View Full Amazon AWS Certified Security – Specialty SCS-C03 Exam Dumps and Practice Test Dumps.

 

Question 101

Which AWS service can detect unauthorized or suspicious activity involving AWS accounts and workloads?

1. AWS Config
2. Amazon GuardDuty
3. AWS Artifact
4. AWS Audit Manager

Correct Answer: 2

Explanation

Amazon GuardDuty is an AWS threat detection service that continuously analyzes supported AWS data sources and activity signals to identify potentially malicious or unauthorized behavior. It can generate findings involving account credentials, EC2 instances, containers, and other supported resources. Security teams can investigate these findings using additional services such as Security Hub and Detective. GuardDuty should be combined with preventive controls, centralized logging, and incident-response procedures because detection alone does not automatically contain or remediate a security incident.

Question 102

An organization wants to prevent an S3 bucket from accepting requests that are not encrypted in transit. Which policy condition can enforce this requirement?

1. aws:SecureTransport
2. aws:SourceIp
3. aws:userid
4. aws:PrincipalTag

Correct Answer: 1

Explanation

The aws:SecureTransport condition key can be used in IAM or resource policies to require requests to use secure transport. An S3 bucket policy can deny requests when the condition indicates that HTTPS is not being used. This provides a strong preventive control against transmitting S3 data over unencrypted connections. Security teams should test the policy carefully and ensure that legitimate clients use supported secure connections. Encryption in transit should also be combined with encryption at rest, appropriate access controls, and logging.

Question 103

Which AWS service helps organizations discover unintended public or cross-account access to supported resources?

1. Amazon Inspector
2. AWS Shield
3. IAM Access Analyzer
4. Amazon Macie

Correct Answer: 3

Explanation

IAM Access Analyzer can identify resource policies that allow access from outside an organization or account for supported resources. This helps security teams discover unintended external access and review whether permissions should be restricted. It can be particularly useful for analyzing resource-based policies involving services such as S3, IAM, and KMS. Findings should be evaluated against business requirements because some cross-account access is intentional. Organizations should regularly review analyzer results and remove permissions that are no longer necessary.

Question 104

A company wants to centrally collect security findings from AWS services and integrated security products. Which service should it use?

1. Amazon Detective
2. AWS Security Hub
3. AWS Systems Manager
4. Amazon CloudWatch

Correct Answer: 2

Explanation

AWS Security Hub provides centralized visibility into security findings from supported AWS services and integrated third-party products. It allows security teams to review findings from multiple sources in a common location and can support automated workflows through integrations such as EventBridge. Security Hub can also help organizations evaluate security posture against supported standards. However, centralizing findings does not replace investigation and remediation processes. Teams should establish ownership, severity handling, response procedures, and escalation paths for findings received through Security Hub.

Question 105

Which AWS service can continuously evaluate AWS resource configurations against defined security rules?

1. AWS Config
2. AWS WAF
3. Amazon GuardDuty
4. AWS Shield Advanced

Correct Answer: 1

Explanation

AWS Config records resource configurations and can evaluate those configurations against defined compliance rules. Security teams can use Config rules to identify resources that violate organizational requirements, such as unrestricted security group access or missing encryption settings. Config can also provide configuration history that helps investigators understand how resources changed over time. It is primarily a configuration and compliance service rather than a threat-detection platform. Organizations often combine Config with Security Hub, EventBridge, and automated remediation mechanisms for continuous security governance.

Question 106

An application running on an EC2 instance needs permission to access an S3 bucket without storing long-term credentials on the instance. What should be used?

1. Root account credentials
2. IAM user access keys
3. IAM role attached through an instance profile
4. Hard-coded credentials in the application

Correct Answer: 3

Explanation

An IAM role attached to an EC2 instance through an instance profile allows applications running on the instance to obtain temporary credentials. This avoids storing long-term access keys in application code or configuration files. The role should contain only the permissions required by the application, following the principle of least privilege. Temporary credentials are automatically managed by AWS for the role and are preferable to permanent credentials for supported workloads. Security teams should still monitor role usage and regularly review the associated permissions.

Question 107

Which AWS service provides centralized management of user access across multiple AWS accounts for workforce identities?

1. AWS IAM Identity Center
2. Amazon Macie
3. AWS Network Firewall
4. AWS Artifact

Correct Answer: 1

Explanation

AWS IAM Identity Center provides centralized workforce access management across multiple AWS accounts and supported applications. It can integrate with an organization’s existing identity provider and allows administrators to assign users and groups to permission sets. Permission sets help standardize access while avoiding the need to create separate long-term IAM users in every account. This approach supports centralized identity lifecycle management and federation. Organizations should still apply least privilege, strong authentication, appropriate session controls, and regular access reviews.

