View Full Amazon AWS Certified Security – Specialty SCS-C03 Exam Dumps and Practice Test Dumps.

 

Question 221

Which AWS service is specifically designed to store and query CloudTrail events using an event data store?

1. Amazon Athena
2. Amazon OpenSearch Service
3. AWS CloudTrail Lake
4. Amazon CloudWatch

Correct Answer: 3

Explanation

AWS CloudTrail Lake provides a managed environment for collecting, storing, and querying CloudTrail activity using event data stores. It can simplify investigation of API activity without requiring security teams to build and maintain their own log-query infrastructure. Analysts can use SQL-based queries to investigate events across relevant time periods and accounts. CloudTrail Lake is particularly useful for security investigations, auditing, and operational analysis. Organizations should configure appropriate event collection, retention, access controls, and encryption according to their monitoring and compliance requirements.

Question 222

A security team needs to record object-level API activity for sensitive S3 buckets. Which CloudTrail capability should be configured?

1. Management events
2. Data events
3. Insight events
4. Console events

Correct Answer: 2

Explanation

CloudTrail data events can record object-level activity for supported resources such as Amazon S3 objects. This is different from management events, which generally capture control-plane operations such as creating, modifying, or deleting AWS resources. Security teams can configure data-event logging for sensitive S3 resources when they need visibility into operations such as object access. Because data events can generate significant volumes of logs, organizations should select resources and event types carefully and consider storage, retention, and analysis costs when designing the logging strategy.

Question 223

An organization wants CloudTrail to identify unusual API activity patterns that differ significantly from normal behavior. Which CloudTrail capability can assist with this requirement?

1. CloudTrail Insights
2. S3 Object Lock
3. IAM Access Analyzer
4. AWS Config

Correct Answer: 1

Explanation

CloudTrail Insights can help identify unusual levels or patterns of API activity by detecting anomalous behavior in supported CloudTrail events. This can provide an additional signal when investigating unexpected administrative activity or sudden changes in API usage. Insights findings should not automatically be treated as confirmed security incidents because unusual activity can have legitimate operational causes. Security teams can correlate the results with IAM information, other CloudTrail events, GuardDuty findings, and workload telemetry to determine whether the behavior represents an actual threat.

Question 224

A company wants operating-system logs from EC2 instances to be collected into CloudWatch Logs. Which component can collect and forward those logs?

1. AWS CloudWatch Agent
2. AWS Firewall Manager
3. Amazon Macie
4. AWS Private CA

Correct Answer: 1

Explanation

The Amazon CloudWatch Agent can collect logs and metrics from supported EC2 instances and send them to Amazon CloudWatch. This allows security and operations teams to centralize operating-system telemetry instead of relying exclusively on local files. The agent must be installed and configured correctly, and the instance needs appropriate IAM permissions to publish the data. Security teams should protect the configuration, verify that required log files are included, and monitor whether ingestion is working. Centralized host logging can support both detection and forensic investigations.

Question 225

A security analyst notices that an EC2 instance is running normally, but expected application logs are missing from CloudWatch Logs. What should be checked first?

1. The CloudWatch Agent configuration and IAM permissions
2. The S3 bucket’s lifecycle policy
3. The Route 53 hosted zone
4. The KMS key alias only

Correct Answer: 1

Explanation

When expected EC2 logs are missing from CloudWatch, the CloudWatch Agent configuration and the instance’s permissions are important initial checks. The configuration determines which files or log sources are collected and where they are sent. The instance also needs appropriate permissions to publish logs to CloudWatch. Security teams should verify the agent’s status, configuration files, target log groups, timestamps, and relevant error messages. Troubleshooting should determine whether the problem is collection, authorization, connectivity, or destination configuration before changing unrelated AWS resources.

Question 226

Which AWS service can provide access logs for requests received by an API Gateway API?

1. Amazon API Gateway
2. Amazon Macie
3. AWS Shield Advanced
4. AWS Artifact

Correct Answer: 1

Explanation

Amazon API Gateway supports access logging for API requests, allowing organizations to capture useful request information for monitoring, troubleshooting, and security analysis. Logs can be directed to supported CloudWatch Logs destinations according to the API configuration. Security teams can use these records to investigate unexpected request patterns, authentication problems, and potential attacks against APIs. Logging should be configured with appropriate retention and access controls, and sensitive information should not be unnecessarily exposed in log fields. API logging complements application and infrastructure monitoring.

Question 227

A company serves an application through CloudFront and wants requests to include security-related HTTP response headers. Which approach is appropriate?

1. CloudFront response headers policy
2. IAM credential report
3. AWS Backup Vault Lock
4. Transit Gateway route table

Correct Answer: 1

Explanation

CloudFront response headers policies can be used to add or manage HTTP response headers for content delivered through CloudFront. Security-related headers can help browsers apply protections such as content-type restrictions and other web security behaviors. This provides an edge-level mechanism for consistently applying headers across supported distributions. Security teams should select headers according to application requirements and test them before deployment because some policies can affect browser behavior. Response headers are one layer of web security and should complement secure application development and AWS WAF protections.

