View Full Amazon AWS Certified Security – Specialty SCS-C02 Exam Dumps and Practice Test Dumps

 

Question 361

Which RDS feature encrypts Performance Insights data with a customer managed key?

1. Performance Insights KMS encryption
2. Enhanced Monitoring
3. IAM database authentication
4. Database Activity Streams

Correct Answer: 1

Explanation:

Amazon RDS Performance Insights can use AWS KMS encryption to protect its stored performance-related data. Organizations with stricter key-management requirements can use a customer managed KMS key where supported, allowing additional control through key policies and lifecycle management. Enhanced Monitoring provides operating-system-level metrics, IAM database authentication controls database login using IAM credentials, and Database Activity Streams captures database activity for auditing purposes. Performance Insights KMS encryption specifically addresses protection of Performance Insights data rather than database storage or authentication. This separation helps security teams apply appropriate encryption and authorization controls to different RDS security requirements.

Question 362

Which Secrets Manager feature allows a secret to be accessed by another AWS account?

1. Automatic rotation schedule
2. Replica Region configuration
3. Secret resource policy
4. Secret version staging

Correct Answer: 3

Explanation:

AWS Secrets Manager supports resource-based policies that can authorize principals from another AWS account to access a secret, subject to the required permissions and conditions. This is useful when applications in separate accounts need controlled access to centrally managed credentials. Resource policies should be narrowly scoped and combined with appropriate identity permissions and encryption controls. Automatic rotation changes secret credentials on a defined schedule, version staging identifies versions such as current or previous values, and replica configuration copies supported secrets to another Region. A secret resource policy is the mechanism directly used to establish cross-account access.

Question 363

What does an S3 legal hold provide?

1. Faster object retrieval
2. Automatic encryption rotation
3. Automatic object deletion
4. Indefinite preservation independent of retention periods

Correct Answer: 4

Explanation:

An S3 Object Lock legal hold prevents an object version from being overwritten or deleted until the legal hold is explicitly removed. Unlike a retention period, a legal hold does not depend on a predetermined expiration date. This makes it useful when records must be preserved for an unresolved investigation, litigation, or regulatory matter. Object retrieval performance is unrelated to legal holds, and encryption key rotation is managed through KMS rather than S3 legal-hold functionality. Automatic deletion is also contrary to the purpose of a legal hold. The key security benefit is preservation until an authorized process releases the hold.

Question 364

Which EBS capability protects newly created volumes without requiring each user to select encryption manually?

1. Elastic Volumes
2. EBS encryption by default
3. Fast Snapshot Restore
4. Snapshot lifecycle policy

Correct Answer: 2

Explanation:

EBS encryption by default establishes automatic encryption for newly created supported EBS volumes and related resources in a Region. This reduces configuration mistakes because users do not need to remember to select encryption during every volume creation workflow. Organizations can also designate a KMS key for default encryption according to supported EBS settings. Snapshot lifecycle policies automate snapshot management, Elastic Volumes supports volume modification, and Fast Snapshot Restore improves snapshot-based volume initialization performance. Encryption by default is the preventive security control that establishes encrypted storage as the standard for new EBS resources.

Question 365

Which CloudTrail configuration can capture object-level activity in an S3 bucket?

1. Data event selector
2. Management event selector
3. Insight event rule
4. Network event filter

Correct Answer: 1

Explanation:

CloudTrail data events provide visibility into object-level actions such as supported S3 object API activity. Examples include operations that access, create, or delete objects. Data events are different from management events, which generally record control-plane operations such as changing bucket configuration or modifying IAM-related resources. Because data events can generate a high volume of records, organizations commonly enable them selectively for sensitive resources. Insight events identify unusual management API activity patterns, while the other listed options do not represent the CloudTrail configuration used for S3 object-level auditing.

Question 366

Which Amazon GuardDuty capability monitors supported RDS database activity for threats?

1. Malware Protection for S3
2. EKS Audit Monitoring
3. RDS Protection
4. Macie Sensitive Data Discovery

Correct Answer: 3

Explanation:

Amazon GuardDuty RDS Protection is designed to monitor supported Amazon Aurora database activity and identify potentially suspicious behavior. It extends GuardDuty’s threat-detection capabilities into the database layer, helping security teams identify activity that may indicate compromised credentials or unusual access patterns. Malware Protection for S3 focuses on scanning uploaded S3 objects for malware-related threats, while Macie focuses on sensitive data discovery. EKS-related monitoring addresses Kubernetes environments. RDS Protection is therefore the GuardDuty capability associated specifically with supported database activity.

Question 367

Which VPC feature can record accepted and rejected network traffic metadata?

