View Full Amazon AWS Certified Security – Specialty SCS-C02 Exam Dumps and Practice Test Dumps

 

Question 321

Which AWS feature prevents an IAM role from being assumed outside approved network locations?

1. An identity policy using aws:SourceIp
2. An S3 lifecycle configuration
3. A KMS alias restriction
4. A CloudTrail event selector

Correct Answer: 1
Explanation:

The aws:SourceIp global condition key can restrict requests according to their originating IP address. When placed appropriately in an IAM policy, it can help limit role usage to approved network ranges. This is useful when organizations require administrative access only from corporate networks, VPNs, or known security infrastructure. The restriction must be designed carefully because AWS services and proxy architectures can affect the source IP observed by AWS. S3 lifecycle rules manage objects, KMS aliases identify keys, and CloudTrail event selectors determine which events are recorded. None of those mechanisms directly enforce an IAM network-origin condition.

Question 322

How can an organization prevent an IAM principal from creating resources outside approved Regions?

1. Configure an S3 replication rule
2. Apply an SCP using aws:RequestedRegion
3. Enable CloudTrail Insights
4. Create a Route 53 health check

Correct Answer: 2
Explanation:

An AWS Organizations service control policy can use the aws:RequestedRegion condition key to restrict API operations to approved AWS Regions. This creates a preventive governance boundary across accounts when attached appropriately. The SCP does not grant permissions itself; instead, it limits the maximum permissions available to principals in affected accounts. This approach is useful for organizations with regulatory, residency, or operational requirements that prohibit resource deployment in certain Regions. S3 replication handles object movement, CloudTrail Insights detects unusual API activity, and Route 53 health checks monitor endpoints. They do not provide an organization-wide Region restriction for API requests.

Question 323

Which KMS capability lets an application delegate limited key operations without changing the key policy?

1. Key aliases
2. Automatic rotation
3. KMS grants
4. Imported key material

Correct Answer: 3
Explanation:

AWS KMS grants allow temporary or controlled delegation of specific cryptographic operations to AWS principals without requiring a permanent modification to the KMS key policy. A grant can specify operations such as encryption, decryption, or grant creation and can include constraints that narrow its use. This is especially useful for AWS services that need controlled access to customer managed keys. Aliases provide friendly names, rotation changes key material according to supported schedules, and imported key material controls how key material enters KMS. Grants are therefore the mechanism designed for delegated, granular cryptographic permissions.

Question 324

What does an IAM role trust policy primarily determine?

1. Which AWS resources the role can access
2. Which principals can assume the role
3. Which Regions the role can operate in
4. How long CloudTrail retains events

Correct Answer: 2
Explanation:

An IAM role has two important policy dimensions: its trust policy and its permissions policies. The trust policy identifies who or what is allowed to assume the role. It can specify AWS accounts, IAM roles, users, AWS services, or federated identities as trusted principals, along with conditions such as external IDs or MFA requirements. The permissions policies attached to the role determine what actions can be performed after the role is assumed. Therefore, a trust policy is fundamentally about establishing the role’s assumption relationship rather than granting access to AWS resources.

Question 325

Which S3 setting requires every uploaded object to use a bucket owner-controlled ownership model?

1. Bucket owner enforced
2. Intelligent-Tiering
3. S3 Inventory
4. Transfer Acceleration

Correct Answer: 1
Explanation:

S3 Object Ownership with Bucket owner enforced disables object ACLs and makes the bucket owner automatically own objects uploaded to the bucket. This simplifies access management by moving authorization toward IAM and bucket policies instead of relying on object-level ACLs. It is particularly useful in centralized data platforms where multiple accounts upload objects into a shared destination. Intelligent-Tiering manages storage-class transitions, S3 Inventory generates reports about objects, and Transfer Acceleration optimizes supported transfers over AWS edge locations. None of these settings establishes ownership of uploaded objects. Bucket owner enforced directly addresses cross-account object ownership concerns.

Question 326

Which service can continuously identify sensitive data in Amazon S3 using managed data identifiers?

1. AWS Audit Manager
2. Amazon Macie
3. AWS Artifact
4. AWS Organizations

Correct Answer: 2
Explanation:

Amazon Macie is designed to discover and classify sensitive data stored in Amazon S3. It uses managed and custom data identifiers to identify information such as credentials, financial data, and personally identifiable information. Macie can provide findings when potentially sensitive content is detected and can help organizations understand the exposure of sensitive S3 data. Audit Manager focuses on evidence collection for compliance assessments, Artifact provides access to AWS compliance documentation, and Organizations manages multiple AWS accounts. Macie therefore fits the requirement for automated sensitive-data discovery within S3.

Question 327

What is the primary security purpose of an AWS CloudHSM cluster?

