View Full Amazon AWS Certified Security – Specialty SCS-C02 Exam Dumps and Practice Test Dumps

 

Question 201

Which AWS service provides managed private certificate authority capabilities?

1. AWS Certificate Manager Private Certificate Authority
2. Amazon GuardDuty
3. AWS Secrets Manager
4. AWS Key Management Service

Correct Answer: 1

Explanation:

AWS Certificate Manager Private Certificate Authority (ACM Private CA) provides managed private certificate authority functionality for organizations that need to issue and manage certificates internally. It can create private certificate hierarchies and issue certificates for applications, services, devices, and internal resources. This is useful when certificates should not be publicly trusted or when an organization requires control over its certificate infrastructure. GuardDuty focuses on threat detection, Secrets Manager manages application credentials, and KMS protects encryption keys. ACM Private CA therefore addresses the specific requirement of creating and operating a private certificate authority without requiring the organization to maintain its own CA servers.

Question 202

Which IAM policy controls who is allowed to assume an IAM role?

1. Permissions policy
2. Trust policy
3. Session policy
4. Identity-based boundary

Correct Answer: 3

Explanation:

An IAM role’s trust policy defines which principals are permitted to assume that role. The policy is attached directly to the role and establishes the trusted relationship between the role and identities such as IAM users, other roles, AWS services, or external principals. A permissions policy instead determines what actions the role can perform after it has been assumed. Session policies can further restrict permissions during a temporary session, while a permissions boundary limits the maximum permissions available to an identity. Understanding the distinction between trust and permissions policies is essential when troubleshooting cross-account access or service-role assumption failures.

Question 203

Which AWS feature helps prevent confused-deputy problems during cross-account role assumption?

1. IAM Access Analyzer
2. External ID
3. Permission set
4. Source VPC condition

Correct Answer: 4

Explanation:

An external ID is commonly used when a third-party service assumes a role in a customer’s AWS account. The customer includes a specific external ID condition in the role trust policy, allowing the trusted third party to demonstrate that the request belongs to the correct customer relationship. This helps reduce the confused-deputy risk, where a service with access to multiple customers could accidentally use one customer’s permissions on behalf of another customer. IAM Access Analyzer identifies potentially unintended access, permission sets are associated with IAM Identity Center, and VPC conditions address network context rather than the third-party confused-deputy scenario.

Question 204

What does an IAM permissions boundary primarily define?

1. The trusted principal for a role
2. The account’s organization structure
3. The maximum permissions an identity can receive
4. The encryption algorithm used by KMS

Correct Answer: 2

Explanation:

An IAM permissions boundary establishes the maximum permissions that an IAM user or role can receive through identity-based policies. It does not itself grant permissions. Effective permissions are determined by the intersection between the permissions granted by applicable identity policies and the permissions allowed by the boundary, along with other policy controls. This mechanism is useful for delegated administration because administrators can allow teams to create roles or users while restricting the maximum privileges those identities may obtain. A trust policy handles role assumption, AWS Organizations manages account relationships, and KMS controls cryptographic key operations rather than IAM permission boundaries.

Question 205

Which S3 setting transfers object ownership to the bucket-owning account automatically?

1. Bucket owner enforced
2. Public access override
3. ACL compatibility mode
4. Requester ownership

Correct Answer: 4

Explanation:

S3 Object Ownership with Bucket owner enforced disables access control lists for the bucket and makes the bucket owner the owner of every object written to the bucket. This simplifies permission management because object ownership no longer depends on the account that uploaded the object. It is especially useful in centralized data repositories where multiple AWS accounts upload objects but the receiving account must retain ownership. The setting also reduces reliance on object ACLs, allowing organizations to manage access primarily through IAM and bucket policies. The other choices do not provide the same automatic ownership behavior for newly uploaded S3 objects.

Question 206

Which S3 capability creates a separate access point for controlled application access?

1. S3 Inventory
2. S3 Access Points
3. S3 Batch Operations
4. S3 Storage Lens

Correct Answer: 1

Explanation:

Amazon S3 Access Points provide dedicated access endpoints and policies for applications or groups that need controlled access to the same S3 bucket. Instead of placing every application’s permissions into one large bucket policy, administrators can create separate access points with policies tailored to particular use cases. This can simplify access management for shared datasets, especially when multiple teams or applications require different permissions. S3 Inventory reports object metadata, Batch Operations performs large-scale object actions, and Storage Lens provides usage and activity visibility. Access Points specifically address the challenge of creating distinct controlled access paths to a shared S3 bucket.

Question 207

Which CloudFront feature provides authenticated access from CloudFront to an S3 origin?

