View Full Amazon AWS Certified Security – Specialty SCS-C02 Exam Dumps and Practice Test Dumps

 

Question 181

Which AWS service provides browser-based shell access without managing local SSH credentials?

1. AWS CloudShell
2. Systems Manager Session Manager
3. EC2 Instance Connect
4. AWS OpsWorks

Correct Answer: 1

Explanation:

AWS CloudShell provides a browser-based command-line environment that is authenticated through AWS credentials and permissions. It is useful for administrators who need to run AWS CLI commands without installing or maintaining a local command-line environment. CloudShell is different from Session Manager, which provides interactive access to managed EC2 instances, and EC2 Instance Connect, which provides temporary SSH access to instances. OpsWorks is focused on configuration and application management. CloudShell can therefore be useful for secure administrative tasks when the requirement is an AWS-managed browser shell rather than direct operating-system access to a particular instance.

Question 182

Which policy condition can require an S3 request to use a specific encryption method?

1. aws:SecureTransport
2. s3:x-amz-server-side-encryption
3. aws:SourceVpce
4. aws:PrincipalOrgID

Correct Answer: 2

Explanation:

The s3:x-amz-server-side-encryption condition key can be used in S3 policies to evaluate the encryption method specified in an upload request. Security teams can use this condition to require a particular server-side encryption mechanism for objects entering a bucket. This is useful when organizational requirements mandate encryption at rest for stored data. The aws:SecureTransport key evaluates whether secure transport is used, aws:SourceVpce can restrict requests to a VPC endpoint, and aws:PrincipalOrgID evaluates organizational membership. The S3 encryption condition therefore directly addresses the required encryption method during object uploads.

Question 183

Which IAM feature limits the maximum permissions an identity-based policy can provide?

1. Resource-based policy
2. Permissions boundary
3. Session tag
4. Trust policy

Correct Answer: 2

Explanation:

An IAM permissions boundary establishes the maximum permissions that an IAM user or role can receive through identity-based policies. If an identity policy grants an action that is outside the permissions boundary, that action cannot become an effective permission for the identity. This makes permissions boundaries useful when delegating IAM administration while maintaining centralized privilege limits. Resource-based policies control access to supported resources, session tags provide contextual attributes, and trust policies determine who can assume roles. A permissions boundary therefore acts as a guardrail around the maximum authorization available to an IAM identity.

Question 184

Which AWS service provides centralized management of security policies across AWS accounts?

1. Amazon Detective
2. AWS Artifact
3. AWS Firewall Manager
4. Amazon Macie

Correct Answer: 3

Explanation:

AWS Firewall Manager enables organizations to centrally manage supported security policies across AWS accounts and organizational units. It can help administer policies involving services such as AWS WAF, Shield Advanced, security groups, and AWS Network Firewall. This is particularly useful in multi-account environments where security teams need consistent controls without manually configuring every account. Detective focuses on investigations, Artifact provides compliance documentation, and Macie discovers sensitive data in S3. Firewall Manager therefore addresses centralized security-policy administration and enforcement across an AWS Organization.

Question 185

Which S3 capability allows a bucket owner to control access without object ACLs?

1. Object Ownership with Bucket owner enforced
2. Multipart upload
3. S3 Select
4. Transfer Acceleration

Correct Answer: 1

Explanation:

S3 Object Ownership with Bucket owner enforced disables ACLs for the bucket and makes the bucket owner the owner of every object. This simplifies security administration because access can be managed primarily through IAM and bucket policies instead of object-level ACLs. The configuration is particularly useful for centralized buckets that receive objects from multiple accounts or applications. Multipart upload is used for large-object transfers, S3 Select retrieves selected data from supported objects, and Transfer Acceleration improves transfer performance. Bucket owner enforced is therefore the appropriate setting when ACL-free ownership and centralized authorization are required.

Question 186

Which AWS feature can identify anomalous management API activity?

1. CloudTrail event selectors
2. CloudTrail Insights
3. CloudTrail digest files
4. CloudTrail data events

Correct Answer: 2

Explanation:

CloudTrail Insights is designed to identify unusual activity patterns associated with supported CloudTrail management events. It establishes a baseline of normal API activity and can generate Insights events when activity changes significantly from expected behavior. This can help security teams investigate unusual administrative operations or unexpected API usage. Event selectors determine which events are recorded, digest files support log integrity validation, and data events capture supported resource-level activity. CloudTrail Insights therefore provides an analytical detection capability rather than simply controlling event collection or validating log integrity.

Question 187

Which AWS service provides dedicated hardware for customer-controlled cryptographic operations?