1. Store application logs
2. Scan container images
3. Provide dedicated hardware-backed cryptographic processing
4. Filter HTTP requests

Correct Answer: 3
Explanation:

AWS CloudHSM provides dedicated hardware security modules that allow customers to generate, store, and use cryptographic keys within hardware designed for secure key operations. Unlike fully managed AWS KMS keys, CloudHSM gives customers more direct control over the HSM environment and cryptographic configuration. It can be useful when applications or compliance requirements demand dedicated HSM capabilities. Application logs are handled by services such as CloudWatch or CloudTrail, container image scanning is associated with Amazon Inspector, and HTTP filtering can be performed by AWS WAF. CloudHSM specifically addresses hardware-backed cryptographic requirements.

Question 328

Which mechanism helps prevent a confused-deputy problem when a third party assumes an IAM role?

1. An S3 storage-class transition
2. An external ID condition
3. A CloudFront cache policy
4. A VPC route table

Correct Answer: 2
Explanation:

An external ID is commonly used when a third-party service assumes a role in a customer’s AWS account. The customer includes a condition requiring a specific external ID in the role trust policy. This helps ensure that the trusted third party can assume the role only in the intended customer relationship and reduces the risk associated with confused-deputy scenarios. Storage-class transitions manage S3 costs, CloudFront cache policies control caching behavior, and VPC route tables determine network routing. The external ID is specifically associated with secure cross-account role assumption by external parties.

Question 329

Which AWS capability allows CloudTrail events to be queried and analyzed using SQL-like queries?

1. CloudTrail Lake
2. AWS Certificate Manager
3. Amazon Route 53 Resolver
4. AWS Firewall Manager

Correct Answer: 1
Explanation:

AWS CloudTrail Lake provides a managed environment for aggregating, storing, and querying CloudTrail activity. Security teams can use SQL-like queries to investigate API activity across accounts and Regions without building their own log-processing pipeline. This can simplify investigations involving identity activity, resource changes, or suspicious API behavior. AWS Certificate Manager manages certificates, Route 53 Resolver provides DNS resolution capabilities, and Firewall Manager centrally manages supported firewall and security policies. CloudTrail Lake is specifically designed to make CloudTrail activity easier to retain and analyze as an event data store.

Question 330

Which IAM policy type can restrict permissions granted by identity policies without granting permissions itself?

1. Resource-based policy
2. Session policy
3. Permissions boundary
4. Service-linked role policy

Correct Answer: 3
Explanation:

An IAM permissions boundary establishes the maximum permissions that an IAM principal can receive through identity-based policies. It does not itself grant permissions. For an action to succeed, the principal must have an applicable identity-based permission, and that permission must remain within the effective boundary and other applicable policy controls. This makes permissions boundaries useful for delegated administration, where teams may create roles or users but should not be able to exceed centrally defined limits. Resource policies attach to resources, session policies can restrict role sessions, and service-linked roles support specific AWS services.

Question 331

Which S3 control can require version-specific object deletion to use MFA?

1. S3 Transfer Acceleration
2. MFA Delete
3. S3 Inventory
4. Object Lambda

Correct Answer: 2
Explanation:

S3 MFA Delete adds an additional authentication requirement for certain operations involving versioned objects, particularly permanent deletion of object versions. It is designed to reduce the chance that an attacker or unauthorized administrator can permanently remove protected data using only normal credentials. Versioning itself preserves multiple object versions, but MFA Delete introduces an additional authentication control for sensitive version-management operations. Transfer Acceleration improves transfer performance, Inventory generates object metadata reports, and S3 Object Lambda modifies data returned through supported access patterns. MFA Delete is therefore the control associated with stronger protection against unauthorized permanent version deletion.

Question 332

Which AWS service can scan Lambda functions for software vulnerabilities?

1. Amazon Inspector
2. Amazon Macie
3. AWS Security Hub
4. Amazon Detective

Correct Answer: 1
Explanation:

Amazon Inspector can assess supported AWS workloads, including Lambda functions, for software vulnerabilities and package-related security issues. Its findings can help security teams identify vulnerable dependencies and prioritize remediation. Inspector is focused on vulnerability management rather than broader security posture aggregation or investigation. Macie concentrates on sensitive data discovery in Amazon S3. Security Hub aggregates and correlates security findings from supported AWS services and third-party products. Detective helps investigate relationships and activity surrounding security findings. Thus, Inspector is the service directly associated with vulnerability assessment of supported Lambda workloads.

Question 333

What does a KMS key deletion waiting period primarily provide?

1. Immediate destruction of key material
2. A recovery window before permanent deletion
3. Automatic migration to another Region
4. Conversion of a key into an alias

Correct Answer: 2
Explanation:

AWS KMS uses a waiting period when a customer managed KMS key is scheduled for deletion. During this period, the key remains available according to its deletion state and can be canceled, allowing administrators to recover from an accidental or premature deletion request. The waiting period therefore acts as an operational safeguard against irreversible cryptographic key loss. It does not immediately destroy the key, migrate it to another Region, or convert it into an alias. Security teams should carefully manage deletion permissions because losing a key can make encrypted data permanently inaccessible if no other valid decryption path exists.

Question 334

Which service provides temporary shell access to EC2 instances without requiring inbound SSH ports?

