View Full Amazon AWS Certified Security – Specialty SCS-C03 Exam Dumps and Practice Test Dumps.

 

Question 281

Which AWS service can help identify whether an IAM policy grants permissions that are broader than necessary based on policy analysis?

1. Amazon GuardDuty
2. IAM Access Analyzer
3. AWS Shield
4. Amazon Macie

Correct Answer: 2

Explanation

IAM Access Analyzer provides policy analysis capabilities that can help identify issues in IAM policies and support least-privilege design. Security teams can use policy validation and analysis features to review permissions before deploying changes. This can help identify overly broad access, unsupported elements, or policy statements that require further review. Automated analysis does not understand every application-specific business requirement, so administrators should still evaluate whether each permission is genuinely necessary. Combining automated policy analysis with access reviews and usage information provides stronger authorization governance.

Question 282

A company wants to use a single sign-on experience for employees accessing AWS accounts while keeping authorization assignments centrally managed. Which AWS feature is designed for this requirement?

1. IAM Identity Center permission sets
2. S3 bucket policies
3. KMS grants
4. Network ACLs

Correct Answer: 1

Explanation

IAM Identity Center uses permission sets to define the permissions assigned to workforce users and groups when they access AWS accounts. This provides centralized management of workforce access while allowing users to sign in through a supported identity provider. Permission sets can be assigned to specific accounts and groups according to job responsibilities. This reduces the need to create separate IAM users across every account. Security teams should periodically review assignments, enforce appropriate authentication controls, and ensure permission sets follow least-privilege principles.

Question 283

Which AWS service can help identify publicly exposed EC2 instances and other reachable resources as part of vulnerability assessment?

1. Amazon Inspector
2. AWS Artifact
3. AWS Audit Manager
4. Amazon Macie

Correct Answer: 1

Explanation

Amazon Inspector can assess supported workloads for software vulnerabilities and network reachability exposure. Its findings can help security teams determine whether vulnerable resources may also be reachable through configured network paths. This combination is useful for prioritizing remediation because a vulnerability’s potential impact can depend on how accessible the affected resource is. Security teams should review Inspector findings alongside application architecture, security groups, network ACLs, routing, and authentication controls. Remediation may involve patching software, changing network exposure, or replacing affected workloads.

Question 284

A security administrator needs to ensure that sensitive S3 objects are encrypted with a customer-managed KMS key rather than an AWS-managed encryption option. Which S3 control can enforce this requirement?

1. Bucket policy requiring a specific KMS key
2. Route 53 Resolver rule
3. Network ACL
4. CloudTrail Insights

Correct Answer: 1

Explanation

An S3 bucket policy can require uploads to use server-side encryption with a designated customer managed AWS KMS key. The policy can evaluate encryption-related request conditions and deny uploads that do not satisfy the organization’s requirements. This creates a preventive control at the storage boundary and reduces reliance on individual application configurations. Security teams must also ensure that legitimate upload principals have permission to use the specified KMS key. Encryption requirements should be tested across all applications and automated processes that write to the bucket.

Question 285

Which AWS feature can help ensure that a KMS key is usable only by authorized AWS principals from a defined organizational environment?

1. KMS key policy conditions
2. CloudFront cache behavior
3. S3 lifecycle configuration
4. Route 53 health checks

Correct Answer: 1

Explanation

KMS key policies can contain conditions that restrict how and by whom a customer managed key may be used. Organizations can combine principal restrictions with applicable global condition keys and encryption-context conditions to create narrower authorization boundaries. This is especially important for keys protecting sensitive information or supporting cross-account architectures. Security teams should review both the key policy and IAM permissions because effective KMS authorization can involve multiple policy layers. Broad key policies should be avoided, and changes should be tested before being applied to production workloads.

Question 286

A company wants to ensure that credentials stored in AWS Secrets Manager can only be retrieved by one specific application role. Which control should be configured?

1. Resource-based policy and IAM permissions scoped to the secret
2. Public S3 access
3. Network ACL only
4. CloudFront response headers

Correct Answer: 1

Explanation

Secrets Manager supports resource-based policies that can help control which principals are allowed to access a secret. The application’s IAM role should also have only the required secretsmanager permissions for the intended secret. Using both resource and identity controls can create a narrowly scoped authorization model. Security teams should avoid wildcard access where possible and monitor secret retrieval activity. Network restrictions may provide additional protection, but network controls alone do not establish which IAM principal is authorized to retrieve the secret.

Question 287

Which AWS service can help enforce a centralized baseline for AWS WAF and Shield protections across accounts in an organization?

