View Full Amazon AWS Certified Security – Specialty SCS-C03 Exam Dumps and Practice Test Dumps.

 

Question 361

A company wants to prevent developers from creating resources in AWS Regions that have not been approved by the security team. Which organization-level control is most appropriate?

1. IAM Access Analyzer
2. AWS Organizations SCP
3. Amazon Macie
4. AWS Certificate Manager

Correct Answer: 2

Explanation

An AWS Organizations service control policy can establish permission guardrails across accounts in an organization. A policy can deny selected actions when requests target Regions that the organization has not approved. This provides centralized preventive governance rather than requiring each account administrator to maintain identical restrictions. SCPs do not grant permissions themselves; they establish the maximum available permissions for affected accounts. Security teams should account for global services and necessary exceptions when designing Region restrictions and should test the policy before applying it broadly.

Question 362

A security team needs to identify unexpected changes to an EC2 security group’s inbound rules and determine when those changes occurred. Which service provides configuration history for this purpose?

1. Amazon GuardDuty
2. AWS WAF
3. AWS Config
4. AWS Shield

Correct Answer: 3

Explanation

AWS Config records configuration information for supported AWS resources and can maintain configuration history. For security groups, this allows administrators and investigators to review changes to inbound and outbound rules and determine how the configuration evolved over time. This information can help identify unauthorized modifications and support incident investigations. Config should be combined with CloudTrail because CloudTrail can provide details about the API operation and identity that made a change. Together, configuration history and API activity provide stronger evidence during security investigations.

Question 363

A company wants to prevent an IAM role from being assumed by principals outside the AWS Organization. Which trust policy condition is useful?

1. aws:PrincipalOrgID
2. aws:SourceIp
3. aws:RequestedRegion
4. aws:SecureTransport

Correct Answer: 1

Explanation

The aws:PrincipalOrgID condition key can be used in an IAM role trust policy to restrict role assumption based on the AWS Organization of the requesting principal. This can help prevent unintended external accounts from assuming a role intended only for organizational identities. The condition should be combined with an appropriately scoped principal and other trust-policy requirements. Security teams should review cross-account relationships carefully because organization membership alone does not determine whether a principal should receive access. Least privilege remains necessary after the role is successfully assumed.

Question 364

An organization wants to require that sensitive administrative API requests originate from a corporate IP range. Which IAM condition key can support this requirement?

1. aws:PrincipalOrgID
2. aws:SourceIp
3. aws:RequestedRegion
4. aws:SourceVpce

Correct Answer: 2

Explanation

The aws:SourceIp condition key can be used in supported IAM policies to restrict requests according to their source IP address. Organizations can use it to require certain administrative operations to originate from approved network ranges. This can add a useful network-based restriction around sensitive actions. However, source IP conditions should be designed carefully for applications using proxies, NAT gateways, VPNs, or changing addresses. Security teams should combine network restrictions with strong authentication, MFA, least privilege, logging, and centralized identity management.

Question 365

A security administrator wants to determine whether an IAM policy contains syntax or policy-structure problems before attaching it to an identity. Which IAM capability should be used?

1. IAM Policy Simulator
2. IAM policy validation
3. IAM Credential Report
4. IAM Access Analyzer unused access

Correct Answer: 2

Explanation

IAM policy validation can identify syntax errors and other policy-definition issues before or during policy use. This helps administrators detect malformed policy statements and certain problems that could prevent a policy from behaving as intended. Validation is different from the IAM Policy Simulator, which is used to test whether specific actions would be allowed under a set of policies. Security teams should use both capabilities where appropriate: validate the policy structure first, then simulate expected authorization behavior before deploying significant permission changes.

Question 366

A company wants to identify whether an S3 bucket policy unintentionally permits anonymous access to objects. Which AWS service can help analyze this resource-based policy?

1. Amazon Inspector
2. AWS Audit Manager
3. IAM Access Analyzer
4. AWS Backup

Correct Answer: 3

Explanation

IAM Access Analyzer can analyze supported resource-based policies and identify access that may be available to external or unintended principals. For S3 resources, this can help security teams detect policies that expose data beyond the organization’s intended trust boundary. Findings should be reviewed to determine whether the access is intentional or represents a security issue. Access Analyzer does not automatically determine the business appropriateness of every relationship. Organizations should combine policy analysis with data classification, S3 access controls, logging, and least-privilege reviews.

Question 367

A security team needs to preserve a copy of an EBS volume’s state at a specific point in time for an investigation. Which capability is appropriate?

1. EBS snapshot
2. EC2 Auto Scaling
3. EBS volume modification
4. Instance hibernation

Correct Answer: 1

Explanation

An EBS snapshot captures the state of an EBS volume at a point in time and can be useful for forensic preservation and investigation. During an incident, security teams can preserve a snapshot before making extensive changes to the original workload, helping maintain evidence for later analysis. Access to forensic snapshots should be tightly restricted and preferably separated from the compromised workload account. Investigators should document when and how the snapshot was created and protect it against unauthorized modification or deletion throughout the investigation.

