Security Foundations and Governance (14%)

SCS-C03 · 42 questions

• A financial holding company uses AWS Organizations with 40 member accounts and must prevent data leaving its boundary, block members from opting out of AI service data protections, and still allow central security to audit all resources. Which organization policy combination should the platform team deploy to enforce these guardrails?
• A bank must ensure no S3 buckets allow public access and must auto-fix violations within 15 minutes with alerts to the security team. Auditors require history of evaluations and fixes. Which compliance detection and remediation design meets the governance requirement?
• A fintech startup preparing for SOC 2 must prove its multi-account landing zone follows AWS security best practices for logging, encryption, and least privilege, with documented remediation ownership. Leadership wants a repeatable review tied to the Well-Architected Security pillar. Which method should the security lead use to evaluate architecture compliance?
• A retail enterprise with 120 accounts in Organizations needs consistent WAF rules on internet-facing ALBs and centrally managed VPC security groups without local edits. Which central policy deployment approach should the security architect implement to enforce firewall protections from the management account?
• A holding company with 60 AWS accounts in five subsidiaries needs centralized billing, separate guardrails per subsidiary, and automated provisioning of new accounts with baselines. The landing zone must scale without email juggling. Which Organizations deployment meets these governance goals?
• A global manufacturer with 80 Organizations member accounts must eliminate standalone root passwords, enforce MFA on every root, and retain a tested emergency access path if Identity Center fails. The CISO requires centralized root credential governance and auditable break-glass use. Which root user management strategy meets these governance goals?
• A media group with 60 Organizations accounts needs to share inspection VPC subnets and approved Service Catalog portfolios without copying templates or peering each VPC. Which secure sharing mechanism should the cloud team implement to distribute resources across accounts centrally?
• A fintech startup has 12 AWS accounts created manually with separate bills and no consistent guardrails. Leadership requires centralized billing, grouped workloads by environment, and preventive controls that block disallowed Regions. Which Organizations configuration should the architect implement to centralize account deployment with preventive guardrails?
• A SaaS company that already has AWS Audit Manager set up in its organization must demonstrate SOC 2 controls each quarter across 12 AWS accounts. The GRC team needs automatically collected configuration evidence mapped to a framework and auditor-ready reports without manual screenshots. Which audit evidence collection service should the compliance lead select to streamline recurring SOC 2 assessments?
• A retail enterprise with 40 existing AWS accounts wants standardized baselines, required guardrails, and a custom rule blocking non-approved Regions. New acquisitions must enroll with networking baselines automatically. Which Control Tower strategy deploys mandatory, optional, and custom controls across new and existing environments?
• A holding company uses AWS Organizations with 60 member accounts and a dedicated Security OU. It must centrally manage GuardDuty, Security Hub and Macie detective findings, keep member data local, and avoid using long-term access keys for administration. Which delegation approach should the architect implement to centrally manage security services?
• A retail enterprise manages 80 AWS accounts under AWS Organizations with separate dev, test, and prod OUs. Platform teams must roll out identical VPC, logging, and guardrails quickly and keep them consistent after changes. Which approach should the cloud architect choose to deploy cloud resources consistently and securely across accounts?
• A manufacturing firm has 30 existing AWS accounts in an organization and wants standardized baselines, new accounts via self-service, plus stronger logging controls beyond defaults and custom encryption checks. Engineers fear migration downtime for existing workloads. Which Control Tower approach should the lead adopt to govern new and existing accounts centrally?
• An auditor requires continuous detection of public S3 buckets and unencrypted EBS volumes, automatic remediation where safe, and Slack plus email alerts for owners. The platform team must prove history and compliance trends. Which compliance evaluation and notification design should the team deploy?
• A logistics firm is preparing for a customer security review and wants a structured gap assessment of its multi-account architecture against AWS security best practices with prioritized improvements. Which evaluation service should the security architect use to benchmark architecture maturity and track remediation?
• An enterprise manages 120 AWS accounts in Organizations and must prevent routine root use, enforce phishing-resistant MFA for any root access, and allow emergency access within one hour with full auditability. Which root credential strategy should the security team implement to manage AWS account root user credentials?
• A multinational must block public S3 access org-wide, restrict IAM to trusted Regions, and prevent training AI models on sensitive data, while allowing security teams to retain detective access. Which organization policy combination enforces these permission guardrails with least operational friction?
• A university operates AWS workloads for engineering, biology, and finance across dev and prod, needing chargeback by department and cost center plus automated cleanup of temporary lab environments. Which tagging strategy should the governance team implement to organize resources into groups for management?
• A retail enterprise runs 60 AWS accounts with VPCs that need identical WAF rules and Security Groups baseline, plus automatic remediation when teams drift. Central security wants single-pane enforcement without logging into accounts. Which centralized deployment strategy enforces consistent network protection centrally?
• A financial services group operates 150 AWS accounts with strict regulators requiring consistent detective controls and no local security opt-outs. They designated a security tooling account and use Control Tower. They must enforce GuardDuty, Inspector, and Security Hub everywhere from one place. Which delegated-administration strategy enforces centralized security service control?
• An existing AWS Audit Manager customer, a fintech company, must prove PCI DSS controls on EC2, RDS, and IAM to external auditors with organized control-mapped evidence, auditor-ready reports, and continuous collection. Manual screenshots are no longer accepted. Which audit evidence service combination should the compliance team use to demonstrate resource compliance?
