View Full Amazon AWS Certified Security – Specialty SCS-C02 Exam Dumps and Practice Test Dumps

 

Question 161

Which IAM feature lets administrators define reusable permission sets for workforce access?

1. IAM Identity Center permission sets
2. Inline user policies
3. IAM access keys
4. Role session tags

Correct Answer: 1

Explanation:

IAM Identity Center permission sets provide reusable access definitions for workforce users and groups. Administrators can create a permission set containing policies and then assign it to users or groups for selected AWS accounts. This approach supports centralized access management in multi-account environments and avoids maintaining separate permissions manually in every account. Permission sets are especially useful when different job functions require standardized access levels. Inline policies are attached directly to identities, access keys provide programmatic credentials, and session tags carry contextual attributes. Permission sets therefore provide a structured way to manage workforce authorization across multiple AWS accounts.

Question 162

Which mechanism helps an application identify the source of temporary STS credentials?

1. KMS encryption context
2. CloudTrail digest files
3. STS source identity
4. S3 object tags

Correct Answer: 3

Explanation:

STS source identity allows a principal assuming a role to pass an identifying value that can help establish who initiated a temporary session. The source identity can appear in relevant CloudTrail records, making it useful for auditing federated access and tracing activity back to the originating identity. This can improve accountability when many users or systems assume the same IAM role. KMS encryption context serves cryptographic purposes, CloudTrail digest files support log integrity validation, and S3 object tags describe stored objects. Source identity is therefore particularly valuable when organizations need stronger traceability for temporary role sessions.

Question 163

Which S3 feature lets different applications use separate access policies for one bucket?

1. S3 Glacier Vault Lock
2. S3 Access Points
3. S3 Batch Operations
4. S3 Inventory reports

Correct Answer: 2

Explanation:

S3 Access Points allow organizations to create separate access configurations for applications or groups that use the same S3 bucket. Each access point can have its own policy and, where supported, network-origin restrictions. This can make authorization easier to manage than placing every application rule into a single large bucket policy. The underlying bucket and its objects remain centrally managed while different consumers receive dedicated access paths. Glacier Vault Lock addresses archival retention, Batch Operations performs large-scale object actions, and Inventory generates object reports. Access Points therefore provide a scalable authorization model for shared S3 datasets.

Question 164

Which KMS capability lets a service receive narrowly scoped key permissions without changing the key policy?

1. Alias target
2. Key rotation schedule
3. Grant
4. External key store

Correct Answer: 3

Explanation:

A KMS grant provides delegated permissions for specific operations on a KMS key. Grants are useful when an AWS service or application needs controlled access to cryptographic operations without requiring frequent modifications to the key policy. The grant can identify the grantee principal and specify permitted operations, with optional constraints. An alias simply provides another name for a key, rotation changes cryptographic material over time, and an external key store is a separate key-management architecture. Grants are therefore useful for implementing narrowly scoped access while maintaining centralized control over the KMS key itself.

Question 165

Which service can automatically apply security group policies to newly created resources?

1. AWS Firewall Manager
2. Amazon Detective
3. AWS Artifact
4. AWS Audit Manager

Correct Answer: 1

Explanation:

AWS Firewall Manager can apply centrally managed security group policies across accounts and supported resources in an AWS Organization. This is useful when an organization wants security requirements to remain consistent as new resources are created. Administrators can define policies that identify required or prohibited security group configurations and apply them across selected accounts or organizational units. Detective focuses on investigations, Artifact provides AWS compliance reports, and Audit Manager gathers evidence for audits. Firewall Manager therefore provides centralized enforcement rather than merely reporting on network configuration.

Question 166

Which CloudTrail capability helps prove that log files were not modified after delivery?

1. Event selectors
2. Log file validation
3. Advanced event filtering
4. Trail encryption

Correct Answer: 2

Explanation:

CloudTrail log file validation helps determine whether CloudTrail log files have been modified or deleted after CloudTrail delivered them. It uses digest files and cryptographic validation techniques to support integrity verification. This can be particularly valuable during forensic investigations or compliance reviews where investigators need confidence that audit records have remained intact. Event selectors determine which events are recorded, advanced event filtering helps control event collection, and encryption protects log confidentiality. Log file validation addresses a different requirement: establishing evidence that collected CloudTrail records have not been tampered with.

Question 167

Which AWS service can identify sensitive data patterns in S3 without requiring users to inspect every object manually?

1. Amazon Macie
2. AWS Config
3. Amazon Inspector
4. AWS Control Tower

Correct Answer: 1

Explanation:

Amazon Macie uses automated sensitive data discovery capabilities to help identify sensitive information stored in Amazon S3. It can analyze supported objects for data patterns associated with categories such as credentials, financial information, or personally identifiable information. This gives security teams a scalable method for discovering potentially sensitive content across large S3 environments. Config evaluates resource configurations, Inspector focuses on vulnerability assessment, and Control Tower helps establish and govern multi-account environments. Macie is therefore the service most directly associated with finding sensitive information in S3 data without requiring manual inspection of every object.

