View Full Amazon AWS Certified Security – Specialty SCS-C02 Exam Dumps and Practice Test Dumps

 

Question 1

Which AWS feature supplies temporary credentials to an EC2 application?

1. IAM user password
2. Instance profile role
3. Root access token
4. S3 access control list

Correct Answer: 2

Explanation:

An IAM role attached to an EC2 instance through an instance profile allows applications running on that instance to obtain temporary security credentials. The credentials are automatically provided through the EC2 instance metadata service and are rotated by AWS. This avoids embedding long-term access keys inside application code or configuration files. IAM roles also make it easier to apply least-privilege permissions because the role can contain only the actions required by the workload. User passwords and root credentials are not appropriate mechanisms for application authentication, while an S3 access control list controls object or bucket access rather than providing workload credentials.

Question 2

Which AWS service records API calls made within an AWS environment?

1. Amazon Inspector
2. AWS Security Hub
3. Amazon Detective
4. AWS CloudTrail

Correct Answer: 4

Explanation:

AWS CloudTrail records API activity performed by users, roles, and AWS services. These records can include information such as the identity that made a request, the operation performed, the target resource, and the request time. Security teams commonly use CloudTrail for auditing, investigation, compliance evidence, and incident response. CloudTrail can capture management events and, where configured, data events for supported services. Keeping CloudTrail logs in a protected centralized destination helps prevent workload administrators from modifying or deleting audit evidence. Other security services provide detection, findings, or investigation capabilities rather than serving as the primary API activity recorder.

Question 3

Which AWS service identifies sensitive information stored in Amazon S3?

1. Amazon Macie
2. AWS Shield Advanced
3. AWS Config Aggregator
4. Amazon Route 53 Resolver

Correct Answer: 1

Explanation:

Amazon Macie uses machine learning and pattern matching to discover and classify sensitive data in Amazon S3. It can help organizations identify information such as personally identifiable information and other sensitive content. Security teams can use these findings to understand where sensitive information exists and determine whether additional controls are needed. Macie is especially useful when an organization has many S3 buckets and needs visibility into the type of information stored within them. The other listed services address different security or networking functions, such as DDoS protection, configuration aggregation, or DNS resolution.

Question 4

Which control can impose permission restrictions across member accounts?

1. IAM identity policy
2. Resource-based policy
3. Service control policy
4. Security group rule

Correct Answer: 3

Explanation:

Service control policies, or SCPs, are an AWS Organizations control that can establish maximum available permissions for accounts within an organization or organizational unit. An SCP does not itself grant permissions. Instead, it limits which permissions identities in affected accounts can use. This makes SCPs useful for enforcing organization-wide security guardrails, such as preventing certain services or actions from being used. IAM policies still determine what an identity can actually access within the account. Resource-based policies control access to supported resources, while security groups regulate network traffic rather than AWS API authorization.

Question 5

Which S3 control blocks public access settings at the account or bucket level?

1. S3 Lifecycle configuration
2. S3 Transfer Acceleration
3. S3 Inventory report
4. S3 Block Public Access

Correct Answer: 4

Explanation:

Amazon S3 Block Public Access provides centralized controls that help prevent buckets and objects from becoming publicly accessible through certain bucket policies, access control lists, or related configurations. The controls can be applied at the account, bucket, or access point level. This is particularly useful for organizations that want a strong preventive safeguard against accidental public exposure. Lifecycle rules manage object retention and transitions, Transfer Acceleration improves data transfer performance, and Inventory provides reports about stored objects. These features do not provide the same preventive protection against public access configuration.

Question 6

Which service aggregates security findings from supported AWS services?

1. Amazon CloudWatch
2. AWS Security Hub
3. AWS CloudFormation
4. Amazon SQS

Correct Answer: 2

Explanation:

AWS Security Hub provides centralized visibility into security findings generated by supported AWS services and integrated security products. It normalizes findings into a common format, making it easier for security teams to review and prioritize issues across an AWS environment. Security Hub can also support automated workflows and compliance checks. Centralizing findings reduces the need to inspect every security service independently. CloudWatch focuses primarily on monitoring and observability, CloudFormation manages infrastructure deployment, and SQS provides message queuing. Therefore, Security Hub is the service specifically designed for consolidated security findings.

Question 7

Which service detects threats using AWS telemetry and threat intelligence?

1. AWS Artifact
2. AWS Audit Manager
3. Amazon GuardDuty
4. AWS Billing Conductor

Correct Answer: 3

Explanation:

Amazon GuardDuty is a managed threat detection service that analyzes supported AWS data sources and security telemetry to identify potentially malicious or suspicious activity. It can detect patterns associated with compromised credentials, unusual API behavior, malware, and other threats. GuardDuty continuously evaluates relevant signals and generates findings when suspicious activity is identified. Security teams can integrate these findings with other AWS security services for investigation and response. AWS Artifact provides compliance documentation, Audit Manager helps collect audit evidence, and Billing Conductor addresses billing management rather than threat detection.

