View Full Amazon AWS Certified Security – Specialty SCS-C02 Exam Dumps and Practice Test Dumps

 

Question 341

Which S3 feature can retain deleted objects for forensic investigation?

1. S3 Transfer Acceleration
2. S3 Select
3. S3 Batch Operations
4. S3 Versioning

Correct Answer: 4
Explanation:

Amazon S3 Versioning preserves multiple versions of an object, including versions that result from overwrite or deletion operations. This can be valuable during security investigations because a deleted or modified object may still have an earlier version available for examination. Security teams can combine versioning with Object Lock, restrictive permissions, and logging to strengthen evidence preservation. Transfer Acceleration improves transfer performance, S3 Select filters object contents during retrieval, and Batch Operations performs large-scale object actions. Versioning specifically provides historical object states that can assist with recovery and forensic analysis after accidental or malicious changes.

Question 342

Which IAM feature limits a role session beyond its attached permissions?

1. Service control policy
2. Session policy
3. Resource tag
4. Identity center directory

Correct Answer: 2
Explanation:

An IAM session policy can further restrict the permissions available during a particular role session. It does not expand the permissions granted by the role. Instead, the effective permissions are constrained by the intersection of the role’s identity-based permissions and the applicable session policy. This can be useful when temporary credentials need narrower access than the underlying role normally permits. Service control policies establish organization-level permission boundaries, resource tags provide metadata for resources, and an IAM Identity Center directory manages identities. Session policies are specifically useful when temporary role sessions require additional permission restrictions.

Question 343

What does AWS RAM primarily enable across AWS accounts?

1. Sharing supported resources
2. Encrypting EBS volumes
3. Inspecting container images
4. Recording API events

Correct Answer: 1
Explanation:

AWS Resource Access Manager, or AWS RAM, allows supported AWS resources to be shared across AWS accounts, organizational units, or an entire AWS Organization. Resource sharing can reduce duplication and centralize infrastructure while maintaining controlled access. Examples of shareable resources include certain network and infrastructure components. RAM itself does not provide encryption for EBS volumes, vulnerability scanning for container images, or API-event recording. Those responsibilities belong to other AWS services. From a security perspective, RAM should be configured carefully so that shared resources are exposed only to intended principals and accounts.

Question 344

Which control can prevent an S3 bucket from accepting unencrypted uploads?

1. S3 Inventory
2. Bucket policy requiring encryption headers
3. S3 Lifecycle
4. Multipart upload configuration

Correct Answer: 2
Explanation:

An S3 bucket policy can require specific encryption-related request attributes before allowing an object upload. For example, a policy can deny PutObject requests that do not use an approved server-side encryption mechanism. This creates a preventive control rather than merely detecting unencrypted objects after they arrive. S3 Inventory produces reports about stored objects, Lifecycle manages retention and transitions, and multipart upload controls how large objects are uploaded in parts. A bucket policy is therefore the appropriate mechanism for enforcing encryption requirements at the time objects are written.

Question 345

Which AWS capability can create a private certificate authority hierarchy?

1. AWS Private Certificate Authority
2. Amazon Detective
3. AWS Shield
4. Amazon Inspector

Correct Answer: 1
Explanation:

AWS Private Certificate Authority, commonly called AWS Private CA, allows organizations to create and operate private certificate authorities within AWS. It can issue certificates for internal applications, services, devices, and workloads that do not need certificates from a public certificate authority. Organizations can establish CA hierarchies and integrate certificate issuance with supported AWS services and applications. Detective focuses on security investigations, Shield provides DDoS protection, and Inspector assesses vulnerabilities. Private CA is therefore the appropriate service when an organization requires its own internal public-key infrastructure and certificate issuance capability.

Question 346

What is a primary security benefit of EBS encryption by default?

1. It blocks all snapshot creation
2. It automatically encrypts new supported volumes
3. It disables cross-account access
4. It removes the need for IAM

Correct Answer: 2
Explanation:

EBS encryption by default ensures that newly created supported EBS volumes and certain related resources are encrypted automatically within the configured Region. This reduces the possibility that an administrator or application accidentally creates unencrypted storage. Organizations can use AWS managed or customer managed KMS keys according to their requirements. The setting does not prevent snapshot creation, eliminate all cross-account access considerations, or replace IAM authorization. Encryption by default is primarily a preventive storage-protection measure that establishes encryption as the standard behavior for new EBS resources.

Question 347

Which RDS capability protects database storage using AWS KMS encryption?

