View Full Amazon AWS Certified Security – Specialty SCS-C02 Exam Dumps and Practice Test Dumps

 

Question 301

Which KMS feature lets an application use the same key material across Regions?

1. Multi-Region key
2. Key alias
3. Grant token
4. Imported key

Correct Answer: 1

Explanation:

AWS KMS Multi-Region keys allow related KMS keys to share the same underlying key material across different AWS Regions. A primary key can have replica keys in other Regions, allowing applications with cross-Region architectures to perform cryptographic operations using related keys. Each key remains a regional KMS resource, but the shared key material provides continuity for supported encryption workflows. Key aliases provide friendly names, grant tokens support certain grant authorization scenarios, and imported keys concern externally supplied key material. Multi-Region keys are particularly useful when applications process encrypted data across multiple geographic Regions.

Question 302

Which S3 capability gives applications separate policies for shared bucket access?

1. Object Lock
2. Access Point
3. Bucket Key
4. Inventory

Correct Answer: 3

Explanation:

S3 Access Points provide dedicated access endpoints with individual policies for applications or groups accessing a shared S3 bucket. This allows administrators to create separate access controls for different workloads without placing every application’s requirements into one large bucket policy. Access Points can be configured with network restrictions and permissions appropriate to particular use cases. Object Lock protects objects from modification or deletion, Bucket Keys optimize KMS request usage for SSE-KMS encryption, and Inventory produces object reports. Access Points are therefore the appropriate feature when multiple applications need distinct controlled access to shared S3 data.

Question 303

Which IAM feature can prevent developers from creating excessively privileged roles?

1. Trust policy
2. Access key
3. Permissions boundary
4. Session tag

Correct Answer: 4

Explanation:

An IAM permissions boundary establishes the maximum permissions that an IAM identity can receive through applicable identity-based policies. This makes it useful when administrators delegate identity creation to developers but need to prevent those developers from creating roles with unrestricted privileges. The boundary does not grant permissions by itself; effective permissions must also be allowed by applicable policies. A trust policy controls who can assume a role, access keys provide programmatic credentials, and session tags provide attributes associated with a session. Permissions boundaries therefore provide a strong control for delegated IAM administration and privilege containment.

Question 304

Which STS mechanism is commonly used for third-party cross-account access?

1. AssumeRole
2. GetCallerIdentity
3. DecodeAuthorizationMessage
4. GetAccessKeyInfo

Correct Answer: 2

Explanation:

AWS STS AssumeRole allows a trusted external principal to obtain temporary credentials for an IAM role in another AWS account. This is commonly used when a third-party provider needs controlled access to customer resources. The role trust policy can specify the trusted principal and additional conditions, such as an external ID, to strengthen the trust relationship. GetCallerIdentity returns information about the current identity, DecodeAuthorizationMessage helps interpret certain encoded authorization messages, and GetAccessKeyInfo identifies the account associated with an access key. AssumeRole is the standard mechanism for controlled cross-account temporary access.

Question 305

Which S3 setting makes uploaded objects owned by the bucket account?

1. Bucket owner enforced
2. Versioning enabled
3. Object replication
4. Request payer

Correct Answer: 4

Explanation:

S3 Object Ownership with Bucket owner enforced makes the bucket-owning account the owner of objects uploaded to that bucket and disables ACLs for the bucket. This simplifies access management because ownership no longer depends on which AWS account uploaded the object. Administrators can instead rely primarily on IAM policies, bucket policies, and related controls. Versioning preserves multiple object versions, replication copies objects to other locations, and Requester Pays changes how request and data-transfer charges are handled. Bucket owner enforced is therefore the appropriate setting when centralized ownership and simplified authorization are required.

Question 306

Which AWS service can identify exposed credentials through threat-detection findings?

1. AWS Artifact
2. Amazon GuardDuty
3. AWS Backup
4. Amazon EFS

Correct Answer: 1

Explanation:

Amazon GuardDuty provides managed threat detection and can generate findings associated with suspicious credential-related activity. Depending on the enabled protection features and available data sources, findings can indicate potentially compromised credentials, unusual API behavior, or other indicators of malicious activity. Artifact supplies compliance documentation, Backup protects recovery data, and EFS provides managed file storage. GuardDuty is designed to analyze security-relevant activity and produce findings for investigation. Security teams can then use those findings with services such as Security Hub and Detective to coordinate analysis and response.

Question 307

Which service can inspect container images before deployment for known vulnerabilities?