Question 168

What is the main purpose of an IAM role’s permissions policy?

1. Define trusted role assumers
2. Specify actions the role can perform
3. Configure MFA enrollment
4. Establish account billing access

Correct Answer: 2

Explanation:

An IAM role’s permissions policies determine which AWS actions and resources the role can access after the role has been assumed. These policies can specify allowed or denied actions, resources, and conditions. This is separate from the role’s trust policy, which determines who or what can assume the role in the first place. Keeping these responsibilities separate is important when designing least-privilege access. MFA enrollment is handled through identity-management mechanisms, while billing permissions involve specific AWS account and billing policies. The permissions policy therefore defines the role’s operational authorization after authentication and assumption.

Question 169

Which AWS service provides a managed firewall for inspecting VPC traffic?

1. Amazon GuardDuty
2. AWS Network Firewall
3. Amazon Inspector
4. AWS Security Hub

Correct Answer: 2

Explanation:

AWS Network Firewall is a managed, stateful network firewall designed to inspect and control traffic flowing through supported VPC architectures. Security teams can configure stateless and stateful rule groups to implement network filtering and inspection requirements. It can be integrated into centralized inspection architectures where traffic from multiple VPCs is routed through designated firewall endpoints. GuardDuty focuses on threat detection, Inspector performs vulnerability assessments, and Security Hub aggregates findings. Network Firewall therefore addresses active network traffic inspection and enforcement rather than primarily detecting or aggregating security findings.

Question 170

Which AWS capability can restrict a VPC endpoint to selected AWS API actions?

1. Endpoint policy
2. Route propagation
3. DHCP option set
4. Elastic IP association

Correct Answer: 1

Explanation:

A VPC endpoint policy can provide an additional authorization layer for supported endpoint types and services. It can restrict which principals and actions are permitted through the endpoint, helping organizations implement tighter network-based access controls. This is useful when a private endpoint should provide access only to specific resources or API operations. Route propagation controls how routes are learned, DHCP option sets influence network configuration, and Elastic IP associations provide public addressing. Endpoint policies therefore help limit what users or workloads can access through a private service connectivity path.

Question 171

Which AWS service helps establish preventive guardrails for a multi-account environment?

1. AWS Control Tower
2. Amazon Detective
3. AWS CloudHSM
4. Amazon Athena

Correct Answer: 1

Explanation:

AWS Control Tower helps organizations establish and govern a multi-account AWS environment using landing-zone concepts, controls, and account governance mechanisms. Its controls can help enforce organizational requirements across accounts and support standardized account provisioning. This is useful when security teams need consistent baseline configurations across a growing AWS Organization. Detective is intended for security investigations, CloudHSM provides dedicated cryptographic hardware, and Athena provides interactive querying of supported data sources. Control Tower therefore addresses governance and preventive account-level guardrails rather than individual security investigations or cryptographic operations.

Question 172

Which IAM policy element can require requests to originate from a specific VPC endpoint?

1. aws
2. aws
3. aws
4. aws

Correct Answer: 3

Explanation:

The aws:SourceVpce condition key can be used in supported IAM or resource-based policies to restrict requests based on the VPC endpoint through which they originate. This can be useful for resources such as S3 buckets when an organization wants access to occur only through controlled private network paths. The condition can help prevent workloads from bypassing the intended endpoint-based architecture. aws:RequestedRegion evaluates the requested AWS Region, aws:PrincipalOrgID evaluates the principal’s organization, and aws:CurrentTime evaluates time-based conditions. aws:SourceVpce specifically addresses endpoint-origin restrictions.

Question 173

Which AWS service can manage encryption keys in dedicated HSM appliances?

1. AWS CloudHSM
2. AWS Secrets Manager
3. AWS Certificate Manager
4. Amazon S3

Correct Answer: 1

Explanation:

AWS CloudHSM provides dedicated hardware security modules for cryptographic key management and operations. Customers have direct control over the HSM cluster and can use supported cryptographic mechanisms within the dedicated hardware environment. This can be important for workloads with specialized security, regulatory, or key-control requirements. Secrets Manager is designed for storing and rotating application secrets, Certificate Manager manages certificates, and S3 provides object storage. CloudHSM is therefore appropriate when cryptographic operations must use dedicated HSM infrastructure rather than a fully managed key service.

Question 174

Which S3 ownership configuration disables ACL-based access management?

