Amazon AWS SAA-C03 Application Protection, WAF, Shield, Secrets, Cognito, and Threat Detection Practice Test 2

 

Topic 04 Practice Test 2 covers Application Protection, WAF, Shield, Secrets, Cognito, and Threat Detection for AWS SAA-C03. For broader exam preparation, review the AWS SAA-C03 Exam Dumps. Every option includes focused technical reasoning explaining both the AWS architecture concept and its fit to the scenario.

Question 1

A retail sign-in endpoint is receiving credential-stuffing traffic. The business wants suspicious requests to continue only after the client proves human interaction, while legitimate clients that already have a valid token should proceed through the remaining web ACL rules. Which AWS WAF action best meets this requirement? Choose ONE.

1. AWS WAF Challenge action
2. AWS WAF CAPTCHA action
3. AWS WAF Count action
4. AWS WAF Block action

Correct Answer(s)

 

B

Rationale

1. Challenge normally uses a silent browser challenge and does not require the user to solve an interactive puzzle. It is useful for validating browser behavior with less friction, but the requirement explicitly calls for a human interaction step before suspicious login traffic can continue. The decisive design point is interactive human verification for suspicious login traffic, rather than passive observation or a silent browser test.
2. CAPTCHA is designed for this decision. When a request lacks a valid CAPTCHA token, AWS WAF presents an interactive puzzle; after successful validation, the token permits the request to continue through later rules. This adds human verification without permanently blocking every suspicious client. The decisive design point is interactive human verification for suspicious login traffic, rather than passive observation or a silent browser test.
3. Count records a matching request and can add labels, yet it does not stop the request or require proof from the client. Using Count alone would observe credential stuffing but would not impose the interactive verification gate requested by the application owner. The decisive design point is interactive human verification for suspicious login traffic, rather than passive observation or a silent browser test.
4. Block terminates evaluation for the matching request and prevents it from reaching the application. That is stronger than requested because the design wants suspicious users to have a chance to prove they are human and then continue normally. The decisive design point is interactive human verification for suspicious login traffic, rather than passive observation or a silent browser test.

 

Question 2

A browser-based application sees automated scraping against an API. Security wants AWS WAF to verify browser behavior with minimal user friction. Suspicious clients should receive a silent JavaScript challenge rather than an interactive puzzle. Which action should the rule use? Choose ONE.

1. AWS WAF CAPTCHA action
2. AWS WAF Block action
3. AWS WAF Count action
4. AWS WAF Challenge action

Correct Answer(s)

 

D

Rationale

1. CAPTCHA is appropriate when the application intentionally wants an interactive puzzle. That would add visible user friction, which conflicts with the requirement for a silent browser validation step. A different token-based WAF action is better suited to background verification. Here the requirement is specifically background browser validation with low friction, so the rule action must avoid an explicit user puzzle.
2. Blocking would immediately reject every matching request and would not distinguish clients that can successfully complete browser validation. The team wants suspicious traffic challenged first, so an unconditional terminal action is too aggressive for this scenario. Here the requirement is specifically background browser validation with low friction, so the rule action must avoid an explicit user puzzle.
3. Count lets AWS WAF record matches and continue processing, but it does not issue a client-side challenge or require a valid token. It therefore provides useful observation but not the requested proof that the request originated from a functioning browser. Here the requirement is specifically background browser validation with low friction, so the rule action must avoid an explicit user puzzle.
4. Challenge returns a browser challenge when the request lacks a valid challenge token. Successful clients receive a token and subsequent rule evaluation continues without an interactive puzzle. This behavior directly matches the low-friction validation requirement for the browser-facing API. Here the requirement is specifically background browser validation with low friction, so the rule action must avoid an explicit user puzzle.

 

Question 3

An AWS WAF managed rule group is needed for the /checkout path, but running it against every application request increases cost and creates false positives on unrelated paths. Which configuration should the architect add to the managed rule group statement? Choose ONE.

