View Full Amazon AWS Certified Security – Specialty SCS-C02 Exam Dumps and Practice Test Dumps

 

Question 261

Which IAM feature lets administrators define reusable access assignments for workforce users?

1. IAM user groups
2. Resource policies
3. Permission sets
4. Inline role policies

Correct Answer: 4

Explanation:

IAM Identity Center permission sets provide reusable permission definitions that administrators can assign to workforce users or groups when granting access to AWS accounts. A permission set can contain AWS managed policies, customer managed policies, or other supported permission configurations. When assigned, IAM Identity Center provisions the corresponding permissions into the target account. IAM user groups are associated with traditional IAM users, resource policies control access to specific resources, and inline policies are directly attached to individual identities. Permission sets are particularly useful in multi-account environments because they provide a centralized and repeatable way to manage workforce access.

Question 262

Which AWS feature helps prevent accidental exposure of an S3 bucket through ACLs?

1. Object Ownership
2. S3 Inventory
3. Replication Rules
4. Storage Lens

Correct Answer: 2

Explanation:

S3 Object Ownership can disable access control lists by using the Bucket owner enforced setting. With ACLs disabled, the bucket owner automatically owns objects uploaded to the bucket, and access can be managed through IAM policies and bucket policies instead of object ACLs. This reduces complexity and helps prevent security problems caused by inconsistent object ownership or ACL configurations. S3 Inventory provides object reports, replication rules control data copies, and Storage Lens provides storage-usage visibility. Object Ownership is therefore the relevant S3 capability when the goal is to simplify permissions and eliminate ACL-based exposure.

Question 263

Which AWS service can scan Lambda functions for software vulnerabilities?

1. Amazon Macie
2. Amazon Inspector
3. AWS Audit Manager
4. AWS Security Hub

Correct Answer: 1

Explanation:

Amazon Inspector can assess supported AWS Lambda functions for software vulnerabilities and generate findings for detected issues. This provides security teams with visibility into vulnerable dependencies and packages used by serverless applications. Inspector’s vulnerability assessment capabilities complement its supported scanning of other workload types, including EC2 instances and container images in Amazon ECR. Macie focuses on sensitive data discovery, Audit Manager collects compliance evidence, and Security Hub aggregates findings from security services. Inspector is therefore the service most directly associated with identifying vulnerabilities in supported Lambda workloads.

Question 264

Which control can restrict an S3 bucket policy to requests originating through a specific VPC endpoint?

1. S3 VersionId condition
2. aws condition
3. aws condition
4. s3 condition

Correct Answer: 3

Explanation:

The aws:SourceVpce condition key can be used in supported resource policies to restrict access based on the VPC endpoint through which a request arrives. For example, an S3 bucket policy can deny access unless requests originate from an approved VPC endpoint. This is useful when an organization wants private application traffic to reach an S3 bucket only through designated network paths. The aws:SecureTransport condition evaluates whether transport encryption is being used, while object-related conditions evaluate object properties. SourceVpce specifically provides network-path-based access control.

Question 265

Which KMS operation schedules a customer managed key for removal?

1. DisableKey
2. CancelKeyDeletion
3. ScheduleKeyDeletion
4. RetireGrant

Correct Answer: 4

Explanation:

The KMS ScheduleKeyDeletion operation places a customer managed KMS key into a pending-deletion state for the configured waiting period. The key is not immediately destroyed, giving administrators an opportunity to cancel the deletion if it was requested accidentally. During the waiting period, the key cannot normally be used for cryptographic operations. DisableKey temporarily prevents key use without deleting the key, CancelKeyDeletion reverses a pending deletion, and RetireGrant concerns retiring a grant. ScheduleKeyDeletion is therefore the API operation specifically used to initiate KMS key deletion.

Question 266

Which KMS action can reverse a key that is awaiting deletion?

1. CancelKeyDeletion
2. EnableKeyRotation
3. RetireGrant
4. CreateAlias

Correct Answer: 1

Explanation:

CancelKeyDeletion can cancel a KMS key deletion that is still in the pending-deletion period. This provides an important recovery mechanism if administrators discover that a key was scheduled for deletion unintentionally. Once a key has actually been deleted, recovery is not available through this operation. EnableKeyRotation controls key rotation, RetireGrant removes a grant’s authorization relationship, and CreateAlias creates a friendly reference to a key. The ability to cancel scheduled deletion is especially important because applications may depend on existing ciphertext that requires the key for future decryption.

Question 267

Which IAM policy type is evaluated for a resource rather than an identity?

