Amazon Web Services Updated SCS-C03 Exam Questions and Answers by rylee

Comprehensive and Detailed 100to 150 words of Explanation From AWS Certified Security – Specialty topics:

SCPs and RCPs solve different sides of this governance requirement. SCPs centrally define the maximum permissions for IAM users and roles in organization accounts, so an SCP deny list is appropriate for explicitly denied services. RCPs centrally control maximum available permissions for resources in the organization and can be attached to the organization root, OU, or account. To enforce S3 minimum TLS centrally for all current and future accounts, an RCP denying S3 access when s3:TlsVersion is below 1.2 should be attached at the organization root. Attaching only to current accounts misses future accounts. Putting the service deny list into an RCP is the wrong policy type. Declarative policies are not the correct S3 request-condition control here.

The findingInstanceCredentialExfiltrationindicates that credentials available to the EC2 instance (from the instance profile / IMDS) were likely stolen and then used from an unusual location. The fastest way todeny the malicious actor immediatelyis to invalidate the stolen, currently usable credentials. Because these aretemporary credentialsissued to the instance profile role, the correct first containment action is torevoke active sessionsfor that role so the stolen session credentials stop working. This directly blocks continued API use while you continue investigation and remediation.

Changing security groups (Option A) affects inbound network access to the website but does not stop an attacker from using stolen API credentials against AWS APIs. Installing agents and running assessments (Options B and C) are investigative steps that take time and do not immediately cut off the attacker’s current access. After revoking sessions, best practice incident response typically continues with additional containment and eradication steps such as rotating credentials, reviewing CloudTrail for actions taken, checking for persistence (new IAM users/keys, modified policies), patching the instance, and restricting IMDS (for example, enforcing IMDSv2) to reduce risk of further credential theft.

Comprehensive and Detailed 100to 150 words of Explanation From AWS Certified Security – Specialty topics:

To keep application traffic off the public internet, EC2 and Lambda resources must reach S3 through private VPC networking. An S3 gateway endpoint provides private access from the VPC to S3 without using an internet gateway or NAT gateway. An S3 access point can also be restricted to VPC origin so S3 rejects requests that do not originate from the configured VPC path. The Lambda function must run inside the VPC so its S3 traffic can use the private endpoint path. Lambda “block public access” is not the relevant S3 network control. Security groups cannot target S3 gateway endpoints or S3 access points as destination resources in the way the distractors describe.

================

The requirement is to havekey material generated and used inside a custom key store backed by an AWS CloudHSM cluster. This is exactly whatAWS KMS Custom Key Storesprovide: KMS manages the keys and policies, but the cryptographic operations for those KMS keys occur in the associatedCloudHSMcluster, keeping the key material within HSM boundaries. For applications that needlocal-use data keys(both symmetric data keys and asymmetric data key pairs), KMS supports generating data keys and data key pairs that applications can use for envelope encryption and local cryptographic operations, while the master key protections remain within KMS (and within CloudHSM when using a custom key store).

For auditing, AWS best practice isAWS CloudTrail, which records KMS API calls (such as CreateKey, GenerateDataKey, GenerateDataKeyPair, Encrypt/Decrypt, etc.) and provides an immutable event history for compliance and investigation. Athena can query logs, but it is not the primary audit record source; GuardDuty is for threat detection, not authoritative key-usage auditing. Therefore, the correct combination isKMS with a CloudHSM-backed custom key storeplusCloudTrailfor auditability.