1. AWS KMS
2. AWS Private CA
3. AWS CloudHSM
4. AWS Secrets Manager

Correct Answer: 3

Explanation:

AWS CloudHSM provides dedicated hardware security modules for cryptographic operations. Customers have greater direct control over the HSM environment and cryptographic key operations compared with fully managed key-management abstractions. This can be useful for workloads with specialized regulatory or cryptographic requirements. AWS KMS provides managed key-management capabilities, Private CA handles private certificate issuance, and Secrets Manager stores and rotates application secrets. CloudHSM is therefore the appropriate service when a workload specifically requires dedicated HSM infrastructure and greater control over cryptographic processing.

Question 188

Which AWS Organizations control can restrict actions across member accounts?

1. Service control policy
2. IAM inline policy
3. KMS key policy
4. S3 access point policy

Correct Answer: 1

Explanation:

Service control policies (SCPs) provide organization-level permission guardrails for AWS accounts and organizational units. They can deny specific AWS actions or establish maximum permission boundaries for accounts within an organization. SCPs do not grant permissions themselves; an IAM policy must still provide the required authorization. Inline IAM policies apply directly to identities, KMS key policies control access to KMS keys, and S3 access point policies govern access through particular S3 access points. SCPs are therefore the appropriate mechanism for applying broad restrictions across multiple AWS accounts.

Question 189

Which AWS service can detect suspicious activity associated with compromised IAM credentials?

1. Amazon Macie
2. Amazon GuardDuty
3. AWS Config
4. AWS Audit Manager

Correct Answer: 2

Explanation:

Amazon GuardDuty continuously analyzes supported AWS security signals to identify potentially malicious activity, including suspicious behavior associated with AWS credentials. It can detect patterns such as unusual credential use, suspicious API activity, and other indicators associated with potential compromise. GuardDuty findings can then be investigated or integrated into automated response workflows. Macie focuses on sensitive data discovery, Config evaluates resource configuration, and Audit Manager collects compliance evidence. GuardDuty is therefore the service most directly associated with detecting potentially malicious credential-related activity.

Question 190

Which S3 capability preserves previous object versions after overwrites?

1. Object Lock
2. Replication
3. Versioning
4. Storage Lens

Correct Answer: 3

Explanation:

S3 Versioning maintains multiple versions of an object, allowing previous versions to remain available after an object is overwritten or deleted. This can help recover from accidental changes and provides an important foundation for several data-protection strategies. Object Lock provides immutability and retention controls, Replication copies eligible objects to another bucket, and Storage Lens provides storage analytics. Versioning therefore addresses the specific requirement of preserving historical object states. It is commonly combined with retention and access controls when organizations need stronger protection against accidental or malicious data loss.

Question 191

Which AWS service can collect and analyze CloudTrail activity using SQL queries?

1. Amazon Athena
2. CloudTrail Lake
3. Amazon OpenSearch Service
4. AWS Config

Correct Answer: 2

Explanation:

CloudTrail Lake provides managed storage and analysis capabilities for CloudTrail activity events. Security teams can use SQL-based queries against event data stores to investigate historical account activity, support compliance analysis, and conduct security investigations. This reduces the need to build a separate event-processing pipeline solely for CloudTrail analysis. Athena can query supported data stored in services such as S3, OpenSearch Service provides search and analytics capabilities, and Config focuses on resource configuration history. CloudTrail Lake is therefore specifically designed for managed analysis of CloudTrail activity.

Question 192

Which IAM feature can pass attributes into a temporary role session for ABAC?

1. Permission set
2. Session tag
3. Access key
4. Identity policy

Correct Answer: 2

Explanation:

IAM session tags allow attributes to be passed into temporary sessions created through role assumption or federation. These attributes can be referenced by IAM policies to implement attribute-based access control (ABAC). For example, a session tag representing a department or project can be used to determine which resources the session is authorized to access. Permission sets are primarily used with IAM Identity Center, access keys provide programmatic authentication, and identity policies define permissions. Session tags therefore provide contextual information that can dynamically influence authorization decisions during temporary sessions.

Question 193

Which AWS service helps discover sensitive information stored in S3 objects?

1. Amazon Inspector
2. Amazon GuardDuty
3. Amazon Macie
4. AWS Security Hub

Correct Answer: 3

Explanation:

Amazon Macie is designed to discover and help protect sensitive data stored in Amazon S3. It can analyze supported objects and identify data patterns associated with categories such as personally identifiable information, financial information, and credentials. This helps security teams understand where sensitive information exists and investigate potentially risky storage configurations. Inspector focuses on vulnerability assessment, GuardDuty provides threat detection, and Security Hub aggregates security findings. Macie is therefore the service specifically associated with sensitive-data discovery and classification within S3 environments.

Question 194

Which mechanism helps prevent a third-party service from accessing the wrong customer account?