1. AWS WAF scope-down statement
2. AWS WAF rule priority change
3. AWS WAF label match statement
4. AWS WAF IP set

Correct Answer(s)

 

A

Rationale

1. A scope-down statement is nested inside the managed rule group statement and filters which requests are evaluated by that group. Restricting evaluation to /checkout reduces unnecessary inspection and keeps unrelated paths outside the managed rules without creating a second web ACL. Because only checkout traffic should enter the costly inspection path, the chosen mechanism has to filter requests before the managed group evaluates them.
2. Changing rule priority controls evaluation order among rules, but it does not limit which requests the managed rule group evaluates. The same non-checkout traffic would still reach the group whenever evaluation proceeds to that rule. Because only checkout traffic should enter the costly inspection path, the chosen mechanism has to filter requests before the managed group evaluates them.
3. A label match statement is useful when a later rule should act on labels attached by an earlier rule or managed rule group. The requirement is to narrow entry into the managed group itself, not to consume labels afterward. Because only checkout traffic should enter the costly inspection path, the chosen mechanism has to filter requests before the managed group evaluates them.
4. An IP set stores reusable IPv4 or IPv6 addresses for rules. It cannot express the application-path condition needed here and would incorrectly tie managed-rule evaluation to client addresses rather than the /checkout URI path. Because only checkout traffic should enter the costly inspection path, the chosen mechanism has to filter requests before the managed group evaluates them.

 

Question 4

A managed rule group in an AWS WAF web ACL labels requests that match a particular threat category. A custom rule later in the ACL should block only requests carrying that label plus an additional business-specific condition. What should the custom rule use? Choose ONE.

1. AWS WAF IP set
2. AWS WAF scope-down statement
3. AWS WAF label match statement
4. AWS WAF sampled requests view

Correct Answer(s)

 

C

Rationale

1. IP sets are address collections and are useful when the decision depends on source networks. They do not consume the semantic labels emitted by earlier rules, so they cannot directly chain the managed rule group’s classification into later logic. The architecture depends on carrying an earlier rule’s classification into downstream enforcement, not recreating the same threat detection in a second rule.
2. Scope-down statements narrow the traffic examined by a managed rule group or rate-based rule. Here the group has already evaluated the request; the requirement is for a later rule to detect the result that the earlier rule attached. The architecture depends on carrying an earlier rule’s classification into downstream enforcement, not recreating the same threat detection in a second rule.
3. A label match statement lets a rule test labels that earlier evaluated rules placed on the request. The architect can combine that label test with the extra business condition, creating downstream logic without duplicating the managed rule group’s detection behavior. The architecture depends on carrying an earlier rule’s classification into downstream enforcement, not recreating the same threat detection in a second rule.
4. Sampled requests help operators inspect representative matches for troubleshooting. They are an observability feature rather than a rule statement, so they cannot make a later rule conditionally block requests based on a previously applied label. The architecture depends on carrying an earlier rule’s classification into downstream enforcement, not recreating the same threat detection in a second rule.

 

Question 5

A security team maintains several regular expressions for administrative and test URI patterns. The same expressions must be referenced by multiple AWS WAF rules, and updates should be made in one reusable object. Which feature should the team create? Choose ONE.

1. AWS WAF string match statement
2. AWS WAF IP set
3. AWS WAF rate-based rule
4. AWS WAF regex pattern set

Correct Answer(s)

 

D

Rationale

1. A string match statement evaluates one configured string pattern within a rule. It does not provide the reusable collection of regular expressions that several rules can reference and maintain centrally. Central maintainability is the key constraint: the regular-expression collection must be reusable by several rules and updated as one object.
2. An IP set centralizes network addresses, not regular expressions. It would help when the shared data is IPv4 or IPv6 ranges, but it cannot represent URI regex patterns for application request matching. Central maintainability is the key constraint: the regular-expression collection must be reusable by several rules and updated as one object.
3. A rate-based rule tracks request rates and can optionally narrow the requests it counts. The requirement is reusable content matching across multiple rules, not per-source request-rate enforcement. Central maintainability is the key constraint: the regular-expression collection must be reusable by several rules and updated as one object.
4. A regex pattern set stores a reusable group of regular expressions and can be referenced by regex pattern set match statements in multiple rules. Central updates to the set therefore propagate to the rules that rely on the shared URI patterns. Central maintainability is the key constraint: the regular-expression collection must be reusable by several rules and updated as one object.

