Amazon SCS-C03 Exam Questions Instant Access

Question 1

A company uses SAML federation with IAM to provide internal users with SSO for their AWS accounts. The company's identity provider certificate was rotated as part of its normal lifecycle. Shortly after, users started receiving the following error when attempting to log in:

''Error: Response Signature Invalid (Service: AWSSecurityTokenService; Status Code: 400; Error Code: InvalidIdentityToken)''

A security engineer needs to address the immediate issue and ensure that it will not occur again.

Which combination of steps should the security engineer take to accomplish this? (Select TWO.)

ADownload a new copy of the SAML metadata file from the identity provider. Create a new IAM identity provider entity. Upload the new metadata file to the new IAM identity provider entity.

BDuring the next certificate rotation period and before the current certificate expires, add a new certificate as the secondary certificate to the identity provider. Generate a new metadata file and upload it to the IAM identity provider entity. Perform automated or manual rotation of the certificate when required.

CDownload a new copy of the SAML metadata file from the identity provider. Upload the new metadata to the IAM identity provider entity configured for the SAML integration in question.

DDuring the next certificate rotation period and before the current certificate expires, add a new certificate as the secondary certificate to the identity provider. Generate a new copy of the metadata file and create a new IAM identity provider entity. Upload the metadata file to the new IAM identity provider entity. Perform automated or manual rotation of the certificate when required.

EDownload a new copy of the SAML metadata file from the identity provider. Create a new IAM identity provider entity. Upload the new metadata file to the new IAM identity provider entity. Update the identity provider configurations to pass a new IAM identity provider entity name in the SAML assertion.

Answer : B, C

Comprehensive and Detailed 100to 150 words of Explanation From AWS Certified Security -- Specialty topics: The immediate error indicates that the certificate information in IAM no longer matches the identity provider's SAML signing metadata. AWS troubleshooting guidance states that this error can occur when federation metadata changes, such as when an expired or rotated certificate is updated, and the fix is to download the updated SAML metadata file from the IdP. The metadata must be uploaded to the existing IAM SAML provider used by the role trust relationship. Creating a new provider entity would require additional role trust and assertion changes and is not the clean immediate fix. For future rotations, adding the new certificate before expiration and updating metadata prevents another outage during the certificate lifecycle.

================

Question 2

A company must inventory sensitive data across all Amazon S3 buckets in all accounts from a single security account.

ADelegate Amazon Macie and Security Hub administration.

BUse Amazon Inspector with Security Hub.

CUse Inspector with Trusted Advisor.

DUse Macie with Trusted Advisor.

Answer : A

Amazon Macie is the AWS service designed to discover and classify sensitive data in S3. Delegated administration enables centralized visibility across an organization. Security Hub aggregates Macie findings for a single-pane-of-glass view.

Inspector does not scan S3 data. Trusted Advisor is not a sensitive data discovery tool.

Referenced AWS Specialty Documents:

AWS Certified Security -- Specialty Official Study Guide

Amazon Macie Multi-Account Architecture

Question 3

A company runs a public web application on Amazon EKS behind Amazon CloudFront and an Application Load Balancer (ALB). A security engineer must send a notification to an existing Amazon SNS topic when the application receives 10,000 requests from the same end-user IP address within any 5-minute period.

Which solution will meet these requirements?

AConfigure CloudFront standard logging and CloudWatch Logs metric filters.

BConfigure VPC Flow Logs and CloudWatch Logs metric filters.

CConfigure an AWS WAF web ACL with an ASN match rule and CloudWatch alarms.

DConfigure an AWS WAF web ACL with a rate-based rule. Associate it with CloudFront. Create a CloudWatch alarm to notify SNS.

Answer : D

AWS WAF rate-based rules are designed specifically to track the number of requests from a single IP address over a configurable time window. According to AWS Certified Security -- Specialty guidance, rate-based rules integrate natively with CloudFront and emit CloudWatch metrics that can trigger alarms.

CloudFront logs and VPC Flow Logs are not real-time detection tools. ASN match rules do not count request rates.