1. AWS Firewall Manager
2. Amazon Detective
3. AWS Config only
4. Amazon Athena

Correct Answer: 1

Explanation

AWS Firewall Manager provides centralized policy management for supported security services, including AWS WAF and AWS Shield Advanced configurations. It can help security teams establish consistent protections across accounts and resources that fall within defined organizational scopes. This reduces the risk of individual teams deploying applications without required baseline protections. Firewall Manager policies can still accommodate controlled exceptions when necessary. Organizations should monitor policy compliance, review exceptions regularly, and coordinate centralized policies with application-specific WAF rules to avoid disrupting legitimate traffic.

Question 288

A security analyst needs to identify which AWS identity created a new IAM access key shortly before suspicious activity occurred. Which evidence source should be examined?

1. AWS CloudTrail management events
2. S3 inventory reports
3. Amazon Macie findings
4. CloudFront cache logs

Correct Answer: 1

Explanation

AWS CloudTrail management events can record IAM administrative API operations, including actions related to access-key creation. During an investigation, analysts can search CloudTrail for the relevant event, examine the principal that performed the operation, and review timestamps, source information, and other event details. This can help establish whether a credential was created by an authorized administrator or by a compromised identity. Investigators should correlate the event with subsequent API activity and other security telemetry to determine the scope and impact of the credential’s use.

Question 289

Which AWS service can help analyze security findings by showing relationships among users, IP addresses, resources, and observed activity?

1. Amazon Detective
2. AWS Certificate Manager
3. AWS Artifact
4. AWS Backup

Correct Answer: 3

Explanation

Amazon Detective is designed to provide context for security investigations by helping analysts explore relationships among entities and activities. It can assist investigators in understanding how a suspicious identity interacted with resources, IP addresses, and other entities over time. This contextual view can help determine whether an individual finding represents isolated behavior or part of a broader incident. Detective supports investigation rather than prevention, so findings should be followed by appropriate containment and remediation actions. Analysts should also validate important conclusions using underlying telemetry.

Question 290

A security team wants to restrict an IAM policy so that a request must originate from a specific VPC endpoint. Which policy condition should be evaluated?

1. aws:SourceVpce
2. aws:SourceIp
3. aws:RequestedRegion
4. aws:PrincipalTag

Correct Answer: 1

Explanation

The aws:SourceVpce condition key can be used in supported authorization policies to restrict requests based on the VPC endpoint through which they originate. This can help organizations enforce private access paths for sensitive resources and reduce reliance on unrestricted network connectivity. The condition should be combined with appropriate IAM and resource permissions because endpoint origin alone does not establish user identity or business authorization. Administrators should verify service support and test the policy carefully to avoid blocking legitimate requests from approved private network paths.

Question 291

Which AWS capability can help organizations verify that an S3 bucket does not allow unintended public access?

1. AWS Config managed rules
2. Amazon Inspector
3. AWS Private CA
4. Amazon CloudFront

Correct Answer: 1

Explanation

AWS Config provides managed and custom rules that can evaluate supported resource configurations against security requirements. For S3, appropriate Config rules can identify conditions associated with public access or other insecure bucket configurations. This creates a continuous compliance-monitoring capability rather than relying solely on manual reviews. Security teams can connect noncompliance findings to remediation workflows where appropriate. Config should be combined with S3 Block Public Access and restrictive resource policies because detecting public exposure is valuable, but preventing it in the first place provides stronger protection.

Question 292

An organization wants to use organization-wide policies to prevent accounts from launching resources in unapproved AWS Regions. Which control should be considered first?

1. Service control policy
2. Security group
3. S3 Object Lock
4. IAM credential report

Correct Answer: 1

Explanation

A service control policy can establish organization-wide restrictions on actions in AWS accounts, including restrictions based on the requested Region. This allows a central governance team to create a guardrail that applies across selected organizational units or accounts. SCPs do not grant permissions; they restrict the maximum available permissions of affected accounts. Security teams should account for global services and legitimate exceptions before deploying Region restrictions. Testing is important because a broadly scoped deny can affect operational services or administrative workflows that legitimately require access to another Region.

Question 293

A security engineer wants to prevent an IAM role from being assumed by arbitrary principals outside the organization. Which trust-policy condition can help restrict the trusted organization?

1. aws:PrincipalOrgID
2. aws:SourceIp
3. aws:RequestedRegion
4. aws:SecureTransport

Correct Answer: 1

Explanation

The aws:PrincipalOrgID condition key can be used in supported IAM trust policies to restrict access based on the AWS Organizations identifier associated with the principal. This can be useful when roles are intended to be assumed only by principals belonging to the same organization. It can reduce the risk of accidentally trusting an unintended external account. Security teams should still explicitly define trusted principals whenever practical and review the role’s permissions separately. Organizational membership should be treated as an additional trust condition rather than the only authorization control.

Question 294

Which AWS service can help automatically discover vulnerabilities in container images stored in Amazon ECR?

