View Full Amazon AWS Certified Security – Specialty SCS-C03 Exam Dumps and Practice Test Dumps.

 

Question 21

A company wants to prevent users from accessing an S3 bucket over an unencrypted connection. Which condition should be included in the bucket policy?

1. aws:SecureTransport
2. aws:SourceVpc
3. aws:PrincipalTag
4. aws:RequestedRegion

Correct Answer: 1

Explanation

The aws:SecureTransport condition key can be used in an Amazon S3 bucket policy to require requests to use HTTPS. A common security pattern is to explicitly deny requests when secure transport is false. This helps protect data in transit from interception or unauthorized observation. The policy should be tested carefully to ensure that legitimate applications and users connect through supported encrypted protocols. Encryption in transit is one part of a broader data-protection strategy that can also include encryption at rest, strong authentication, and restrictive resource policies.

Question 22

Which AWS service can automatically rotate supported secrets without requiring applications to store new credentials manually?

1. AWS KMS
2. AWS Secrets Manager
3. AWS CloudTrail
4. Amazon GuardDuty

Correct Answer: 2

Explanation

AWS Secrets Manager can automatically rotate supported secrets, reducing the need for administrators or applications to manually manage credential changes. Rotation can help reduce the exposure associated with long-lived passwords and other secrets. Secrets Manager works with AWS Lambda-based rotation workflows for supported secret types and can integrate with applications through API calls or SDKs. Applications should retrieve secrets securely at runtime rather than embedding them in source code. IAM permissions should also be restricted so that only authorized workloads and users can retrieve the required secrets.

Question 23

Which AWS capability can identify whether an EC2 instance is reachable from a network path that violates the intended security architecture?

1. Amazon Inspector network reachability
2. Amazon Macie
3. AWS Artifact
4. Amazon Cognito

Correct Answer: 1

Explanation

Amazon Inspector can provide network reachability findings that help identify unintended exposure of supported resources. These findings can help security teams understand whether an EC2 instance may be reachable through network paths that create unnecessary risk. Security teams can use this information alongside security groups, network ACLs, routing configurations, and Network Access Analyzer to investigate and reduce unwanted connectivity. Identifying unnecessary reachability is important because a vulnerable workload can become significantly more exposed when an attacker has an accessible network path to it.

Question 24

A company wants employees to access AWS accounts without creating individual IAM users in every account. Which solution is most appropriate?

1. AWS IAM Identity Center
2. Amazon Inspector
3. AWS Network Firewall
4. AWS Backup

Correct Answer: 1

Explanation

AWS IAM Identity Center provides centralized workforce access to multiple AWS accounts. Organizations can connect an external identity provider and assign users or groups permission sets for specific accounts. This avoids maintaining separate IAM users in every account and supports centralized identity lifecycle management. Administrators can use permission sets to apply least privilege based on job responsibilities. Strong authentication should be enabled through the organization’s identity system where appropriate. Centralized access also makes it easier to revoke access when users change roles or leave the organization.

Question 25

Which AWS service can help enforce organization-wide security controls across multiple AWS accounts?

1. AWS Organizations
2. Amazon Detective
3. Amazon Macie
4. AWS Certificate Manager

Correct Answer: 1

Explanation

AWS Organizations provides centralized management of multiple AWS accounts and supports governance mechanisms such as service control policies. SCPs can establish permission guardrails that limit what principals in member accounts can do, although they do not grant permissions themselves. Organizations can also support account structures and centralized governance strategies. Security teams should combine organization-level controls with IAM policies, resource policies, logging, and monitoring. Proper account separation can reduce blast radius and make security governance easier to manage across development, testing, and production environments.

Question 26

An organization needs to prevent member accounts from disabling a required AWS service. Which control should be considered?

1. Service control policy
2. Security group
3. S3 lifecycle rule
4. CloudFront cache policy

Correct Answer: 1

Explanation

A service control policy can establish permission guardrails across accounts in an AWS Organization. For example, an SCP can deny specific actions that would weaken required security controls, provided the organization designs the policy appropriately. SCPs do not directly grant access; they establish the maximum permissions available to principals in affected accounts. Security teams should carefully test SCPs because overly broad denies can interrupt legitimate administrative operations. Combining SCPs with IAM policies, centralized logging, and security monitoring creates stronger multi-account governance.

Question 27

Which AWS service provides a managed way to establish private connectivity between a VPC and supported AWS services without using public IP addresses?