1. Performance Insights
2. Enhanced Monitoring
3. Encryption at rest
4. Database Activity Streams

Correct Answer: 3
Explanation:

Amazon RDS encryption at rest protects supported database storage, automated backups, read replicas, and snapshots associated with an encrypted database using AWS KMS. Customer managed KMS keys can provide additional control over key policies and lifecycle management. Encryption at rest is distinct from monitoring and auditing capabilities. Performance Insights provides database performance information, Enhanced Monitoring supplies operating-system metrics, and Database Activity Streams focuses on database activity auditing for supported engines. For protecting the underlying stored database data from unauthorized access to storage media, RDS encryption at rest is the relevant security control.

Question 348

Which mechanism can restrict an interface VPC endpoint to selected API actions?

1. Endpoint policy
2. Network ACL
3. Route table propagation
4. DHCP option set

Correct Answer: 1
Explanation:

An interface VPC endpoint can have an endpoint policy that controls which principals can perform supported actions through the endpoint. This provides an additional authorization layer for private access to AWS services. For example, an organization may permit access to a service while limiting the specific resources or operations that can be reached through the endpoint. Network ACLs operate at the subnet network boundary, route tables control traffic paths, and DHCP option sets provide network configuration parameters. Endpoint policies are therefore the mechanism designed to refine authorization for traffic reaching supported AWS services through VPC endpoints.

Question 349

Which GuardDuty protection can identify suspicious activity involving Amazon EKS clusters?

1. EKS Protection
2. Macie classification
3. Config conformance packs
4. CloudTrail Lake

Correct Answer: 1
Explanation:

Amazon GuardDuty EKS Protection extends threat detection to Kubernetes activity associated with Amazon EKS. It can analyze relevant activity and generate findings when behavior matches supported threat-detection scenarios. This helps security teams identify suspicious actions involving containerized workloads without relying exclusively on traditional host-based controls. Macie focuses on sensitive S3 data, AWS Config evaluates resource configuration, and CloudTrail Lake provides storage and querying capabilities for CloudTrail events. EKS Protection is therefore the GuardDuty capability specifically associated with security monitoring of EKS environments.

Question 350

Which control helps prevent unrestricted cross-account use of a KMS key?

1. KMS alias naming
2. Key policy authorization
3. CloudWatch dashboard
4. S3 replication rule

Correct Answer: 2
Explanation:

KMS key policies determine which principals are authorized to use or manage a customer managed KMS key. When cross-account access is required, the key policy and the requesting account’s IAM permissions must be configured consistently. Administrators can use explicit principals and conditions to narrow the permitted access rather than allowing broad account-level usage. An alias provides a convenient key identifier, CloudWatch dashboards visualize metrics, and S3 replication moves objects between buckets. The key policy is therefore the central control for limiting who can use a KMS key across account boundaries.

Question 351

Which service can continuously evaluate AWS resource configurations against security rules?

1. AWS Config
2. Amazon Cognito
3. AWS Artifact
4. Amazon CloudFront

Correct Answer: 1
Explanation:

AWS Config records resource configurations and evaluates them against configurable rules. Security teams can use Config rules to identify resources that violate organizational requirements, such as overly permissive security groups, missing encryption settings, or unsupported configurations. Config can also provide historical configuration information that helps investigators understand when a resource changed. Cognito provides application identity capabilities, Artifact provides AWS compliance documentation, and CloudFront delivers content through a global distribution network. AWS Config is therefore the service used for continuous configuration assessment against defined compliance or security requirements.

Question 352

What is the main purpose of a Security Hub automation rule?

1. Create IAM users
2. Automatically update matching findings
3. Encrypt S3 objects
4. Rotate database credentials

Correct Answer: 2
Explanation:

AWS Security Hub automation rules allow organizations to automatically update security findings when they match defined criteria. Rules can be used to change finding status, severity, workflow status, or other supported attributes based on organizational processes. This reduces repetitive manual handling and helps standardize security operations. Automation rules do not create IAM users, directly encrypt S3 objects, or rotate database credentials. Those tasks are handled through other AWS services and controls. Security Hub automation is particularly useful for routing, suppressing, prioritizing, or updating findings according to consistent operational conditions.

Question 353

Which S3 Object Lock mode prevents protected objects from being permanently deleted before retention expires?

1. Governance mode
2. Compliance mode
3. Intelligent-Tiering
4. One Zone-IA

Correct Answer: 2
Explanation:

S3 Object Lock Compliance mode provides strong immutability by preventing protected object versions from being deleted or overwritten during their retention period, including by users with elevated permissions. This makes it appropriate for situations where regulatory or legal requirements demand strict write-once-read-many behavior. Governance mode provides retention protection with special administrative considerations, while Intelligent-Tiering and One Zone-IA are storage classes rather than retention controls. Compliance mode is particularly important when evidence or regulated records must remain immutable for a defined period and ordinary administrative privileges should not bypass the retention requirement.

Question 354

Which AWS service can aggregate findings from multiple security services into one view?