Question 228

A security engineer wants CloudFront to access objects in an S3 bucket without making the bucket publicly accessible. Which feature should be used?

1. CloudFront Origin Access Control
2. S3 website hosting
3. S3 public access ACL
4. Internet Gateway

Correct Answer: 1

Explanation

CloudFront Origin Access Control allows a CloudFront distribution to securely access an S3 origin while the bucket remains private. The S3 bucket policy can be configured to permit access from the CloudFront distribution rather than exposing objects directly to the public internet. This creates a controlled path between the content-delivery layer and the storage origin. Security teams should also keep S3 Block Public Access enabled where appropriate and carefully review the bucket policy. OAC is preferable to making the underlying bucket publicly readable.

Question 229

An application requires stronger protection against automated abusive web requests while still allowing legitimate users to continue after verification. Which AWS WAF feature can help?

1. CAPTCHA or Challenge
2. S3 Object Lock
3. KMS grants
4. AWS Config conformance packs

Correct Answer: 1

Explanation

AWS WAF CAPTCHA and Challenge actions can help distinguish legitimate users from automated or potentially abusive clients. Instead of simply blocking every matching request, these controls can require additional verification before allowing continued access. They can be useful for login pages, account-registration endpoints, and other areas commonly targeted by automation. Security teams should configure appropriate rules and thresholds based on application behavior. CAPTCHA and Challenge controls are complementary to rate-based rules, managed rule groups, authentication controls, and application-level protections.

Question 230

Which AWS capability can protect an AWS Direct Connect connection at the Ethernet layer using encryption?

1. MACsec
2. NAT gateway
3. VPC peering
4. S3 Transfer Acceleration

Correct Answer: 1

Explanation

MAC Security, or MACsec, can provide encryption and integrity protection for supported AWS Direct Connect connections at the Ethernet layer. It is useful when organizations require protection for data traversing the physical Direct Connect connection. MACsec addresses link-level security and does not replace application-layer encryption or other network controls. Security architects should verify hardware, connection, and configuration requirements before deployment. Depending on the threat model, organizations may combine MACsec with TLS, IPsec, application authentication, and other protections for defense in depth.

Question 231

A security engineer is securing connected devices that communicate with AWS IoT Core. Which control determines whether an IoT device is authorized to perform specific IoT actions?

1. IoT policy
2. S3 bucket policy
3. SCP
4. KMS key alias

Correct Answer: 1

Explanation

AWS IoT policies control what authenticated IoT principals can do within AWS IoT Core. Policies can restrict actions such as connecting, publishing, subscribing, or receiving messages to specified resources. Security teams should avoid broad wildcards and should scope device permissions to the minimum required resources and operations. IoT authentication establishes identity, while the IoT policy determines authorization. Proper certificate lifecycle management, device identity controls, logging, and monitoring should also be implemented because compromised devices can otherwise become an entry point into connected environments.

Question 232

A company wants to collect flow logs specifically for traffic passing through an AWS Transit Gateway. Which feature should be enabled?

1. Transit Gateway Flow Logs
2. CloudTrail data events
3. S3 server access logging
4. API Gateway access logging

Correct Answer: 1

Explanation

Transit Gateway Flow Logs provide visibility into network traffic associated with a Transit Gateway. They can help security teams investigate communication patterns across connected VPCs and other attached networks. This is distinct from VPC Flow Logs, which provide visibility at supported VPC network interfaces and related resources. Transit Gateway Flow Logs can therefore provide an additional perspective when analyzing centralized network connectivity. Organizations should select suitable destinations, retention periods, access controls, and analysis mechanisms to ensure the resulting telemetry remains useful and appropriately protected.

Question 233

During an incident, a security team needs to isolate a compromised EC2 instance while preserving the instance for later investigation. Which action is most appropriate for initial containment?

1. Immediately terminate the instance
2. Apply a restrictive security group that blocks unnecessary network communication
3. Delete all CloudTrail logs
4. Disable encryption on the instance

Correct Answer: 2

Explanation

Applying a restrictive security group can provide a rapid containment mechanism while keeping the compromised instance available for investigation. The security team can limit unnecessary inbound and outbound communication and preserve the system state for forensic analysis. The exact containment procedure should follow the organization’s incident-response plan because overly aggressive network restrictions can also affect evidence collection or legitimate investigation access. Termination may destroy valuable evidence unless specifically required. Security teams should document containment actions and continue collecting relevant logs and forensic artifacts.

Question 234

Which AWS service is specifically intended to help coordinate incident-response operational items and investigation tasks?

