← Back to exam page

Free AWS-CERTIFIED-SECURITY-SPECIALTY-SCS-C03 – Amazon AWS-CERTIFIED-SECURITY-SPECIALTY-SCS-C03 Practice Test Question

Loading demo links...

Showing 1–3 of 9 questions

Question 1 (Topic 1)

An AWS account administrator created an IAM group and applied the following managed policy to require that each individual user authenticate using multi-factor authentication: After implementing the policy, the administrator receives reports that users are unable to perform Amazon EC2 commands using the AWS CLI. What should the administrator do to resolve this problem while still enforcing multi-factor authentication?

Select an option, then click Submit answer.

  • ○ Change the value of aws:MultiFactorAuthPresent to true.
  • ○ Instruct users to run the aws sts get-session-token CLI command and pass the multi-factor authentication --serial-number and -token-code parameters. Use these resulting values to make API/CLI calls.
  • ○ Implement federated API/CLI access using SAML 2.0, then configure the identity provider to enforce multi-factor authentication.
  • ○ Create a role and enforce multi-factor authentication in the role trust policy. Instruct users to run the sts assume-role CLI command and pass --serial-number and --token-code parameters. Store the resulting values in environment variables. Add sts:AssumeRole to NotAction in the policy.
Question 2 (Topic 1)

A company needs a solution to protect critical data from being permanently deleted. The data is stored in Amazon S3 buckets. The company needs to replicate the S3 objects from the company's primary AWS Region to a secondary Region to meet disaster recovery requirements. The company must also ensure that users who have administrator access cannot permanently delete the data in the secondary Region. Which solution will meet these requirements?

Select an option, then click Submit answer.

  • ○ Configure AWS Backup to perform cross-Region S3 backups. Select a backup vault in the secondary Region. Enable AWS Backup Vault Lock in governance mode for the backups in the secondary Region.
  • ○ Implement S3 Object Lock in compliance mode in the primary Region. Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region.
  • ○ Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region. Create an S3 bucket policy to deny the s3:ReplicateDelete action on the S3 bucket in the secondary Region.
  • ○ Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region. Configure S3 object versioning on the S3 bucket in the secondary Region.
Question 3 (Topic 1)

A company has installed a third-party application that is distributed on several Amazon EC2 instances and on-premises servers. Occasionally, the company's IT team needs to use SSH to connect to each machine to perform software maintenance tasks. Outside these time slots, the machines must be completely isolated from the rest of the network. The company does not want to maintain any SSH keys. Additionally, the company wants to pay only for machine hours when there is an SSH connection. Which solution will meet these requirements?

Select an option, then click Submit answer.

  • ○ Create a bastion host with port forwarding to connect to the machines.
  • ○ Set up AWS Systems Manager Session Manager to allow temporary connections.
  • ○ Use AWS CloudShell to create serverless connections.
  • ○ Set up an interface VPC endpoint for each machine for private connection.