1. Origin Access Control
2. S3 Transfer Acceleration
3. Bucket Replication
4. CloudFront Functions

Correct Answer: 3

Explanation:

CloudFront Origin Access Control (OAC) allows CloudFront to securely access an S3 origin while restricting direct public access to the bucket. OAC uses AWS Signature Version 4 signing and can be integrated with S3 bucket policies so requests are permitted when they originate through the authorized CloudFront distribution. This architecture is useful when content should be delivered through CloudFront while preventing users from bypassing the distribution and accessing S3 directly. Transfer Acceleration improves transfer performance, replication copies objects between buckets, and CloudFront Functions execute lightweight edge logic. OAC is specifically designed for securing CloudFront-to-S3 origin access.

Question 208

Which KMS capability allows related keys in different Regions to share key material?

1. Imported key material
2. Multi-Region keys
3. Grant tokens
4. Custom key stores

Correct Answer: 2

Explanation:

AWS KMS Multi-Region keys allow related KMS keys to exist in multiple AWS Regions while sharing the same underlying key material and key ID lineage. This can simplify cryptographic operations for applications that operate across Regions and need consistent encryption or decryption capabilities. A primary Multi-Region key can have replica keys in other Regions, and each replica remains a regional KMS resource. Imported key material refers to externally supplied cryptographic material, grant tokens support authorization changes involving grants, and custom key stores integrate KMS with external key-management infrastructure. Multi-Region keys specifically address cross-Region cryptographic continuity.

Question 209

Which KMS option lets an organization supply its own cryptographic key material?

1. Automatic rotation
2. Alias management
3. Imported key material
4. Key grants

Correct Answer: 1

Explanation:

KMS imported key material allows an organization to generate cryptographic material externally and then import it into a customer managed KMS key. This can be useful when an organization has requirements around key generation or wants greater control over the source of the material. Imported material has specific lifecycle considerations, including expiration behavior when an expiration period is configured. Automatic rotation is a KMS key-management feature, aliases provide friendly names for keys, and grants delegate permissions to principals. Those features do not provide the mechanism for supplying externally generated cryptographic material to a KMS key.

Question 210

Which KMS mechanism can delegate limited key operations without modifying the key policy?

1. Grant
2. Alias
3. Key description
4. Rotation schedule

Correct Answer: 4

Explanation:

A KMS grant is a delegation mechanism that allows specific AWS principals to perform permitted operations on a KMS key. Grants can provide fine-grained permissions and are commonly used by AWS services that need temporary or controlled access to encrypted resources. They can be created and retired independently from the key policy. An alias is simply a friendly reference to a key, a description provides metadata, and rotation changes key material according to the configured rotation behavior. Grants are particularly useful when an application or AWS service needs narrowly scoped cryptographic permissions without requiring frequent changes to the key policy itself.

Question 211

Which service provides managed threat detection using AWS account and workload activity?

1. AWS Artifact
2. Amazon GuardDuty
3. AWS Audit Manager
4. AWS Trusted Advisor

Correct Answer: 3

Explanation:

Amazon GuardDuty is a managed threat detection service that analyzes relevant AWS activity and data sources to identify suspicious behavior and potential security threats. It can produce findings involving activities such as credential misuse, unusual API behavior, malicious network activity, and other indicators depending on enabled protection features and supported resources. AWS Artifact provides compliance documentation, Audit Manager helps collect evidence for audits, and Trusted Advisor provides recommendations across several AWS account areas. GuardDuty is therefore the service specifically designed for continuously identifying potential threats and generating security findings for investigation.

Question 212

Which Amazon Macie capability identifies sensitive data stored in S3 objects?

1. Sensitive data discovery
2. Network packet inspection
3. IAM credential analysis
4. Application tracing

Correct Answer: 1

Explanation:

Amazon Macie provides sensitive data discovery capabilities for Amazon S3. It can analyze objects to identify sensitive information such as personally identifiable information and other data types supported by Macie’s detection mechanisms. Organizations can use these findings to understand where sensitive information resides and improve data protection controls. Macie is focused on data security and privacy rather than network packet inspection or IAM credential analysis. Application tracing is handled by other AWS observability services. Macie’s S3-focused discovery capability is particularly valuable for organizations maintaining large data lakes or repositories where manually identifying sensitive information would be difficult.

Question 213

Which AWS service evaluates resources against configurable compliance rules?

1. AWS Config
2. Amazon Inspector
3. AWS Shield
4. Amazon Detective

Correct Answer: 4

Explanation:

AWS Config continuously records resource configurations and can evaluate them against configurable rules. These rules can identify resources that violate organizational requirements, such as security configurations that do not meet defined standards. Config can also maintain configuration history, making it useful for investigating how resources changed over time. Amazon Inspector focuses on vulnerability findings for supported workloads, AWS Shield provides DDoS protection, and Detective helps investigate relationships and activity associated with security findings. AWS Config is therefore the appropriate service when the primary requirement is evaluating AWS resource configuration against defined compliance or governance conditions.

Question 214

Which AWS service provides centralized security findings across supported AWS security services?