 

Question 6

A Shield Advanced protected application has variable traffic, so raw traffic anomalies sometimes look suspicious even when the service remains healthy. The team wants DDoS detection to incorporate the application’s actual availability state. What should be configured? Choose ONE.

1. Application Load Balancer access-log delivery
2. Shield Advanced health-based detection with a Route 53 health check
3. AWS WAF sampled requests
4. Amazon CloudWatch Synthetics canary only

Correct Answer(s)

 

B

Rationale

1. ALB access logs are valuable for request analysis, but Shield Advanced does not use them as the resource-health signal for health-based DDoS detection. Logging alone therefore cannot provide the availability context the protection service needs. The requested signal is application health that Shield Advanced can directly associate with the protected resource, not a separate monitoring dashboard.
2. Associating a Route 53 health check with the protected resource lets Shield Advanced use application health as additional context. That improves detection and response accuracy when traffic changes are ambiguous but the protected service’s actual availability indicates whether an event is harmful. The requested signal is application health that Shield Advanced can directly associate with the protected resource, not a separate monitoring dashboard.
3. Sampled requests show examples of traffic that matched WAF rules. They are useful for rule tuning, yet they are not the application-health input Shield Advanced uses to enhance DDoS detection. The requested signal is application health that Shield Advanced can directly associate with the protected resource, not a separate monitoring dashboard.
4. A canary can measure user-path availability, but simply creating one does not associate the health signal with Shield Advanced. Health-based detection specifically requires a Route 53 health check associated with the protected resource. The requested signal is application health that Shield Advanced can directly associate with the protected resource, not a separate monitoring dashboard.

 

Question 7

A critical public application uses Shield Advanced. Management requires AWS security specialists to contact the on-call team automatically when an eligible DDoS event is detected and the protected application becomes unhealthy. Which Shield Advanced capability should be configured? Choose ONE.

1. An AWS Support case template
2. Amazon GuardDuty delegated administration
3. Shield Advanced proactive engagement
4. AWS Firewall Manager notification settings

Correct Answer(s)

 

C

Rationale

1. A prepared support-case template can speed manual escalation, but someone still has to open the case. The requirement is automatic outreach from AWS during a qualifying event rather than an operator-initiated support workflow. Automatic contact by the Shield Response Team is the operational requirement, so a manually initiated escalation path does not satisfy the design.
2. GuardDuty delegated administration centralizes threat-detection management across accounts. It does not arrange direct Shield Response Team contact based on a protected resource’s DDoS event and health status. Automatic contact by the Shield Response Team is the operational requirement, so a manually initiated escalation path does not satisfy the design.
3. Proactive engagement lets the Shield Response Team contact designated responders during eligible detected events. It relies on current contact information and associated Route 53 health checks, which aligns with the requirement for automatic outreach when application health is affected. Automatic contact by the Shield Response Team is the operational requirement, so a manually initiated escalation path does not satisfy the design.
4. Firewall Manager centralizes policy deployment and compliance across accounts. Its notifications do not substitute for the Shield Response Team’s proactive engagement process during a DDoS event. Automatic contact by the Shield Response Team is the operational requirement, so a manually initiated escalation path does not satisfy the design.

 

Question 8

A CloudFront distribution is protected by Shield Advanced and already has an AWS WAF v2 web ACL. The operations team wants AWS to automatically create, verify, and apply WAF rules when Shield detects application-layer DDoS attacks against the distribution. What should be enabled? Choose ONE.

1. Shield Advanced automatic application layer DDoS mitigation
2. AWS Shield Standard
3. AWS WAF managed rule groups only
4. AWS Network Firewall

Correct Answer(s)

 

