SCS-C03 Exam Preparation Material | AWS Certified Security - Specialty

Explanation:
The most secure and AWS-recommended pattern for cross-account access is to create an IAM role in the target account (production) and allow trusted principals from the source account (developer) to assume the role by using AWS STS. This avoids long-term credentials in the production account, supports short-lived session credentials, and enables strong controls such as MFA requirements, session duration limits, and precise least-privilege permissions attached to the role. It also centralizes ownership of production permissions in the production account, which is important for separation of duties and governance.
Option A is insecure because it requires password sharing and uses a long-lived IAM user credential, which is against AWS best practices.
Option C is also poor because it relies on a long-lived IAM user in the production account and encourages credential sharing/duplication.
Option B places the role in the developer account; while you can attach permissions there, access to production resources is governed by the production account. The standard approach is a production-account role with a trust policy that names the developer account principals (or a role) as allowed to assume it. Therefore, Option D is the most secure solution.

Explanation:
The company needs centralized, scalable protection across many accounts for both existing and future API Gateway resources, with minimal ongoing effort. AWS Firewall Manager is specifically designed for this: it can centrally deploy and enforce AWS WAF protections across AWS Organizations. By creating a Firewall Manager WAF policy, the security team defines a single set of controls (for example, AWS Managed Rules for SQL injection protection and AWS Bot Control) and applies them automatically to in-scope resources across member accounts.
Critically, Firewall Manager can be configured to auto-remediate noncompliant resources, ensuring that if new API Gateway stages are created later, they are automatically brought under the policy without manual per-account work. This directly meets the “existing and future resources” requirement.
Options A, C, and D introduce higher operational overhead: per-API ACL creation plus AWS Config remediation (A) is more moving parts; Service Catalog plus detection/remediation (C) is indirect and heavy; and Security Hub + EventBridge + Lambda automation (D) is custom engineering and maintenance. Firewall Manager is the AWS-native centralized governance solution for multi-account WAF rollout and enforcement.

Explanation:
AWS Organizations service control policies (SCPs) are designed to enforce preventive guardrails across accounts without requiring application-level changes. According to the AWS Certified Security C Specialty documentation, SCPs can restrict specific API actions or require certain condition keys to enforce security standards centrally. AWS Lambda function URLs support two authentication modes: AWS_IAM and NONE. When the authentication type is set to NONE, the function URL becomes publicly accessible, which introduces a significant security risk in production environments.
By using an SCP that explicitly denies the lambda: CreateFunctionUrlConfig and lambda: UpdateFunctionUrlConfig actions when the lambda: FunctionUrlAuthType condition key equals NONE, the organization ensures that unauthenticated function URLs cannot be created or modified in production accounts. This enforcement occurs at the AWS Organizations level and applies automatically to all accounts within the specified organizational units (OUs). Developers are not required to change their workflows or add additional controls, satisfying the requirement of no additional developer effort.
Option A relates to browser-based access controls and does not provide authentication or authorization enforcement.
Option B is not valid because AWS WAF cannot be attached directly to AWS Lambda function URLs.
Option C is incorrect because SCPs do not grant permissions; they only limit permissions. AWS documentation clearly states that SCPs define maximum available permissions and are evaluated before IAM policies.
This approach aligns with AWS best practices for centralized governance, least privilege, and preventive security controls.
Referenced AWS Specialty Documents:
AWS Certified Security C Specialty Official Study Guide
AWS Organizations Service Control Policies Documentation
AWS Lambda Security and Function URL Authentication Overview

Explanation:
Comprehensive and Detailed 100to 150 words of Explanation From AWS Certified Security C Specialty topics:
Centralized root access management in IAM is the correct preventive control because it lets an organization centrally manage privileged root user credentials for member accounts. AWS documentation states that after centralizing root access, an organization can delete root user credentials from member accounts, including passwords, access keys, signing certificates, and MFA configuration. New accounts created in AWS Organizations have no root credentials by default. This directly reduces compromise risk and removes the operational burden of rotating or monitoring root credentials in every account. Lambda cannot truly disable the root user cleanly. Security Hub CSPM does not provide this root access management function. SCPs can deny many root actions, but they do not remove long-term root credentials and still leave credential-management overhead.

Explanation:
Amazon GuardDuty provides continuous threat detection for compromised instances by analyzing VPC Flow Logs, DNS logs, and CloudTrail events. According to AWS Certified Security C Specialty guidance, GuardDuty is the fastest service to enable for detecting malware and compromised EC2 instances.
To notify the security team, Amazon SNS provides a native email notification mechanism with minimal setup. Amazon EventBridge integrates directly with GuardDuty findings and can filter based on severity. Creating an EventBridge rule that matches high severity GuardDuty findings and publishes to SNS ensures immediate notification.
Security Hub is not required for this use case and adds additional setup time. Amazon SQS does not support email subscriptions.
Referenced AWS Specialty Documents:
AWS Certified Security C Specialty Official Study Guide Amazon GuardDuty Findings and Severity Amazon EventBridge Integration with GuardDuty