View Full Amazon AWS Certified Security – Specialty SCS-C02 Exam Dumps and Practice Test Dumps

 

Question 41

Which IAM feature helps identify unused permissions granted to roles?

1. IAM Access Advisor
2. AWS Shield
3. S3 Inventory
4. Amazon Inspector

Correct Answer: 1

Explanation:

IAM Access Advisor provides information about when AWS services were last accessed by an IAM principal. Security teams can use this information to review permissions and identify services that may no longer be required. This supports least-privilege initiatives by giving administrators evidence they can use when reducing excessive permissions. Access Advisor does not automatically remove permissions; administrators must review the information and make appropriate policy changes. AWS Shield focuses on DDoS protection, S3 Inventory provides object metadata reports, and Amazon Inspector identifies vulnerabilities in supported workloads.

Question 42

Which policy decision overrides an otherwise allowed IAM request?

1. Allow statement
2. Explicit deny
3. Default allow
4. Resource tag

Correct Answer: 2

Explanation:

An explicit deny in an applicable AWS policy overrides an allow. This is a fundamental part of AWS authorization evaluation. Even when another policy grants an action, an explicit deny prevents that action from being authorized. This behavior allows organizations to create strong security guardrails that cannot easily be bypassed by adding additional allow permissions. Default IAM behavior is deny unless an applicable policy grants access. Resource tags can be used with certain policy conditions, but they are not authorization decisions by themselves. Understanding explicit denies is essential when troubleshooting complex IAM permissions.

Question 43

Which service detects malware-related activity in Amazon EKS environments?

1. Amazon GuardDuty
2. AWS Artifact
3. Amazon Aurora
4. AWS Glue

Correct Answer: 1

Explanation:

Amazon GuardDuty provides threat detection capabilities across supported AWS environments, including capabilities designed for container-related activity. For supported Amazon EKS environments, GuardDuty can analyze relevant runtime and control-plane signals to identify potentially malicious behavior. This can help security teams detect suspicious activity occurring inside containerized workloads. AWS Artifact provides compliance documentation, Aurora is a relational database service, and Glue supports data integration and analytics workflows. GuardDuty is therefore the security service most directly associated with managed threat detection for supported EKS environments.

Question 44

Which S3 control restricts access through a specific network origin?

1. Object metadata
2. Lifecycle transition
3. Bucket policy condition
4. Storage class

Correct Answer: 3

Explanation:

An S3 bucket policy can include condition elements that restrict requests based on characteristics such as source IP address, VPC endpoint, or other supported request attributes. This allows organizations to create more specific access controls rather than granting access solely based on identity. For example, a bucket policy can require requests to originate through a particular VPC endpoint. Object metadata describes stored objects, lifecycle transitions manage storage behavior over time, and storage classes determine storage characteristics and pricing. Bucket policy conditions therefore provide the policy mechanism for restricting access according to request context.

Question 45

Which AWS service automates responses to security events using event-driven rules?

1. Amazon EventBridge
2. AWS Snowcone
3. Amazon DocumentDB
4. AWS Elastic Disaster Recovery

Correct Answer: 1

Explanation:

Amazon EventBridge can route events from AWS services and other supported sources to targets for automated processing. Security teams can use EventBridge rules to trigger actions when security findings or infrastructure changes occur. For example, an event can invoke a Lambda function that performs a predefined containment or notification task. This supports automated incident-response workflows and reduces manual intervention for repeatable events. Snowcone provides edge computing and data transfer capabilities, DocumentDB is a document database service, and Elastic Disaster Recovery focuses on workload recovery rather than event-driven security automation.

Question 46

Which KMS key type gives an organization direct control over its key policy?

1. AWS owned key
2. Customer managed key
3. AWS service key
4. Temporary session key

Correct Answer: 2

Explanation:

Customer managed KMS keys provide organizations with direct administrative control over important key-management settings, including key policies, aliases, rotation configuration, and lifecycle decisions. This makes them appropriate when an organization requires detailed control over who can administer or use encryption keys. AWS owned keys are managed entirely by AWS and are used by services on behalf of customers. Temporary session keys are not a general KMS key-management category. Service-managed encryption mechanisms can simplify operations but may provide less direct administrative control than a customer managed KMS key.

Question 47

Which log source can reveal rejected network connections between VPC resources?

1. AWS Config snapshots
2. VPC Flow Logs
3. IAM Credential Reports
4. CloudTrail digest files

Correct Answer: 2

Explanation:

VPC Flow Logs provide metadata about network traffic associated with VPCs, subnets, or network interfaces. Depending on the configuration, flow records can indicate whether traffic was accepted or rejected. Security analysts can use these records to investigate unexpected communication, identify blocked connections, and understand network behavior during an incident. Flow Logs do not capture packet contents, but they provide valuable traffic metadata for analysis. AWS Config focuses on resource configuration history, IAM Credential Reports describe user credentials, and CloudTrail digest files help validate log-file integrity.