1. VPC Peering
2. VPC Flow Logs
3. Internet Gateway
4. Elastic IP

Correct Answer: 2

Explanation:

VPC Flow Logs capture metadata about network traffic to and from supported network interfaces. Depending on configuration and flow-log format, records can include source and destination addresses, ports, protocols, packet information, and whether traffic was accepted or rejected. This information is valuable during incident investigations because it can reveal unexpected communication paths or blocked connections. VPC peering connects networks, an Internet Gateway provides connectivity for supported internet-bound traffic, and an Elastic IP provides a static public IPv4 address. None of these features independently provides network-flow logging.

Question 368

Which IAM feature can require users to authenticate with MFA before sensitive API actions?

1. S3 replication configuration
2. IAM policy MFA condition
3. CloudFront response policy
4. EBS snapshot archive

Correct Answer: 2

Explanation:

IAM policies can use MFA-related condition keys to require multi-factor authentication for specific operations. This allows organizations to apply stronger authentication requirements to sensitive actions rather than treating every API request identically. A policy can evaluate whether the request was made using MFA and deny selected operations when that requirement is not satisfied. S3 replication controls object replication, CloudFront response policies influence response headers, and EBS snapshot archive concerns snapshot storage options. The IAM MFA condition directly provides policy-based enforcement for authentication-sensitive API actions.

Question 369

Which AWS service can automatically rotate supported database credentials stored as secrets?

1. AWS Secrets Manager
2. AWS Artifact
3. Amazon Detective
4. AWS Shield Advanced

Correct Answer: 1

Explanation:

AWS Secrets Manager supports automatic rotation for supported secrets and integrated services, including supported database credentials. Rotation can periodically generate new credentials and update the corresponding secret, reducing the lifetime of static passwords. This is a key security practice because credentials that remain unchanged for long periods provide a larger window of opportunity if exposed. AWS Artifact provides compliance documentation, Detective supports security investigations, and Shield Advanced provides enhanced DDoS protection. Secrets Manager is the service specifically designed to centrally store, retrieve, and rotate application credentials and other sensitive secrets.

Question 370

Which security control can block traffic based on domain names in VPC DNS queries?

1. Network Load Balancer
2. NAT Gateway
3. Route 53 Resolver DNS Firewall
4. VPC Traffic Mirroring

Correct Answer: 3

Explanation:

Route 53 Resolver DNS Firewall allows organizations to control DNS queries originating from VPC resources by using domain lists and rule groups. Security teams can block or alert on queries for domains associated with malware, command-and-control infrastructure, or other prohibited destinations. Because DNS resolution occurs before many application connections are established, this can provide an additional preventive layer for outbound traffic. A Network Load Balancer distributes network connections, a NAT Gateway provides address translation, and Traffic Mirroring copies network traffic for inspection. DNS Firewall specifically addresses domain-based DNS query control.

Question 371

Which AWS service centrally manages supported firewall policies across multiple accounts?

1. Amazon Inspector
2. AWS Systems Manager
3. AWS Private CA
4. AWS Firewall Manager

Correct Answer: 4

Explanation:

AWS Firewall Manager provides centralized management of supported security policies across accounts and resources in an AWS Organization. It can help administrators apply and maintain policies for services such as AWS WAF, AWS Shield Advanced, security groups, and AWS Network Firewall according to supported configurations. This is particularly useful in multi-account environments where individually configuring every account can lead to inconsistent controls. Inspector focuses on vulnerability assessment, Systems Manager manages operational tasks, and Private CA manages private certificates. Firewall Manager is the service designed for centralized firewall-policy administration.

Question 372

Which KMS feature can limit a grant to a specific encryption context?

1. Key alias
2. Grant constraint
3. Key rotation schedule
4. Imported key material

Correct Answer: 2

Explanation:

KMS grants can include constraints that limit how the granted permissions may be used. An encryption-context constraint can require cryptographic requests to contain an appropriate encryption context before the grant is effective. This provides an additional layer of authorization and can help ensure that delegated key use is tied to a particular application or data context. Key aliases provide alternate names, rotation schedules govern supported key-material rotation, and imported key material concerns the origin of cryptographic material. Grant constraints are specifically intended to narrow the circumstances under which delegated KMS permissions can be exercised.

Question 373

Which service helps enforce preventive controls across AWS Organizations accounts?

1. AWS Organizations SCPs
2. Amazon Macie
3. Amazon CloudFront
4. AWS Audit Manager

Correct Answer: 1

Explanation:

Service control policies, or SCPs, are organization-level controls that define the maximum available permissions for principals within affected AWS accounts. They can prevent actions such as using certain services, creating resources in prohibited Regions, or modifying protected configurations. SCPs do not grant permissions themselves; IAM policies are still required to authorize allowed actions. Macie focuses on S3 sensitive-data discovery, CloudFront provides content delivery, and Audit Manager collects evidence for assessments. SCPs are therefore the preventive governance mechanism used to establish permission boundaries across accounts in AWS Organizations.

