Amazon AWS Certified Security - Specialty SCS-C03 Exam Questions

Answer : A

Comprehensive and Detailed 100to 150 words of Explanation From AWS Certified Security -- Specialty topics: AWS Systems Manager Parameter Store is the most cost-effective AWS-native option for large volumes of configuration values and SecureString parameters when the company already has an external password management system handling rotation and audit workflows. Parameter Store can store sensitive values as SecureString parameters encrypted with AWS KMS, and applications can retrieve them securely without hardcoding credentials. AWS Secrets Manager is a strong secrets service, but its per-secret pricing becomes expensive for more than 5,000 credentials when native rotation is not required. S3 is not a purpose-built secrets store and creates unnecessary custom security responsibility. CloudHSM is high cost and excessive for simple application credential storage.

================

Answer : A

AWS KMS key policies can restrict how and when a key is used by applyingconditions such as kms:ViaService, which limits usage to requests that originate from a specific AWS service. According to the AWS Certified Security -- Specialty Official Study Guide and AWS KMS documentation, the kms:ViaService condition is evaluated against the service that calls KMS on behalf of the principal.

Using StringEquals with kms:ViaService restricts usage toexactly one service endpoint. However, AWS services can invoke KMS throughservice variants, internal endpoints, or additional service integrations. When StringEquals is used, these variations can unintentionally bypass the condition, allowing the key to be used by other services through different internal service paths.

Changing the condition operator from StringEquals to StringLike ensures thatonly EC2-related service callsthat match the intended service pattern are allowed, while still preventing use by unrelated AWS services. This aligns with AWS guidance to use StringLike when service invocation patterns may vary.

Option B is incorrect because the root principal statement is required to retain administrative control over the key. Option C is invalid because changing Regions does not address unauthorized service usage. Option D does not restrict key usage and does not mitigate the issue.

AWS documentation explicitly recommendstightening condition operatorsin KMS key policies to prevent unintended service access while maintaining required functionality.

AWS Certified Security -- Specialty Official Study Guide

AWS Key Management Service Developer Guide

AWS KMS Key Policy Best Practices

Answer : C

Comprehensive and Detailed 100to 150 words of Explanation From AWS Certified Security -- Specialty topics: The enforceable control is an S3 bucket policy that denies requests when the global condition key aws:SecureTransport is false. That condition evaluates whether the request was sent over HTTPS/TLS. A deny statement is evaluated before any allow statement, so even a signed URL cannot be used over an unencrypted transport path. Telling clients to use HTTPS is not a preventive AWS-side control. AWS Config's s3-bucket-ssl-requests-only managed rule can detect noncompliant bucket policy configuration, but it does not itself block an insecure upload request. An ACL granting AllUsers WRITE would be dangerously wrong and would increase exposure. The bucket policy deny is the direct security enforcement mechanism for encryption in transit.

================

Answer : D

When an internet-facing ALB is used as a CloudFront origin, it remains directly accessible unless additional access controls are enforced. According to AWS Certified Security -- Specialty guidance,CloudFront IP allow lists alone are insufficient, because CloudFront IP ranges change and are not guaranteed to be exclusive.

The recommended and most secure approach is to configure CloudFront to send acustom origin header(such as X-Shared-Secret) with a secret value on every request to the origin. The ALB listener rules are then configured toforward traffic only when the header exists and matches the expected value. Requests that attempt to bypass CloudFront will not include this header and will be denied.

Option A is invalid because CloudFront does not support PrivateLink origins. Option B introduces unnecessary architectural changes and is not required. Option C is brittle and operationally risky due to changing IP ranges.

AWS documentation explicitly recommendscustom origin headersas the best practice to ensure that only CloudFront can access an internet-facing ALB when AWS WAF is attached at the CloudFront layer.

AWS Certified Security -- Specialty Official Study Guide

Amazon CloudFront Origin Security Documentation

AWS WAF and ALB Integration Guidance

Answer : A

Amazon S3 Block Public Access configured at the AWS account level is the recommended and most effective approach to protect data stored in Amazon S3 while minimizing operational overhead. AWS Security Specialty documentation explains that S3 Block Public Access provides centralized, preventative controls designed to block public access to S3 buckets and objects regardless of individual bucket policies or object-level ACL configurations. When enabled at the account level, these controls automatically apply to all existing and newly created buckets, significantly reducing the risk of accidental exposure caused by misconfigured permissions.

The AWS Certified Security -- Specialty Study Guide emphasizes that public access misconfiguration is a leading cause of data leaks in cloud environments. Account-level S3 Block Public Access acts as a guardrail by overriding any attempt to grant public permissions through bucket policies or ACLs. This eliminates the need to manage security settings on a per-bucket or per-object basis, thereby reducing administrative complexity and human error.

Configuring Block Public Access at the object level, as in option B, requires continuous monitoring and manual configuration, which increases operational overhead. Disabling ACLs alone, as described in option C, does not fully prevent public access because bucket policies can still allow public permissions. Using AWS PrivateLink, as in option D, controls network access but does not protect against public exposure through misconfigured S3 policies.

AWS security best practices explicitly recommend enabling S3 Block Public Access at the account level as the primary mechanism for preventing unintended public data exposure with minimal management effort.

Referenced AWS Specialty Documents:

AWS Certified Security -- Specialty Official Study Guide

Amazon S3 Security Best Practices Documentation

Amazon S3 Block Public Access Overview

AWS Well-Architected Framework -- Security Pillar

Answer : C

Comprehensive and Detailed 100to 150 words of Explanation From AWS Certified Security -- Specialty topics: AWS CloudFormation Guard is the correct policy-as-code control for validating CloudFormation templates before deployment. Guard lets security teams write rules that check JSON or YAML templates for policy requirements, such as requiring encrypted EBS volumes. AWS CloudFormation best practices specifically recommend integrating cfn-guard into CI/CD pipelines to validate templates before deployment and prevent noncompliant resources from reaching the environment. AWS Config is mainly detective or proactive compliance evaluation after or during resource provisioning, but the question asks to prevent deployment inside an IaC pipeline. Trusted Advisor does not validate templates. SCPs restrict account-level permissions but are not a CloudFormation template validation engine.

================

Answer : C

Comprehensive and Detailed 100to 150 words of Explanation From AWS Certified Security -- Specialty topics: CloudTrail must be allowed to deliver log files to the exact Amazon S3 bucket prefix configured for the trail. If the S3 bucket policy still references the old prefix, CloudTrail detects the mismatch and returns the bucket policy error. AWS documentation explicitly states that when adding, modifying, or removing a log file prefix for a bucket receiving CloudTrail logs, the bucket policy must be updated first with the matching prefix, and then the CloudTrail trail should be updated to use that same prefix. Creating a new trail is unnecessary. Granting PutBucketPolicy or GetBucketPolicy to the security engineer does not fix the CloudTrail service delivery path. The issue is the prefix value in the bucket policy.

================