Question 48

Which AWS service provides centralized compliance evidence collection?

1. Amazon Detective
2. AWS Audit Manager
3. Amazon GuardDuty
4. AWS Network Firewall

Correct Answer: 2

Explanation:

AWS Audit Manager helps organizations collect and organize evidence related to audits and compliance requirements. It can continuously gather evidence from supported AWS services and map collected information to control frameworks. This reduces the manual effort involved in preparing audit documentation and provides a structured way to demonstrate how controls are operating. Detective is designed for security investigations, GuardDuty detects potential threats, and Network Firewall provides network traffic inspection. Audit Manager therefore addresses the governance and evidence-collection requirement described in the question.

Question 49

Which S3 feature creates multiple recoverable versions of an object?

1. S3 Versioning
2. S3 Select
3. S3 Batch Operations
4. S3 Access Analyzer

Correct Answer: 1

Explanation:

S3 Versioning preserves multiple versions of objects within a bucket. When an object is overwritten or deleted, previous versions can remain available, depending on the configured behavior and permissions. This can help recover from accidental overwrites or deletions. Versioning is also commonly used with other S3 protection mechanisms such as Object Lock. S3 Select is designed for querying supported object content, Batch Operations performs actions across large numbers of objects, and access analysis evaluates resource permissions. Versioning specifically provides the object-history capability described.

Question 50

Which control helps prevent an IAM role from receiving permissions beyond an approved maximum?

1. IAM permissions boundary
2. CloudWatch alarm
3. Route 53 health check
4. S3 replication rule

Correct Answer: 1

Explanation:

An IAM permissions boundary establishes the maximum permissions that a user or role can have. Even if an identity policy grants additional actions, permissions outside the boundary cannot become effective. This is particularly useful when organizations delegate IAM role creation to development teams while retaining centralized security controls. The boundary is not itself a permission grant; it limits the effective permission set. CloudWatch alarms monitor metrics, Route 53 health checks monitor endpoint availability, and S3 replication rules control object replication. None of those mechanisms limits an IAM principal’s maximum authorization scope.

Question 51

Which AWS service can detect public or cross-account resource access?

1. Amazon Polly
2. IAM Access Analyzer
3. AWS Batch
4. Amazon Neptune

Correct Answer: 2

Explanation:

IAM Access Analyzer can analyze supported resource-based policies to identify resources that can be accessed from outside an intended trust boundary. Findings can reveal public access or access granted to another AWS account, organization, or external principal. This helps security teams identify unintended exposure and review whether resource policies follow least-privilege principles. Polly provides text-to-speech capabilities, Batch runs batch computing workloads, and Neptune provides graph database functionality. Access Analyzer is therefore the relevant AWS security capability for identifying external access paths in supported resources.

Question 52

Which CloudTrail setting can validate whether log files were altered?

1. Log file validation
2. EventBridge archive
3. S3 replication time control
4. CloudWatch contributor insights

Correct Answer: 1

Explanation:

CloudTrail log file validation helps determine whether CloudTrail log files were modified or deleted after delivery. It uses digest files and cryptographic validation mechanisms to support integrity verification. This is valuable when CloudTrail records are being used as security evidence or during forensic investigations. Enabling validation does not by itself prevent an authorized principal from deleting logs, so organizations should combine it with restrictive S3 permissions and centralized log storage. EventBridge archives events, S3 replication controls object replication, and CloudWatch Contributor Insights analyzes log or metric patterns rather than validating CloudTrail file integrity.

Question 53

Which service can automatically evaluate container images for known vulnerabilities?

1. Amazon Inspector
2. AWS Direct Connect
3. Amazon Lex
4. AWS Organizations

Correct Answer: 1

Explanation:

Amazon Inspector can assess supported Amazon Elastic Container Registry image repositories for known software vulnerabilities. It identifies vulnerable packages and generates findings that security teams can use for remediation. This helps organizations integrate vulnerability management into container development and deployment processes. Direct Connect provides dedicated network connectivity, Lex supports conversational interfaces, and Organizations manages multiple AWS accounts. Inspector’s vulnerability assessment capabilities make it appropriate for identifying known security issues in supported container images before or during deployment.

Question 54

Which network architecture component connects multiple VPCs through a central hub?