1. AWS PrivateLink
2. AWS Shield
3. Amazon Detective
4. AWS Artifact

Correct Answer: 1

Explanation

AWS PrivateLink enables private connectivity to supported services through VPC endpoints without requiring traffic to traverse the public internet. This can reduce exposure and provide more controlled network paths for applications accessing services. Interface VPC endpoints use elastic network interfaces within subnets and can be protected using security groups and endpoint policies. Organizations should evaluate DNS configuration, routing, endpoint policies, and access controls as part of the overall design. Private connectivity does not automatically guarantee authorization, so identity and resource policies remain important.

Question 28

A security team wants to restrict access to an internal application based on user identity and device security attributes rather than exposing the application directly to the internet. Which AWS service can support this requirement?

1. AWS Verified Access
2. Amazon S3
3. AWS Backup
4. Amazon Macie

Correct Answer: 1

Explanation

AWS Verified Access provides application access controls that can evaluate user identity and device security information before allowing access to applications. It is designed to support secure access without requiring traditional network-level VPN access for every application. Policies can use contextual information to determine whether access should be granted. This approach aligns with zero trust principles by evaluating access requests rather than assuming that a user is trusted simply because they are connected to a particular network. Organizations should integrate identity and device signals appropriately.

Question 29

Which AWS service can help protect applications from large-scale distributed denial-of-service attacks?

1. AWS Shield
2. AWS Config
3. AWS Secrets Manager
4. Amazon Athena

Correct Answer: 1

Explanation

AWS Shield provides managed protection against distributed denial-of-service attacks for AWS applications. AWS Shield Standard is automatically available for AWS customers and provides baseline protection against common network and transport-layer DDoS attacks. AWS Shield Advanced provides additional capabilities for organizations with more demanding protection requirements, including enhanced visibility and response support. DDoS protection should be combined with resilient architecture, appropriate load balancing, CloudFront, AWS WAF, and monitoring. The correct combination depends on application architecture, attack characteristics, availability requirements, and cost considerations.

Question 30

Which AWS service can help centrally manage security groups and other firewall policies across an AWS Organization?

1. AWS Firewall Manager
2. Amazon GuardDuty
3. AWS KMS
4. Amazon Detective

Correct Answer: 1

Explanation

AWS Firewall Manager provides centralized management of supported firewall and security policies across accounts in an AWS Organization. It can help administrators maintain consistent security group policies and manage protections such as AWS WAF, Shield Advanced, and Network Firewall. Centralized policy management is especially valuable in large multi-account environments where resources are frequently created or modified. Firewall Manager can help apply policies automatically to resources that fall within defined scopes. Organizations should still validate that centralized rules do not conflict with legitimate application requirements.

Question 31

Which AWS feature should be used to provide temporary permissions to a Lambda function that needs access to another AWS service?

1. Lambda execution role
2. IAM user access key
3. Root user
4. Static credentials in environment variables

Correct Answer: 1

Explanation

A Lambda execution role provides the function with permissions to interact with AWS services. When the function runs, AWS provides temporary credentials associated with the role rather than requiring developers to embed long-term access keys in the function code. The role should contain only the permissions required by the function. For example, a function that reads specific objects from an S3 bucket should not automatically receive broad administrator permissions. Restricting execution roles according to least privilege reduces the potential impact of a compromised function.

Question 32

A company wants to prevent developers from deploying infrastructure that violates approved security configurations. Which approach is most appropriate?

1. Infrastructure as code security validation
2. Disable all deployment logging
3. Grant developers administrator access
4. Store templates without version control

Correct Answer: 1

Explanation

Infrastructure as code security validation can identify insecure configurations before resources are deployed. Security checks can evaluate CloudFormation templates or other infrastructure definitions for issues such as overly permissive access, missing encryption, insecure network exposure, or prohibited configurations. Integrating these checks into CI/CD pipelines creates an early security control that can prevent problematic infrastructure from reaching production. Organizations should combine automated validation with policy governance, peer review, controlled deployment roles, and continuous post-deployment monitoring because configuration can still change after deployment.

Question 33

Which AWS service can help automate patching of EC2 instances according to defined maintenance requirements?

1. AWS Systems Manager
2. Amazon Macie
3. AWS Shield Advanced
4. Amazon Security Lake

Correct Answer: 1

Explanation

AWS Systems Manager provides capabilities for managing and automating operations across AWS resources, including patch management for supported compute instances. Patch Manager can help define patch baselines and automate patching according to organizational requirements. Automated patching can improve consistency and reduce the time that vulnerable software remains exposed. Organizations should test patches before broad deployment when appropriate and monitor patch compliance afterward. Combining Systems Manager with Amazon Inspector findings can help security teams identify vulnerable software and establish remediation workflows based on risk.

Question 34

Which AWS capability provides interactive shell access to managed EC2 instances without requiring inbound SSH ports to be open?

