A security engineer needs to ensure that a specific software patch is installed on all managed EC2 instances. Which AWS service can be used to automatically maintain this configuration on a schedule?

AWS Systems Manager State Manager

A security team wants to automatically evaluate whether all S3 buckets in an account have encryption enabled and report any noncompliant buckets. Which AWS service should be used to create this automated assessment?

AWS Systems Manager State Manager

A security team manages a large AWS Organization with hundreds of accounts. They have enabled AWS Security Hub and AWS Config in all accounts. They need to ensure that all accounts have a baseline set of security checks enabled, and they want to be able to report on compliance across the entire organization. They also want to automatically remediate the most common misconfigurations. Which solution is the most efficient and scalable?

Use AWS Config conformance packs in the management account and deploy them to all accounts in the organization.

Use AWS Systems Manager to run a script in each account that creates the required AWS Config rules.

Manually create the same AWS Config rules in each account and configure SNS notifications for each.

Enable AWS Trusted Advisor and use its organizational view to report on compliance.

A company is designing monitoring for a web application that handles personal data. The security team needs to detect unauthorized access attempts and data exfiltration. Which workload characteristic most directly influences the monitoring and alerting requirements?

The application's programming language

The number of developers on the team

The sensitivity of the data processed

The color scheme of the user interface

A company has enabled Amazon GuardDuty and AWS Security Hub in its management account. The security team wants to receive a single notification for all high-severity findings from both services. They have created an SNS topic. What is the most efficient way to route these findings to the SNS topic?

Create a CloudWatch alarm on the GuardDuty metric for high-severity findings and configure it to send notifications to the SNS topic.

Create an Amazon EventBridge rule that matches Security Hub findings with a severity of 'HIGH' and routes them to the SNS topic.

Create two separate EventBridge rules: one for GuardDuty findings and one for Security Hub findings, both routing to the SNS topic.

Use AWS Config to create a rule that detects high-severity findings and sends notifications to the SNS topic.

AWSCertified Security - Specialty

Domain 1Objective 1

Task 1.1: Design and Implement Monitoring and Alerting Solutions for an AWS Account or Organization SCS-C03 Practice Questions (Page 3)

Part of the Content Domain 1: Detection domain, which accounts for 16% of the SCS-C03 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

5concepts

16%of the exam

Questions 11–15

11foundation · easy
A security engineer needs to ensure that a specific software patch is installed on all managed EC2 instances. Which AWS service can be used to automatically maintain this configuration on a schedule?
Select an answer first
12foundation · easy
A security team wants to automatically evaluate whether all S3 buckets in an account have encryption enabled and report any noncompliant buckets. Which AWS service should be used to create this automated assessment?
Select an answer first
13expert · medium
A security team manages a large AWS Organization with hundreds of accounts. They have enabled AWS Security Hub and AWS Config in all accounts. They need to ensure that all accounts have a baseline set of security checks enabled, and they want to be able to report on compliance across the entire organization. They also want to automatically remediate the most common misconfigurations. Which solution is the most efficient and scalable?
Select an answer first
14foundation · easy
A company is designing monitoring for a web application that handles personal data. The security team needs to detect unauthorized access attempts and data exfiltration. Which workload characteristic most directly influences the monitoring and alerting requirements?
Select an answer first
15expert · medium
A company has enabled Amazon GuardDuty and AWS Security Hub in its management account. The security team wants to receive a single notification for all high-severity findings from both services. They have created an SNS topic. What is the most efficient way to route these findings to the SNS topic?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCS-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SCS-C03” is a trademark of its owner, used for identification only.