A

Rationale

1. This Shield Advanced feature is built for supported CloudFront distributions and Application Load Balancers with a WAF v2 web ACL. Shield can generate and maintain mitigation rules in a Shield rule group after detecting a Layer 7 DDoS attack. The required behavior is Shield-driven creation of application-layer mitigation rules during an attack, rather than a static protection policy alone.
2. Shield Standard supplies baseline DDoS protections automatically, but it does not create and manage application-layer WAF mitigation rules in response to Shield Advanced detections. The requested automation is an Advanced feature. The required behavior is Shield-driven creation of application-layer mitigation rules during an attack, rather than a static protection policy alone.
3. Managed rule groups provide maintained protections for known web threats. They are not the Shield-driven mechanism that dynamically creates and verifies rules specifically for a detected application-layer DDoS event. The required behavior is Shield-driven creation of application-layer mitigation rules during an attack, rather than a static protection policy alone.
4. Network Firewall protects VPC network traffic with stateful and stateless rules. It is not attached to CloudFront as a Shield application-layer mitigation engine and cannot fulfill the requested automatic WAF-rule response. The required behavior is Shield-driven creation of application-layer mitigation rules during an attack, rather than a static protection policy alone.

 

Question 9

An application role in Account B must directly call GetSecretValue for a secret owned by Account A. The secret is encrypted with KMS. Which design provides the required cross-account access without copying the secret? Choose ONE.

1. Add a resource policy to the secret, an identity policy to the caller, and appropriate permissions on a customer-managed KMS key
2. Grant only secretsmanager:GetSecretValue in Account B
3. Keep the default AWS managed key and add only a secret resource policy
4. Create an interface VPC endpoint in Account B

Correct Answer(s)

 

A

Rationale

1. Direct cross-account retrieval requires authorization on both sides: the secret’s resource policy must trust the external principal and the caller needs identity permissions. Because decryption is cross-account, the secret should use a customer-managed KMS key whose key policy also permits the required use. Network reachability and secret authorization are separate concerns; this scenario requires both cross-account resource permission and usable cross-account decryption.
2. An identity policy in the caller’s account is not sufficient by itself. The secret is a resource in Account A, so Account A must also authorize the external principal, and the KMS encryption key must permit cross-account decryption. Network reachability and secret authorization are separate concerns; this scenario requires both cross-account resource permission and usable cross-account decryption.
3. A secret resource policy is necessary for direct cross-account access, but the default AWS managed Secrets Manager key cannot provide the required cross-account key authorization. The caller also needs its own identity permission. Network reachability and secret authorization are separate concerns; this scenario requires both cross-account resource permission and usable cross-account decryption.
4. A VPC endpoint changes the network path used to reach Secrets Manager. It does not grant cross-account permission to a secret or allow the external principal to decrypt the KMS-protected secret in another account. Network reachability and secret authorization are separate concerns; this scenario requires both cross-account resource permission and usable cross-account decryption.

 

Question 10

A multi-Region application fails over from us-east-1 to us-west-2. During a regional outage, the standby workload must retrieve a local managed copy of the application’s secret instead of depending on the primary Region. What should the architect configure? Choose ONE.

1. Read the primary-Region secret through a VPC endpoint in us-west-2
2. Store a plaintext copy in a standby instance’s user data
3. Secrets Manager multi-Region secret replication
4. Export the secret value into a CloudFormation parameter during each deployment

Correct Answer(s)

 

C

Rationale

1. Interface endpoints are regional and provide private connectivity to a regional service endpoint; they do not create a resilient local copy of a secret from another Region. The failover design would still depend on the primary Region’s secret. Regional independence is the goal, so the standby workload needs a Secrets Manager copy in its failover Region instead of reaching back to the primary.
2. User data is not an appropriate secret store and would create a second unmanaged credential copy. It also loses Secrets Manager controls such as encryption, access policies, and lifecycle management. Regional independence is the goal, so the standby workload needs a Secrets Manager copy in its failover Region instead of reaching back to the primary.
3. Secrets Manager can replicate a primary secret to selected Regions, creating regional replica secrets that workloads can retrieve locally. That removes the primary-Region lookup dependency and keeps the failover design within Secrets Manager’s managed secret lifecycle. Regional independence is the goal, so the standby workload needs a Secrets Manager copy in its failover Region instead of reaching back to the primary.
4. Embedding the secret value into deployment inputs creates additional secret material and does not maintain an automatically managed regional replica. It also complicates rotation and failover consistency. Regional independence is the goal, so the standby workload needs a Secrets Manager copy in its failover Region instead of reaching back to the primary.