1. IAM external ID condition
2. KMS key alias
3. S3 version ID
4. CloudTrail event selector

Correct Answer: 1

Explanation:

An external ID can be required in an IAM role trust policy when a third-party service assumes roles on behalf of customers. This helps mitigate the confused deputy problem by allowing the customer account to require a value known to the intended customer relationship. The third party includes the external ID when requesting role assumption, and the trust policy evaluates it before granting access. A KMS alias identifies a key, an S3 version ID identifies an object version, and a CloudTrail event selector controls event collection. External IDs therefore provide an important safeguard for third-party cross-account access.

Question 195

Which AWS service can evaluate resources against security configuration rules?

1. AWS Config
2. Amazon Inspector
3. AWS Security Hub
4. Amazon Detective

Correct Answer: 1

Explanation:

AWS Config evaluates supported resources against configuration rules and records compliance status. Security teams can use managed or custom rules to check whether resources satisfy requirements such as encryption, network configuration, or approved settings. Config also maintains configuration history, which can help investigators understand when a security-relevant change occurred. Inspector focuses on vulnerabilities, Security Hub centralizes security findings and standards checks, and Detective assists investigations. AWS Config is therefore particularly appropriate when the requirement is to evaluate resource configurations continuously against defined rules.

Question 196

Which S3 protection provides WORM-style retention for regulated records?

1. S3 Access Points
2. S3 Object Lock
3. S3 Inventory
4. S3 Batch Operations

Correct Answer: 2

Explanation:

S3 Object Lock provides WORM-style protection by preventing protected objects from being overwritten or deleted during configured retention periods. It supports retention modes designed for different operational requirements and can also use legal holds. This makes Object Lock useful for records that must remain immutable for regulatory, legal, or organizational reasons. Access Points manage application-specific access, Inventory generates object reports, and Batch Operations performs large-scale object actions. Object Lock directly addresses the requirement for immutable record retention and is therefore the appropriate S3 security control for WORM-style protection.

Question 197

Which service can route a GuardDuty finding to an automated response workflow?

1. Amazon EventBridge
2. AWS Artifact
3. Amazon Macie
4. AWS Private CA

Correct Answer: 1

Explanation:

Amazon EventBridge can receive events from AWS security services such as GuardDuty and route matching events to configured targets. A security architecture can use this capability to initiate automated response actions through Lambda, Systems Manager, Step Functions, or other supported services. Event patterns can identify specific finding types or severity conditions before a workflow is triggered. Artifact provides compliance documentation, Macie performs sensitive-data discovery, and Private CA manages private certificates. EventBridge therefore serves as the event-routing layer connecting security detections with automated response processes.

Question 198

Which AWS Backup feature protects recovery points from unauthorized deletion?

1. Backup Vault Lock
2. Backup plan tags
3. Backup job reports
4. Backup lifecycle transition

Correct Answer: 1

Explanation:

AWS Backup Vault Lock helps protect backup recovery points against unauthorized deletion or changes to retention settings. It is designed to support immutable backup strategies and can provide stronger protection against destructive actions during security incidents. This is particularly important when ransomware or compromised administrator credentials could otherwise affect both production systems and their backups. Tags organize backup resources, reports provide operational visibility, and lifecycle transitions manage backup storage behavior. Backup Vault Lock therefore provides the direct protection needed when recovery points must be safeguarded against unauthorized modification or deletion.

Question 199

Which IAM policy component determines who may assume a role?

1. Permissions boundary
2. Trust policy
3. Session policy
4. Resource tag

Correct Answer: 2

Explanation:

An IAM role trust policy defines which principals are trusted to assume the role. It can specify AWS accounts, roles, services, federated identities, or other supported principals and can include conditions such as MFA or external IDs. The trust policy is separate from the permissions policies that determine what the role can do after assumption. Permissions boundaries limit maximum permissions, session policies can restrict temporary sessions, and resource tags provide attributes that policies may evaluate. The trust policy is therefore the key authorization component for determining who can obtain temporary credentials through role assumption.

Question 200

Which AWS service centralizes security findings from multiple AWS security tools?

1. Amazon Detective
2. AWS Security Hub
3. Amazon Inspector
4. Amazon GuardDuty

Correct Answer: 2

Explanation:

AWS Security Hub aggregates security findings from multiple AWS services and supported third-party products into a centralized view. This allows security teams to review findings consistently and establish workflows for investigation and remediation. Security Hub can also evaluate supported security standards and provide control findings. Detective provides investigative context, Inspector performs vulnerability assessments, and GuardDuty detects threats. Security Hub therefore serves as a central security-management layer rather than being limited to one specific detection or vulnerability domain.