A company's web application is under a distributed denial-of-service (DDoS) attack, and the security team has confirmed that the attack is targeting the application layer. The application is behind an Application Load Balancer (ALB) with AWS WAF. The team needs to contain the attack while minimizing impact on legitimate users. Which action should the team take first?

Add an AWS WAF rule to rate-limit requests from the attacking IPs identified in the WAF logs.

Terminate all EC2 instances behind the ALB and launch new ones.

Change the ALB's security group to deny all inbound traffic from the internet.

Create a new NACL rule to block all traffic from the attacking IPs at the subnet level.

AWSCertified Security - Specialty

Domain 2Objective 2

Task 2.2: Respond to Security Events SCS-C03 Practice Questions (Page 5)

Part of the Content Domain 2: Incident Response domain, which accounts for 14% of the SCS-C03 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~10–16 in this domain), expect 5–8 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

7concepts

14%of the exam

Questions 21–25

21foundation · easy
A security team needs to store forensic logs in a way that prevents accidental or malicious modification and allows recovery of previous versions. Which S3 feature should be enabled to meet this requirement?
Select an answer first
22application · medium
A company's web application is under a distributed denial-of-service (DDoS) attack, and the security team has confirmed that the attack is targeting the application layer. The application is behind an Application Load Balancer (ALB) with AWS WAF. The team needs to contain the attack while minimizing impact on legitimate users. Which action should the team take first?
Select an answer first
23foundation · easy
A security team needs to block traffic from a specific IP address at the subnet level to contain a spreading threat. Which AWS resource should be configured with a deny rule?
Select an answer first
24foundation · easy
A security team wants to use an AWS service that automatically collects and analyzes log data from multiple sources to help visualize and identify the root cause of a security event. Which AWS service is designed for this purpose?
Select an answer first
25foundation · easy
A security analyst needs to run SQL-like queries against CloudTrail logs stored in S3 to identify suspicious API activity. Which AWS service is designed for this purpose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SCS-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SCS-C03” is a trademark of its owner, used for identification only.

Task 2.2: Respond to Security Events SCS-C03 Practice Questions (Page 5)

Questions 21–25

A security team needs to store forensic logs in a way that prevents accidental or malicious modification and allows recovery of previous versions. Which S3 feature should be enabled to meet this requirement?

A security team needs to block traffic from a specific IP address at the subnet level to contain a spreading threat. Which AWS resource should be configured with a deny rule?

A security team wants to use an AWS service that automatically collects and analyzes log data from multiple sources to help visualize and identify the root cause of a security event. Which AWS service is designed for this purpose?

A security analyst needs to run SQL-like queries against CloudTrail logs stored in S3 to identify suspicious API activity. Which AWS service is designed for this purpose?

Keep studying — Content Domain 2: Incident Response