Question 108

A security team needs to preserve an S3 object so that it cannot be deleted or overwritten during a defined retention period. Which feature should be enabled?

1. S3 Transfer Acceleration
2. S3 Object Lock
3. S3 Inventory
4. S3 Select

Correct Answer: 2

Explanation

S3 Object Lock can prevent protected objects from being deleted or overwritten for a configured retention period. It is useful for preserving security logs, compliance records, and forensic evidence where immutability is required. Object Lock supports retention modes and legal holds for supported use cases. Organizations should carefully manage permissions around retention settings because improperly configured administrative access can undermine the intended protection. Object Lock should complement encryption, access controls, monitoring, and appropriate bucket-level security rather than being treated as the only S3 protection mechanism.

Question 109

Which AWS service is designed to identify software vulnerabilities in supported EC2 instances and other supported workloads?

1. Amazon Inspector
2. AWS Config
3. Amazon Detective
4. AWS Firewall Manager

Correct Answer: 1

Explanation

Amazon Inspector continuously assesses supported workloads for vulnerabilities and other security exposures. For EC2 instances, it can identify vulnerabilities associated with installed software packages and provide findings that security teams can prioritize for remediation. Inspector findings can be integrated into centralized security workflows. After identifying a vulnerability, teams can remediate it through patching, updating software, rebuilding machine images, or other approved operational processes. Vulnerability scanning should be combined with secure configuration, network controls, identity security, and continuous monitoring.

Question 110

An organization needs a managed service for storing database passwords and automatically rotating supported credentials. Which service is appropriate?

1. AWS Key Management Service
2. AWS Secrets Manager
3. AWS Certificate Manager
4. AWS Artifact

Correct Answer: 2

Explanation

AWS Secrets Manager securely stores secrets such as database credentials, API keys, and other sensitive values. For supported secret types, it can automate credential rotation, reducing dependence on long-lived static passwords. Applications can retrieve secrets programmatically at runtime using IAM authorization instead of embedding credentials directly in source code. Security teams should restrict access to individual secrets and monitor retrieval activity. Secrets Manager works alongside encryption and identity controls, helping organizations improve credential management while reducing the risk of accidental exposure.

Question 111

Which service can help security investigators analyze relationships between entities involved in suspicious AWS activity?

1. Amazon Detective
2. Amazon Macie
3. AWS Artifact
4. AWS WAF

Correct Answer: 1

Explanation

Amazon Detective helps investigators analyze security-related activity and relationships among entities involved in AWS events. It can provide contextual information that assists analysts in determining how resources, identities, and activities may be connected. Detective is especially useful after a finding has been generated by services such as GuardDuty. It can help investigators develop a clearer timeline and understand potential impact. Analysts should still correlate Detective information with CloudTrail, VPC Flow Logs, application logs, and other evidence before determining the full scope of an incident.

Question 112

Which control is specifically designed to limit the maximum permissions that an IAM role can receive?

1. SCP
2. Identity-based policy
3. Permissions boundary
4. Resource-based policy

Correct Answer: 3

Explanation

An IAM permissions boundary defines the maximum permissions that an IAM user or role can receive. It does not grant permissions by itself; instead, it limits the effective permissions that can result from other applicable policies. Permissions boundaries are useful when organizations delegate IAM role creation to teams while maintaining centralized restrictions on what those roles can ultimately do. They are different from SCPs, which apply organizational guardrails at the account level. Security teams should evaluate all applicable policy types when determining effective permissions.

Question 113

Which AWS service can protect applications from common web exploits by inspecting HTTP and HTTPS requests?

1. AWS Network Firewall
2. AWS WAF
3. Amazon GuardDuty
4. AWS Config

Correct Answer: 2

Explanation

AWS WAF is a web application firewall that inspects HTTP and HTTPS requests and applies configured rules to determine whether requests should be allowed, blocked, counted, or challenged where supported. It can help protect applications from common web attacks, automated abuse, and unwanted traffic patterns. AWS WAF can use managed rule groups as well as custom rules tailored to an application’s requirements. Security teams should monitor WAF activity and tune rules carefully because overly broad rules can interfere with legitimate application traffic.

Question 114

A company wants to identify DNS requests from VPC resources to known malicious domains. Which service should the security team consider?