 

Question 11

A Secrets Manager rotation completed, but an external dependency was not ready for the new credential. Operators need the immediately previous secret value for a controlled rollback while they investigate. Which version selector should they use? Choose ONE.

1. Retrieve the version labeled AWSCURRENT
2. Retrieve the version labeled AWSPREVIOUS
3. Create a second secret from the current value and rename it
4. Disable the KMS key and read the encrypted secret from cache

Correct Answer(s)

 

B

Rationale

1. AWSCURRENT points to the version that Secrets Manager currently treats as active. Immediately after the problematic rotation, that is the new credential causing the compatibility issue rather than the prior value needed for rollback. The recovery decision is about selecting the immediately preceding managed secret version, not creating a new copy or changing encryption controls.
2. Secrets Manager uses staging labels to track versions during rotation. AWSPREVIOUS identifies the formerly current version after a successful rotation, allowing operators to retrieve the immediately prior credential without guessing a version identifier. The recovery decision is about selecting the immediately preceding managed secret version, not creating a new copy or changing encryption controls.
3. Duplicating the current value would preserve the credential that is already causing trouble. It also introduces unnecessary secret objects instead of using the retained version metadata that Secrets Manager already manages. The recovery decision is about selecting the immediately preceding managed secret version, not creating a new copy or changing encryption controls.
4. Disabling the encryption key would impede legitimate decrypt operations and does not select the earlier secret value. Recovery should use version staging rather than altering encryption availability. The recovery decision is about selecting the immediately preceding managed secret version, not creating a new copy or changing encryption controls.

 

Question 12

A user pool authenticates employees, but downstream APIs need entitlement claims that are calculated from internal attributes at sign-in time. The application should continue to trust Cognito-issued tokens rather than mint its own JWTs. Which feature should be used? Choose ONE.

1. Post authentication Lambda trigger
2. Custom authentication challenge Lambda triggers
3. Identity pool unauthenticated role
4. Amazon Cognito pre token generation Lambda trigger

Correct Answer(s)

 

D

Rationale

1. A post authentication trigger can run custom logic after sign-in, but it is not the token-customization hook that changes claims before Cognito issues the token. The API would still receive the original claims. The API needs claims embedded in Cognito-signed tokens at issuance time, which makes a token-generation hook the relevant extension point.
2. Custom challenge triggers replace or extend how a user proves identity. They are appropriate for bespoke authentication steps, not for modifying the claims in otherwise normal Cognito-issued ID or access tokens. The API needs claims embedded in Cognito-signed tokens at issuance time, which makes a token-generation hook the relevant extension point.
3. An unauthenticated identity-pool role provides temporary AWS credentials to guest users. It does not customize the claims in a user pool JWT and therefore cannot carry the required application entitlement data. The API needs claims embedded in Cognito-signed tokens at issuance time, which makes a token-generation hook the relevant extension point.
4. The pre token generation trigger runs before token issuance and can add, suppress, or modify supported claims. That lets downstream APIs receive calculated entitlement information while the tokens remain signed and issued by the user pool. The API needs claims embedded in Cognito-signed tokens at issuance time, which makes a token-generation hook the relevant extension point.

 

Question 13

A consumer application uses Amazon Cognito managed login. Product management wants users to sign in with device-backed WebAuthn passkeys so that a password is not required. Which Cognito design should the architect choose? Choose ONE.

1. Require SMS MFA after a password
2. Use only the USER_SRP_AUTH password flow
3. Enable passkeys with Cognito choice-based authentication
4. Store device API keys in user attributes

Correct Answer(s)

 