1. AWS Secrets Manager
2. Amazon Security Hub
3. AWS Private CA
4. Amazon Route 53

Correct Answer: 2
Explanation:

Amazon Security Hub provides centralized visibility into security findings from supported AWS services and integrated third-party security products. It normalizes findings and presents them in a consolidated security view, making it easier for teams to identify and manage security issues across accounts and Regions. Security Hub can also support standards checks and automated finding workflows. Secrets Manager manages credentials and secrets, Private CA manages private certificates, and Route 53 provides DNS services. Security Hub is therefore the service designed to consolidate security findings from multiple sources into a central operational view.

Question 355

Which mechanism can identify unusual API activity for investigation?

1. CloudTrail event history
2. S3 storage class
3. ACM certificate renewal
4. EBS volume type

Correct Answer: 1
Explanation:

AWS CloudTrail event history provides a searchable record of recent management activity made through AWS APIs, consoles, SDKs, and command-line tools. Security teams can use it to investigate unexpected actions such as changes to IAM permissions, security groups, KMS policies, or resource configurations. For longer-term centralized analysis, organizations can also configure trails or CloudTrail Lake. S3 storage classes manage object storage characteristics, ACM handles certificates, and EBS volume types determine storage performance characteristics. CloudTrail event history is therefore a practical starting point when investigating suspicious API activity.

Question 356

Which feature can require MFA before a role is assumed?

1. S3 bucket notification
2. IAM trust-policy condition
3. CloudFront invalidation
4. VPC endpoint route

Correct Answer: 2
Explanation:

An IAM role trust policy can include conditions that require MFA for role assumption. This is useful when organizations want stronger authentication assurance before granting temporary elevated or sensitive permissions. The trust relationship can combine the trusted principal with conditions such as MFA requirements and other supported context keys. S3 notifications trigger downstream actions when bucket events occur, CloudFront invalidations remove cached content, and VPC routing determines packet paths. The trust-policy condition directly controls whether an authentication requirement is satisfied before the principal can obtain the role’s temporary credentials.

Question 357

Which AWS service is designed to investigate relationships among security events and resources?

1. AWS Firewall Manager
2. Amazon Detective
3. AWS Certificate Manager
4. Amazon ECR

Correct Answer: 2
Explanation:

Amazon Detective helps security teams investigate security findings by analyzing relationships among resources, users, IP addresses, API activity, and other relevant behavior. It builds an investigation-oriented view from supported data sources, helping analysts understand what happened before, during, and after suspicious activity. Firewall Manager centrally manages supported security policies, Certificate Manager handles certificates, and Amazon ECR provides container image storage. Detective is therefore particularly useful after a security alert has been generated and analysts need contextual information to understand the sequence and relationships associated with the event.

Question 358

Which backup control can help enforce immutable retention requirements?

1. Backup Vault Lock
2. EC2 user data
3. Route 53 Resolver rule
4. IAM access key

Correct Answer: 1
Explanation:

AWS Backup Vault Lock helps enforce retention controls for recovery points stored in a backup vault. Once configured according to its supported settings and requirements, it can prevent backup recovery points from being prematurely deleted or retention periods from being shortened. This provides an important defense against attempts to destroy backups during ransomware or other destructive incidents. EC2 user data configures instance initialization behavior, Resolver rules influence DNS resolution, and IAM access keys provide programmatic credentials. Backup Vault Lock specifically addresses immutability and retention protection for backups.

Question 359

Which service can detect exposed secrets in source-code repositories?

1. AWS WAF
2. Amazon Macie
3. Amazon CodeGuru Security
4. AWS Shield

Correct Answer: 3
Explanation:

Amazon CodeGuru Security can identify security vulnerabilities and coding issues in application source code, including certain types of sensitive information exposure. Detecting credentials or secrets in code is important because committed credentials can potentially be used to access AWS resources or other systems. Security teams should combine automated detection with credential revocation, secure secret storage, and repository controls. AWS WAF protects web applications from supported request threats, Macie focuses on sensitive data in S3, and Shield provides DDoS protection. CodeGuru Security is therefore the relevant application-code security capability among these choices.

Question 360

Which IAM mechanism can require a specific organizational context for requests?

1. S3 Object Lock
2. aws:PrincipalOrgID condition
3. KMS automatic rotation
4. CloudTrail Insights

Correct Answer: 2
Explanation:

The aws:PrincipalOrgID global condition key can be used in supported resource policies to restrict access to principals belonging to a specific AWS Organization. This is useful for creating organization-wide data access boundaries while avoiding long lists of individual account IDs. For example, a resource policy can permit access only when the requesting principal belongs to the organization’s identifier. S3 Object Lock controls object retention, KMS automatic rotation manages supported key material rotation, and CloudTrail Insights detects unusual API activity patterns. The organization ID condition directly addresses organizational-context authorization.