1. Systems Manager Session Manager
2. AWS Client VPN
3. Amazon CloudFront
4. AWS Direct Connect

Correct Answer: 1

Explanation

Systems Manager Session Manager provides secure interactive access to managed instances without requiring administrators to expose inbound SSH or RDP ports. Access can be controlled through IAM permissions, and session activity can be logged according to the configured architecture. Removing unnecessary inbound management ports reduces the attack surface of EC2 instances. Session Manager requires appropriate Systems Manager configuration, agent support, IAM permissions, and network connectivity. Organizations should still apply least privilege and monitor administrative sessions to detect inappropriate access.

Question 35

Which control is most appropriate for preventing an S3 bucket from becoming publicly accessible because of an accidental policy or ACL change?

1. S3 Block Public Access
2. CloudTrail Insights
3. Amazon Detective
4. AWS Certificate Manager

Correct Answer: 1

Explanation

S3 Block Public Access provides account- and bucket-level settings designed to prevent public access configurations for S3 resources. It can block certain public bucket policies and access control list configurations, helping protect against accidental exposure. Organizations should enable appropriate Block Public Access settings and still use least-privilege IAM and bucket policies. Security teams should monitor configuration changes with AWS Config and CloudTrail. Block Public Access is a preventive safeguard, while logging and monitoring provide visibility into attempted or actual configuration changes.

Question 36

Which AWS service can identify whether AWS resources comply with defined configuration rules?

1. AWS Config
2. Amazon GuardDuty
3. AWS Shield
4. Amazon Detective

Correct Answer: 1

Explanation

AWS Config evaluates AWS resource configurations against defined rules and can identify resources that are compliant or noncompliant. Security teams can use Config rules to check requirements such as encryption, restricted access, approved configurations, or required security settings. Config can also maintain configuration history, which helps investigate changes and support compliance activities. Automated remediation can be integrated for certain findings. Config should not be treated as a replacement for threat detection because its primary purpose is configuration assessment and governance rather than identifying malicious behavior.

Question 37

Which AWS service is designed to provide a centralized repository of audit evidence for compliance assessments?

1. AWS Audit Manager
2. Amazon GuardDuty
3. AWS WAF
4. Amazon Inspector

Correct Answer: 1

Explanation

AWS Audit Manager helps organizations collect and organize evidence relevant to audits and compliance assessments. It can continuously collect evidence from supported AWS services and map that evidence to defined frameworks or control requirements. This can reduce the manual effort involved in preparing for audits and provide a structured view of control evidence. Audit Manager does not itself make an environment compliant; organizations remain responsible for implementing and operating appropriate controls. Security teams should validate evidence and ensure that mapped controls accurately reflect organizational requirements.

Question 38

A company wants to detect unusual API activity and investigate whether an IAM principal behaved differently from its normal pattern. Which combination is most appropriate?

1. CloudTrail and GuardDuty
2. S3 and CloudFront
3. Route 53 and ACM
4. EFS and DataSync

Correct Answer: 1

Explanation

AWS CloudTrail provides records of API activity that can be examined to determine what actions occurred and which identity performed them. Amazon GuardDuty analyzes relevant AWS activity and other signals to identify suspicious behavior and generate findings. Using these services together provides both detailed event records and threat-detection capabilities. Security teams can further investigate findings using Amazon Detective or centralized security data platforms. Organizations should ensure that CloudTrail logging is appropriately configured and protected so that investigators have reliable evidence during security incidents.

Question 39

Which AWS service can help protect encryption keys using dedicated hardware designed for cryptographic operations?

1. AWS CloudHSM
2. Amazon Macie
3. AWS Config
4. Amazon Route 53

Correct Answer: 1

Explanation

AWS CloudHSM provides dedicated hardware security modules that allow organizations to generate, store, and use cryptographic keys in hardware-controlled environments. It is appropriate when workloads require greater control over cryptographic operations or specific compliance and key-management requirements. CloudHSM differs from AWS KMS because KMS is a managed key-management service with integrated AWS service support, while CloudHSM provides customer-controlled HSM clusters. Selecting between them depends on operational requirements, compliance needs, cryptographic control, availability expectations, and the complexity the organization is prepared to manage.

Question 40

Which security principle requires granting only the permissions necessary for a user or workload to perform its intended function?

1. Least privilege
2. Defense in depth
3. Failover
4. Data sovereignty

Correct Answer: 1

Explanation

Least privilege means providing a user, application, service, or workload only the permissions required to perform its authorized tasks. In AWS, this can involve carefully scoped IAM policies, resource policies, permission boundaries, service roles, and temporary credentials. Excessive permissions increase the potential impact of compromised identities or applications. Organizations should regularly review permissions and remove unnecessary access as requirements change. Least privilege should be applied together with strong authentication, logging, monitoring, and other controls because no single authorization mechanism eliminates every security risk.