SCS-C03 — frequently asked questions

Athena is right only after events age past 90 days into an S3 log archive, and it requires a configured trail plus a table definition — setup the scenario never mentions.

No. AWS Config tracks resource configuration changes and compliance, not a searchable per-principal history of API calls; CloudTrail Event History is the tool for that.

IAM task roles give ECS microservices temporary AWS permissions, but they do not authenticate external web users. The question's ordered flow is specifically the user-login and token-validation chain.

No; Cognito user pools authenticate users and issue tokens, while the Lambda authorizer validates those tokens at API Gateway before requests reach the ECS microservices.

Long-term access keys are not MFA-authenticated, so aws:MultiFactorAuthPresent stays false and the deny applies. STS GetSessionToken returns temporary MFA-backed credentials.

It can shift enforcement to a role trust policy, but it changes the architecture and can weaken the original deny. Option B's GetSessionToken flow directly supplies MFA-authenticated CLI credentials.

A bastion still needs SSH keys, an always-on inbound SSH path, and separate access for on-premises servers, so it conflicts with the no-key and isolation requirements.

Yes. The SSM Agent can be activated on on-premises servers as a managed instance, allowing IAM-controlled sessions without inbound ports or SSH keys.

EKS Protection analyzes Kubernetes audit logs for control-plane risks, while Runtime Monitoring observes container and node activity such as file access, process execution, and network connections.

Security Hub standards check configuration posture against EKS controls; they do not analyze EKS audit logs or generate runtime findings for OS, network, and file events.

GuardDuty detects threats and anomalous behavior; it does not provide the authoritative record of KMS API and key-use events that CloudTrail does.

Amazon S3 is object storage and cannot create or control KMS keys; only AWS KMS integrates with a CloudHSM-backed custom key store for that purpose.

The application still writes to local EBS first, so a scale-in before the daily copy loses up to a day of logs. EFS is durable, but the copy process is not continuous.

Yes. CloudWatch Logs retention is configured per log group, and you can set it to 365 days or another period that satisfies the audit requirement.

Snapshots are discrete recovery points and may be hours away from the attack time. Point-in-time recovery can restore to a specific second just before the attack, minimizing data loss.

That restores to the start of the retention window, not the last known good state before the attack. It would discard valid changes made after that earlier point and may hit the retention boundary.

IAM users are per-account and separate from IAM Identity Center users; disabling the management-account IAM user does not stop the compromised Identity Center user from signing in to other assigned accounts.

No. Logs Insights queries CloudWatch Logs log groups, not S3 objects; the organizational event data store is queried through CloudTrail Lake instead.

It only scans objects uploaded after the trigger is configured, ignores existing objects, and requires per-bucket event wiring and code maintenance — far more overhead than Macie automated discovery.

No. It uses intelligent sampling to evaluate buckets and objects on a schedule, which is why you then run targeted full classification jobs only on the buckets it flags as sensitive.

NACLs are stateless: the return packet for an outbound TLS connection is destined to the EC2 instance's ephemeral source port, not to port 443.

Its inbound rule 100 allows TCP 1024–65535 first, and NACLs evaluate the lowest rule number first, so MySQL 3306 is allowed before rule 200 can deny it.

A standard KMS customer managed key is Regional and cannot encrypt data in us-west-1. D only works if the key is explicitly multi-Region with a replica key in us-west-1.

No. Secrets Manager can replicate secrets encrypted with the AWS managed aws/secretsmanager key, and the destination replica can use the destination Region's AWS managed key.

IAM Access Analyzer evaluates resource policies to find external access; it does not log API calls or identify the principal behind a credential's use. CloudTrail or the credential report is appropriate for usage review.

No. Deactivation sets the key to Inactive so API calls fail, but the key remains listed; you can delete it later after investigation.

AWS RAM shares supported AWS resources, not CloudFormation templates. To distribute an approved template for repeated deployments, use a Service Catalog product in a shared portfolio.

End users launch the product from the portfolio but cannot modify the underlying CloudFormation template. Each launch creates a new S3 bucket with the approved secure settings.

The EBS data key was wrapped by the original customer managed key and its material; different key material creates a different cryptographic key that cannot unwrap the existing ciphertext.

No. An encrypted snapshot still depends on the same CMK; without the original material it cannot be restored, and it may omit data written after the snapshot.

SCPs only constrain IAM permissions; they cannot modify or populate AWS WAF web ACL rule groups, so option B cannot enforce the third-party managed rule group.

No. Security Hub CSPM can generate findings for missing controls but does not automatically insert the third-party managed rule group into every web ACL.

s3:GetObject is an object-level action and requires an object ARN such as arn:aws:s3:::DOC-EXAMPLE-BUCKET/*. The bucket ARN alone only authorizes bucket-level actions like s3:ListBucket.

No. Lambda signs S3 requests with its execution role, so grant access to that role ARN or an account principal, and ensure the role's identity policy also allows s3:GetObject.

No. A condition may still be valid, and removing it can broaden access. First verify the condition key is present for the actual Lambda-to-S3 request and fix the resource or principal mismatch.