1. Identity-based policy
2. Permissions boundary
3. Resource-based policy
4. Session policy

Correct Answer: 3

Explanation:

Resource-based policies are attached to supported AWS resources and specify which principals can access those resources and what actions they may perform. Examples include S3 bucket policies, KMS key policies, and certain other service-specific resource policies. Identity-based policies are attached to users, groups, or roles, while permissions boundaries limit the maximum permissions an identity can receive. Session policies can further restrict permissions during a temporary session. Resource-based policies are particularly useful when access decisions need to be defined directly at the protected resource.

Question 268

Which STS capability lets an application request temporary credentials for a role?

1. AssumeRole
2. GetCallerIdentity
3. DecodeAuthorizationMessage
4. GetFederationToken

Correct Answer: 2

Explanation:

AWS STS AssumeRole allows a trusted principal to obtain temporary security credentials for an IAM role. The resulting credentials include an access key ID, secret access key, and session token and are valid only for the configured session duration. AssumeRole is widely used for cross-account access, workload identity, and temporary administrative sessions. GetCallerIdentity returns information about the current caller, DecodeAuthorizationMessage helps decode certain authorization failure messages, and GetFederationToken provides temporary credentials under a different federation model. AssumeRole is the standard mechanism for obtaining temporary credentials associated with an IAM role.

Question 269

Which IAM mechanism can require a request to originate from a specific AWS Region?

1. PrincipalOrgID
2. aws
3. aws
4. aws

Correct Answer: 4

Explanation:

The aws:RequestedRegion global condition key can be used in IAM policies to restrict API requests according to the AWS Region targeted by the request. Organizations can use this condition to prevent identities from performing certain actions outside approved Regions. This can support data-residency requirements, governance standards, and regional deployment strategies. PrincipalOrgID evaluates whether the principal belongs to a specified AWS Organization, PrincipalType identifies the principal type, and UserId relates to the calling identity. RequestedRegion is the condition key specifically designed for evaluating the target Region of an AWS request.

Question 270

Which Organizations policy can limit actions across member accounts?

1. IAM policy
2. SCP
3. Session policy
4. Bucket policy

Correct Answer: 1

Explanation:

Service Control Policies, or SCPs, are AWS Organizations policies that establish permission guardrails for accounts within an organization or organizational unit. An SCP does not grant permissions by itself. Instead, it defines the maximum available permissions that identities in affected accounts can use when combined with applicable identity and resource policies. This makes SCPs useful for centrally preventing actions such as disabling security controls or using unsupported Regions. IAM policies grant permissions to identities, session policies restrict temporary sessions, and bucket policies control access to S3 resources. SCPs provide organization-level permission boundaries.

Question 271

Which condition key can restrict access to principals belonging to an AWS Organization?

1. aws
2. aws
3. aws
4. aws

Correct Answer: 2

Explanation:

The aws:PrincipalOrgID global condition key can be used in supported resource policies to restrict access to principals that belong to a specified AWS Organization. This is useful for centralized resource sharing where an organization wants to permit access from its own member accounts while excluding unrelated external accounts. SourceIp evaluates the requester’s source IP address, VpcSourceIp can evaluate certain VPC-originated request contexts, and CalledVia provides information about service-mediated requests. PrincipalOrgID is specifically intended to establish an organization-based trust condition.

Question 272

Which AWS service helps detect unintended resource sharing outside an organization?

1. AWS Shield
2. AWS Backup
3. IAM Access Analyzer
4. Amazon CloudFront

Correct Answer: 3

Explanation:

IAM Access Analyzer can analyze resource-based policies and identify external access that may not be intended. It can help security teams discover resources that are accessible from outside an organization or account boundary and investigate whether that access is justified. This capability is useful for maintaining least privilege and reducing accidental data exposure. Shield protects against DDoS attacks, Backup protects recovery data, and CloudFront delivers content through edge locations. Access Analyzer is therefore the relevant service for analyzing resource-sharing relationships and identifying potentially unintended external access.

Question 273

Which S3 feature preserves previous object versions after an overwrite?

1. Versioning
2. Lifecycle expiration
3. Transfer Acceleration
4. Inventory configuration

Correct Answer: 4

Explanation:

S3 Versioning maintains multiple versions of an object in the same bucket. When an object is overwritten or deleted, previous versions can remain available instead of being immediately lost. This provides an important recovery mechanism for accidental modifications and deletions. Versioning is also commonly combined with Object Lock and replication for stronger data-protection architectures. Lifecycle rules can manage old versions, Transfer Acceleration improves transfer performance, and Inventory provides object metadata reports. Versioning specifically provides the historical object versions that allow organizations to recover earlier copies of data.

Question 274

Which S3 Object Lock mode allows authorized users to bypass governance retention?

