View Full Amazon AWS Certified Security – Specialty SCS-C02 Exam Dumps and Practice Test Dumps

 

Question 281

Which IAM policy element identifies the AWS resource affected by a statement?

1. Effect
2. Principal
3. Resource
4. Version

Correct Answer: 1

Explanation:

The Resource element identifies the AWS resources to which an IAM policy statement applies. Depending on the service and operation, the value can specify a particular resource ARN, multiple ARNs, or a wildcard when broader access is intended. Effect determines whether access is allowed or denied, Principal identifies the requester in policies that support it, and Version identifies the policy language version. Understanding the Resource element is important when implementing least-privilege permissions because administrators can restrict actions to only the resources that a workload or user actually needs instead of granting access across an entire service.

Question 282

Which IAM policy element identifies the principal in a resource-based policy?

1. Action
2. Principal
3. Resource
4. Condition

Correct Answer: 3

Explanation:

The Principal element identifies the AWS identity or identities that are allowed or denied access in a resource-based policy. For example, an S3 bucket policy can specify an AWS account, role, user, or service principal as the requester. The Action element specifies the API operations, Resource identifies the protected resource, and Condition adds contextual requirements. Resource-based policies are especially useful for cross-account access because the policy can directly identify an external principal. Correctly defining the Principal is essential because an overly broad principal can unintentionally expose a resource to identities outside the intended trust boundary.

Question 283

Which AWS service provides centralized identity access for employees across AWS accounts?

1. Amazon Cognito
2. AWS IAM Identity Center
3. AWS Directory Service
4. Amazon Verified Permissions

Correct Answer: 4

Explanation:

AWS IAM Identity Center provides centralized workforce access to multiple AWS accounts and supported applications. Administrators can connect an identity source, organize users and groups, and assign permission sets to accounts. This approach avoids maintaining separate IAM users for every employee in every AWS account. Amazon Cognito primarily handles application end-user identities, Directory Service provides managed directory capabilities, and Verified Permissions evaluates application authorization decisions. IAM Identity Center is therefore designed for workforce identity management and centralized access to AWS environments.

Question 284

Which AWS service evaluates application authorization decisions using policy-based rules?

1. Amazon Cognito
2. IAM Access Analyzer
3. Amazon Verified Permissions
4. AWS Audit Manager

Correct Answer: 2

Explanation:

Amazon Verified Permissions is a managed authorization service designed for applications that need fine-grained policy-based access decisions. It uses the Cedar policy language to determine whether a particular principal should be allowed to perform an action on a resource under specified conditions. This allows application authorization logic to be separated from application code. Cognito manages application identities, Access Analyzer analyzes AWS resource policies and access, and Audit Manager gathers compliance evidence. Verified Permissions is specifically intended to evaluate authorization decisions for applications using centrally managed policies.

Question 285

Which Amazon Cognito component manages application user registration and authentication?

1. User pool
2. Identity pool
3. Access analyzer
4. Permission set

Correct Answer: 4

Explanation:

Amazon Cognito user pools provide user directories for applications and support capabilities such as registration, authentication, password management, and federation with supported identity providers. They allow application developers to implement user sign-in without building an entire authentication system from scratch. Identity pools serve a different purpose by providing temporary AWS credentials to authenticated or guest identities when configured. Access Analyzer evaluates AWS access policies, while permission sets belong to IAM Identity Center. User pools are therefore the Cognito component primarily responsible for managing application users and their authentication lifecycle.

Question 286

Which Cognito capability can provide temporary AWS credentials to application users?

1. User pool
2. Identity pool
3. User group
4. App client

Correct Answer: 2

Explanation:

Amazon Cognito identity pools can provide temporary AWS credentials to authenticated or unauthenticated application users when the appropriate configuration and IAM roles are established. This allows applications to grant users controlled access to AWS resources without embedding long-term AWS credentials into the application. User pools manage application identities and authentication, user groups organize users within a user pool, and app clients represent applications that interact with a user pool. Identity pools specifically address the federation of application identities into temporary AWS authorization credentials.

Question 287

Which service can identify sensitive information in application data stored in S3?

1. Amazon Macie
2. Amazon Detective
3. AWS Shield
4. AWS Firewall Manager

Correct Answer: 3

Explanation:

Amazon Macie helps discover and classify sensitive data stored in Amazon S3. It can identify supported sensitive information types within objects and provide findings that help organizations understand where sensitive information is located. This visibility can support data-protection reviews, privacy programs, and security investigations. Detective focuses on investigative analysis, Shield provides DDoS protection, and Firewall Manager centrally manages supported firewall policies. Macie is therefore the service most directly associated with discovering sensitive information within S3 data repositories.