1. Route 53 Resolver DNS Firewall
2. Amazon Inspector
3. AWS Artifact
4. AWS Audit Manager

Correct Answer: 1

Explanation

Route 53 Resolver DNS Firewall provides DNS query filtering for resources using Route 53 Resolver within a VPC. Organizations can create rule groups that allow or block DNS queries according to domain lists and supported conditions. This can help prevent workloads from resolving known malicious or unwanted domains. DNS Firewall provides a different control from AWS WAF, which protects web applications, and Network Firewall, which provides broader network traffic inspection. Security teams should combine DNS controls with endpoint monitoring and other outbound security mechanisms.

Question 115

Which AWS service can help protect applications from distributed denial-of-service attacks at the AWS edge?

1. Amazon Inspector
2. AWS Shield
3. AWS Config
4. AWS Audit Manager

Correct Answer: 2

Explanation

AWS Shield provides managed protection against distributed denial-of-service attacks for supported AWS resources. AWS Shield Standard is automatically available for certain AWS services, while Shield Advanced provides additional protection and capabilities for supported resources. DDoS protection should be implemented as part of a layered architecture that can also include CloudFront, Route 53, AWS WAF, and appropriate application design. Security teams should understand traffic patterns and establish response procedures because DDoS mitigation is only one part of broader availability and resilience planning.

Question 116

A security team wants to analyze AWS CloudTrail events stored in Amazon S3 using SQL queries. Which service can provide this capability?

1. Amazon Athena
2. AWS WAF
3. AWS Shield
4. Amazon Macie

Correct Answer: 1

Explanation

Amazon Athena can query data stored in Amazon S3 using SQL without requiring a traditional database server. Security teams can use Athena to analyze CloudTrail logs and other security datasets when those logs are stored in appropriate formats and structures. This can support investigations involving API activity, suspicious principals, resource changes, and event timelines. Effective use requires appropriate table definitions, partitions, data organization, and access controls. Athena should be combined with centralized logging and retention strategies to support reliable security investigations.

Question 117

Which AWS capability can help prevent unauthorized use of AWS services across member accounts in an organization?

1. AWS Security Hub
2. Service control policy
3. Amazon Detective
4. VPC Flow Logs

Correct Answer: 2

Explanation

Service control policies can establish organization-level restrictions on actions and services available within member accounts. For example, an organization can use an SCP to deny specific actions or restrict access to certain AWS services across a group of accounts. SCPs act as guardrails rather than permission grants, so an identity must still receive permission through another applicable policy. Security teams should test organizational policies carefully and use organizational units to apply controls according to account requirements while avoiding unnecessary operational disruption.

Question 118

Which AWS service can issue and manage TLS certificates for AWS services and supported applications?

1. AWS Certificate Manager
2. Amazon GuardDuty
3. AWS Audit Manager
4. Amazon Detective

Correct Answer: 1

Explanation

AWS Certificate Manager provides certificate management capabilities for public and private certificates and can simplify certificate provisioning, deployment, and renewal for supported AWS services. Using managed certificates can reduce the operational burden of manually tracking certificate expiration dates and renewal processes. Certificates help establish encrypted TLS connections and authenticate supported endpoints. Security teams should still configure secure TLS policies, protect private keys, monitor certificate use, and ensure that certificates are issued only for authorized domains and workloads.

Question 119

A company wants to centralize security logs from multiple AWS accounts into a dedicated account. Which architecture supports this goal?

1. Store all logs independently on each workload
2. Use a centralized logging account with controlled cross-account log delivery
3. Disable CloudTrail in member accounts
4. Store logs only on individual EC2 instances

Correct Answer: 2

Explanation

A centralized logging account provides a dedicated location for collecting and protecting logs from multiple AWS accounts. This architecture can improve visibility and reduce the risk that an attacker who compromises a workload account can easily delete all security evidence. Organizations can centralize CloudTrail, VPC Flow Logs, and other supported security logs while applying restrictive access controls and retention policies. The logging account should have strong administrative protections, encryption, monitoring, and limited write and read permissions to preserve the integrity of collected evidence.

Question 120

Which security principle recommends using multiple independent controls so that failure of one control does not completely expose a workload?

1. Least privilege
2. Defense in depth
3. Nonrepudiation
4. Single sign-on

Correct Answer: 2

Explanation

Defense in depth uses multiple layers of security controls so that the failure or bypass of one control does not automatically result in complete compromise. An AWS workload might combine IAM least privilege, encryption, network segmentation, WAF, logging, threat detection, vulnerability management, and incident response. Each layer addresses different attack paths or failure conditions. This approach reduces reliance on a single security mechanism and can improve resilience against sophisticated attacks. Effective defense in depth requires coordinating controls rather than simply adding redundant technologies without clear security objectives.