View Full Amazon AWS Certified Security – Specialty SCS-C03 Exam Dumps and Practice Test Dumps.

 

Question 241

Which IAM feature can restrict the permissions available during a specific role session without changing the role’s identity-based policy?

1. Resource-based policy
2. Session policy
3. Security group
4. SCP

Correct Answer: 2

Explanation

An IAM session policy can further restrict the permissions available to a role session when temporary credentials are issued. It does not grant additional permissions beyond those already available to the principal. Instead, the effective permissions are limited by the intersection of the applicable permissions and session policies. This can be useful when an application or trusted party should receive temporary access with narrower capabilities than the underlying role normally permits. Security teams should understand how session policies interact with identity policies, resource policies, permissions boundaries, and SCPs.

Question 242

A security engineer wants to allow an IAM role to access resources only when it is assumed through an approved application workflow. Which role configuration should be reviewed first?

1. Trust policy
2. Lifecycle policy
3. Route table
4. Security group

Correct Answer: 1

Explanation

The IAM role trust policy determines which principals can assume the role and under what conditions. For an approved application workflow, the trust policy can restrict trusted principals and use supported condition keys to place additional requirements on role assumption. The permissions policy then controls what the role can do after successful assumption. Reviewing the trust policy first helps ensure unauthorized principals cannot obtain the role’s temporary credentials. Security teams should also monitor role-assumption events in CloudTrail and regularly review both trust and permissions policies.

Question 243

Which AWS mechanism can help prevent the use of the root user for routine administrative operations?

1. Dedicated IAM roles and federated access for administrators
2. Public access to the management account
3. Shared root credentials
4. Unrestricted IAM access keys

Correct Answer: 1

Explanation

AWS recommends avoiding the root user for routine administrative activities. Organizations can instead use IAM roles, federation, and centralized identity management to provide administrators with controlled access. This reduces dependence on the highly privileged root identity and enables stronger authentication, authorization, and auditing practices. The root account should have strong protection, including MFA and secure credential handling, and its credentials should be used only when root-level actions are specifically required. Administrative activity performed through managed identities is generally easier to govern and monitor.

Question 244

A company wants to ensure that administrators cannot modify a security-critical S3 bucket policy unless they are operating from an approved corporate network. Which IAM condition can help enforce this restriction?

1. aws:SourceIp
2. aws:RequestedRegion
3. aws:PrincipalOrgID
4. aws:SecureTransport

Correct Answer: 1

Explanation

The aws:SourceIp condition key can be used in IAM policies to restrict requests based on the originating IP address. An organization can use it to require certain administrative operations to originate from approved corporate network ranges. This can provide an additional authorization condition for sensitive actions. However, source IP controls should be designed carefully because users may access AWS through proxies, VPNs, or changing network addresses. Security teams should combine network-based restrictions with strong authentication, least privilege, logging, and other identity controls.

Question 245

Which network control is stateful and automatically permits return traffic for an allowed connection?

1. Network ACL
2. Security group
3. Route table
4. Transit Gateway route

Correct Answer: 2

Explanation

Amazon VPC security groups are stateful network controls. When an inbound or outbound connection is permitted by a security group rule, return traffic for that connection is automatically allowed, regardless of whether an explicit reverse rule exists. Network ACLs, by contrast, are stateless and require rules for both directions when applicable. Understanding this difference is important when troubleshooting connectivity and designing layered network security. Security groups should still be configured according to least privilege, with unnecessary ports and sources removed to reduce the attack surface.

Question 246

A security engineer needs a stateless network control that can explicitly allow or deny traffic at the subnet boundary. Which option should be used?

1. IAM policy
2. Network ACL
3. Security group
4. KMS key policy

Correct Answer: 2

Explanation

Network ACLs provide stateless traffic filtering at the subnet level. They can contain ordered allow and deny rules for inbound and outbound traffic, making them useful when an explicit subnet-level network boundary is required. Because they are stateless, return traffic must be explicitly permitted by the appropriate rule. Security groups are stateful and operate differently. Network ACLs should be carefully planned because rule ordering and broad deny statements can unintentionally block legitimate traffic. They are most effective when used as one layer within a broader network security architecture.

Question 247

Which AWS service can help encrypt an Amazon RDS database using AWS KMS keys?

1. Amazon RDS encryption
2. Amazon Route 53
3. AWS WAF
4. AWS Config

Correct Answer: 1

Explanation

Amazon RDS supports encryption at rest using AWS KMS. When encryption is enabled for a supported database deployment, the database storage and certain associated resources are protected using the selected KMS key. Organizations should determine their key-management requirements before creating encrypted databases because changing encryption characteristics may require migration or snapshot-based procedures depending on the scenario. Encryption at rest does not replace database authentication, network isolation, authorization, or TLS for connections. A complete database security design should address both data at rest and data in transit.