Referenced AWS Specialty Documents:

AWS Certified Security -- Specialty Official Study Guide

AWS WAF Rate-Based Rules

CloudFront and AWS WAF Integration

Question 4

A company has an encrypted Amazon Aurora DB cluster in the us-east-1 Region that uses an AWS KMS customer managed key. The company must copy a DB snapshot to the us-west-1 Region but cannot access the encryption key across Regions.

What should the company do to properly encrypt the snapshot in us-west-1?

AStore the customer managed key in AWS Secrets Manager in us-west-1.

BCreate a new customer managed key in us-west-1 and use it to encrypt the snapshot.

CCreate an IAM policy to allow access to the key in us-east-1 from us-west-1.

DCreate an IAM policy that allows RDS in us-west-1 to access the key in us-east-1.

Answer : B

AWS KMS keys are strictly regional resources. According to AWS Certified Security -- Specialty documentation, a KMS key created in one Region cannot be used to encrypt or decrypt data in another Region. This includes encrypted RDS and Aurora snapshots.

When copying an encrypted snapshot to a different Region, the destination Region must have its own KMS key. AWS automatically re-encrypts the snapshot using the specified KMS key in the destination Region during the copy operation.

Options C and D are invalid because IAM policies cannot extend a KMS key's scope across Regions. Option A is incorrect because Secrets Manager does not store or manage KMS keys themselves.

AWS best practices require creating a new customer managed key in the target Region and using it during the snapshot copy process.

Referenced AWS Specialty Documents:

AWS Certified Security -- Specialty Official Study Guide

AWS KMS Regional Key Limitations

Amazon RDS Encrypted Snapshot Copy

Question 5

A company is investigating an increase in its AWS monthly bill. The company discovers that bad actors compromised some Amazon EC2 instances and served webpages for a large email phishing campaign. A security engineer must implement a solution to monitor for cost increases in the future to help detect malicious activity.

Which solution will offer the company the EARLIEST detection of cost increases?

ACreate an Amazon EventBridge rule that invokes an AWS Lambda function hourly. Program the Lambda function to download an AWS usage report from AWS Data Exports about usage of all services. Program the Lambda function to analyze the report and to send a notification when anomalies are detected.

BCreate a cost monitor in AWS Cost Anomaly Detection. Configure an individual alert to notify an Amazon Simple Notification Service (Amazon SNS) topic when the percentage above the expected cost exceeds a threshold.

CReview AWS Cost Explorer daily to detect anomalies in cost from prior months. Review the usage of any services that experience a significant cost increase from prior months.

DCapture VPC flow logs from the VPC where the EC2 instances run. Use a third-party network analysis tool to analyze the flow logs and to detect anomalies in network traffic that might increase cost.

Answer : B

For the earliest detection of abnormal spend, the most direct and purpose-built capability isAWS Cost Anomaly Detection. It continuously evaluates spend patterns and uses machine learning to identify unexpected cost increases soon after they begin, then sends alerts based on the configured thresholds. By creating acost monitor(for example, for linked accounts, services, or cost categories) and configuring an alert to publish toSNS, the security team can receive near-real-time notifications when costs deviate beyond an expected baseline. This is well suited for detecting compromise-driven spend (such as abused EC2 instances serving phishing pages, crypto-mining, or data exfiltration patterns that raise transfer costs).

Option A introduces significant operational overhead and delays because billing/usage exports are not guaranteed to be updated on an hourly cadence in a way that consistently outperforms the native anomaly detector, and the company would be maintaining custom analytics logic. Option C is explicitly slower (daily manual review). Option D may detect suspicious traffic but is indirect for ''earliest cost increase'' detection and depends on building/operating a separate analytics pipeline; also, not all cost anomalies are visible from flow logs. Therefore, Cost Anomaly Detection provides the fastest and lowest-overhead alerting for unexpected spend.

Question 6

A company is expanding its group of stores. On the day that each new store opens, the company wants to launch a customized web application for that store. Each store's application will have a non-production environment and a production environment. Each environment will be deployed in a separate AWS account. The company uses AWS Organizations and has an OU that is used only for these accounts.

