View Full Amazon AWS Certified Security – Specialty SCS-C02 Exam Dumps and Practice Test Dumps

 

Question 21

Which IAM control sets a maximum permission boundary for an identity?

1. IAM permission boundary
2. Route table association
3. KMS grant token
4. CloudTrail trail

Correct Answer: 1

Explanation:

An IAM permissions boundary defines the maximum permissions that an IAM user or role can receive through identity-based policies. It does not grant permissions by itself. Instead, the effective permissions are limited to what is allowed by both the identity policy and the permissions boundary. This is useful in delegated administration scenarios where an organization wants users or teams to create roles without allowing those roles to exceed predefined permission limits. Route tables control network routing, KMS grant tokens relate to temporary authorization for KMS operations, and CloudTrail trails define event delivery configurations.

Question 22

Which IAM policy element can require MFA for an API action?

1. Sid
2. Resource
3. Condition
4. Version

Correct Answer: 3

Explanation:

The Condition element in an IAM policy allows access decisions to depend on specific circumstances. For example, the aws condition key can be used to require MFA for certain actions. This enables organizations to apply stronger authentication requirements to sensitive operations without necessarily requiring the same condition for every AWS action. The Sid element provides an optional statement identifier, Resource identifies affected resources, and Version specifies the policy language version. Conditions are therefore the policy mechanism used when authorization should depend on contextual information such as MFA status, source address, or requested region.

Question 23

Which service helps centralize organization-wide CloudTrail activity?

1. Amazon RDS
2. AWS Organizations
3. Amazon CloudFront
4. AWS Elastic Beanstalk

Correct Answer: 2

Explanation:

AWS Organizations provides the multi-account structure used to manage accounts centrally, while CloudTrail organization trails can be configured to collect activity across accounts in an organization. This approach gives security teams centralized visibility instead of requiring every workload account to independently manage audit trails. An organization trail can cover management events across member accounts and can deliver logs to a designated S3 location. RDS provides managed databases, CloudFront delivers content, and Elastic Beanstalk manages application environments. Those services do not provide the organizational framework used for centralized account-level CloudTrail governance.

Question 24

Which CloudTrail feature helps detect unusual API activity patterns?

1. CloudTrail Insights
2. S3 Replication
3. IAM Credential Report
4. VPC Peering

Correct Answer: 1

Explanation:

CloudTrail Insights helps identify unusual patterns in API call volume or error rates that may indicate unexpected activity. It establishes a baseline for normal behavior and generates Insights events when activity deviates significantly from that baseline. Security teams can use these events as an additional signal during investigations. Insights is different from ordinary CloudTrail event logging because it focuses on detecting anomalous API behavior rather than simply recording individual requests. S3 Replication copies objects between locations, the IAM Credential Report provides credential-related information, and VPC Peering connects networks.

Question 25

Which S3 encryption option uses AWS KMS keys for object protection?

1. SSE-S3
2. SSE-KMS
3. S3 Object Lock
4. S3 Versioning

Correct Answer: 2

Explanation:

SSE-KMS uses server-side encryption with AWS Key Management Service keys to protect Amazon S3 objects. It provides additional control over encryption-key permissions, auditing, and key management compared with S3-managed encryption. Organizations can use customer managed KMS keys when they require greater control over key policies and lifecycle operations. S3 Object Lock protects objects against deletion or overwrite according to retention settings, while Versioning maintains multiple versions of objects. SSE-S3 also provides server-side encryption, but it uses keys managed by Amazon S3 rather than customer-controlled KMS keys.

Question 26

Which network control evaluates traffic using ordered subnet-level rules?

1. IAM groups
2. KMS key policies
3. Network ACLs
4. S3 access points

Correct Answer: 3

Explanation:

Network Access Control Lists, or network ACLs, operate at the subnet level and evaluate inbound and outbound traffic using numbered rules. Rules are evaluated in order, and the first matching rule determines whether traffic is allowed or denied. Network ACLs are stateless, meaning return traffic must be explicitly permitted when required. This differs from security groups, which operate at the resource level and are stateful. IAM groups manage user permissions, KMS key policies govern key access, and S3 access points provide specialized access paths to S3 data. Therefore, network ACLs are the subnet-level traffic control described.

Question 27

Which AWS service provides managed web application firewall capabilities?

1. AWS WAF
2. Amazon EFS
3. AWS Storage Gateway
4. Amazon MQ

Correct Answer: 1

Explanation:

AWS WAF is a managed web application firewall that helps protect supported applications from common web-based attacks and unwanted traffic patterns. Security teams can create rules based on characteristics such as IP addresses, request headers, query strings, or known attack patterns. AWS WAF commonly works with services such as CloudFront, Application Load Balancers, and API Gateway. EFS provides file storage, Storage Gateway connects on-premises environments with AWS storage services, and Amazon MQ provides managed message brokers. These services do not provide the web request filtering capabilities offered by AWS WAF.