Question 288

Which S3 mechanism can retain an object indefinitely until an explicit hold is removed?

1. Versioning
2. Legal hold
3. Lifecycle rule
4. Replication configuration

Correct Answer: 1

Explanation:

An S3 Object Lock legal hold can prevent an object version from being overwritten or deleted until the legal hold is explicitly removed. Unlike a retention period, a legal hold does not require a predetermined expiration date. This can be useful when information must be preserved for an investigation, legal matter, or other requirement whose duration is uncertain. Versioning preserves multiple object versions, lifecycle rules automate object transitions or expiration, and replication copies objects to another location. A legal hold is specifically intended for indefinite preservation until an authorized user removes the hold.

Question 289

Which AWS service provides centralized encryption-key management for AWS workloads?

1. AWS KMS
2. AWS Artifact
3. AWS Config
4. Amazon CloudWatch

Correct Answer: 4

Explanation:

AWS Key Management Service provides managed creation, storage, control, and use of cryptographic keys for supported AWS workloads. KMS integrates with numerous AWS services and allows administrators to define key policies, grants, and other controls governing cryptographic operations. CloudWatch focuses on monitoring and observability, Config evaluates resource configurations, and Artifact provides compliance documentation. KMS is therefore the appropriate service when an organization needs centralized management of encryption keys and controlled use of those keys across AWS resources.

Question 290

Which KMS object provides an alternate friendly name for a key?

1. Grant
2. Alias
3. Key policy
4. Key material

Correct Answer: 4

Explanation:

A KMS alias is a friendly name that can reference a KMS key. Instead of requiring applications or administrators to work directly with a long key identifier, an alias can provide a recognizable reference such as an environment or application-specific name. Aliases can also be updated to point to another eligible key, which can simplify certain key-management workflows. Grants delegate permissions, key policies define authorization for the key, and key material represents the cryptographic material used by the key. The alias is specifically intended to provide a convenient human-readable reference.

Question 291

Which AWS service can detect anomalous API activity and potential credential compromise?

1. Amazon GuardDuty
2. AWS Artifact
3. AWS Backup
4. Amazon EFS

Correct Answer: 2

Explanation:

Amazon GuardDuty continuously analyzes supported AWS activity and security data sources to identify suspicious behavior and potential threats. Its findings can indicate unusual API activity, potentially compromised credentials, malicious network behavior, and other security concerns depending on enabled protection capabilities. Artifact provides compliance documentation, Backup handles data recovery protection, and EFS provides managed file storage. GuardDuty is specifically designed for managed threat detection rather than merely storing activity records or managing infrastructure resources.

Question 292

Which service helps security teams investigate the sequence and relationships surrounding a finding?

1. AWS WAF
2. Amazon Detective
3. Amazon Macie
4. AWS Certificate Manager

Correct Answer: 3

Explanation:

Amazon Detective helps security teams investigate security findings by analyzing relationships among users, resources, IP addresses, API calls, and other relevant activity. It can help investigators understand how events are connected and reconstruct activity surrounding a potential incident. WAF protects web applications from malicious HTTP and HTTPS requests, Macie identifies sensitive information, and Certificate Manager manages certificates. Detective is therefore focused on investigation rather than prevention or data classification. Its analysis can provide additional context after another security service has identified suspicious activity.

Question 293

Which AWS service aggregates findings from multiple security products?

1. AWS Security Hub
2. Amazon Route 53
3. AWS CloudHSM
4. AWS Private CA

Correct Answer: 4

Explanation:

AWS Security Hub provides a centralized view of security findings from supported AWS services and integrated partner products. It can normalize findings and provide security teams with a consolidated location for monitoring and response activities. Security Hub can also evaluate supported security standards and apply automation rules to findings. Route 53 provides DNS services, CloudHSM offers dedicated hardware security modules, and Private CA manages private certificate authorities. Security Hub is specifically designed to bring security findings together so teams can manage security issues from a central service.

Question 294

Which AWS service collects evidence that can support compliance assessments?