C

Rationale

1. SMS MFA adds a second factor to password authentication, but it still depends on a password and does not deliver the requested passwordless WebAuthn experience. It also has different phishing and recovery characteristics than passkeys. The requirement is passwordless WebAuthn authentication through Cognito, so password-centric or ad hoc credential approaches do not meet the user experience.
2. SRP protects password exchange, yet the user still authenticates with a password. The requirement explicitly asks for passkeys through managed login, so a password-only SRP flow does not satisfy the sign-in experience. The requirement is passwordless WebAuthn authentication through Cognito, so password-centric or ad hoc credential approaches do not meet the user experience.
3. Cognito passkey authentication is available through the choice-based flow, and managed login can handle the passkey experience. This provides asymmetric, phishing-resistant credentials tied to authenticators without forcing the application to collect a password for each sign-in. The requirement is passwordless WebAuthn authentication through Cognito, so password-centric or ad hoc credential approaches do not meet the user experience.
4. API keys are not end-user WebAuthn credentials and user attributes are not an appropriate authentication secret store. This approach would bypass Cognito’s native passkey support and weaken lifecycle and phishing resistance. The requirement is passwordless WebAuthn authentication through Cognito, so password-centric or ad hoc credential approaches do not meet the user experience.

 

Question 14

A customer portal uses a Cognito user pool. Security wants normal low-risk sign-ins to remain frictionless, but sessions that Cognito evaluates as high risk should require MFA before access continues. What should the architect configure? Choose ONE.

1. Amazon Cognito adaptive authentication
2. AWS WAF CAPTCHA on the sign-in page
3. Require MFA for every user on every sign-in
4. Amazon GuardDuty Runtime Monitoring

Correct Answer(s)

 

A

Rationale

1. Adaptive authentication evaluates sign-in risk and can apply responses such as requiring MFA for elevated-risk attempts. That lets ordinary low-risk sessions proceed normally while adding a stronger challenge when Cognito’s threat-protection signals justify it. Risk-sensitive MFA is the governing condition: strong authentication should be invoked only when the user pool’s sign-in risk evaluation warrants it.
2. A WAF CAPTCHA can challenge web requests that match a rule, but it does not use Cognito’s authentication-risk assessment to decide whether a user must complete MFA. It operates at the web-request layer rather than the user-pool risk engine. Risk-sensitive MFA is the governing condition: strong authentication should be invoked only when the user pool’s sign-in risk evaluation warrants it.
3. Always-on MFA would increase security but would not preserve the frictionless low-risk experience. The requirement is conditional enforcement based on Cognito’s assessment of the current sign-in. Risk-sensitive MFA is the governing condition: strong authentication should be invoked only when the user pool’s sign-in risk evaluation warrants it.
4. GuardDuty Runtime Monitoring observes workload runtime behavior such as processes, files, and connections. It does not score individual Cognito sign-in attempts or invoke MFA within a user pool. Risk-sensitive MFA is the governing condition: strong authentication should be invoked only when the user pool’s sign-in risk evaluation warrants it.

 

Question 15

Authenticated users obtain temporary AWS credentials from a Cognito identity pool. A trusted department claim in each token should determine whether the user receives the Finance, Engineering, or Support IAM role. Which identity-pool configuration best implements this? Choose ONE.

1. Cognito managed login branding
2. A user-pool password policy
3. A WAF label match statement
4. Identity pool rule-based role mapping

Correct Answer(s)

 

D

Rationale

1. Managed login branding controls the authentication interface and federation experience. It does not inspect a token claim to select among temporary IAM roles when an identity pool exchanges identity for AWS credentials. The identity pool must convert a trusted token attribute into an IAM role choice when issuing AWS credentials, which is role-mapping behavior.
2. Password policy controls password strength and related authentication requirements. It has no role-selection logic for identity-pool credential issuance and cannot map a department claim to Finance, Engineering, or Support permissions. The identity pool must convert a trusted token attribute into an IAM role choice when issuing AWS credentials, which is role-mapping behavior.
3. WAF labels describe web-request classification within a web ACL. They are unrelated to Cognito token claims and cannot cause an identity pool to choose an IAM role for an authenticated user. The identity pool must convert a trusted token attribute into an IAM role choice when issuing AWS credentials, which is role-mapping behavior.
4. Rule-based mapping evaluates token claims and assigns the IAM role associated with the first matching rule. Mapping the trusted department claim therefore lets the identity pool issue temporary credentials with different permissions without separate pools for each department. The identity pool must convert a trusted token attribute into an IAM role choice when issuing AWS credentials, which is role-mapping behavior.

 

Question 16

A company runs sensitive workloads on Amazon EKS. Security needs managed threat detection that can observe process execution, file access, and network connections inside workloads and detect attempts to escalate from a container toward the host. Which capability should be enabled? Choose ONE.

