Amazon Web Services SCS-C03 Dumps Questions Answers

Amazon Inspector is the AWS service designed specifically for vulnerability management across compute workloads, including Amazon ECR container images and AWS Lambda functions. According to the AWS Certified Security – Specialty documentation, Amazon Inspector provides automated vulnerability assessments for container images stored in ECR by performing enhanced image scanning that identifies common vulnerabilities and exposures (CVEs) in operating systems and application dependencies.

Inspector also supports Lambda code scanning to analyze function packages and container-based Lambda images for known software vulnerabilities. Findings include severity ratings and remediation guidance, allowing security teams to identify and prioritize risks efficiently.

Amazon GuardDuty focuses on threat detection using behavioral analysis and does not perform static vulnerability scanning of container images or Lambda code. AWS Security Hub aggregates findings from other services but does not perform scanning itself.

AWS best practices recommend Amazon Inspector for vulnerability detection in container images and serverless workloads.

Referenced AWS Specialty Documents:

AWS Certified Security – Specialty Official Study Guide

Amazon Inspector for ECR and Lambda

AWS Vulnerability Management Best Practices

Toenforcerequired tagging and approved values at scale, the strongest guardrail is anSCPbecause SCPs can prevent API calls across accounts/OUs before resources are created or tags are changed. By using the aws:RequestTag/CostCenter condition key and checking that the value is one of the approved values, an SCP candeny Create (and TagResource/UntagResource where supported)* when the request attempts to set a non-approved value. This prevents “bad” CostCenter values from being introduced.

AWS Config (including custom policy rules with CloudFormation Guard) is excellent fordetectingnoncompliance and reporting, but on its own it is not a hard preventative control. Pairing Config rule evaluation with an SCP guardrail gives both visibility and prevention. Option A is the only option that explicitly combines an enforceable preventive control (SCP deny based on aws:RequestTag/CostCenter) with compliance evaluation logic.

Option B cannot “block creation” reliably because EventBridge/Lambda isafter-the-fact; by the time the function runs, the resource is already created. Option C relies on tag policies enforcement semantics; tag policies primarilystandardize and reporttag usage, and the provided SCP in C only checks for null/missing values, not for non-approved values or for preventing later changes. Option D is also reactive and not a guaranteed preventative control.

Comprehensive and Detailed 100to 150 words of Explanation From AWS Certified Security – Specialty topics:

Secrets Manager is the appropriate service for database credentials because it encrypts secrets at rest with AWS KMS and retrieves them over TLS. The application should stop storing sensitive credentials directly in environment variables and retrieve them from Secrets Manager at runtime, or the ECS task should reference the secret securely through the task definition. In either design, the task role or task execution role must have permission to call secretsmanager:GetSecretValue and kms:Decrypt for the specific secret and KMS key. Storing credentials in S3 is a weaker secret-management pattern. A Fargate task has no EC2 container instance role that the customer manages. Logging in to a Fargate instance is not valid and would not be an auditable secure deployment pattern