View Full Amazon AWS Certified Security – Specialty SCS-C02 Exam Dumps and Practice Test Dumps

 

Question 61

Which IAM capability helps identify services a role has actually accessed?

1. IAM Access Advisor
2. AWS Shield Standard
3. Amazon EFS
4. Route 53 Resolver

Correct Answer: 1

Explanation:

IAM Access Advisor provides information about when an IAM principal last accessed AWS services. Security administrators can use this information during permission reviews to identify services that may no longer be required. This supports least-privilege improvements because administrators can compare granted permissions with observed service usage. Access Advisor does not automatically remove permissions; policy changes still require administrative action. AWS Shield focuses on DDoS protection, Amazon EFS provides managed file storage, and Route 53 Resolver handles DNS resolution. Access Advisor is specifically useful when reviewing whether an identity still needs access to particular AWS services.

Question 62

Which IAM policy element evaluates contextual request information?

1. Principal
2. Condition
3. Resource
4. Sid

Correct Answer: 2

Explanation:

The Condition element allows an IAM policy to evaluate contextual information before authorization is granted or denied. Conditions can use keys related to factors such as source IP address, MFA status, requested region, resource tags, or other supported attributes. This enables more precise access controls than a simple allow or deny statement. Principal identifies an identity in supported resource-based policies, Resource identifies the affected resource, and Sid provides an optional statement identifier. Therefore, Condition is the appropriate policy element when authorization needs to depend on characteristics of the request or execution context.

Question 63

Which organization control can deny selected API actions across member accounts?

1. Security group rule
2. Route table entry
3. Service control policy
4. S3 lifecycle configuration

Correct Answer: 3

Explanation:

A service control policy, or SCP, establishes permission guardrails for accounts within AWS Organizations. An SCP can deny selected AWS actions across affected accounts, helping security teams enforce centralized restrictions. It is important to understand that an SCP does not grant permissions. An action must still be allowed by the applicable identity or resource policies. Security groups regulate network traffic, route tables determine packet paths, and S3 lifecycle configurations manage object transitions and expiration. SCPs are specifically designed to provide organization-level authorization boundaries across member accounts.

Question 64

Which CloudTrail event category captures S3 object operations?

1. Data events
2. Management events
3. Insight events
4. Digest files

Correct Answer: 1

Explanation:

CloudTrail data events provide detailed visibility into data-plane activity on supported resources. For Amazon S3, data events can record operations involving individual objects, including actions such as GetObject, PutObject, and DeleteObject. Management events instead cover control-plane operations such as creating or modifying AWS resources. CloudTrail Insights identifies unusual API activity patterns, while digest files support log-integrity validation. Because S3 object activity can generate substantial event volume, organizations often enable data-event logging selectively for important buckets or prefixes where detailed auditing is required.

Question 65

Which AWS service discovers sensitive information stored in S3?

1. Amazon ECS
2. AWS CodeDeploy
3. Amazon Neptune
4. Amazon Macie

Correct Answer: 4

Explanation:

Amazon Macie is designed to discover and classify sensitive information stored in Amazon S3. It can identify supported categories of sensitive data and help security teams understand where important information resides. This visibility can support data-protection programs by highlighting potentially exposed or improperly managed content. Amazon ECS manages container workloads, CodeDeploy supports application deployment automation, and Neptune provides graph database capabilities. These services can be part of broader AWS architectures, but they do not provide Macie’s specialized sensitive-data discovery capabilities for S3.

Question 66

Which architecture separates security administration from workload administration?

1. Public subnet design
2. Dedicated security account
3. Shared developer account
4. Single-account deployment

Correct Answer: 2

Explanation:

A dedicated security account can separate centralized security administration from ordinary workload operations. Organizations may use such an account for security tooling, centralized findings, logging, or security administration. This separation reduces the likelihood that workload administrators can directly modify critical security evidence or controls. It also supports separation of duties within a multi-account AWS architecture. A public subnet describes network routing, while shared developer accounts and single-account deployments do not provide the same administrative separation. Account-level isolation is therefore an important architectural control for centralized security operations.

Question 67

Which service evaluates resource configurations against defined compliance rules?

1. Amazon SQS
2. AWS CodePipeline
3. AWS Config
4. Amazon Redshift

Correct Answer: 3

Explanation:

AWS Config records supported resource configurations and evaluates them against configured rules. Security teams can use these rules to determine whether resources comply with organizational requirements, such as encryption, network restrictions, or approved configuration settings. Config can also maintain configuration history, which helps investigators understand how a resource changed over time. SQS provides message queuing, CodePipeline supports software delivery automation, and Redshift provides analytical data warehousing. AWS Config is specifically designed for configuration assessment and compliance monitoring across supported AWS resources.