1. Amazon Inspector
2. AWS Artifact
3. Amazon Macie
4. AWS Shield

Correct Answer: 1

Explanation

Amazon Inspector can assess supported Amazon ECR container images for known software vulnerabilities. This allows security teams to identify vulnerable packages in container images and incorporate findings into development and deployment workflows. Image vulnerability scanning can help organizations address security issues before affected containers are deployed to production. Security teams should establish remediation thresholds, update vulnerable packages, and consider image rebuilds when fixes are available. Container scanning should complement secure image construction, dependency management, access controls, and runtime security monitoring.

Question 295

A company wants to prevent a compromised workload from using an IAM role to access resources outside its intended permission scope. Which control can establish a maximum permission boundary for that role?

1. IAM permissions boundary
2. Route 53 Resolver rule
3. CloudFront origin policy
4. S3 lifecycle rule

Correct Answer: 1

Explanation

An IAM permissions boundary establishes the maximum permissions that can be granted to an IAM role or user by applicable identity-based policies. If the role’s policy later becomes broader, the boundary can prevent permissions outside the approved maximum from becoming effective. This provides a useful defense against accidental or unauthorized privilege expansion. A permissions boundary does not itself grant permissions, so administrators must still configure the identity policy correctly. Security teams should combine boundaries with SCPs, least privilege, policy analysis, and monitoring.

Question 296

Which AWS service can help an organization evaluate evidence against predefined audit requirements and control frameworks?

1. AWS Audit Manager
2. Amazon GuardDuty
3. AWS Network Firewall
4. Amazon CloudFront

Correct Answer: 1

Explanation

AWS Audit Manager helps organizations collect and organize evidence relevant to audits and compliance requirements. It can support assessments against predefined or customized frameworks and gather evidence from supported AWS services. This can reduce the manual effort required to demonstrate that controls are operating as intended. Audit Manager does not automatically make an environment compliant; organizations must still implement and maintain the required controls. Security and compliance teams should validate collected evidence, address control gaps, and maintain appropriate ownership for each requirement.

Question 297

A security administrator wants to prevent users from creating IAM roles that can be assumed by every AWS account. Which policy design is most appropriate?

1. Restrict role trust policies to approved principals
2. Allow Principal: “*” for every role
3. Disable CloudTrail
4. Make all roles publicly assumable

Correct Answer: 4

Explanation

IAM role trust policies should explicitly restrict which principals can assume a role whenever possible. Allowing every principal through a wildcard trust relationship can create significant unauthorized-access risk, particularly when the role has powerful permissions. Security teams should define approved AWS accounts, roles, services, or federated identities in the trust policy and use appropriate conditions where needed. Trust policy reviews are especially important for cross-account roles because an overly broad trust relationship can allow an external account to obtain temporary credentials.

Question 298

Which AWS service can help collect and normalize security findings from integrated AWS services into a central security posture view?

1. AWS Security Hub
2. AWS Private CA
3. Amazon Route 53
4. AWS Backup

Correct Answer: 1

Explanation

AWS Security Hub aggregates security findings from supported AWS services and integrated security products, providing a centralized view of security posture and findings. This can help analysts prioritize issues without switching between numerous service consoles. Security Hub also supports standards-based controls that can identify configuration or security gaps. Centralization does not replace the source services that generate findings, and teams should establish workflows for triage, ownership, and remediation. Automation through supported integrations can further improve response speed for selected finding types.

Question 299

An organization wants to prevent sensitive data from being exposed through an accidentally permissive S3 bucket while also detecting configuration changes. Which combination provides complementary protection?

1. S3 Block Public Access and AWS Config
2. CloudFront and Route 53
3. AWS Artifact and AWS Private CA
4. Amazon Inspector and AWS Certificate Manager

Correct Answer: 1

Explanation

S3 Block Public Access provides preventive protection against several forms of public S3 access, while AWS Config can continuously evaluate bucket configuration against defined compliance requirements. Together, they provide complementary controls: Block Public Access helps prevent accidental public exposure, while Config can detect configuration states that violate organizational policies and provide historical visibility. Security teams should also use restrictive bucket policies, IAM permissions, encryption, and monitoring. Layered controls reduce reliance on a single mechanism and improve the ability to detect or prevent storage misconfigurations.

Question 300

A security team wants to automatically quarantine an EC2 instance after a high-confidence security finding by changing its network access. Which automation pattern is appropriate?

1. EventBridge triggering an automated remediation workflow
2. Manually deleting all CloudTrail logs
3. Publishing the instance IP address publicly
4. Disabling all encryption keys

Correct Answer: 1

Explanation

Amazon EventBridge can detect matching security events and trigger an automated remediation workflow. For a high-confidence finding, the workflow could apply a restrictive security group or otherwise isolate the affected EC2 instance according to the organization’s incident-response procedures. Automation can reduce response time, but it should include safeguards to prevent unnecessary isolation of legitimate workloads. Security teams should define trusted finding criteria, document rollback procedures, preserve forensic evidence, and test the workflow before production use. Automated containment should complement human investigation and broader incident-response processes.