• A regulated enterprise with 120 AWS accounts must block all IAM users from disabling CloudTrail, prevent data exfiltration to external S3 buckets, and centrally restrict AI services from training on content. Only the break-glass admin role may bypass controls. Which organization policy strategy manages these permissions centrally?
• A platform team must deploy guardrail VPCs, roles, and Config rules identically to 60 Organization accounts, prevent drift, and promote changes through dev to production with approvals. Manual console work caused inconsistency. Which IaC deployment strategy should the architect implement to deploy cloud resources consistently and securely across accounts?
• A logistics company with 60 AWS accounts in one payer needs isolated production, stage, and sandbox environments, centrally enforced guardrails, and consolidated billing. Which Organizations deployment best provides delegated structure with centralized governance?
• A regional bank with 40 existing AWS accounts in Organizations wants a governed landing zone with preventive controls, centralized logging, and enrollment of current workloads without recreation plus a custom check for approved regions. Which Control Tower approach meets all landing zone enrollment and control requirements?
• A 400-person fintech runs 60 AWS accounts for payments, analytics, and dev sandboxes under Organizations. Finance must allocate spend by department and environment, and security must find all prod databases quickly. Tagging is inconsistent and manual. Which tagging control best delivers consistent grouping for management?
• A SaaS company with 40 AWS accounts must demonstrate alignment to AWS security best practices for SOC 2, with prioritized remediation tracked by workload owners across business units. Reviews must be repeatable each quarter without hiring external assessors. Which control should the auditor test first to confirm architecture compliance with security best practices?
• A platform team manages 60 member accounts in AWS Organizations and must distribute approved golden VPCs, license-included AMIs, and Service Catalog portfolios from a central shared-services account. Each product must remain centrally versioned, least-privilege accessible, and auditable without copying templates manually. Which cross-account sharing approach securely distributes centrally governed resources?
• A fintech company runs 45 AWS accounts in Organizations where each member root user still has a long-term password. Auditors require removal of standalone root credentials, MFA-protected privileged access, and a documented emergency path with full audit trails. Which root-management approach should the security architect implement to centralize member root control and break-glass recovery?
• A retail enterprise with 120 accounts in AWS Organizations wants GuardDuty, Security Hub, and Macie managed centrally, with findings aggregated in a security account and policies preventing members from disabling them. Local teams should retain read-only visibility. Which delegated administration strategy should the governance team implement to centralize security services?
• A SaaS company with 200 accounts must detect publicly readable S3 buckets and unencrypted EBS volumes, auto-remediate them, and notify platform teams within minutes. Audits demand evidence of rule evaluations and change history across the organization. Which compliance detection and remediation design meets these notification needs?
• A fintech with 25 AWS accounts needs VPCs, KMS keys, and Config rules deployed identically in each Region, with peer-reviewed changes, drift detection, and automatic rollback on failure while avoiding console click-ops. Which IaC deployment strategy delivers consistent secure baselines across accounts?
• A university system with 40 AWS accounts in Organizations struggles with inconsistent WAF rules, open security groups, and divergent firewall policies. Central security must enforce baseline protections automatically, including remediation of drift. Which centralized control best deploys and enforces network protections?
• A regulated bank is consolidating 40 standalone AWS accounts after an acquisition, needs delegated admin for audit, requires preventive guardrails on production OUs, and must automate future account creation with baselines. Which Organizations design should the architect deploy to centrally provision accounts with preventive guardrails?
• A university system manages 65 research AWS accounts under Organizations with HIPAA data. Leadership requires central prevention of accounts leaving the organization, blocking S3 buckets from accepting public cross-account access, and requiring encryption on every new EBS volume without touching member-account roles. Which centralized organization policy combination should the governance team deploy to enforce the permission and configuration mandates?
• A regional healthcare network manages 25 AWS Organizations member accounts for clinics. Auditors require no standing root passwords, centrally enforced MFA, prevention of member recovery, and a logged emergency access path. Which centralized root credential strategy removes standing access while preserving audited emergency use?
• A public company must prove quarterly patch, encryption, and access controls across 80 accounts, continuously evaluate and collect control evidence mapped to a framework, and share compliance reports with auditors without giving console access. Manual screenshots are failing. Which approach automates evidence collection and organization for compliance reviews?
• A retailer with 40 accounts needs identical VPC baselines, guardrails, and encryption defaults deployed from a security admin account, with drift detection and versioned rollbacks. Local console changes have caused outages. Which deployment strategy should the architect choose to deliver consistent secure infrastructure across accounts?
• A media company manages 2,000 EC2, S3, and RDS resources across video and audio teams in production, staging, and development. Finance needs cost allocation by department and cost center, and security needs consistent grouping for access controls. Which tagging strategy should the governance lead enforce to organize resources by department and environment for management?
• A biotech company has 12 standalone AWS accounts running lab workloads that must stay in place. It plans 30 new project accounts over the next year that need standardized baselines. Security requires centralized governance, an elective detective control for exposed snapshots, and a custom control blocking non-approved Regions. Which Control Tower enrollment and control strategy meets all account and governance requirements?
• A holding company with 80 member accounts must enforce GuardDuty, Security Hub, and Macie findings centrally while letting each subsidiary view only its own findings and preventing members from disabling the services. Which delegated administration design achieves central control with scoped visibility?
• A media group with 20 accounts needs to share approved machine images and a central transit gateway with spoke accounts without copying resources or granting admin rights. They require scalable, auditable sharing with account-level control. Which cross-account sharing control distributes resources securely?