Question 68

Which service provides managed protection against distributed denial-of-service attacks?

1. Amazon EMR
2. AWS Glue
3. Amazon FSx
4. AWS Shield

Correct Answer: 4

Explanation:

AWS Shield provides managed protection against distributed denial-of-service attacks for supported AWS resources. Shield Standard offers automatic protection against common network and transport-layer attacks, while Shield Advanced provides additional capabilities for eligible resources. Organizations can combine Shield with other security controls, including AWS WAF and resilient application architectures. Amazon EMR supports large-scale data processing, AWS Glue provides data integration capabilities, and Amazon FSx supplies managed file systems. These services address different workload requirements and do not provide the specialized DDoS protection offered by AWS Shield.

Question 69

Which IAM control establishes the maximum permissions available to a role?

1. IAM permissions boundary
2. CloudWatch metric filter
3. VPC route table
4. S3 replication rule

Correct Answer: 1

Explanation:

An IAM permissions boundary establishes the maximum permissions that an IAM user or role can receive. It does not grant permissions by itself. Instead, the effective permissions are limited by the intersection of the permissions boundary and applicable authorization policies. This is especially useful when developers or delegated administrators are allowed to create IAM roles but should not be able to create roles with unrestricted privileges. CloudWatch metric filters analyze log information, VPC route tables control network paths, and S3 replication rules manage object replication. A permissions boundary specifically addresses excessive IAM authorization.

Question 70

Which service routes security events to automated response targets?

1. Amazon Aurora
2. AWS DataSync
3. Amazon EventBridge
4. Amazon WorkDocs

Correct Answer: 3

Explanation:

Amazon EventBridge can receive events from AWS services and route them to targets according to configured rules. Security teams can use this capability to automate responses to findings or infrastructure changes. For example, an EventBridge rule can trigger a Lambda function when a security finding is generated, allowing predefined remediation or notification logic to execute. Aurora provides relational database services, DataSync transfers data between storage environments, and WorkDocs supports document collaboration. EventBridge is the appropriate service for connecting security events with event-driven automation.

Question 71

Which KMS policy controls permissions on a customer managed key?

1. Security group policy
2. KMS key policy
3. VPC endpoint policy
4. S3 bucket ACL

Correct Answer: 2

Explanation:

A KMS key policy is a primary authorization mechanism for controlling access to a customer managed AWS KMS key. It can define which principals may administer the key or perform cryptographic operations. IAM policies can also influence authorization depending on how the key policy is configured. Because KMS keys protect encrypted data, key-policy design is especially important when implementing separation of duties. Security groups control network traffic, VPC endpoint policies regulate access through endpoints, and S3 ACLs apply to supported S3 resources. Only the KMS key policy directly governs permissions for the encryption key.

Question 72

Which AWS feature protects backup recovery points from deletion?

1. Amazon RDS Proxy
2. EBS Elastic Volumes
3. CloudFront Functions
4. AWS Backup Vault Lock

Correct Answer: 4

Explanation:

AWS Backup Vault Lock provides controls for protecting backup recovery points against deletion or modification during configured retention periods. It is designed to support immutable backup strategies and can help reduce the impact of accidental deletion or ransomware-related activity. Organizations can use it as part of a broader backup-security architecture that separates backup administration from ordinary workload operations. RDS Proxy manages database connections, EBS Elastic Volumes support storage-volume changes, and CloudFront Functions execute lightweight edge logic. These features do not provide the backup immutability mechanism supplied by Backup Vault Lock.

Question 73

Which VPC feature enables private access to supported AWS services?

1. Internet gateway
2. Public load balancer
3. VPC endpoint
4. Elastic IP address

Correct Answer: 3

Explanation:

A VPC endpoint allows resources inside a VPC to access supported AWS services without requiring traffic to travel through a public internet path. Gateway endpoints support selected AWS services, while interface endpoints use private network interfaces and AWS PrivateLink technology. This approach can reduce public-network exposure and support private application architectures. Internet gateways provide internet connectivity, public load balancers expose applications through public paths, and Elastic IP addresses provide public IPv4 addressing. A VPC endpoint is therefore the appropriate choice when workloads need private connectivity to supported AWS services.

Question 74

Which AWS service filters HTTP requests using configurable security rules?