1. Amazon CloudFront
2. AWS Systems Manager Session Manager
3. Amazon GuardDuty
4. AWS Config

Correct Answer: 2
Explanation:

AWS Systems Manager Session Manager provides interactive access to managed EC2 instances without requiring administrators to expose inbound SSH or RDP ports. The connection is established through the Systems Manager agent and AWS service infrastructure, allowing organizations to reduce publicly reachable management surfaces. Access can also be controlled using IAM permissions and logged for auditing purposes. CloudFront distributes web content, GuardDuty detects threats, and AWS Config records resource configuration information. Session Manager is therefore a security-focused alternative to opening traditional remote administration ports on instances.

Question 335

Which CloudFront security feature provides a service-to-service trust relationship for private S3 origins?

1. Origin Access Control
2. S3 Transfer Acceleration
3. Bucket Lifecycle Rules
4. CloudFront Functions

Correct Answer: 1
Explanation:

CloudFront Origin Access Control, or OAC, allows CloudFront to securely access an S3 origin while keeping direct public access to the bucket restricted. The S3 bucket policy can authorize requests from the designated CloudFront distribution rather than allowing anonymous access. This supports a design in which users retrieve content through CloudFront while the S3 bucket remains private. Transfer Acceleration addresses transfer performance, lifecycle rules manage object transitions and expiration, and CloudFront Functions execute lightweight edge logic. OAC is specifically designed to establish controlled access between CloudFront and supported origins such as S3.

Question 336

Which AWS service records load balancer request information for later security analysis?

1. Amazon Inspector
2. AWS Audit Manager
3. Elastic Load Balancing access logs
4. AWS Resource Access Manager

Correct Answer: 3
Explanation:

Elastic Load Balancing access logs capture detailed information about requests processed by supported load balancers. These logs can contain request-related details useful for troubleshooting, traffic analysis, and security investigations. Organizations can store the logs in Amazon S3 and integrate them with analysis workflows. Inspector focuses on vulnerability assessment, Audit Manager supports compliance evidence collection, and Resource Access Manager shares supported resources across AWS accounts. Access logging is therefore the appropriate mechanism when security teams need historical visibility into load balancer traffic and request patterns.

Question 337

Which KMS option lets an organization use cryptographic keys backed by an external key management system?

1. KMS external key store
2. KMS alias
3. KMS grant token
4. KMS automatic rotation

Correct Answer: 1
Explanation:

AWS KMS external key store, or XKS, provides an integration model in which cryptographic key material is held and controlled outside AWS KMS by an external key manager that meets the supported interface requirements. This can help organizations that require external control over key material while still using AWS KMS APIs for supported cryptographic operations. An alias is simply a friendly identifier, a grant token is associated with grant propagation, and automatic rotation manages supported KMS key material rotation. XKS specifically addresses scenarios where an external key management system must remain involved in cryptographic key control.

Question 338

Which VPC Flow Logs destination can support centralized retention and later querying?

1. Amazon S3
2. Amazon Cognito
3. AWS Certificate Manager
4. Amazon ElastiCache

Correct Answer: 1
Explanation:

VPC Flow Logs can be delivered to Amazon S3, where organizations can centrally retain network-flow records and integrate them with analytics or security investigation workflows. S3 provides durable object storage and can support lifecycle, access-control, and retention configurations appropriate for security logs. Cognito manages application identity and user authentication, Certificate Manager handles certificates, and ElastiCache provides in-memory caching. Flow logs stored in S3 can be useful for investigating communication patterns, rejected connections, unexpected destinations, and network-level indicators during security incidents.

Question 339

Which Security Lake characteristic standardizes security data using the OCSF schema?

1. Centralized normalization of security events
2. Automatic password rotation
3. Application-layer firewall filtering
4. Hardware key generation

Correct Answer: 1
Explanation:

Amazon Security Lake uses the Open Cybersecurity Schema Framework, or OCSF, to normalize supported security data into a standardized structure. This makes security information from different sources easier to analyze consistently because fields and event categories follow a common schema. Security teams can use normalized data for investigations, analytics, detection engineering, and integration with security tools. Password rotation is handled by services such as Secrets Manager, application-layer filtering is associated with services such as AWS WAF, and hardware-backed cryptographic processing can be provided by CloudHSM. OCSF normalization is a central characteristic of Security Lake.

Question 340

Which control helps ensure a KMS key cannot be used outside an approved AWS account context?

1. An S3 lifecycle rule
2. A KMS key policy condition
3. A CloudFront origin request policy
4. An EC2 placement group

Correct Answer: 2
Explanation:

A KMS key policy can include condition keys that restrict how and by whom the key may be used. Security teams can use conditions involving account, principal, encryption context, or other supported attributes to create more precise authorization boundaries. This is particularly useful for customer managed keys shared across services or accounts where unrestricted use would create unnecessary risk. S3 lifecycle rules manage object retention, CloudFront origin request policies control forwarded request information, and EC2 placement groups influence instance placement. The KMS key policy remains the central authorization mechanism for controlling access to a customer managed KMS key.