1. Compliance mode
2. Governance mode
3. Legal hold mode
4. Versioning mode

Correct Answer: 2

Explanation:

S3 Object Lock Governance mode protects objects from modification or deletion during a retention period while allowing specially authorized users to bypass the retention controls. This provides strong protection while retaining administrative flexibility for approved personnel. Compliance mode is stricter because protected versions cannot be overwritten or deleted during the retention period even by users with elevated permissions. Legal holds provide indefinite protection until explicitly removed but are not a retention mode themselves. Versioning is an S3 data-management feature rather than an Object Lock mode. Governance mode is therefore the correct choice for controlled administrative bypass.

Question 275

Which CloudFront control restricts direct access to an S3 origin?

1. Origin Access Control
2. Signed cookie
3. Cache policy
4. Response headers policy

Correct Answer: 1

Explanation:

CloudFront Origin Access Control, or OAC, allows CloudFront to securely access an Amazon S3 origin while the bucket policy can restrict direct access from unauthorized sources. OAC supports signing requests to the S3 origin and is the recommended mechanism for many modern CloudFront-to-S3 architectures. Signed cookies control viewer access to private content, cache policies determine caching behavior, and response headers policies modify HTTP response headers. OAC specifically addresses the origin-access relationship between CloudFront and S3, helping prevent users from bypassing CloudFront and accessing the bucket directly.

Question 276

Which AWS service can inspect network traffic using stateful and stateless rules?

1. Amazon GuardDuty
2. AWS Network Firewall
3. AWS WAF
4. AWS Shield

Correct Answer: 4

Explanation:

AWS Network Firewall is a managed network firewall service that supports both stateless and stateful rule groups. Stateless rules can make filtering decisions independently for each packet, while stateful rules can evaluate traffic with connection context and more advanced inspection capabilities. AWS WAF focuses on web application traffic such as HTTP and HTTPS requests, Shield provides DDoS protection, and GuardDuty detects suspicious activity. Network Firewall is therefore the service designed for centralized inspection and filtering of network traffic at the VPC level using both stateless and stateful controls.

Question 277

Which AWS service can enforce security policies on resources created in new accounts?

1. AWS Control Tower
2. Amazon Macie
3. AWS CloudTrail
4. Amazon Inspector

Correct Answer: 1

Explanation:

AWS Control Tower helps establish governance for newly created and existing accounts in a multi-account AWS environment. It can apply organizational controls and guardrails intended to maintain consistent security and compliance requirements across governed accounts. This is useful when organizations want newly provisioned accounts to inherit standardized governance rather than relying on administrators to configure every security control manually. Macie focuses on sensitive data, CloudTrail records AWS activity, and Inspector evaluates supported workloads for vulnerabilities. Control Tower is therefore relevant when account provisioning and centralized governance are part of the security requirement.

Question 278

Which service can encrypt and protect a database password used by an application?

1. Amazon Route 53
2. AWS Secrets Manager
3. Amazon Inspector
4. AWS Artifact

Correct Answer: 2

Explanation:

AWS Secrets Manager provides secure storage for database passwords and other sensitive application credentials. Applications can retrieve secrets at runtime through authenticated API calls rather than embedding passwords directly in source code or configuration files. Secrets Manager also supports rotation workflows for supported use cases, helping organizations reduce reliance on long-lived credentials. Route 53 manages DNS, Inspector performs vulnerability assessment, and Artifact provides compliance documentation. Secrets Manager is therefore appropriate when an application needs centralized, encrypted storage and controlled retrieval of a database password or similar sensitive credential.

Question 279

Which AWS service records resource configuration history for supported resources?

1. AWS Config
2. AWS Security Hub
3. Amazon Detective
4. AWS Artifact

Correct Answer: 3

Explanation:

AWS Config records configuration information for supported AWS resources and can maintain configuration history over time. This allows administrators to investigate how resource settings changed and evaluate resources against compliance rules. Configuration history can be useful during security investigations because it helps establish when a security-sensitive configuration changed and what the previous state was. Security Hub centralizes findings, Detective supports investigation of security activity, and Artifact provides compliance documentation. AWS Config is specifically designed to provide resource configuration visibility and historical tracking.

Question 280

Which AWS capability helps preserve forensic evidence by preventing backup deletion?

1. S3 Transfer Acceleration
2. AWS Backup Vault Lock
3. CloudFront caching
4. Route 53 Resolver

Correct Answer: 4

Explanation:

AWS Backup Vault Lock can help protect recovery points from deletion or retention reduction according to configured retention controls. This is valuable for forensic and incident-response scenarios because backup copies can provide preserved versions of systems and data after a security incident. Strong retention controls can reduce the possibility that an attacker who compromises administrative credentials will immediately destroy recovery evidence. Transfer Acceleration concerns S3 data transfer, CloudFront caching concerns content delivery, and Route 53 Resolver provides DNS resolution. Backup Vault Lock directly supports protected, retention-controlled backup storage.