1. Amazon CloudWatch
2. AWS Security Hub
3. AWS Control Tower
4. AWS Resource Explorer

Correct Answer: 2

Explanation:

AWS Security Hub provides centralized security findings from supported AWS security services and integrated partner products. It helps security teams aggregate findings into a consistent view and can evaluate the environment against supported security standards. Security Hub is useful when an organization wants to consolidate security information rather than investigate each detection service independently. CloudWatch focuses on monitoring and observability, Control Tower assists with multi-account governance, and Resource Explorer helps locate AWS resources. Security Hub therefore serves as a central security-management layer for aggregating and prioritizing findings from multiple sources.

Question 215

Which service is designed to investigate relationships among AWS security activity and resources?

1. Amazon Detective
2. AWS WAF
3. Amazon Macie
4. AWS Firewall Manager

Correct Answer: 3

Explanation:

Amazon Detective helps security teams investigate security findings by analyzing relationships among resources, users, IP addresses, API activity, and other relevant security data. Instead of simply identifying an alert, Detective helps investigators understand what happened and how related activities connect. This makes it useful during incident investigation and threat analysis. AWS WAF protects web applications from common web exploits, Macie focuses on sensitive data discovery, and Firewall Manager centrally manages firewall policies. Detective’s primary role is investigative analysis, helping analysts move from an initial security finding toward a clearer understanding of the surrounding activity.

Question 216

Which service centrally manages firewall policies across multiple AWS accounts?

1. AWS Firewall Manager
2. Amazon Detective
3. AWS Artifact
4. AWS Certificate Manager

Correct Answer: 4

Explanation:

AWS Firewall Manager provides centralized management of firewall and security policies across AWS Organizations. It can help administrators consistently deploy and manage protections such as AWS WAF rules, security groups, and other supported firewall controls across multiple accounts and resources. This is particularly useful in large multi-account environments where manually configuring every account can lead to inconsistent protection. Detective is focused on investigation, Artifact provides compliance reports, and Certificate Manager handles certificates. Firewall Manager addresses the centralized governance requirement by allowing security policies to be managed and enforced across organizational accounts.

Question 217

Which IAM feature provides temporary permissions through centrally managed permission sets?

1. IAM Identity Center
2. Amazon Cognito
3. AWS Resource Access Manager
4. IAM Access Analyzer

Correct Answer: 1

Explanation:

IAM Identity Center provides centralized workforce access to AWS accounts and applications. Administrators can create permission sets that define the permissions users receive when accessing assigned AWS accounts. These permissions are provisioned through IAM roles, providing temporary credentials rather than requiring users to maintain long-lived IAM user credentials in each account. Amazon Cognito focuses on application end-user identity, Resource Access Manager shares supported resources across accounts, and Access Analyzer evaluates resource access. IAM Identity Center is therefore the appropriate solution when an organization needs centralized workforce authentication and account access managed through reusable permission sets.

Question 218

Which AWS service can identify unused permissions granted to IAM identities?

1. Amazon Inspector
2. IAM Access Analyzer
3. AWS Network Firewall
4. Amazon GuardDuty

Correct Answer: 2

Explanation:

IAM Access Analyzer includes capabilities that help organizations understand access and identify unused permissions associated with supported IAM identities. This information can help security teams reduce excessive privileges and move toward least-privilege access. Access Analyzer also provides other policy analysis capabilities, including identifying unintended external access. Inspector is primarily focused on workload vulnerabilities, Network Firewall provides network protection, and GuardDuty detects suspicious activity. IAM Access Analyzer is therefore the relevant service when the objective is analyzing identity permissions and finding opportunities to remove permissions that are not being used.

Question 219

Which S3 control requires an additional authentication factor for certain bucket deletion operations?

1. S3 Transfer Acceleration
2. S3 Access Points
3. MFA Delete
4. S3 Inventory

Correct Answer: 4

Explanation:

Amazon S3 MFA Delete can require multi-factor authentication for specific operations involving versioned buckets, including permanently deleting object versions and changing certain versioning-related settings. It adds an additional authentication requirement to sensitive bucket operations, helping reduce the risk of accidental or unauthorized destructive actions. Transfer Acceleration concerns data-transfer performance, Access Points provide application-specific access endpoints, and Inventory generates reports about objects. MFA Delete is specifically associated with protecting versioned S3 data against certain destructive administrative actions by requiring an additional authentication factor.

Question 220

Which S3 Object Lock mode prevents protected objects from being deleted or overwritten during retention?

1. Governance mode
2. Compliance mode
3. Lifecycle mode
4. Replication mode

Correct Answer: 2

Explanation:

S3 Object Lock Compliance mode provides strong immutability protection by preventing protected object versions from being deleted or overwritten during their configured retention period, including by users with elevated administrative permissions. This makes it appropriate for requirements where retained records must remain immutable for a defined period. Governance mode also protects objects but can allow authorized users with appropriate permissions to bypass retention controls. Lifecycle mode and replication mode are not Object Lock retention modes. Compliance mode is therefore the relevant choice when an organization requires strict retention enforcement for protected S3 objects.