Question 248

A company needs to ensure that an S3 bucket cannot be accessed through public ACLs or public bucket policies. Which control provides broad preventive protection?

1. S3 Block Public Access
2. CloudTrail Insights
3. IAM credential report
4. Amazon Inspector

Correct Answer: 1

Explanation

Amazon S3 Block Public Access provides centralized controls that can prevent or restrict public access through bucket policies, access point policies, and ACL-related mechanisms. It is designed to reduce the risk of accidental public exposure of S3 data. Organizations can enable appropriate Block Public Access settings at the account or bucket level according to their architecture. The control should be combined with IAM policies, resource policies, encryption, monitoring, and data classification. Security teams should also review exceptions carefully because some legitimate public-content architectures may require deliberate configuration.

Question 249

An organization needs to provide an application with temporary credentials that are valid only for a limited session instead of storing permanent access keys. Which AWS service provides these credentials?

1. AWS Security Token Service
2. AWS Artifact
3. Amazon Inspector
4. AWS Firewall Manager

Correct Answer: 1

Explanation

AWS Security Token Service provides temporary security credentials that can be used by applications, users, and services to access AWS resources for a limited duration. Temporary credentials reduce the risks associated with long-lived access keys because they expire automatically and can be issued for specific roles or sessions. STS is commonly used with IAM roles, federation, and cross-account access. Security teams should still apply least privilege to the underlying role and monitor credential use. Temporary credentials improve credential lifecycle management but do not eliminate authorization requirements.

Question 250

Which KMS capability allows an authorized principal to delegate limited cryptographic permissions without changing the entire KMS key policy?

1. KMS grant
2. S3 ACL
3. Route table
4. CloudTrail selector

Correct Answer: 1

Explanation

AWS KMS grants provide a mechanism for delegating specific permissions to a principal for cryptographic operations involving a KMS key. Grants can be useful for applications and AWS services that need controlled access without requiring frequent changes to the key policy. They can specify permitted operations and constraints, helping implement narrowly scoped authorization. Security teams should monitor grants and remove unnecessary ones because excessive cryptographic permissions can expose protected data. Key policies and IAM policies remain important parts of the overall KMS authorization model.

Question 251

A company operates workloads across several AWS Regions and wants cryptographic keys that can be replicated across Regions while retaining related key material. Which KMS capability is designed for this use case?

1. Multi-Region KMS keys
2. IAM permission boundaries
3. S3 access points
4. Security groups

Correct Answer: 1

Explanation

AWS KMS Multi-Region keys are designed for scenarios where related cryptographic keys are needed across multiple AWS Regions. A primary key and its replicas can support cryptographic operations in different Regions while maintaining related key material and key properties. This can simplify certain multi-Region encryption architectures and disaster-recovery designs. Multi-Region keys do not automatically replicate encrypted data or eliminate the need for regional security controls. Organizations should carefully evaluate key policies, grants, lifecycle management, and compliance requirements before using this feature.

Question 252

Which S3 encryption option allows customers to use AWS KMS keys to control access to encryption operations?

1. SSE-S3
2. SSE-KMS
3. Client-side compression
4. S3 Transfer Acceleration

Correct Answer: 2

Explanation

S3 Server-Side Encryption with AWS KMS keys, commonly called SSE-KMS, integrates Amazon S3 object encryption with AWS KMS authorization and key management. This allows organizations to apply KMS policies and permissions to cryptographic operations and provides additional control over key usage. SSE-KMS can also support auditing of relevant KMS activity through AWS logging mechanisms. Organizations should consider KMS request quotas, key policies, IAM permissions, and cost when designing large-scale workloads. SSE-S3 provides encryption at rest but does not provide the same customer-controlled KMS authorization model.

Question 253

A security architect wants stronger protection for highly sensitive S3 objects by using two independent layers of server-side encryption with AWS KMS. Which option should be considered?

1. DSSE-KMS
2. SSE-S3 only
3. S3 Transfer Acceleration
4. S3 website hosting

Correct Answer: 1

Explanation

Dual-layer server-side encryption with AWS KMS, known as DSSE-KMS, provides two layers of server-side encryption for supported Amazon S3 objects. It is intended for workloads with stronger encryption requirements where an additional encryption layer is desirable. The feature still requires appropriate KMS permissions and S3 authorization controls. Security teams should evaluate whether the additional protection aligns with their threat model, regulatory obligations, and operational requirements. Encryption does not replace access control, monitoring, classification, or secure application design.

Question 254

Which AWS service can help continuously identify configuration changes that cause resources to become noncompliant with defined security requirements?