Question 368

A company wants to detect known vulnerabilities in software installed on supported EC2 instances without manually inspecting every package. Which AWS service provides this capability?

1. AWS Config
2. Amazon Inspector
3. AWS Shield
4. Amazon Detective

Correct Answer: 2

Explanation

Amazon Inspector can continuously assess supported EC2 instances for software vulnerabilities and related security findings. It can identify vulnerable packages and provide information that helps organizations prioritize remediation. This reduces the need for security teams to manually inventory and inspect every installed package. Inspector findings should be incorporated into a vulnerability-management process that considers severity, asset importance, exploitability, and available mitigations. Vulnerability scanning should also be complemented by patch management, network restrictions, least-privilege IAM roles, and runtime threat detection.

Question 369

A security engineer wants to prevent an S3 bucket from being accessed using unencrypted HTTP requests. Which policy statement is commonly used?

1. Allow requests when aws:SecureTransport is false
2. Deny requests when aws:SecureTransport is false
3. Allow requests only when aws:SourceIp is public
4. Deny requests when aws:PrincipalOrgID matches the organization

Correct Answer: 2

Explanation

A common S3 security pattern is an explicit deny when the aws:SecureTransport condition indicates that secure transport is not being used. This ensures that HTTP requests are rejected while HTTPS requests remain eligible for normal authorization evaluation. Explicit denies override applicable allows, making this approach useful for enforcing a transport-security requirement. Security teams should test the policy with every legitimate application and client. TLS enforcement should be combined with encryption at rest, appropriate identity permissions, logging, and network controls for broader data protection.

Question 370

A company needs a centralized service that can receive findings from GuardDuty, Inspector, Macie, and other supported sources. Which service should be used?

1. Amazon Security Hub
2. AWS Certificate Manager
3. AWS Network Firewall
4. Amazon CloudFront

Correct Answer: 1

Explanation

Amazon Security Hub provides centralized security findings management and can receive findings from supported AWS security services and integrated products. This gives security teams a consolidated view of issues across accounts and workloads instead of requiring analysts to investigate every service independently. Security Hub can also support automation and workflow integration for findings that meet defined criteria. Centralization does not eliminate the need to investigate the original evidence. Security teams should establish ownership, severity-handling procedures, and response workflows so that important findings are addressed consistently.

Question 371

A security administrator wants to identify unusual API activity that may indicate compromised AWS credentials. Which service is primarily designed for managed threat detection based on AWS activity?

1. AWS Artifact
2. Amazon GuardDuty
3. AWS Config
4. AWS Backup

Correct Answer: 2

Explanation

Amazon GuardDuty provides managed threat detection and can identify suspicious activity across supported AWS data sources. It can detect patterns associated with compromised credentials, unusual API activity, malicious network behavior, and other threats. GuardDuty findings provide security teams with indicators and context that can support investigation and response. GuardDuty is a detection service rather than an authorization mechanism, so it does not prevent every suspicious operation. Organizations should integrate findings with Security Hub, EventBridge, and incident-response procedures to support timely investigation and containment.

Question 372

A company wants to restrict an S3 bucket so that only requests through a specific VPC endpoint can access it. Which condition should be included in the bucket policy?

1. aws:RequestedRegion
2. aws:MultiFactorAuthPresent
3. aws:SourceVpce
4. aws:PrincipalOrgID

Correct Answer: 3

Explanation

The aws:SourceVpce condition key can be used to restrict supported requests according to the VPC endpoint through which the request originates. In an S3 bucket policy, this can help ensure that access follows a specific private network path rather than allowing unrestricted network access. Security teams should verify the endpoint identifier and ensure that all legitimate applications use the intended endpoint. This condition should not replace IAM authorization or encryption controls. Combining network-path restrictions with least privilege and logging provides stronger protection for private data.

Question 373

A security team wants to automatically isolate an EC2 instance after a high-confidence security finding by applying a restrictive security group. Which service can coordinate an automated response workflow?

1. AWS Systems Manager Automation
2. AWS Artifact
3. AWS Private CA
4. Amazon Macie

Correct Answer: 1

Explanation

AWS Systems Manager Automation can execute predefined runbooks that perform controlled operational actions on AWS resources. During incident response, an automation workflow can be designed to modify an EC2 instance’s network controls, such as applying a restrictive security group, after a sufficiently trusted finding triggers the workflow. Automated isolation can reduce attacker activity while preserving the instance for investigation. Security teams should carefully validate the trigger conditions and runbook permissions because incorrect automation could disrupt legitimate workloads. Approval steps may be appropriate for lower-confidence findings.

Question 374

A company wants to evaluate whether an IAM policy would allow a specific action on a particular resource before deploying the policy. Which tool is designed for authorization testing?