Question 8

Which service evaluates resource configurations against defined rules?

1. AWS Config
2. Amazon Kinesis Data Streams
3. AWS Glue Data Catalog
4. Amazon ElastiCache

Correct Answer: 1

Explanation:

AWS Config continuously records supported resource configurations and evaluates them against configuration rules. Security teams can use AWS Config rules to determine whether resources meet organizational requirements, such as encryption or restricted access settings. Config also maintains configuration history, allowing teams to investigate how a resource changed over time. This makes it valuable for governance, compliance, and security monitoring. Kinesis Data Streams handles real-time data streaming, Glue Data Catalog manages metadata, and ElastiCache provides in-memory caching. None of those services is designed to continuously assess AWS resource configurations against security requirements.

Question 9

Which AWS service manages application secrets with automated rotation?

1. AWS Direct Connect
2. AWS Secrets Manager
3. Amazon ECR
4. AWS DataSync

Correct Answer: 2

Explanation:

AWS Secrets Manager is designed to securely store, retrieve, and manage sensitive information such as database passwords, API credentials, and application secrets. It supports automated rotation for supported secret types and can integrate with AWS services and applications. Using a dedicated secret-management service reduces the need to place credentials directly inside source code, configuration files, or deployment packages. Secrets Manager also provides controlled access through IAM policies and encryption. Direct Connect provides dedicated network connectivity, ECR stores container images, and DataSync transfers data between storage systems, so they do not serve as general-purpose secret stores.

Question 10

Which IAM concept grants only the permissions an identity needs?

1. Federation
2. Credential stuffing
3. Permission inheritance
4. Least privilege

Correct Answer: 4

Explanation:

Least privilege means providing an identity only the permissions required to perform its legitimate tasks. This reduces the potential impact if credentials are compromised or an application is misused. In AWS, least privilege can be implemented through carefully scoped IAM policies, roles, resource permissions, and conditions. Organizations should periodically review permissions because application requirements can change over time. Federation allows identities to authenticate through an external identity provider, while credential stuffing is an attack technique. Permission inheritance is not the IAM security principle described in the question.

Question 11

Which AWS service provides managed protection against DDoS attacks?

1. AWS Backup
2. Amazon Textract
3. AWS Shield
4. Amazon Athena

Correct Answer: 3

Explanation:

AWS Shield is a managed service that helps protect applications from distributed denial-of-service attacks. AWS Shield Standard provides automatic protection for many AWS services, while AWS Shield Advanced provides additional capabilities for eligible workloads. DDoS protection can be combined with other controls such as AWS WAF and architectural resilience measures. Backup protects data recovery points, Textract extracts information from documents, and Athena provides interactive query capabilities for data stored in supported locations. These services therefore address different operational requirements rather than network-level DDoS protection.

Question 12

Which AWS service creates and controls cryptographic keys?

1. AWS Key Management Service
2. Amazon Lightsail
3. AWS Snowball Edge
4. Amazon AppFlow

Correct Answer: 1

Explanation:

AWS Key Management Service, commonly called AWS KMS, enables organizations to create and manage cryptographic keys used to protect data. KMS integrates with numerous AWS services, allowing encryption keys to be used for workloads such as S3 objects, EBS volumes, databases, and other resources. Key policies and IAM permissions can control who is allowed to perform cryptographic operations or administer keys. KMS also supports features such as key rotation and grants. Lightsail provides simplified cloud resources, Snowball Edge supports data transfer and edge computing, and AppFlow integrates data between applications.

Question 13

Which AWS capability helps identify unintended external access to resources?

1. AWS Control Tower
2. Amazon Polly
3. AWS Batch
4. IAM Access Analyzer

Correct Answer: 4

Explanation:

IAM Access Analyzer helps organizations identify resource policies that allow access from outside a defined trust zone, such as an AWS account or organization. It can analyze supported resource-based policies and help security teams detect unintended external access. This is useful when reviewing permissions for resources such as S3 buckets, IAM roles, and other supported resources. Access Analyzer can therefore support least-privilege and governance efforts. Control Tower focuses on multi-account governance, Polly provides text-to-speech capabilities, and Batch runs batch computing jobs. None of those services is primarily designed for external-access analysis.

Question 14

Which CloudTrail event type captures object-level S3 activity?