The company distributes most of the development work to third-party development teams. A security engineer needs to ensure that each team follows the company's deployment plan for AWS resources. The security engineer also must limit access to the deployment plan to only the developers who need access. The security engineer already has created an AWS CloudFormation template that implements the deployment plan.

What should the security engineer do next to meet the requirements in theMOST secureway?

ACreate an AWS Service Catalog portfolio in the organization's management account. Upload the CloudFormation template. Add the template to the portfolio's product list. Share the portfolio with the OU.

BUse the CloudFormation CLI to create a module from the CloudFormation template. Register the module as a private extension in the CloudFormation registry. Publish the extension. Create an SCP that allows access to the extension.

CCreate an AWS Service Catalog portfolio and create an IAM role for cross-account access. Attach the AWSServiceCatalogEndUserFullAccess managed policy to the role.

DUse the CloudFormation CLI to create a module and share the extension directly with the OU.

Answer : A

AWS Service Catalog is specifically designed to help organizationsgovern and control how AWS resources are provisioned at scale. According to the AWS Certified Security -- Specialty Official Study Guide, Service Catalog enables administrators to define approved CloudFormation templates asproductsand to control which accounts, users, or organizational units can deploy those products.

By creating a Service Catalog portfolio in the management account and sharing it with a specific OU, the security engineer ensures that only accounts within that OU can deploy the approved infrastructure. Third-party developers can deploy resources only by using the predefined CloudFormation template and cannot alter the deployment plan, which enforces consistency and compliance.

This approach also limits access to the deployment plan itself, because developers interact with the Service Catalog product rather than the raw template. No cross-account IAM roles or excessive permissions are required, which reduces the attack surface.

CloudFormation modules and extensions (Options B and D) provide reuse but do not enforce deployment governance or access control. Option C introduces unnecessary cross-account IAM roles, which is less secure than native Service Catalog sharing.

AWS documentation explicitly identifiesAWS Service Catalog + AWS Organizationsas the recommended pattern for secure, standardized multi-account deployments.

AWS Certified Security -- Specialty Official Study Guide

AWS Service Catalog Administrator Guide

AWS Organizations Best Practices

Question 7

A company uses AWS IAM Identity Center with SAML 2.0 federation. The company decides to change its federation source from one identity provider (IdP) to another. The underlying directory for both IdPs is Active Directory.

Which solution will meet this requirement?

ADisable all existing users and groups within IAM Identity Center that were part of the federation with the original IdP.

BModify the attribute mappings within the IAM Identity Center trust relationship to match information that the new IdP sends.

CReconfigure all existing IAM roles in the company's AWS accounts to explicitly trust the new IdP as the principal.

DConfirm that the Network Time Protocol (NTP) clock skew is correctly set between IAM Identity Center and the new IdP endpoints.

Answer : B

AWS IAM Identity Center relies on SAML assertions and attribute mappings to associate federated users with identities, groups, and permission sets. According to the AWS Certified Security -- Specialty documentation, when changing identity providers while maintaining the same underlying directory, existing users and group identities can be preserved by updating attribute mappings to align with the new IdP's SAML assertions.

By modifying the attribute mappings, IAM Identity Center can correctly interpret usernames, group memberships, and unique identifiers sent by the new IdP without requiring changes to AWS account roles or permission sets. This approach minimizes operational effort and avoids disruption to access management.

Option A unnecessarily disables identities and causes access outages. Option C is incorrect because IAM Identity Center abstracts role trust relationships, and roles do not directly trust the IdP. Option D is unrelated to federation source configuration and only affects authentication timing issues.

AWS best practices recommend updating attribute mappings when switching IdPs that share the same directory source.

Referenced AWS Specialty Documents:

AWS Certified Security -- Specialty Official Study Guide

AWS IAM Identity Center SAML Federation

AWS Identity Federation Best Practices

Amazon AWS Certified Security - Specialty SCS-C03 Exam Questions