1. IAM Credential Report
2. IAM Policy Simulator
3. AWS Artifact
4. AWS Config Aggregator

Correct Answer: 2

Explanation

The IAM Policy Simulator allows administrators to test whether specified IAM actions would be allowed for a principal under selected policies and conditions. It can help security teams validate authorization behavior before making permission changes in production. This is particularly useful when policies contain multiple statements, conditions, explicit denies, or resource restrictions. The simulator should not replace real-world testing because application behavior and service-specific conditions can vary. Nevertheless, it provides a controlled way to examine expected IAM authorization results and identify unintended permissions.

Question 375

A security team needs to record which user or role changed an AWS resource configuration, while another service records the resulting configuration state. Which combination provides both types of information?

1. Macie and Inspector
2. CloudTrail and AWS Config
3. Shield and WAF
4. GuardDuty and Private CA

Correct Answer: 2

Explanation

CloudTrail and AWS Config provide complementary information during configuration investigations. CloudTrail can record the API operation, identity, timestamp, and other request details associated with a change. AWS Config can record the resulting resource configuration and maintain configuration history for supported resources. Using both services helps security teams answer two different questions: who performed the operation and what configuration changed. This combination is particularly useful for investigating unauthorized security-group, IAM, encryption, or other infrastructure modifications across an AWS environment.

Question 376

A company wants to ensure that newly created IAM users cannot create long-term access keys unless explicitly authorized. Which control can help enforce this requirement?

1. IAM permissions policy with an explicit deny
2. S3 bucket lifecycle rule
3. AWS WAF rate-based rule
4. CloudFront signed URL

Correct Answer: 1

Explanation

An IAM policy can explicitly deny actions such as creating access keys for users who should not have long-term credentials. An explicit deny overrides applicable allow permissions, making it useful as a preventive guardrail. Organizations can apply such controls through appropriate IAM policies or broader governance mechanisms depending on their architecture. Security teams should carefully identify service accounts or legacy integrations that legitimately require access keys before enforcing a blanket restriction. Wherever possible, workloads should use temporary credentials through IAM roles to reduce the risks associated with long-lived access keys.

Question 377

A security administrator wants to determine whether an AWS resource is reachable from the internet because of its network configuration. Which capability can analyze the configured network path?

1. Amazon Macie
2. AWS Network Firewall
3. VPC Reachability Analyzer
4. AWS Audit Manager

Correct Answer: 3

Explanation

VPC Reachability Analyzer can analyze network paths between specified resources and identify whether connectivity is possible through the configured VPC components. Security teams can use it to investigate whether routing, security groups, network ACLs, and related components create an unintended path. It is particularly useful for validating network segmentation and troubleshooting exposure concerns. Reachability analysis does not determine whether a service has software vulnerabilities or whether an authenticated user should be authorized. Therefore, network analysis should be combined with Inspector, IAM controls, and threat-detection services.

Question 378

A company wants to make security policies consistent across multiple AWS accounts and automatically manage supported AWS WAF configurations. Which service is most appropriate?

1. AWS Firewall Manager
2. Amazon Detective
3. AWS Artifact
4. Amazon Inspector

Correct Answer: 1

Explanation

AWS Firewall Manager helps organizations centrally manage supported security policies across multiple AWS accounts. It can be used to establish consistent AWS WAF configurations and other supported protections throughout an AWS Organization. This reduces the risk of individual accounts drifting away from the organization’s security baseline. Administrators can define policy scope and account exclusions where appropriate. Firewall Manager does not replace account-level IAM or application security controls. Organizations should combine centralized security policies with monitoring and regular reviews to ensure that protections remain appropriate as workloads and accounts change.

Question 379

A security team wants to determine whether a resource-based policy grants access to an external account that was not intentionally approved. Which service can identify this type of exposure?

1. AWS Shield
2. IAM Access Analyzer
3. Amazon Inspector
4. AWS Backup

Correct Answer: 2

Explanation

IAM Access Analyzer can identify external access granted through supported resource-based policies. This allows security teams to review whether an S3 bucket, IAM role, KMS key, or another supported resource has been shared outside its intended trust boundary. Not every external relationship is necessarily a security problem; some are required for legitimate business integrations. Analysts should therefore validate each finding against organizational requirements before changing the policy. Access Analyzer is valuable for continuously identifying policy relationships that might otherwise remain unnoticed during manual reviews.

Question 380

A company wants to protect highly sensitive data stored in S3 by preventing objects from being deleted or overwritten during a required retention period. Which feature should be configured?

1. S3 Transfer Acceleration
2. S3 Object Lock
3. S3 Inventory
4. S3 Select

Correct Answer: 2

Explanation

S3 Object Lock provides protection against deletion or overwrite of objects for a defined retention period. It can support compliance, forensic preservation, and ransomware-resilience requirements when objects must remain immutable. Organizations should select the appropriate retention configuration and ensure that only authorized personnel can manage related settings. Object Lock protects objects according to its configured retention behavior but does not replace IAM controls, encryption, or monitoring. Security teams should also consider how retention periods align with legal requirements, operational recovery procedures, and the organization’s overall data lifecycle strategy.