View Full Amazon AWS Certified Security – Specialty SCS-C02 Exam Dumps and Practice Test Dumps

 

Question 381

Which AWS service can securely store application configuration values as encrypted parameters?

1. AWS Artifact
2. Systems Manager Parameter Store
3. Amazon Detective
4. AWS Firewall Manager

Correct Answer: 2

Explanation:

AWS Systems Manager Parameter Store provides centralized storage for configuration data and can store sensitive values as SecureString parameters encrypted with AWS KMS. Applications can retrieve these values through IAM-controlled API calls rather than embedding credentials or configuration secrets directly in source code. Parameter Store is useful for database connection information, API tokens, and environment-specific settings. AWS Artifact provides compliance documents, Detective supports investigations, and Firewall Manager manages centralized security policies. For securely storing application configuration values with controlled access, Parameter Store is the appropriate service.

Question 382

Which S3 feature can replicate objects to a bucket in another AWS account?

1. S3 Cross-Region Replication
2. S3 Select
3. S3 Object Lambda
4. S3 Storage Lens

Correct Answer: 1

Explanation:

S3 replication can copy objects from a source bucket to a destination bucket, including destinations owned by another AWS account when the required permissions and configuration are established. Cross-Region Replication is particularly useful for geographic resilience, disaster recovery, and maintaining copies in separate Regions. Replication rules can target selected objects based on supported filters. S3 Select retrieves portions of object data, Object Lambda can transform retrieved content, and Storage Lens provides storage analytics. Replication is therefore the appropriate mechanism for maintaining synchronized object copies across controlled S3 destinations.

Question 383

Which AWS service can provide managed protection for private keys used by applications through dedicated HSMs?

1. Amazon Macie
2. AWS WAF
3. AWS CloudHSM
4. Amazon Inspector

Correct Answer: 3

Explanation:

AWS CloudHSM provides dedicated hardware security modules that allow organizations to generate, store, and use cryptographic keys within customer-controlled HSM environments. It is designed for workloads that require direct control over cryptographic operations or hardware-backed key storage. CloudHSM can support applications with specialized compliance or cryptographic requirements where managed HSM infrastructure is needed. Macie focuses on sensitive data discovery, WAF protects web applications, and Inspector performs vulnerability assessments. CloudHSM is therefore the service that directly provides dedicated HSM capabilities for cryptographic key protection.

Question 384

Which policy condition can restrict requests to a specific AWS account organization?

1. aws:PrincipalOrgID
2. s3:x-amz-acl
3. kms:ViaService
4. aws:SecureTransport

Correct Answer: 1

Explanation:

The aws:PrincipalOrgID global condition key can restrict resource access to principals that belong to a specified AWS Organization. It is useful for creating organization-wide resource policies without individually listing every trusted account. For example, an S3 bucket policy can use this condition to prevent access from principals outside the organization’s boundary. The s3:x-amz-acl condition relates to S3 ACL headers, kms:ViaService can constrain KMS usage through specified AWS services, and aws:SecureTransport can enforce encrypted transport. PrincipalOrgID directly addresses organizational membership.

Question 385

Which AWS service can detect vulnerable packages in supported EC2 instances?

1. Amazon Inspector
2. AWS CloudTrail
3. Amazon GuardDuty
4. AWS Config

Correct Answer: 1

Explanation:

Amazon Inspector continuously assesses supported AWS workloads for software vulnerabilities and exposure-related security issues. For supported EC2 instances, it can identify vulnerable packages and generate findings based on known vulnerability information. This helps security teams prioritize patching and remediation activities. CloudTrail records API activity, GuardDuty focuses on threat detection, and Config evaluates resource configurations. These services can complement Inspector during security operations, but vulnerability assessment of software packages on supported EC2 workloads is specifically within Inspector’s scope.

Question 386

Which S3 setting helps prevent public access through bucket and access point policies?

1. Object tagging
2. S3 Block Public Access
3. Inventory reports
4. Lifecycle expiration

Correct Answer: 2

Explanation:

S3 Block Public Access provides account- and bucket-level controls that help prevent public exposure through supported S3 access configurations. It can override or restrict public access granted through ACLs and bucket or access point policies according to the specific settings enabled. This makes it an important preventive control for organizations that do not permit publicly accessible S3 data. Object tagging adds metadata, Inventory produces reports, and Lifecycle expiration manages object retention. Block Public Access directly addresses the risk of accidentally or intentionally exposing S3 resources to the public internet.

Question 387

Which CloudTrail feature helps identify unusual patterns in management API activity?