1. AWS Config
2. Amazon CloudFront
3. AWS Private Certificate Authority
4. Amazon Athena

Correct Answer: 1

Explanation

AWS Config records resource configuration information and can evaluate resources against defined compliance rules. When a resource configuration changes, Config can determine whether the resulting state satisfies the relevant rule. This makes it useful for continuous configuration governance rather than relying only on periodic manual reviews. Security teams can create remediation workflows for important violations and retain configuration history for investigation. Config should be combined with preventative controls where possible because detecting a misconfiguration after deployment is different from preventing the insecure configuration from being created.

Question 255

A security team wants to ensure that an IAM policy does not grant access to all S3 resources when only one bucket is required. Which principle should guide the policy design?

1. Least privilege
2. High availability
3. Network redundancy
4. Data compression

Correct Answer: 1

Explanation

The principle of least privilege requires identities to receive only the permissions necessary to perform their intended tasks. For an application that needs access to one S3 bucket, the policy should identify the required actions and resources rather than granting broad permissions across all buckets. Narrow policies reduce the potential impact of compromised credentials or application vulnerabilities. Security teams should review permissions regularly because application requirements can change over time. Automated policy analysis and access-usage information can help identify opportunities to reduce unnecessary permissions.

Question 256

Which AWS service can provide a centralized view of security controls and findings while also supporting standards-based security checks?

1. AWS Security Hub
2. Amazon CloudWatch
3. AWS Certificate Manager
4. Amazon Route 53

Correct Answer: 1

Explanation

AWS Security Hub provides centralized security findings and security posture information across supported AWS accounts and services. It can evaluate supported security standards and controls, helping organizations identify configuration or control gaps. Security Hub can also aggregate findings from integrated services and third-party sources, providing a more unified view for security teams. It does not replace the underlying detection or configuration services. Organizations should establish ownership and remediation processes for findings so that security issues are addressed rather than simply accumulated in the centralized console.

Question 257

A company wants to identify sensitive information such as credentials or personally identifiable information stored in S3 objects. Which AWS service is designed for this purpose?

1. Amazon Macie
2. AWS Network Firewall
3. Amazon Inspector
4. AWS Shield

Correct Answer: 1

Explanation

Amazon Macie uses automated discovery and analysis capabilities to help identify sensitive data stored in Amazon S3. It can detect supported categories of sensitive information and provide findings that help organizations understand where sensitive data exists. This can support data classification, privacy requirements, and security investigations. Macie does not replace S3 access controls or encryption. Organizations should combine sensitive-data discovery with appropriate bucket policies, IAM permissions, encryption, retention controls, and monitoring to reduce the risk of unauthorized exposure.

Question 258

A security engineer needs to restrict an IAM policy so that it can be used only by principals belonging to the organization’s AWS Organizations structure. Which condition key is appropriate?

1. aws:PrincipalOrgID
2. aws:SourceIp
3. aws:RequestedRegion
4. aws:SecureTransport

Correct Answer: 1

Explanation

The aws:PrincipalOrgID condition key can be used to restrict access based on the AWS Organizations identifier associated with the principal making a request. This can help organizations create resource policies that allow access from principals belonging to their organization while reducing unintended access from external accounts. It is particularly useful in multi-account architectures where account IDs may change or where access should be organization-wide. Security teams should still evaluate specific resource permissions and avoid assuming organizational membership alone provides sufficient authorization.

Question 259

A security administrator wants to restrict access to an AWS service so that only requests using a specific VPC endpoint are permitted. Which IAM condition key can support this control for applicable services?

1. aws:SourceVpce
2. aws:PrincipalOrgID
3. aws:RequestedRegion
4. aws:MultiFactorAuthAge

Correct Answer: 1

Explanation

The aws:SourceVpce condition key can be used in supported IAM or resource policies to restrict requests based on the VPC endpoint through which the request originated. This can help keep access to sensitive resources within an intended private network path. For example, an S3 bucket policy can require requests to originate through a specific S3 VPC endpoint. Security teams should verify service support and carefully test the policy because overly restrictive conditions can block legitimate access. Endpoint restrictions should complement identity and resource authorization controls.

Question 260

Which AWS service can help detect when an S3 bucket becomes publicly accessible because of an unintended configuration change?

1. Amazon Macie
2. AWS Config
3. AWS Certificate Manager
4. Amazon CloudFront

Correct Answer: 2

Explanation

AWS Config can evaluate S3 bucket configuration against rules designed to identify security conditions such as public access. When a relevant configuration changes, Config can determine whether the bucket remains compliant with the organization’s defined rule. This provides a continuous configuration-monitoring approach and can support automated remediation workflows. Other AWS services may provide related security visibility, but Config is particularly suited to configuration compliance. Organizations should combine these checks with S3 Block Public Access, IAM policies, resource policies, and continuous monitoring to reduce accidental exposure.