1. Bucket owner enforced
2. Object writer retained
3. ACL compatibility mode
4. Request ownership relay

Correct Answer: 1

Explanation:

S3 Object Ownership with Bucket owner enforced disables access control lists for the bucket and makes the bucket owner the owner of every object. This simplifies authorization by allowing organizations to rely primarily on IAM and bucket policies rather than managing object-level ACLs. It is especially useful for centralized data collection where objects may be uploaded by principals from different AWS accounts. The configuration reduces ownership ambiguity and helps prevent inconsistent ACL permissions. The other listed configurations do not represent the S3 Object Ownership setting that disables ACL-based access control.

Question 175

Which service can create automated findings from AWS security configuration standards?

1. AWS Security Hub
2. Amazon ECR
3. AWS DataSync
4. Amazon ElastiCache

Correct Answer: 1

Explanation:

AWS Security Hub can evaluate AWS environments against supported security standards and generate findings for controls that are not satisfied. These findings give security teams centralized visibility into configuration issues and help identify areas requiring remediation. Security Hub can also aggregate findings from other AWS security services and supported partner products. ECR manages container images, DataSync transfers data, and ElastiCache provides managed in-memory data stores. Security Hub therefore fits the requirement of centrally identifying security-control failures against supported standards while also consolidating findings from multiple security sources.

Question 176

Which AWS service records configuration history for supported resources?

1. AWS Config
2. Amazon CloudFront
3. AWS Direct Connect
4. Amazon SNS

Correct Answer: 1

Explanation:

AWS Config records configuration information and configuration changes for supported AWS resources. This historical information allows security and compliance teams to determine how a resource was configured at a particular point in time and investigate configuration drift. Config can also evaluate resources against compliance rules and provide configuration timelines. CloudFront delivers web content, Direct Connect provides dedicated connectivity, and SNS distributes notifications. AWS Config is therefore useful when investigators need to understand how resource configurations changed over time or determine when a security-relevant configuration was introduced.

Question 177

Which mechanism can prevent an S3 bucket policy from granting public access?

1. RestrictPublicBuckets
2. Replication Time Control
3. Object Lambda
4. Transfer Acceleration

Correct Answer: 1

Explanation:

The S3 Block Public Access setting RestrictPublicBuckets limits the effects of certain public bucket policies. When enabled, it helps prevent access through policies that are considered public, while allowing appropriate non-public access patterns. This control is one component of S3’s broader public-access protection framework. Replication Time Control addresses replication performance objectives, Object Lambda enables custom processing of retrieved objects, and Transfer Acceleration improves data-transfer performance. RestrictPublicBuckets therefore serves a security purpose by limiting the impact of policies that could otherwise expose bucket data publicly.

Question 178

Which AWS service can identify publicly accessible resources through external access analysis?

1. IAM Access Analyzer
2. Amazon CloudWatch
3. AWS Backup
4. Amazon EventBridge

Correct Answer: 1

Explanation:

IAM Access Analyzer analyzes supported resource-based policies to identify access granted outside an intended trust boundary, including certain cases where resources may be accessible externally. These findings can help security teams detect unintended access and review whether the exposure is actually required. CloudWatch provides monitoring and observability, AWS Backup protects data through backup workflows, and EventBridge routes events between applications and services. Access Analyzer therefore provides specialized authorization analysis rather than general monitoring or automation. It is useful for continuously reviewing whether resource policies expose resources beyond their intended organizational boundaries.

Question 179

Which S3 capability can automatically copy objects to another AWS Region for resilience?

1. Cross-Region Replication
2. Inventory manifest generation
3. Intelligent-Tiering analysis
4. Static website hosting

Correct Answer: 1

Explanation:

S3 Cross-Region Replication automatically replicates eligible objects from a source bucket to a destination bucket in another AWS Region. This can support resilience, disaster recovery, compliance, and geographic data distribution requirements. Replication rules can be configured for selected object prefixes or tags and can work with encryption and ownership controls according to the configured architecture. Inventory provides object reports, Intelligent-Tiering optimizes storage-class placement, and static website hosting serves website content. Cross-Region Replication is therefore the relevant capability when the security architecture requires geographically separated copies of S3 data.

Question 180

Which AWS service can automate responses to security findings using event-driven rules?

1. Amazon EventBridge
2. AWS Snow Family
3. Amazon Neptune
4. AWS Glue Data Catalog

Correct Answer: 1

Explanation:

Amazon EventBridge can receive events from AWS security services and route matching events to targets such as Lambda functions, Systems Manager workflows, or other supported services. This enables event-driven security automation. For example, a security finding can trigger a workflow that isolates a resource, disables a compromised credential, or starts an investigation process, depending on the organization’s response design. Snow Family products support data transfer and edge processing, Neptune is a graph database service, and Glue Data Catalog stores metadata. EventBridge therefore provides the event-routing mechanism required for automated security-response workflows.