1. AWS Audit Manager
2. Amazon GuardDuty
3. AWS Network Firewall
4. Amazon Inspector

Correct Answer: 1

Explanation:

AWS Audit Manager helps automate evidence collection for audits and compliance assessments. It can gather evidence from supported AWS services and organize that information around controls and frameworks. This allows organizations to reduce manual evidence-gathering work and maintain a structured collection of compliance-related information. GuardDuty focuses on threat detection, Network Firewall controls network traffic, and Inspector identifies workload vulnerabilities. Audit Manager is therefore appropriate when the primary requirement is collecting and organizing evidence that demonstrates how an AWS environment meets defined control requirements.

Question 295

Which service provides AWS compliance reports and legal agreements?

1. AWS Config
2. AWS Artifact
3. Amazon Inspector
4. AWS Systems Manager

Correct Answer: 1

Explanation:

AWS Artifact provides access to AWS security and compliance documentation, including reports and agreements relevant to customers’ regulatory and contractual requirements. Security, compliance, and audit teams can use Artifact when reviewing AWS certifications and other official documentation. Config records resource configurations and evaluates compliance rules, Inspector assesses supported workloads for vulnerabilities, and Systems Manager provides operational management capabilities. Artifact is specifically focused on delivering AWS compliance materials rather than evaluating customer resources or managing application infrastructure.

Question 296

Which Systems Manager feature executes commands across managed instances without interactive login?

1. Session Manager
2. Patch Manager
3. Run Command
4. Automation

Correct Answer: 2

Explanation:

AWS Systems Manager Run Command allows administrators to execute commands remotely on managed instances without requiring an interactive shell connection. It can be used for administrative tasks such as configuration changes, diagnostics, software operations, and other command-based activities across one or more instances. Session Manager provides interactive shell sessions, Patch Manager handles patch operations, and Automation runs predefined or custom workflows. Run Command is therefore the appropriate capability when administrators need to send commands to managed instances without establishing a traditional interactive login session.

Question 297

Which Systems Manager capability automates operational workflows using runbooks?

1. State Manager
2. Automation
3. Inventory
4. Fleet Manager

Correct Answer: 2

Explanation:

AWS Systems Manager Automation uses runbooks to automate common maintenance, deployment, remediation, and operational procedures. Runbooks can contain sequences of actions that execute against AWS resources or managed instances, helping organizations standardize repetitive administrative tasks. State Manager maintains desired instance configurations, Inventory collects metadata about managed instances, and Fleet Manager provides operational visibility and management features. Automation is especially useful for security response because predefined runbooks can perform consistent remediation actions without requiring administrators to manually execute every step.

Question 298

Which AWS capability can automatically invoke remediation after a security event is detected?

1. EventBridge rule
2. S3 lifecycle action
3. KMS alias
4. Route 53 health check

Correct Answer: 3

Explanation:

Amazon EventBridge rules can match events from AWS services and route matching events to supported targets such as Lambda functions, Systems Manager automation, or other services. Security teams can use this event-driven model to trigger remediation when a finding or configuration change occurs. For example, an event can invoke a workflow that modifies a resource or initiates an investigation. S3 lifecycle actions manage object storage, KMS aliases identify encryption keys, and Route 53 health checks monitor endpoints. EventBridge rules provide the event-routing mechanism needed for automated security response workflows.

Question 299

Which AWS service can centrally manage security group policies across multiple accounts?

1. AWS Firewall Manager
2. Amazon Detective
3. AWS Artifact
4. Amazon Macie

Correct Answer: 4

Explanation:

AWS Firewall Manager can centrally manage supported security group policies across AWS Organizations. Administrators can define common security requirements and apply them consistently across accounts and resources rather than manually configuring every security group. This is useful for enforcing organization-wide network security standards and reducing configuration drift. Detective supports security investigations, Artifact provides compliance documentation, and Macie focuses on sensitive data discovery. Firewall Manager is therefore the service designed for centralized administration of supported security group policies across multiple AWS accounts.

Question 300

Which AWS service can centrally govern accounts using organizational guardrails?

1. AWS Control Tower
2. Amazon Inspector
3. AWS CloudHSM
4. Amazon Cognito

Correct Answer: 3

Explanation:

AWS Control Tower helps establish governance across a multi-account AWS environment through organizational controls, account provisioning workflows, and guardrails. It provides a structured approach for maintaining security and compliance standards as accounts are created and managed. Inspector focuses on vulnerability assessment, CloudHSM provides dedicated cryptographic hardware, and Cognito manages application identities. Control Tower is therefore the relevant service when an organization needs centralized account governance and standardized controls across its AWS environment.