Question 374

Which AWS feature can detect whether an IAM policy grants access to an external principal?

1. AWS Backup
2. Amazon CloudWatch
3. IAM Access Analyzer
4. AWS Control Tower

Correct Answer: 3

Explanation:

IAM Access Analyzer helps identify resources that are accessible from outside an intended trust boundary, such as an AWS account or organization. It analyzes resource-based policies and can generate findings when resources are configured to allow access by external principals. This is useful for detecting unintended public or cross-account exposure. AWS Backup protects data through backup workflows, CloudWatch provides monitoring and observability, and Control Tower helps establish and govern multi-account environments. Access Analyzer is the appropriate service for analyzing resource policies and identifying unintended external access.

Question 375

Which S3 control can restrict access through a specific access point?

1. Storage Lens dashboard
2. Access point policy
3. Inventory configuration
4. Lifecycle transition

Correct Answer: 2

Explanation:

An S3 access point can have its own resource policy that defines which principals can use that access point and under what conditions. This allows organizations to create different controlled entry points to the same bucket for different applications, teams, or environments. Access point policies can complement the underlying bucket policy and other S3 authorization controls. Storage Lens provides visibility into storage usage and activity, Inventory produces object reports, and Lifecycle controls retention or storage transitions. The access point policy is the mechanism specifically designed to govern access through an individual S3 access point.

Question 376

Which service can scan container images for known software vulnerabilities?

1. AWS Secrets Manager
2. Amazon Route 53
3. Amazon Inspector
4. AWS CloudTrail

Correct Answer: 3

Explanation:

Amazon Inspector supports vulnerability assessment for container images stored in Amazon Elastic Container Registry, or Amazon ECR. It can identify known software vulnerabilities in packages contained within supported images and generate findings for security teams. This helps organizations detect vulnerable dependencies before images are deployed or while they remain in the registry. Secrets Manager manages sensitive credentials, Route 53 provides DNS functionality, and CloudTrail records API activity. Inspector is therefore the service among these choices directly associated with vulnerability scanning of supported container images.

Question 377

Which AWS capability can automatically remediate a noncompliant resource after an AWS Config finding?

1. CloudFront cache behavior
2. S3 replication rule
3. Config remediation action
4. KMS alias

Correct Answer: 3

Explanation:

AWS Config supports remediation actions that can automatically invoke supported Systems Manager Automation documents when a resource is found to be noncompliant. This allows organizations to move from detection toward corrective action. For example, a remediation workflow can address an insecure configuration after a Config rule identifies it. CloudFront cache behaviors control content delivery, S3 replication moves objects between destinations, and KMS aliases provide alternate key names. Config remediation is therefore useful for building automated compliance workflows that detect and correct security configuration drift.

Question 378

Which AWS service provides managed DDoS protection for applications and resources?

1. Amazon Macie
2. AWS Shield
3. AWS Config
4. Amazon ECR

Correct Answer: 2

Explanation:

AWS Shield provides managed protection against distributed denial-of-service attacks for supported AWS resources. Shield Standard is automatically available for supported AWS services, while Shield Advanced provides additional capabilities and protections for organizations with more demanding DDoS defense requirements. Macie identifies sensitive data in S3, Config evaluates resource configurations, and ECR stores container images. DDoS protection focuses on maintaining availability when malicious traffic attempts to overwhelm network or application resources. Shield is therefore the AWS service specifically dedicated to managed DDoS protection.

Question 379

Which IAM concept allows temporary credentials to inherit additional restrictions during role assumption?

1. S3 replication metrics
2. CloudTrail digest files
3. Session tags
4. ACM renewal rules

Correct Answer: 3

Explanation:

IAM session tags are attributes passed into a role session and can be used with policy conditions to implement attribute-based access-control designs. When configured appropriately, session attributes can influence authorization decisions and help organizations apply contextual restrictions to temporary credentials. This is useful in environments where access should depend on characteristics such as project, department, or workload context. S3 replication metrics monitor replication activity, CloudTrail digest files support log-integrity validation, and ACM renewal handles certificate lifecycle operations. Session tags specifically provide contextual information that can participate in authorization decisions during role sessions.

Question 380

Which AWS service can provide a centralized, normalized security data lake?

1. Amazon Security Lake
2. AWS Certificate Manager
3. Amazon ElastiCache
4. AWS Database Migration Service

Correct Answer: 1

Explanation:

Amazon Security Lake is designed to centrally collect security-related data from supported AWS, third-party, and custom sources and normalize it using the Open Cybersecurity Schema Framework. This creates a centralized security data lake that can support threat detection, investigation, analytics, and downstream security tooling. Certificate Manager handles certificate issuance and management, ElastiCache provides in-memory caching, and Database Migration Service supports database migration workflows. Security Lake is specifically designed for centralized security-data collection and normalization across diverse security sources.