1. Amazon Macie
2. AWS Config
3. Amazon Inspector
4. AWS Audit Manager

Correct Answer: 3

Explanation:

Amazon Inspector can assess container images stored in Amazon ECR for known software vulnerabilities. It examines supported packages and dependencies and generates findings when vulnerable components are identified. This allows development and security teams to discover issues before affected container images become active workloads. Macie focuses on sensitive data discovery, Config evaluates resource configurations, and Audit Manager gathers compliance evidence. Inspector’s container scanning capability is therefore relevant when an organization wants vulnerability visibility within its software supply chain and wants to address known package weaknesses before deployment.

Question 308

Which AWS service helps investigate suspicious relationships between users and resources?

1. AWS WAF
2. Amazon Detective
3. AWS Shield
4. Amazon Macie

Correct Answer: 2

Explanation:

Amazon Detective is designed to help security teams investigate activity surrounding security findings by analyzing relationships among users, resources, IP addresses, API activity, and other available signals. Instead of simply identifying an alert, it helps analysts understand the context and connections surrounding that activity. AWS WAF filters web requests, Shield provides DDoS protection, and Macie discovers sensitive data in S3. Detective is therefore appropriate when investigators need additional context to understand how identities, resources, and activities may be connected during a security investigation.

Question 309

Which AWS feature can require encryption keys to be accessed only through approved conditions?

1. KMS key policy
2. S3 lifecycle rule
3. CloudFront cache policy
4. Route 53 record policy

Correct Answer: 1

Explanation:

A KMS key policy controls access to a customer managed KMS key and can include conditions that restrict how principals may use the key. Administrators can use supported condition keys to impose requirements related to principals, encryption context, source services, or other request attributes. This allows key authorization to be more restrictive than simply granting broad cryptographic permissions. S3 lifecycle rules control object transitions and expiration, CloudFront cache policies influence caching behavior, and Route 53 record policies concern DNS routing. KMS key policies are therefore the primary authorization mechanism for controlling access to KMS keys.

Question 310

Which AWS service can block malicious HTTP requests using managed rule groups?

1. AWS Network Firewall
2. Amazon GuardDuty
3. AWS WAF
4. AWS Shield

Correct Answer: 4

Explanation:

AWS WAF protects web applications by inspecting HTTP and HTTPS requests and applying configured web access control rules. Managed rule groups can provide protections against common web-based threats without requiring administrators to build every detection pattern themselves. WAF can be associated with supported services such as CloudFront and Application Load Balancers. Network Firewall operates at the network firewall layer, GuardDuty detects suspicious activity, and Shield provides DDoS protection. WAF is therefore the service specifically intended to filter malicious web requests before they reach protected applications.

Question 311

Which VPC mechanism lets workloads privately reach a supported AWS service?

1. VPC endpoint
2. Internet gateway
3. NAT gateway
4. Public IP address

Correct Answer: 2

Explanation:

VPC endpoints allow resources inside a VPC to communicate privately with supported AWS services without requiring an internet gateway or public IP address for the service connection. Endpoint types include gateway endpoints and interface endpoints, depending on the target service and connectivity model. Internet gateways provide general internet connectivity, NAT gateways allow private resources to initiate outbound internet connections, and public IP addresses expose resources through public networking. VPC endpoints are therefore useful when organizations want AWS service traffic to remain on private network paths and reduce unnecessary exposure to public connectivity.

Question 312

Which AWS service can enforce organization-wide security group controls?

1. AWS Config
2. AWS Firewall Manager
3. Amazon Detective
4. AWS Audit Manager

Correct Answer: 3

Explanation:

AWS Firewall Manager provides centralized administration of supported security group policies across accounts and resources in AWS Organizations. Security teams can use it to establish common controls and reduce configuration differences between accounts. This is particularly valuable in large environments where application teams manage their own resources but must still comply with centrally defined network security requirements. Config evaluates resource configurations, Detective supports investigations, and Audit Manager collects compliance evidence. Firewall Manager is specifically designed to distribute and maintain supported firewall and security group policies across organizational environments.

Question 313

Which CloudTrail feature can record activity against individual DynamoDB items?

1. Management events
2. Data events
3. Insight events
4. Digest events

Correct Answer: 4

Explanation:

CloudTrail data events provide visibility into data-plane operations involving supported resources. For supported DynamoDB configurations, data events can record item-level API activity, providing more detailed visibility than management events. Management events primarily capture control-plane operations such as creating, updating, or deleting resources. Insight events identify unusual API activity patterns, while digest files support CloudTrail log integrity validation. Data events are therefore appropriate when security teams need detailed records of operations performed directly against supported data resources rather than only administrative changes.

Question 314

Which AWS service can apply automated responses to centralized security findings?

