View Full Amazon AWS Certified Security – Specialty SCS-C02 Exam Dumps and Practice Test Dumps

 

Question 81

Which IAM method lets an application obtain temporary AWS credentials?

1. IAM group membership
2. IAM role assumption
3. Root account login
4. Static console password

Correct Answer: 2

Explanation:

IAM role assumption allows an application or trusted principal to obtain temporary AWS security credentials. AWS Security Token Service can issue these credentials after the principal is authorized to assume the role. Temporary credentials are preferable to embedding permanent access keys inside applications because they have limited lifetimes and can be restricted to specific permissions. IAM groups are used to organize IAM users, while root credentials and static console passwords are not appropriate mechanisms for application authentication. Role-based access is therefore a fundamental AWS security pattern for workloads that need controlled access to AWS resources.

Question 82

Which IAM policy element specifies the actions being permitted or denied?

1. Resource
2. Principal
3. Action
4. Condition

Correct Answer: 3

Explanation:

The Action element in an IAM policy specifies the AWS API operations that a statement allows or denies. Examples include actions such as reading an object, creating a resource, or modifying a configuration. Resource identifies the resources affected by the statement, Principal identifies an identity in supported resource-based policies, and Condition adds contextual requirements. Carefully limiting the Action element is an important part of implementing least privilege. Security teams should avoid broad wildcard permissions when narrower actions can satisfy the workload’s requirements.

Question 83

Which AWS service analyzes resource policies for unintended external access?

1. IAM Access Analyzer
2. Amazon Polly
3. AWS Glue Studio
4. Amazon AppFlow

Correct Answer: 1

Explanation:

IAM Access Analyzer helps identify resources that can be accessed from outside an intended trust boundary. It analyzes supported resource-based policies and can identify access granted to external accounts, organizations, or public principals. Security teams can investigate these findings to determine whether the access is intentional or represents an unintended exposure. Polly provides text-to-speech capabilities, Glue Studio supports data integration workflows, and AppFlow transfers data between applications. Access Analyzer is specifically designed to provide visibility into external resource access.

Question 84

Which AWS feature provides centralized restrictions across organizational units?

1. Security group associations
2. Bucket ownership controls
3. Service control policies
4. Network ACL entries

Correct Answer: 3

Explanation:

Service control policies provide centralized permission guardrails within AWS Organizations. They can be attached to organizational units or accounts and can restrict which AWS actions are available to affected accounts. SCPs do not grant permissions themselves; effective access still depends on applicable identity and resource policies. Security groups control network traffic, S3 ownership controls manage object ownership behavior, and network ACLs filter subnet traffic. SCPs are especially useful for establishing organization-wide restrictions that individual workload administrators cannot override by adding broader identity permissions.

Question 85

Which CloudTrail setting captures activity from multiple AWS accounts centrally?

1. Local event selector
2. Organization trail
3. Console session history
4. Resource tag

Correct Answer: 2

Explanation:

A CloudTrail organization trail can collect activity across accounts that belong to an AWS Organization. This provides centralized auditing and reduces the need to independently configure equivalent trails in every member account. Organization trails are particularly useful for security monitoring, compliance, and incident response because security teams can maintain a consistent logging strategy across the environment. Local event selectors can control which events are recorded, but they do not themselves provide organization-wide governance. Console history and resource tags also do not create centralized CloudTrail collection.

Question 86

Which S3 mechanism uses KMS keys for server-side encryption?

1. SSE-KMS
2. S3 Versioning
3. S3 Object Lock
4. S3 Inventory

Correct Answer: 1

Explanation:

SSE-KMS provides server-side encryption for Amazon S3 objects using AWS Key Management Service keys. Organizations can use AWS managed or customer managed KMS keys depending on their control requirements. Customer managed keys can provide greater administrative control over key policies, permissions, and lifecycle settings. S3 Versioning preserves multiple object versions, Object Lock supports retention and immutability, and Inventory generates reports about stored objects. SSE-KMS specifically addresses encryption of S3 data at rest through KMS-backed cryptographic keys.

Question 87

Which service detects suspicious activity using AWS threat intelligence?

1. AWS Audit Manager
2. Amazon GuardDuty
3. AWS Certificate Manager
4. Amazon QuickSight

Correct Answer: 2

Explanation:

Amazon GuardDuty is a managed threat detection service that analyzes supported AWS data sources and telemetry to identify potentially malicious activity. It can detect signals associated with compromised credentials, unusual API behavior, suspicious network communication, and other threats. GuardDuty findings can be integrated with services such as Security Hub and EventBridge to support centralized analysis and automated response. Audit Manager focuses on compliance evidence, Certificate Manager handles TLS certificates, and QuickSight provides business intelligence capabilities. GuardDuty is therefore the service specifically designed for threat detection.

Question 88

Which AWS service evaluates whether resources meet configuration requirements?

1. AWS Config
2. Amazon SQS
3. AWS CodeArtifact
4. Amazon Chime SDK

Correct Answer: 1

Explanation:

AWS Config evaluates supported AWS resource configurations against defined rules. Security teams can use configuration rules to identify resources that violate requirements such as encryption settings, approved network configurations, or restricted access controls. Config also maintains configuration history, which can help determine when a security-relevant change occurred. SQS provides message queuing, CodeArtifact manages software packages, and Chime SDK supports communication features. AWS Config is the appropriate service for continuous configuration assessment and compliance monitoring.