1. Internet gateway
2. Transit Gateway
3. NAT gateway
4. Elastic IP address

Correct Answer: 2

Explanation:

AWS Transit Gateway acts as a centralized network hub that can connect multiple VPCs and other supported networks. It simplifies network architecture by reducing the need to create numerous individual point-to-point connections. From a security perspective, administrators should carefully design route tables, attachments, segmentation, and inspection paths so that connected environments do not receive unintended access. An internet gateway provides internet connectivity, a NAT gateway supports outbound internet access for private resources, and an Elastic IP is a public IPv4 address. Transit Gateway specifically provides centralized network connectivity.

Question 55

Which control protects an S3 bucket from accidental public policy changes?

1. S3 Block Public Access
2. S3 Multipart Upload
3. S3 Inventory
4. S3 Transfer Acceleration

Correct Answer: 1

Explanation:

S3 Block Public Access provides preventive controls designed to help stop public access configurations on S3 resources. It can be applied at multiple scopes and helps protect against common mistakes involving bucket policies and access control lists. This makes it an important baseline control for organizations that do not intentionally expose S3 data publicly. Multipart Upload supports large object uploads, Inventory produces object reports, and Transfer Acceleration improves transfer performance. These features serve operational purposes rather than acting as a preventive control against public S3 exposure.

Question 56

Which service can quarantine a compromised workload through automated remediation?

1. Amazon EventBridge
2. AWS Lambda
3. Amazon WorkSpaces
4. AWS Marketplace

Correct Answer: 2

Explanation:

AWS Lambda can execute automated remediation code in response to security events. For example, a Lambda function can modify security group rules, update resource configurations, or perform other containment actions when triggered by an event source such as EventBridge or a security finding. Automated remediation should be carefully designed and tested because incorrect actions can disrupt legitimate workloads. EventBridge is commonly used to route the triggering event, while WorkSpaces provides virtual desktops and Marketplace distributes software and services. Lambda provides the compute mechanism that can execute the custom response logic.

Question 57

Which RDS option encrypts database storage using AWS KMS?

1. Performance Insights
2. Enhanced Monitoring
3. Storage encryption
4. Read replica

Correct Answer: 3

Explanation:

Amazon RDS storage encryption protects database storage using AWS KMS encryption keys. When encryption is enabled, related storage components such as automated backups, read replicas in supported configurations, and snapshots can also receive encryption protection according to AWS behavior and configuration. Storage encryption helps protect data at rest from unauthorized access to the underlying storage. Performance Insights provides database performance visibility, Enhanced Monitoring supplies operating-system metrics, and read replicas provide additional database copies for scaling or availability. These features do not themselves represent the database storage encryption mechanism.

Question 58

Which AWS service helps enforce governance across multiple AWS accounts?

1. AWS Organizations
2. Amazon Comprehend
3. AWS IoT Device Defender
4. Amazon Kinesis Analytics

Correct Answer: 1

Explanation:

AWS Organizations provides centralized management capabilities for multiple AWS accounts. Security teams can use organizational units, service control policies, and account-level governance mechanisms to establish consistent controls across an AWS environment. Organizations is especially important in multi-account security architectures because it allows central administrators to define guardrails that member accounts must operate within. Comprehend provides natural-language processing, IoT Device Defender helps monitor IoT security posture, and Kinesis Analytics supports stream-processing workloads. Organizations directly addresses centralized multi-account governance.

Question 59

Which security practice preserves evidence before modifying a compromised instance?

1. Delete temporary files
2. Create a forensic snapshot
3. Reinstall the operating system
4. Rotate every account credential immediately

Correct Answer: 2

Explanation:

Creating a forensic snapshot before making significant changes to a compromised workload can help preserve evidence for later investigation. For an EC2 instance, security teams may capture relevant EBS volume snapshots and document the incident state before performing containment or remediation. Evidence preservation should follow the organization’s incident-response procedures and access controls. Immediately deleting files or reinstalling the operating system can destroy useful evidence. Credential rotation may be necessary during an incident, but it does not preserve the state of the compromised system itself.

Question 60

Which AWS service provides centralized detection findings for security operations?

1. AWS Security Hub
2. Amazon AppStream
3. AWS Data Exchange
4. Amazon Chime SDK

Correct Answer: 1

Explanation:

AWS Security Hub provides a centralized location for reviewing security findings from supported AWS services and integrated third-party products. It can normalize findings into a consistent format and help security teams identify issues across multiple accounts and workloads. Security Hub can also support security standards and automated response workflows when integrated with other AWS services. AppStream provides application streaming, Data Exchange facilitates data subscriptions, and Chime SDK provides communication capabilities. Security Hub is therefore the service designed for centralized security-finding visibility and security operations workflows.