1. Amazon Inspector ECR enhanced scanning
2. GuardDuty Runtime Monitoring for Amazon EKS
3. AWS CloudTrail management events only
4. Amazon Macie automated discovery

Correct Answer(s)

 

B

Rationale

1. ECR scanning examines container images for software vulnerabilities. It does not observe a running container’s process execution, file access, or network behavior after deployment, so it cannot provide the required runtime compromise visibility. Runtime process, file, and connection activity inside EKS is the evidence source; vulnerability inventories or control-plane logs do not provide that visibility.
2. Runtime Monitoring deploys a GuardDuty security agent that provides workload-level visibility into process, file, and network activity. That telemetry allows GuardDuty to identify suspicious container behavior and privilege-escalation attempts that static image scanning cannot see. Runtime process, file, and connection activity inside EKS is the evidence source; vulnerability inventories or control-plane logs do not provide that visibility.
3. CloudTrail management events record control-plane API activity, which is important for audit and investigation. They do not expose the in-container runtime telemetry needed to see a malicious process or local privilege-escalation behavior. Runtime process, file, and connection activity inside EKS is the evidence source; vulnerability inventories or control-plane logs do not provide that visibility.
4. Macie focuses on sensitive-data discovery and S3 data-security posture. It does not instrument EKS nodes or containers for runtime processes and network connections, so it addresses a different security problem. Runtime process, file, and connection activity inside EKS is the evidence source; vulnerability inventories or control-plane logs do not provide that visibility.

 

Question 17

An incident responder suspects malware on an EC2 instance after receiving intelligence from an external source. GuardDuty has not generated a finding for the instance, but the responder wants an agentless malware scan now. Which GuardDuty feature should be used? Choose ONE.

1. GuardDuty-initiated malware scan
2. GuardDuty on-demand malware scan
3. Amazon Inspector network reachability analysis
4. AWS Systems Manager Inventory

Correct Answer(s)

 

B

Rationale

1. GuardDuty-initiated scanning starts automatically when certain GuardDuty findings indicate possible malware. Because no triggering finding exists in this scenario, the analyst cannot rely on the automatic scan path to begin immediately. The responder needs a scan that can be initiated on demand without waiting for GuardDuty to emit one of the findings that triggers automatic scanning.
2. On-demand malware scanning lets the responder specify an EC2 instance and start an agentless scan even without a preceding GuardDuty finding. GuardDuty analyzes snapshots of attached EBS volumes while the instance remains in use, matching the incident-response requirement. The responder needs a scan that can be initiated on demand without waiting for GuardDuty to emit one of the findings that triggers automatic scanning.
3. Inspector can identify software vulnerabilities and exposure paths for supported resources, but it is not an operator-triggered malware scanner for the contents of an EC2 instance’s EBS volumes. The responder needs a scan that can be initiated on demand without waiting for GuardDuty to emit one of the findings that triggers automatic scanning.
4. Systems Manager Inventory collects metadata about managed instances and installed software. It does not perform the GuardDuty malware analysis needed to determine whether malicious files are present on attached volumes. The responder needs a scan that can be initiated on demand without waiting for GuardDuty to emit one of the findings that triggers automatic scanning.

 

Question 18

A company stores documents in Amazon S3 that contain a proprietary employee identifier format not covered by Macie’s managed data identifiers. The privacy team wants Macie classification to recognize the format consistently. What should they create? Choose ONE.

1. Amazon Macie custom data identifier
2. A GuardDuty threat list
3. An AWS WAF regex pattern set
4. A Security Hub custom action

Correct Answer(s)

 