1. Amazon Kinesis
2. AWS WAF
3. AWS Storage Gateway
4. Amazon Timestream

Correct Answer: 2

Explanation:

AWS WAF is a managed web application firewall that evaluates HTTP and HTTPS requests against configured rules. Security teams can create rules based on request attributes such as IP addresses, headers, query strings, and known attack patterns. WAF can integrate with services including Amazon CloudFront, Application Load Balancers, and API Gateway. Kinesis handles streaming data, Storage Gateway connects on-premises environments with AWS storage services, and Timestream provides time-series data capabilities. AWS WAF specifically addresses application-layer request filtering and protection.

Question 75

Which log records DNS requests handled by Route 53 Resolver?

1. Resolver query logs
2. S3 access records
3. EBS snapshot history
4. CloudTrail digest files

Correct Answer: 1

Explanation:

Route 53 Resolver query logs provide visibility into DNS queries made through Resolver. Security teams can use these records to identify unusual domain-resolution activity, investigate potentially compromised workloads, and understand which domains resources are attempting to reach. DNS logs can be particularly valuable when combined with threat-intelligence information or DNS Firewall controls. S3 access records describe requests to S3 resources, EBS snapshot history concerns storage snapshots, and CloudTrail digest files support audit-log validation. Resolver query logs are specifically intended for monitoring DNS-resolution activity.

Question 76

Which AWS service supports investigation of relationships among security activities?

1. AWS Batch
2. Amazon Polly
3. AWS Migration Hub
4. Amazon Detective

Correct Answer: 4

Explanation:

Amazon Detective helps security teams investigate potentially suspicious activity by analyzing relationships among AWS resources, identities, and activity. It provides contextual information that can help analysts understand how events are connected and what may have occurred during a security incident. This makes it particularly useful after a finding has already identified potentially suspicious behavior. AWS Batch runs batch workloads, Amazon Polly provides text-to-speech capabilities, and Migration Hub assists with application migration tracking. Detective is the service specifically focused on security investigation and contextual analysis.

Question 77

Which service consolidates security findings from AWS and integrated products?

1. Amazon SES
2. AWS CodeBuild
3. AWS Security Hub
4. Amazon Neptune

Correct Answer: 3

Explanation:

AWS Security Hub provides a centralized view of security findings from supported AWS services and integrated third-party products. It normalizes findings and allows security teams to review issues across multiple workloads and accounts from a common interface. Security Hub can also evaluate supported security standards and help identify areas requiring attention. Amazon SES provides email delivery, CodeBuild supports software compilation and testing, and Neptune provides graph database capabilities. Security Hub is specifically designed to consolidate security findings and support centralized security operations.

Question 78

Which S3 feature supports immutable object retention?

1. S3 Select
2. S3 Inventory
3. S3 Object Lock
4. S3 Transfer Acceleration

Correct Answer: 3

Explanation:

S3 Object Lock allows organizations to prevent objects from being deleted or overwritten for a configured retention period. It supports governance and compliance modes for different protection requirements. This capability is useful for audit records, regulated information, backup data, and other content that should remain unchanged. S3 Select allows supported object content to be queried, S3 Inventory generates reports about objects, and Transfer Acceleration improves transfer performance. These features do not provide the retention-based immutability capability offered by S3 Object Lock.

Question 79

Which service scans supported EC2 workloads for known vulnerabilities?

1. Amazon Athena
2. AWS AppConfig
3. Amazon Simple Email Service
4. Amazon Inspector

Correct Answer: 4

Explanation:

Amazon Inspector provides vulnerability assessment capabilities for supported AWS workloads, including eligible EC2 instances. It can identify known software vulnerabilities and generate findings that security teams can investigate and remediate. Continuous assessment helps organizations identify vulnerabilities as workloads and vulnerability databases change. Athena provides query capabilities for data analysis, AppConfig manages application configuration, and Simple Email Service handles email delivery. Inspector is specifically intended for vulnerability management and assessment of supported workloads, making it the appropriate service for this requirement.

Question 80

Which AWS service issues temporary credentials for federated access?

1. AWS Security Token Service
2. Amazon S3 Glacier
3. AWS Backup
4. Amazon CloudWatch

Correct Answer: 1

Explanation:

AWS Security Token Service, or AWS STS, issues temporary security credentials that can be used by federated users, applications, and trusted principals. In a federation workflow, an external identity provider can authenticate a user before temporary AWS credentials are provided for accessing authorized resources. Temporary credentials generally have a limited lifetime, reducing the risks associated with long-term access keys. S3 Glacier provides archival storage, AWS Backup manages backup operations, and CloudWatch provides monitoring and observability. STS is therefore the AWS service directly associated with temporary credential issuance.