Question 28

Which service provides DNS-level filtering for VPC workloads?

1. Amazon EventBridge
2. AWS Network Firewall
3. Route 53 Resolver DNS Firewall
4. Amazon Kinesis Firehose

Correct Answer: 3

Explanation:

Route 53 Resolver DNS Firewall allows organizations to control DNS queries originating from VPC resources. Administrators can create rule groups containing domain lists and determine whether queries matching those domains should be allowed or blocked. This can help prevent workloads from resolving known malicious or unwanted domains. DNS Firewall operates at the DNS resolution layer, making it different from network firewalls that inspect broader network traffic. EventBridge handles event routing, Network Firewall provides network traffic inspection, and Kinesis Data Firehose delivers streaming data to destinations. Resolver DNS Firewall is specifically focused on DNS query filtering.

Question 29

Which service can inspect network traffic using managed firewall rules?

1. AWS Network Firewall
2. Amazon DynamoDB
3. AWS Step Functions
4. Amazon Cognito

Correct Answer: 1

Explanation:

AWS Network Firewall is a managed, stateful network firewall designed to inspect and control traffic entering, leaving, or moving between network environments. It supports firewall rules and traffic inspection capabilities that can help organizations enforce network security policies. Network Firewall can be deployed within a VPC architecture and integrated with routing configurations. DynamoDB provides NoSQL database capabilities, Step Functions coordinates application workflows, and Cognito manages application authentication and user identities. These services address different requirements and do not provide the network traffic inspection function associated with AWS Network Firewall.

Question 30

Which VPC log records information about network interface traffic?

1. CloudFront logs
2. VPC Flow Logs
3. Route 53 query logs
4. S3 access logs

Correct Answer: 2

Explanation:

VPC Flow Logs capture information about IP traffic going to and from network interfaces, subnets, or VPCs depending on the configured scope. They can help security teams investigate unexpected connections, identify communication patterns, and troubleshoot network behavior. Flow logs contain metadata about traffic rather than the full contents of network packets. CloudFront logs describe content delivery requests, Route 53 query logs capture DNS queries, and S3 access logs provide information about requests to S3 resources. Therefore, VPC Flow Logs are the appropriate source for network interface traffic metadata.

Question 31

Which S3 feature prevents protected objects from being deleted during retention?

1. S3 Transfer Acceleration
2. S3 Object Lock
3. S3 Analytics
4. S3 Select

Correct Answer: 2

Explanation:

S3 Object Lock helps prevent objects from being deleted or overwritten for a defined retention period. It supports governance and compliance retention modes, with compliance mode providing stronger restrictions against changes to protected objects. Object Lock can be useful when organizations need immutable storage for audit records, backups, or other important information. Transfer Acceleration is designed to improve long-distance upload and download performance, Analytics provides storage-class usage insights, and S3 Select enables querying of supported object content. None of those features provides the immutability capability offered by Object Lock.

Question 32

Which KMS capability lets applications use keys without granting key administration rights?

1. Key grants
2. Security groups
3. IAM Access Analyzer
4. CloudWatch dashboards

Correct Answer: 1

Explanation:

KMS grants provide a mechanism for allowing specific principals to perform cryptographic operations with a KMS key without necessarily giving them full administrative permissions over the key. Grants are useful for AWS services and applications that need controlled access to encryption keys. They can specify operations and constraints for the grantee. Security groups control network traffic, IAM Access Analyzer analyzes resource access, and CloudWatch dashboards visualize monitoring data. Separating cryptographic usage from key administration supports a stronger security model because workloads can receive only the cryptographic permissions they require.

Question 33

Which AWS service can rotate supported database secrets automatically?

1. Amazon QuickSight
2. AWS Secrets Manager
3. Amazon Neptune Analytics
4. AWS CodeArtifact

Correct Answer: 2

Explanation:

AWS Secrets Manager supports automatic rotation for supported secrets, including credentials used by certain databases and services. Rotation changes the stored credential according to an automated process, reducing the period during which a compromised password remains useful. Secrets Manager can coordinate rotation with supported AWS resources and applications. QuickSight provides business intelligence and visualization, Neptune Analytics supports graph analytics, and CodeArtifact provides package management for software dependencies. Secrets Manager is specifically designed for securely storing and managing credentials and other sensitive configuration information.

Question 34

Which service helps assess AWS resources against compliance frameworks?

