SCS-C03 Exam Preparation Material | AWS Certified Security - Specialty

Explanation:
AWS Systems Manager Run Command enables security engineers to remotely and securely execute scripts on EC2 instances without requiring SSH or inbound network access. According to AWS Certified Security C Specialty incident response guidance, Run Command is a foundational tool for instance quarantine and forensic preparation.
By configuring IAM permissions that allow the SSM Agent to execute a predefined Run Command document, the security engineer can rapidly deploy forensic tools, disable services, or modify system configurations across affected EC2 instances during an incident. This approach aligns with AWS best practices for containment and evidence preservation, while maintaining auditability through Systems Manager logs.
Option A only provides visibility, not quarantine capability.
Option B restricts access but does not allow forensic tooling.
Option C enables access to the script but does not execute it. AWS documentation emphasizes that Systems Manager Run Command is the recommended mechanism for incident response automation and quarantine action son EC2 instances.
AWS Certified Security C Specialty Official Study Guide AWS Systems Manager Run Command Documentation AWS Incident Response Best Practices

Explanation:
Amazon GuardDuty provides continuous threat detection for compromised instances by analyzing VPC Flow Logs, DNS logs, and CloudTrail events. According to AWS Certified Security C Specialty guidance, GuardDuty is the fastest service to enable for detecting malware and compromised EC2 instances.
To notify the security team, Amazon SNS provides a native email notification mechanism with minimal setup. Amazon EventBridge integrates directly with GuardDuty findings and can filter based on severity. Creating an EventBridge rule that matches high severity GuardDuty findings and publishes to SNS ensures immediate notification.
Security Hub is not required for this use case and adds additional setup time. Amazon SQS does not support email subscriptions.
Referenced AWS Specialty Documents:
AWS Certified Security C Specialty Official Study Guide Amazon GuardDuty Findings and Severity Amazon EventBridge Integration with GuardDuty

Explanation:
Amazon WorkSpaces is a fully managed desktop-as-a-service solution designed to minimize infrastructure and operational overhead. According to AWS Certified Security C Specialty documentation, WorkSpaces supports device trust by using client certificates to restrict access to approved devices.
By deploying client certificates only to company-managed devices and enforcing restricted access at the directory level, the organization ensures that only trusted endpoints can authenticate. This approach avoids the cost and complexity of building and maintaining a custom VDI or managing individual EC2 instances.
Option A and B significantly increase management overhead.
Option C is incorrect because IAM does not manage WorkSpaces authentication gateway policies or device trust.
AWS best practices highlight Amazon WorkSpaces with certificate-based device trust as the most efficient solution for secure, managed desktops .
Referenced AWS Specialty Documents:
AWS Certified Security C Specialty Official Study Guide Amazon WorkSpaces Security Controls Amazon WorkSpaces Device Trust

Explanation:
Comprehensive and Detailed 100to 150 words of Explanation From AWS Certified Security C Specialty topics:
IAM Identity Center account instances are designed for isolated deployments of supported
AWS managed applications in a single AWS account. AWS documentation states that account instances should be used for isolated users who need applications in one account, and they remain bound to the account in which they are created .
This matches the requirement:
third-party users cannot be added to the company’s main IdP, and access must be isolated from the organization-level IAM Identity Center identity source. Amazon Cognito identity pools do not configure authentication for IAM Identity Center integrated AWS managed applications in this pattern. IAM SAML roles in the management account would not isolate the application account cleanly. IAM Identity Center supports one identity source per instance, so adding a second identity source to the organization instance is not the right design.

Explanation:
Comprehensive and Detailed 100to 150 words of Explanation From AWS Certified Security C Specialty topics:
Cryptocurrency mining validation requires evidence of actual mining behavior, not only metadata about the finding. Process details show whether mining binaries or suspicious processes are running on the instance. DNS analysis can reveal lookups to known mining pools or suspicious domains. VPC Flow Logs help confirm outbound connections , destinations, ports, and traffic volume from the instance. GuardDuty uses foundational data sources such as DNS logs, VPC Flow Logs, and CloudTrail events to detect suspicious activity, so those same sources are appropriate for validating and scoping the finding. CPU
metrics alone are useful context but not enough. Counting findings or checking severity does not prove impact. Session history and Route 53 records do not directly validate mining behavior.