1. AWS Systems Manager OpsCenter
2. Amazon CloudFront
3. AWS Certificate Manager
4. Amazon Macie

Correct Answer: 1

Explanation

AWS Systems Manager OpsCenter provides capabilities for managing operational work items, including operational issues that require investigation and remediation. Security teams can incorporate OpsCenter into incident-response workflows to organize operational findings, assign responsibility, and track resolution activities. It can work with other AWS services and automation mechanisms as part of a broader response process. OpsCenter itself is not a threat-detection service. Effective incident response still requires appropriate telemetry, containment procedures, evidence preservation, remediation actions, and recovery processes.

Question 235

Which AWS service can help automate forensic collection and response activities for compromised EC2 instances?

1. Automated Forensics Orchestrator for Amazon EC2
2. AWS Artifact
3. Amazon Route 53
4. AWS Certificate Manager

Correct Answer: 1

Explanation

Automated Forensics Orchestrator for Amazon EC2 is designed to help automate forensic workflows for EC2 security incidents. Automation can assist with collecting relevant evidence and executing repeatable response procedures while reducing manual effort during high-pressure investigations. A properly designed forensic workflow should preserve evidence integrity, restrict access, document actions, and minimize changes to affected resources. Security teams should test forensic automation before relying on it during production incidents. Automated collection complements, rather than replaces, documented incident-response procedures and human investigation.

Question 236

A security team needs to distinguish between an IAM user’s direct permissions and permissions obtained through a role assumption. Which AWS service provides detailed API activity that can support this investigation?

1. AWS CloudTrail
2. Amazon Inspector
3. AWS Shield
4. Amazon Macie

Correct Answer: 1

Explanation

AWS CloudTrail records API activity and includes identity information that can help investigators understand which principal performed an action and how credentials were used. During an investigation involving IAM roles, analysts can examine events such as AssumeRole and subsequent API calls to reconstruct activity. This can help distinguish direct user activity from operations performed with temporary role credentials. Analysts should correlate timestamps, principal information, source addresses, session details, and related events to establish an accurate sequence rather than relying on a single CloudTrail record.

Question 237

A company wants to make an AWS CloudFormation deployment fail when a security control in the template does not meet organizational requirements. Which approach can provide preventive infrastructure-as-code validation?

1. CloudFormation security policy validation or automated IaC scanning in the deployment pipeline
2. S3 public access
3. Route 53 health checks
4. CloudFront caching

Correct Answer: 1

Explanation

Security validation integrated into an infrastructure-as-code pipeline can identify insecure configurations before resources are deployed. Organizations can use supported AWS and security tooling to inspect CloudFormation templates for policy violations, exposed resources, or other configuration problems. Preventive validation reduces the likelihood that insecure infrastructure reaches production and allows developers to correct issues earlier in the lifecycle. Security teams should define clear policies and integrate checks with deployment workflows. Validation should be combined with runtime monitoring because deployed resources can change after initial provisioning.

Question 238

Which AWS service can help continuously evaluate whether supported resources comply with defined configuration rules?

1. AWS Config
2. AWS Artifact
3. Amazon Detective
4. AWS Private CA

Correct Answer: 1

Explanation

AWS Config provides configuration recording and evaluation capabilities that allow organizations to assess resources against defined rules. Security teams can use Config rules to identify resources that violate organizational requirements, such as insecure configurations or missing controls. Config can also maintain configuration history, helping investigators understand how resource states changed over time. It does not replace security detection services such as GuardDuty. Organizations should define meaningful rules, protect Config data, and establish remediation workflows for findings so that compliance issues are addressed rather than merely reported.

Question 239

An organization wants to delegate administration of a supported AWS security service to a dedicated security account instead of allowing every account administrator to manage it independently. Which AWS Organizations capability can support this design?

1. Delegated administrator
2. Security group rule
3. IAM access key
4. VPC endpoint policy

Correct Answer: 1

Explanation

AWS Organizations supports delegated administrator capabilities for supported AWS services. This allows an organization to designate a specific member account to administer a service centrally without requiring the management account to perform every operational task. A dedicated security account can therefore become the administrative location for supported security services while workload accounts remain separated. Organizations should carefully define permissions for the delegated administrator account and monitor administrative activity. Delegation can improve separation of duties and centralized security management in multi-account environments.

Question 240

A security architect wants to share selected AWS resources across multiple accounts without making them publicly accessible. Which AWS service can provide centralized resource sharing?

1. AWS Resource Access Manager
2. AWS WAF
3. Amazon GuardDuty
4. AWS CloudTrail Lake

Correct Answer: 1

Explanation

AWS Resource Access Manager allows supported AWS resources to be shared with other AWS accounts, organizational units, or the organization without making those resources publicly accessible. This can simplify multi-account architectures by allowing approved accounts to use shared resources while maintaining organizational boundaries. Security teams should define precisely which principals and resources can participate in each share and monitor changes to sharing configurations. Resource sharing should complement IAM, SCPs, network controls, and resource-specific policies rather than being treated as an authorization mechanism by itself.