A

Rationale

1. A custom data identifier lets the team define organization-specific detection criteria, including a regular expression and optional contextual terms. Macie can then use that identifier in discovery jobs or automated sensitive-data discovery to recognize the proprietary employee format. The missing capability is organization-specific content recognition in S3, so the solution must extend Macie’s classification criteria rather than web or threat rules.
2. GuardDuty threat lists supply IP-address or domain intelligence for threat detection. They do not define data-classification patterns for text stored inside S3 objects and therefore cannot teach Macie a proprietary identifier format. The missing capability is organization-specific content recognition in S3, so the solution must extend Macie’s classification criteria rather than web or threat rules.
3. WAF regex pattern sets match HTTP request components at the application edge. They do not extend Macie’s content-classification engine or cause S3 objects to be scanned for a proprietary sensitive-data pattern. The missing capability is organization-specific content recognition in S3, so the solution must extend Macie’s classification criteria rather than web or threat rules.
4. A custom action can support analyst workflows around findings, but it does not define new sensitive-data recognition logic. Macie needs a data identifier, not a post-finding workflow control. The missing capability is organization-specific content recognition in S3, so the solution must extend Macie’s classification criteria rather than web or threat rules.

 

Question 19

A Security Hub administrator wants all new or provider-updated informational findings from a specific product to be automatically marked with a lower priority workflow status when they meet defined criteria. The team wants a native solution without Lambda code. What should be configured? Choose ONE.

1. Security Hub finding aggregator
2. A Security Hub insight
3. AWS Security Hub automation rule
4. A Security Hub custom action

Correct Answer(s)

 

C

Rationale

1. A finding aggregator centralizes Security Hub findings across Regions. It changes where findings are collected, but it does not apply conditional field updates to matching new or updated findings. The requirement is native conditional mutation of matching findings as they arrive, not regional aggregation, visualization, or a manual analyst action.
2. Insights group and filter related findings so analysts can monitor patterns. They do not mutate workflow fields automatically when a provider creates or updates a finding. The requirement is native conditional mutation of matching findings as they arrive, not regional aggregation, visualization, or a manual analyst action.
3. Automation rules evaluate new and updated findings against configured criteria and can automatically update supported finding fields. This provides the native no-code policy the administrator needs for consistent low-risk finding handling. The requirement is native conditional mutation of matching findings as they arrive, not regional aggregation, visualization, or a manual analyst action.
4. A custom action supports an analyst-initiated workflow, commonly through EventBridge integrations. It still requires someone to select the action and does not automatically update every matching incoming finding. The requirement is native conditional mutation of matching findings as they arrive, not regional aggregation, visualization, or a manual analyst action.

 

Question 20

A data lake contains sensitive S3 objects. Security wants managed threat detection for credentialed object-level API behavior such as suspicious access, exfiltration, or destructive activity. The team does not want to create and manage a separate CloudTrail S3 data-event trail for this purpose. What should be enabled? Choose ONE.

1. Amazon Macie automated sensitive data discovery
2. AWS CloudTrail management events only
3. Amazon Inspector EC2 scanning
4. GuardDuty S3 Protection

Correct Answer(s)

 

D

Rationale

1. Macie analyzes S3 objects and bucket posture to identify sensitive data. It does not perform GuardDuty-style threat detection on credentialed object-level API behavior such as suspicious access sequences or destructive calls. The signal of interest is credentialed object-level S3 API behavior, so a threat-detection protection plan is required rather than content classification alone.
2. Management events cover control-plane operations but not the full object-level S3 data activity required here. Relying on management events alone would miss the detailed API behavior the security team wants analyzed. The signal of interest is credentialed object-level S3 API behavior, so a threat-detection protection plan is required rather than content classification alone.
3. Inspector assesses supported compute resources, images, and Lambda packages for vulnerabilities. It does not monitor S3 object-level API activity and therefore cannot detect data-access threats in the bucket. The signal of interest is credentialed object-level S3 API behavior, so a threat-detection protection plan is required rather than content classification alone.
4. S3 Protection enables GuardDuty to analyze CloudTrail data events for S3 object-level operations and generate findings for suspicious credentialed activity. GuardDuty obtains the relevant data events for this protection plan, so the team need not configure its own S3 data-event trail. The signal of interest is credentialed object-level S3 API behavior, so a threat-detection protection plan is required rather than content classification alone.

• < Amazon AWS SAA-C03 Application Protection, WAF, Shield, Secrets, Cognito, and Threat Detection Practice Test 1
• Amazon AWS SAA-C03 Encryption, KMS, Key Policies, Certificates, and Data Protection Practice Test 1 >