1. AWS Security Hub
2. Amazon EFS
3. AWS Artifact
4. Amazon Route 53

Correct Answer: 1

Explanation:

AWS Security Hub supports automation rules that can automatically update or modify supported security findings based on defined criteria. Organizations can use these rules to standardize repetitive security operations, such as changing finding status, assigning ownership information, or applying other supported updates. This can reduce manual effort when security teams receive large numbers of findings from multiple integrated sources. EFS provides file storage, Artifact supplies compliance documents, and Route 53 provides DNS services. Security Hub automation is therefore useful when organizations want consistent handling of centralized security findings.

Question 315

Which AWS service can store secrets without placing passwords directly in application code?

1. AWS Config
2. AWS Secrets Manager
3. Amazon CloudFront
4. AWS Shield

Correct Answer: 2

Explanation:

AWS Secrets Manager provides secure storage and controlled retrieval of sensitive information such as passwords, API credentials, and database secrets. Applications can retrieve secrets programmatically rather than embedding permanent credentials in source code or configuration files. Secrets Manager also supports rotation workflows for supported use cases, helping reduce the lifetime of sensitive credentials. Config evaluates resource configurations, CloudFront delivers content, and Shield protects against DDoS attacks. Secrets Manager is therefore the appropriate service when an application needs centralized protection and lifecycle management for sensitive credentials.

Question 316

Which AWS service can evaluate resources against predefined security standards?

1. Amazon Inspector
2. AWS Security Hub
3. AWS CloudHSM
4. Amazon Cognito

Correct Answer: 3

Explanation:

AWS Security Hub can evaluate an AWS environment against supported security standards and controls, helping organizations identify resources or configurations that do not satisfy selected requirements. It combines this posture-management capability with centralized security findings from supported services and integrations. Inspector focuses primarily on vulnerability assessment, CloudHSM provides dedicated hardware security modules, and Cognito manages application identities. Security Hub is therefore appropriate when an organization needs centralized security posture information alongside findings and control evaluations.

Question 317

Which AWS service can automatically rotate supported database credentials stored as secrets?

1. AWS Secrets Manager
2. AWS Artifact
3. Amazon Macie
4. AWS CloudTrail

Correct Answer: 4

Explanation:

AWS Secrets Manager supports automated rotation for supported secrets and databases through configured rotation workflows. Rotation can periodically change credentials while updating the stored secret so applications can retrieve the current value securely. This reduces dependence on long-lived passwords and supports stronger credential lifecycle management. Artifact provides compliance documentation, Macie discovers sensitive data, and CloudTrail records AWS activity. Secrets Manager is specifically designed to manage the storage, retrieval, and rotation of application credentials and other sensitive secrets.

Question 318

Which AWS service provides private certificate issuance for internal workloads?

1. AWS Certificate Manager Private CA
2. Amazon GuardDuty
3. AWS Network Firewall
4. AWS Audit Manager

Correct Answer: 1

Explanation:

AWS Certificate Manager Private Certificate Authority provides managed private certificate authority capabilities for organizations that need to issue certificates for internal applications, services, devices, or private infrastructure. It allows organizations to create private certificate hierarchies without operating traditional certificate authority servers themselves. GuardDuty detects threats, Network Firewall filters network traffic, and Audit Manager collects compliance evidence. Private CA is therefore the appropriate AWS capability when internal workloads require certificates that are trusted within an organization’s private environment rather than certificates issued by a public certificate authority.

Question 319

Which backup control can protect recovery points from early deletion?

1. Backup plan
2. Backup Vault Lock
3. Backup report
4. Backup selection

Correct Answer: 2

Explanation:

AWS Backup Vault Lock provides retention enforcement for recovery points stored in a backup vault. Depending on its configuration, it can prevent protected recovery points from being deleted or having their retention periods reduced before the required period expires. This creates an additional protection layer against accidental deletion and certain malicious actions affecting backups. A backup plan defines when and how backups are created, backup selections identify resources, and reports provide information about backup activity. Vault Lock specifically addresses the requirement to preserve backup data for a defined retention period.

Question 320

Which AWS capability can trigger remediation when a configuration change occurs?

1. Amazon Macie
2. AWS Artifact
3. Amazon EventBridge
4. AWS CloudHSM

Correct Answer: 3

Explanation:

Amazon EventBridge can receive events from AWS services and route matching events to targets that perform automated actions. A configuration-related event can therefore trigger a remediation workflow, such as invoking Lambda or Systems Manager Automation. This event-driven model helps security teams respond consistently when resources change in ways that violate organizational requirements. Macie focuses on sensitive data discovery, Artifact provides compliance documentation, and CloudHSM supplies dedicated cryptographic hardware. EventBridge is therefore useful for connecting security events and configuration changes to automated remediation processes.