1. Amazon Polly
2. AWS Config
3. Amazon Lex
4. AWS Snow Family

Correct Answer: 2

Explanation:

AWS Config can evaluate resource configurations against predefined or custom rules and can be used as part of compliance monitoring. AWS also provides conformance packs that combine configuration rules and remediation-related components to help organizations assess resources against specific compliance requirements. This allows security teams to detect resources that deviate from established controls. Polly and Lex provide language-related application capabilities, while AWS Snow Family supports data transfer and edge computing. Config is therefore the relevant service for continuously evaluating whether AWS resource configurations meet defined security or compliance expectations.

Question 35

Which service provides managed TLS certificates for AWS-integrated resources?

1. AWS Certificate Manager
2. Amazon ElastiCache
3. AWS Lake Formation
4. Amazon Redshift Serverless

Correct Answer: 1

Explanation:

AWS Certificate Manager, or ACM, provides managed SSL/TLS certificates that can be used with supported AWS services. ACM can handle certificate provisioning and, for eligible certificates, automatic renewal, reducing the operational effort required to maintain certificates. Proper certificate management helps protect data in transit by enabling encrypted connections. ElastiCache provides in-memory caching, Lake Formation manages data lake governance, and Redshift Serverless provides serverless data warehousing. These services may support secure architectures in other ways but do not provide the certificate-management function offered by ACM.

Question 36

Which IAM report lists information about a user’s credentials?

1. AWS Trusted Advisor
2. IAM Credential Report
3. CloudTrail Insights
4. AWS Health Dashboard

Correct Answer: 2

Explanation:

The IAM Credential Report provides account-level information about IAM users and their credentials. It can help security teams review details such as password status, access key age, MFA configuration, and credential activity indicators. Organizations can use this report during periodic access reviews to identify stale or unnecessary credentials. Trusted Advisor provides recommendations across several AWS categories, CloudTrail Insights identifies unusual API activity patterns, and the AWS Health Dashboard reports service and account-related operational events. The IAM Credential Report is therefore the appropriate source for reviewing IAM user credential status.

Question 37

Which security group behavior allows return traffic automatically?

1. Stateful connection tracking
2. Stateless packet evaluation
3. One-way route propagation
4. Manual response authorization

Correct Answer: 1

Explanation:

Security groups are stateful virtual firewalls associated with supported resources such as EC2 instances. When an inbound or outbound connection is permitted by a security group rule, return traffic for that established connection is automatically allowed, regardless of a separate rule for the response direction. This stateful behavior simplifies network access management. Network ACLs, by contrast, are stateless and require appropriate rules in both directions. Understanding this difference is important when designing layered network controls because security groups and network ACLs serve different roles within a VPC security architecture.

Question 38

Which service helps investigate compromised AWS identities and resources?

1. Amazon Detective
2. AWS Batch
3. Amazon SES
4. AWS IoT Core

Correct Answer: 1

Explanation:

Amazon Detective is designed to help security teams investigate potentially suspicious activity by analyzing relationships among AWS resources, identities, and activity data. It can provide context around findings generated by security services and help investigators understand sequences of events. This is particularly useful after a suspicious identity or resource has been detected and analysts need to determine what happened. AWS Batch runs batch computing workloads, SES provides email services, and IoT Core manages connected devices. These services have different primary purposes and do not provide Detective’s investigation-oriented security analysis.

Question 39

Which backup control can enforce immutable recovery points?

1. AWS Backup Vault Lock
2. Amazon FSx snapshots
3. EBS Fast Snapshot Restore
4. S3 Transfer Acceleration

Correct Answer: 1

Explanation:

AWS Backup Vault Lock helps protect backup recovery points against deletion or changes during a defined retention period. It is designed to support backup immutability and can help protect recovery data from accidental or malicious deletion. This is particularly valuable in scenarios involving ransomware or compromised administrative credentials. EBS Fast Snapshot Restore improves snapshot restoration performance, while S3 Transfer Acceleration improves data-transfer speeds. These features do not provide the same governance mechanism for preventing modification or deletion of protected backup recovery points.

Question 40

Which response action isolates a compromised EC2 instance from normal network access?

1. Increase EBS volume size
2. Replace the instance type
3. Apply an isolation security group
4. Enable enhanced monitoring

Correct Answer: 3

Explanation:

During an incident, assigning an isolation security group with tightly restricted traffic rules can reduce an EC2 instance’s network connectivity while investigators preserve the system for analysis. The exact response procedure should be designed carefully so that required forensic or management access is retained. Security teams may combine isolation with snapshot creation, evidence preservation, and incident documentation. Increasing an EBS volume, changing the instance type, or enabling enhanced monitoring does not itself isolate the workload. Network containment is therefore an important response action when an EC2 instance is suspected of compromise.