1. Trail encryption
2. CloudTrail Insights
3. Log file validation
4. Event selectors

Correct Answer: 2

Explanation:

CloudTrail Insights is designed to identify unusual activity patterns associated with supported management API operations. It can help detect changes in API call rates or error rates that differ from established behavioral patterns. This can provide an additional signal during investigations involving potentially compromised credentials or unexpected administrative activity. Trail encryption protects log delivery, log file validation helps verify log integrity, and event selectors determine which events are recorded. Insights is the feature specifically intended to highlight anomalous management API behavior.

Question 388

Which IAM mechanism can restrict permissions granted to newly created roles by delegated administrators?

1. IAM permissions boundary
2. CloudTrail trail
3. S3 bucket versioning
4. KMS alias

Correct Answer: 1

Explanation:

An IAM permissions boundary establishes the maximum permissions that an IAM role or user can receive through identity-based policies. This is especially useful for delegated administration because administrators can create roles while remaining unable to grant permissions beyond the centrally established boundary. The boundary itself does not grant permissions; it limits the effective permission set. CloudTrail records activity, S3 versioning preserves object versions, and KMS aliases provide alternate names for keys. Permissions boundaries are therefore useful for controlling privilege escalation in delegated IAM administration models.

Question 389

Which service can centrally manage identities for workforce users accessing AWS accounts?

1. AWS Identity and Access Management
2. IAM Identity Center
3. Amazon Cognito
4. AWS Secrets Manager

Correct Answer: 2

Explanation:

AWS IAM Identity Center provides centralized workforce access management for users who need access to multiple AWS accounts and supported applications. Administrators can create permission sets and assign them to users or groups across accounts, simplifying centralized workforce access management. IAM remains the core service for AWS resource authorization, Cognito focuses primarily on application customers and user pools, and Secrets Manager stores sensitive credentials. IAM Identity Center is specifically designed for workforce identity access across multi-account AWS environments.

Question 390

Which AWS service can analyze DNS query logs for security investigations?

1. Amazon CloudWatch
2. Route 53 Resolver query logging
3. AWS Artifact
4. Amazon ECR

Correct Answer: 2

Explanation:

Route 53 Resolver query logging can capture DNS queries made from resources using the Resolver service and deliver the resulting logs to supported destinations. Security teams can analyze these records to identify unusual domain lookups, unexpected destinations, or patterns associated with compromised workloads. DNS visibility can be particularly useful during incident response because malware may attempt to resolve command-and-control or suspicious domains. CloudWatch provides broad monitoring capabilities, Artifact provides compliance documentation, and ECR stores container images. Resolver query logging directly supplies the DNS activity records required for this investigation.

Question 391

Which KMS property allows a key to be used for cryptographic operations in multiple AWS Regions?

1. Multi-Region key
2. Alias target
3. Key grant
4. External ID

Correct Answer: 1

Explanation:

AWS KMS Multi-Region keys are related key resources that can be used across multiple AWS Regions while maintaining coordinated key material and key identifiers according to KMS’s Multi-Region design. They can simplify applications that encrypt or decrypt data in different Regions and need cryptographic continuity across those locations. An alias provides a friendly name, a grant delegates permissions, and an external ID helps secure certain third-party role-assumption scenarios. Multi-Region keys specifically address cryptographic requirements spanning multiple AWS Regions.

Question 392

Which AWS service can collect evidence for security and compliance assessments?

1. AWS Audit Manager
2. Amazon GuardDuty
3. AWS Network Firewall
4. Amazon ElastiCache

Correct Answer: 1

Explanation:

AWS Audit Manager helps automate the collection and organization of evidence relevant to audits and compliance assessments. It can gather evidence from AWS services and configurations and associate that evidence with controls in supported frameworks. This reduces the need for teams to manually collect screenshots and configuration records for every assessment. GuardDuty detects potential threats, Network Firewall provides network inspection and filtering, and ElastiCache provides in-memory data caching. Audit Manager is therefore the service most directly associated with structured evidence collection for compliance and audit activities.

Question 393

Which VPC architecture provides private connectivity to supported AWS services without traversing the public internet?

1. Internet Gateway
2. NAT Gateway
3. VPC endpoint
4. Elastic IP address

Correct Answer: 3

Explanation:

VPC endpoints provide private connectivity from a VPC to supported AWS services without requiring traffic to traverse the public internet. Depending on the service and endpoint type, organizations can use interface endpoints or gateway endpoints. This can reduce exposure and support architectures where workloads operate without public IP addresses. An Internet Gateway provides internet connectivity, a NAT Gateway enables outbound internet access for private resources through supported routing, and an Elastic IP is a public IPv4 address. VPC endpoints are specifically designed for private service connectivity.

Question 394

Which AWS feature can preserve CloudTrail log integrity by validating delivered log files?

