SCS-C03 Exam Results

Comprehensive and Detailed 100to 150 words of Explanation From AWS Certified Security – Specialty topics:

AWS WAF can be associated directly with an Amazon Cognito user pool. A web ACL gives fine-grained control over HTTPS requests that Cognito hosted UI, managed login, and API endpoints process. This is the correct way to block unwanted requests, bot traffic, suspicious user agents, IP patterns, and abusive request behavior while preserving access for legitimate users. Cognito threat protection is aimed at adaptive authentication and compromised-credential style risks, not broad request filtering for bot traffic at the endpoint layer. App client settings cannot block unauthenticated malicious requests before they reach Cognito endpoints. CloudWatch can monitor activity but does not itself enforce blocking. AWS WAF is the preventive control specifically designed for this edge-facing request-filtering requirement.

================

When an internet-facing ALB is used as a CloudFront origin, it remains directly accessible unless additional access controls are enforced. According to AWS Certified Security – Specialty guidance,CloudFront IP allow lists alone are insufficient, because CloudFront IP ranges change and are not guaranteed to be exclusive.

The recommended and most secure approach is to configure CloudFront to send acustom origin header(such as X-Shared-Secret) with a secret value on every request to the origin. The ALB listener rules are then configured toforward traffic only when the header exists and matches the expected value. Requests that attempt to bypass CloudFront will not include this header and will be denied.

Option A is invalid because CloudFront does not support PrivateLink origins. Option B introduces unnecessary architectural changes and is not required. Option C is brittle and operationally risky due to changing IP ranges.

AWS documentation explicitly recommendscustom origin headersas the best practice to ensure that only CloudFront can access an internet-facing ALB when AWS WAF is attached at the CloudFront layer.

AWS Certified Security – Specialty Official Study Guide

Amazon CloudFront Origin Security Documentation

AWS WAF and ALB Integration Guidance

Comprehensive and Detailed 100to 150 words of Explanation From AWS Certified Security – Specialty topics:

AWS Backup uses backup plans to define backup frequency, lifecycle behavior, cold storage transition, and retention. For snapshot-based backups, AWS Backup supports retention periods from 1 day up to 100 years, or indefinitely if no retention is specified. Therefore, a backup plan with a 5-year retention period is the correct lifecycle-management mechanism. Tags alone do not enforce retention. The customer does not directly manage an S3 bucket that AWS Backup uses for RDS snapshots, so S3 versioning or S3 Lifecycle policies are not the correct control path. RDS native automated backups have shorter retention limits, but AWS Backup snapshot retention is managed through the AWS Backup plan and is the appropriate service-level mechanism for long-term retention.

================

Amazon S3 Object Lock in compliance mode provides write-once-read-many (WORM) protection, which prevents objects from being modified or deleted for a specified retention period. According to the AWS Certified Security – Specialty Study Guide, compliance mode enforces immutability even for the root user and cannot be overridden.

Enabling S3 Object Lock requires S3 bucket versioning and ensures that once an object is written, it cannot be changed or removed until the retention period expires. This is the strongest protection against data modification and is commonly used for regulatory and legal retention requirements.

Option A can be bypassed by administrators. Option D only protects against deletions, not overwrites. Option C changes encryption but does not prevent modification.

AWS documentation explicitly identifies S3 Object Lock in compliance mode as the correct solution for immutable data storage.

Referenced AWS Specialty Documents:

AWS Certified Security – Specialty Official Study Guide

Amazon S3 Object Lock

Amazon S3 Data Protection and Compliance