1. Insights events
2. Data events
3. Billing events
4. Organization events

Correct Answer: 2

Explanation:

CloudTrail data events provide visibility into data-plane operations performed on supported resources. For Amazon S3, data events can record object-level operations such as object retrieval and deletion. These events can generate a large volume of logs, so organizations often enable them selectively for important buckets or access patterns. Management events, in contrast, primarily cover control-plane operations such as creating or modifying resources. CloudTrail Insights is intended to identify unusual API activity patterns, while the other options do not represent the relevant CloudTrail event category for S3 object operations.

Question 15

Which authentication mechanism requires an additional verification factor?

1. Multi-factor authentication
2. DNSSEC signing
3. Tokenization
4. Network segmentation

Correct Answer: 1

Explanation:

Multi-factor authentication, or MFA, requires users to provide an additional authentication factor beyond a primary credential. The second factor may involve something the user possesses, such as a hardware security key or authenticator-generated code. MFA strengthens account security because possession of a password alone is insufficient for successful authentication. AWS supports MFA for IAM users and the root user, and organizations can use IAM policies or other controls to enforce stronger authentication requirements. DNSSEC protects DNS integrity, tokenization replaces sensitive values with tokens, and network segmentation controls connectivity rather than user authentication.

Question 16

Which AWS service helps analyze relationships surrounding security findings?

1. AWS Resource Groups
2. Amazon Pinpoint
3. Amazon Detective
4. AWS AppSync

Correct Answer: 3

Explanation:

Amazon Detective helps security teams investigate security findings by analyzing relationships among resources, users, API activity, and other relevant data. Instead of simply presenting an isolated alert, Detective helps investigators understand the surrounding activity and potentially determine how an incident developed. This makes it useful during security investigations when analysts need additional context. Resource Groups assists with resource organization, Pinpoint supports customer engagement, and AppSync provides managed GraphQL APIs. Those services do not provide the same investigation-focused analysis of security activity and relationships.

Question 17

Which approach avoids embedding long-term credentials inside application code?

1. Use an IAM role for workload access
2. Save passwords inside source repositories
3. Place access keys in container images
4. Store credentials in application comments

Correct Answer: 1

Explanation:

Using IAM roles for workloads avoids the need to embed long-term AWS access keys directly into application code. AWS services such as EC2, Lambda, and ECS can obtain temporary credentials associated with an appropriate role. This approach reduces credential exposure and allows permissions to be managed centrally through IAM. Developers should avoid placing secrets in source repositories, container images, comments, or configuration files that may be distributed with an application. Temporary credentials also reduce the operational burden associated with manually rotating long-term access keys.

Question 18

Which service scans supported workloads for software vulnerabilities?

1. Amazon Neptune
2. Amazon Inspector
3. AWS Transit Gateway
4. Amazon Rekognition

Correct Answer: 2

Explanation:

Amazon Inspector is a vulnerability management service that continuously assesses supported AWS workloads for software vulnerabilities and unintended network exposure. Depending on the supported resource type and configuration, Inspector can evaluate workloads such as EC2 instances, container images, and Lambda functions. Findings help security teams identify vulnerabilities that require remediation. Neptune is a graph database service, Transit Gateway connects VPCs and networks, and Rekognition provides image and video analysis. Those services do not provide the vulnerability assessment capabilities associated with Amazon Inspector.

Question 19

Which VPC feature enables private access to supported AWS services?

1. Internet gateway
2. NAT instance
3. VPC endpoint
4. Public DNS record

Correct Answer: 3

Explanation:

A VPC endpoint allows resources inside a VPC to communicate privately with supported AWS services without requiring traffic to traverse the public internet. Depending on the service and endpoint type, organizations can use gateway endpoints or interface endpoints. This architecture can reduce exposure to public network paths and help meet security requirements for private service communication. An internet gateway provides internet connectivity, a NAT instance enables outbound internet access for private resources, and a public DNS record provides name resolution information. These alternatives do not provide the same private service-access mechanism as a VPC endpoint.

Question 20

Which architecture best protects centralized audit logs from workload administrators?

1. Keep audit records on each application host
2. Permit developers to remove historical logs
3. Send records to publicly writable storage
4. Store logs in a dedicated security account

Correct Answer: 4

Explanation:

Centralizing security logs in a dedicated security account can provide stronger separation between workload administration and audit-data management. A common architecture sends logs from multiple AWS accounts into centralized storage that has tightly controlled permissions. Security teams can restrict deletion and modification privileges while retaining appropriate access for investigations and compliance activities. Keeping logs on application hosts or allowing developers to delete historical records creates greater risk of evidence loss. Publicly writable storage would introduce an even more serious integrity concern. Separation of duties therefore plays an important role in protecting centralized audit records.