Amazon Web Services Updated SCS-C03 Exam Questions and Answers by alaya

AWS WAF logs contain detailed request-level information, including source IP addresses, requested URIs, and rule matches. According to AWS Certified Security – Specialty guidance, enabling AWS WAF logging provides the most reliable and tamper-resistant method to investigate web-based attacks, especially when instance-level logs are unavailable.

By streaming WAF logs through Amazon Kinesis Data Firehose to Amazon S3, the company ensures durable, centralized log storage that is independent of EC2 lifecycle events. Amazon Athena can then query the logs efficiently to identify repeated requests to the new-user-creation.php endpoint and extract attacker IP addresses.

VPC Flow Logs do not capture HTTP-level details. ALB access logs alone may not capture blocked requests. WAF logs provide the best forensic visibility for future detection.

Referenced AWS Specialty Documents:

AWS Certified Security – Specialty Official Study Guide

AWS WAF Logging and Monitoring

Amazon Athena Log Analysis

Option C is the best fit because Amazon GuardDuty provides managed threat detection forEKSby analyzingEKS control plane audit logs(EKS Protection) and correlating those signals withruntime telemetry(Runtime Monitoring) that includesprocess/OS activity, network connections, and file activityon the worker nodes. This directly matches the requirement to monitor EKS audit logsin addition tooperating system, networking, and file events to detect Kubernetes security risks.

GuardDuty produces securityfindingsfor suspicious Kubernetes behavior and runtime indicators (for example, unexpected API calls, anomalous container activity, or known malicious behaviors). To notify the security team, anAmazon EventBridgerule can match GuardDuty findings and forward them to anSNS topic. SNS supportsemail subscriptions, so the team’s mailing list can receive near-real-time alerts without building a custom log parsing pipeline.

Option A (Security Hub) aggregates findings and maps to controls/standards but does not itself provide the combined audit-log + runtime event detection described. Option B combines unrelated services and still requires custom processing. Option D only alarms on “new audit logs generated,” which does not detect “security risks” and does not include OS/network/file threat detections.

Comprehensive and Detailed 100to 150 words of Explanation From AWS Certified Security – Specialty topics:

The auditor already has iam:ChangePassword for the correct user resource pattern, but the console also needs to read the account password policy so the user can see and satisfy the account’s password requirements. AWS IAM policy examples for self-managing passwords include iam:GetAccountPasswordPolicy to view account password requirements while changing an IAM user password. MFA cannot be configured before the first password reset if the user cannot complete the login flow. Password complexity might matter after the policy is readable, but the stated error is authorization failure, not password-format rejection. Granting iam:ChangePassword on all resources is broader than necessary and does not solve the missing password-policy read permission.

================

Comprehensive and Detailed 100to 150 words of Explanation From AWS Certified Security – Specialty topics:

Centralized root access management in IAM is the correct preventive control because it lets an organization centrally manage privileged root user credentials for member accounts. AWS documentation states that after centralizing root access, an organization can delete root user credentials from member accounts, including passwords, access keys, signing certificates, and MFA configuration. New accounts created in AWS Organizations have no root credentials by default. This directly reduces compromise risk and removes the operational burden of rotating or monitoring root credentials in every account. Lambda cannot truly disable the root user cleanly. Security Hub CSPM does not provide this root access management function. SCPs can deny many root actions, but they do not remove long-term root credentials and still leave credential-management overhead.

================