1. CloudTrail log file validation
2. CloudWatch metric filters
3. S3 Lifecycle
4. AWS Config snapshots

Correct Answer: 1

Explanation:

CloudTrail log file validation uses cryptographic digest information to help determine whether CloudTrail log files were modified or deleted after delivery. This is important when audit records may need to serve as reliable evidence during investigations or compliance reviews. Security teams can use validation mechanisms to detect changes to collected logs after they have been delivered to the configured destination. CloudWatch metric filters analyze log content, S3 Lifecycle manages object transitions and deletion, and Config snapshots represent configuration information. Log file validation directly addresses the integrity of CloudTrail records.

Question 395

Which service provides centralized security policies for VPC security groups across an organization?

1. AWS Firewall Manager
2. Amazon Detective
3. AWS Private CA
4. Amazon Macie

Correct Answer: 1

Explanation:

AWS Firewall Manager can centrally manage supported security group policies across accounts in an AWS Organization. Organizations can define common rules and apply them consistently to designated resources or accounts according to supported policy configurations. This helps reduce configuration drift and ensures that required network controls are not removed unintentionally. Detective is designed for security investigations, Private CA manages certificate authorities, and Macie discovers sensitive data in S3. Firewall Manager is the service that provides centralized administration of supported security group policies across organizational environments.

Question 396

Which mechanism helps an IAM role distinguish requests made by different external customers?

1. KMS encryption context
2. External ID
3. S3 object tag
4. CloudTrail event selector

Correct Answer: 2

Explanation:

An external ID is commonly included in an IAM role trust policy when a third-party service assumes roles on behalf of multiple customers. The value helps the trusted service distinguish one customer relationship from another and provides protection against certain confused-deputy scenarios. The external ID is supplied during role assumption and evaluated through the trust policy. KMS encryption context provides additional cryptographic authorization context, S3 object tags provide metadata, and CloudTrail event selectors control event collection. External ID is specifically associated with secure third-party cross-account role assumption.

Question 397

Which backup design can isolate recovery points from routine account-level deletion activity?

1. Cross-account backup copy
2. EC2 hibernation
3. EBS volume modification
4. Route 53 failover routing

Correct Answer: 1

Explanation:

Cross-account backup copies can place recovery points in a separate AWS account, creating an additional administrative boundary between production resources and backups. This can improve resilience against compromised credentials or destructive activity affecting the production account. Organizations can further strengthen this architecture with backup vault controls and carefully restricted permissions in the backup account. EC2 hibernation preserves instance state for supported workloads, EBS volume modification changes storage characteristics, and Route 53 failover routing directs DNS traffic. Cross-account backup copying specifically supports stronger separation of protected recovery data.

Question 398

Which AWS service can inspect network traffic using a managed stateful firewall?

1. Amazon GuardDuty
2. AWS Network Firewall
3. AWS CloudTrail
4. Amazon Inspector

Correct Answer: 2

Explanation:

AWS Network Firewall is a managed network firewall service that supports stateful and stateless traffic inspection for VPC architectures. It can enforce centralized network security rules and inspect traffic flowing through appropriately designed network paths. This makes it useful for architectures requiring controlled east-west or north-south traffic inspection. GuardDuty provides threat detection, CloudTrail records API activity, and Inspector performs vulnerability assessment. Network Firewall directly addresses the requirement to inspect and filter network traffic using managed firewall capabilities.

Question 399

Which S3 encryption option uses two independent layers of server-side encryption?

1. SSE-S3
2. SSE-KMS
3. DSSE-KMS
4. Client-side encryption

Correct Answer: 3

Explanation:

S3 dual-layer server-side encryption with AWS KMS keys, known as DSSE-KMS, applies two independent layers of server-side encryption to supported S3 objects. It is intended for workloads with requirements for an additional encryption layer beyond standard server-side encryption approaches. SSE-S3 uses Amazon S3 managed keys, while SSE-KMS uses AWS KMS for key management and authorization. Client-side encryption occurs before data is sent to S3 and is controlled by the application or client. DSSE-KMS specifically provides the dual-layer server-side model.

Question 400

Which AWS capability can automatically trigger remediation after detecting a security finding?

1. EventBridge event rule
2. S3 Inventory
3. ACM certificate request
4. EBS snapshot

Correct Answer: 1

Explanation:

Amazon EventBridge can receive events generated by AWS security services and route matching events to targets such as Lambda functions, Systems Manager Automation, or other supported services. This allows organizations to build automated incident-response workflows. For example, a security finding can trigger an EventBridge rule that invokes remediation logic to isolate a resource, disable a credential, or initiate an investigation workflow. S3 Inventory reports object information, ACM certificate requests manage certificate issuance, and EBS snapshots preserve storage states. EventBridge provides the event-driven mechanism needed to initiate automated security response actions.