AWS Certified Security Specialty (SCS-C03) - 340 Questions

1. A security engineer needs to enable threat detection for an AWS account. The engineer wants to automatically detect when an EC2 instance is communicating with known malicious IP addresses. Which AWS service should the engineer enable to accomplish this with the least operational overhead?

2. A company has enabled Amazon GuardDuty across all regions in their AWS Organization. The security team receives a GuardDuty finding of type UnauthorizedAccess:IAMUser/ConsoleLoginSuccess.B. What does this finding indicate?

3. A security team wants to use Amazon GuardDuty to monitor Amazon S3 buckets for threats such as unusual data access patterns and potential data exfiltration. Which GuardDuty feature must be enabled to support S3 protection?

4. A company uses AWS Security Hub to centralize security findings. The security operations team wants to automatically send high-severity findings to their ticketing system. Which combination of services provides the most straightforward solution?

5. A security engineer wants to classify sensitive data stored in Amazon S3 buckets across a company's AWS account and identify buckets that contain personally identifiable information (PII). Which AWS service is purpose-built for this task?