). Working with AWS CloudTrail Lake. AWS CloudTrail User Guide. Retrieved from https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake.html. (See sections on "Create an event data store" for retention settings and "Query your CloudTrail events" for query capabilities).

2. AWS CloudTrail Documentation. (2023). CloudTrail Lake dashboards. AWS CloudTrail User Guide. Retrieved from https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake-dashboards.html. (This section details the integrated visualization feature).

3. AWS CloudTrail. (2023). AWS CloudTrail Pricing. Retrieved from https://aws.amazon.com/cloudtrail/pricing/. (The pricing page details the cost structure for CloudTrail Lake, which is optimized for this use case).

The optimal solution is to use Amazon Macie for sensitive data discovery and AWS Security Hub for centralized findings management. By designating the security account as the delegated administrator for both services within AWS Organizations, you can manage them centrally. Macie can be configured to scan S3 buckets across all member accounts and automatically send its findings to Security Hub. Security Hub then aggregates these findings, along with others, into a single pane of glass in the delegated administrator account, meeting all requirements efficiently.

B. Amazon Inspector is used for vulnerability management in compute workloads (EC2, containers), not for discovering sensitive data within Amazon S3 buckets.
C. This option incorrectly proposes Amazon Inspector for S3 data scanning and AWS Trusted Advisor for centralizing findings, neither of which is the correct service for the task.
D. While Amazon Macie is the correct discovery tool, AWS Trusted Advisor is not the designated service for aggregating detailed security findings; AWS Security Hub is.

1. Amazon Macie Documentation, "Managing multiple accounts," Section: "Integrating Amazon Macie with AWS Organizations." This section explains how to designate a delegated administrator account for Macie to manage the service across an organization.

2. AWS Security Hub Documentation, "Integrating Security Hub with AWS Organizations." This describes how to designate a delegated administrator account to centrally view and manage findings from all member accounts.

3. Amazon Macie Documentation, "Integration with AWS Security Hub." This page details how Macie sends sensitive data discovery findings to Security Hub, allowing for centralized visibility.