Question 89

Which service stores application secrets separately from source code?

1. AWS Secrets Manager
2. Amazon EC2 Image Builder
3. AWS CodeCommit
4. Amazon ECR Public

Correct Answer: 1

Explanation:

AWS Secrets Manager provides a dedicated service for storing sensitive information such as passwords, API credentials, and other application secrets. Applications can retrieve secrets at runtime instead of embedding them directly in source code or deployment artifacts. Secrets Manager also supports controlled access through IAM and offers rotation capabilities for supported secret types. EC2 Image Builder automates image creation, CodeCommit provides source-control functionality, and ECR Public distributes public container images. Separating secrets from application code reduces the likelihood of accidentally exposing credentials through repositories or build artifacts.

Question 90

Which network control is stateful and attached directly to supported resources?

1. Network ACL
2. Security group
3. Route table
4. Internet gateway

Correct Answer: 2

Explanation:

Security groups are stateful virtual firewalls associated with supported resources such as EC2 instances. When a connection is allowed, return traffic for that established connection is automatically permitted. Security groups contain inbound and outbound rules and do not use ordered rule evaluation in the same way as network ACLs. Network ACLs operate at the subnet level and are stateless, while route tables determine network paths and internet gateways provide internet connectivity. Understanding stateful security-group behavior is essential when designing layered VPC network controls.

Question 91

Which service provides managed detection of vulnerabilities in supported AWS workloads?

1. Amazon Inspector
2. Amazon Athena
3. AWS Transit Gateway
4. Amazon Pinpoint

Correct Answer: 1

Explanation:

Amazon Inspector continuously assesses supported AWS workloads for vulnerabilities and other security-related issues. It can evaluate eligible resources such as EC2 instances, container images, and Lambda functions depending on supported capabilities and configuration. Inspector findings can help security teams prioritize software vulnerabilities and network exposure issues for remediation. Athena provides data-query capabilities, Transit Gateway provides centralized network connectivity, and Pinpoint supports customer engagement. Inspector is specifically designed for vulnerability management rather than general analytics, networking, or messaging functions.

Question 92

Which service helps investigate the context surrounding security findings?

1. AWS WAF
2. Amazon Detective
3. AWS Backup
4. Amazon FSx

Correct Answer: 2

Explanation:

Amazon Detective helps security analysts investigate security activity by analyzing relationships among AWS identities, resources, and behavior. It can provide additional context around findings and help analysts understand how events may be connected during an investigation. This is different from a prevention service because Detective focuses on investigation and analysis after potentially suspicious activity has been identified. AWS WAF protects web applications, AWS Backup manages recovery data, and Amazon FSx provides managed file systems. Detective is specifically designed to support security investigations.

Question 93

Which S3 feature helps prevent objects from being permanently deleted during retention?

1. S3 Object Lock
2. S3 Transfer Acceleration
3. S3 Select
4. S3 Batch Operations

Correct Answer: 1

Explanation:

S3 Object Lock provides retention controls that can prevent protected objects from being deleted or overwritten for a configured period. It supports governance and compliance modes, allowing organizations to select the appropriate protection level for their requirements. This feature is useful for audit records, regulatory information, backup data, and other content requiring immutability. Transfer Acceleration focuses on faster data transfers, S3 Select enables querying supported object content, and Batch Operations performs actions across many objects. Object Lock is the feature specifically designed for retention-based object protection.

Question 94

Which AWS service provides DNS filtering for unwanted domains?

1. Amazon Route 53 Resolver
2. AWS Network Firewall
3. Route 53 Resolver DNS Firewall
4. Amazon CloudFront

Correct Answer: 3

Explanation:

Route 53 Resolver DNS Firewall allows organizations to control DNS queries originating from VPC resources. Administrators can create rule groups containing domain lists and define how matching queries should be handled. This can help block resolution attempts for known malicious, suspicious, or otherwise unwanted domains. Network Firewall provides broader network traffic inspection, while CloudFront is a content delivery service. The standard Resolver service provides DNS resolution, but the DNS Firewall capability adds policy-based filtering for domain queries. Therefore, Resolver DNS Firewall is the appropriate choice for this requirement.

Question 95

Which AWS service centralizes findings from multiple security sources?

1. AWS Security Hub
2. Amazon WorkSpaces
3. AWS Batch
4. Amazon RDS Proxy

Correct Answer: 1

Explanation:

AWS Security Hub provides centralized visibility into security findings generated by supported AWS services and integrated third-party products. It normalizes findings and helps security teams review issues across multiple accounts and workloads from a common location. Security Hub can also support security standards and automated response workflows when integrated with other AWS services. WorkSpaces provides virtual desktops, Batch runs batch workloads, and RDS Proxy manages database connections. Security Hub is specifically intended to consolidate and organize security findings for security operations.

Question 96

Which AWS capability helps preserve CloudTrail evidence integrity?

1. S3 lifecycle transition
2. CloudTrail log file validation
3. IAM credential report
4. VPC endpoint policy

Correct Answer: 2

Explanation:

CloudTrail log file validation helps organizations determine whether delivered CloudTrail log files have been modified or deleted after delivery. It uses digest files and cryptographic mechanisms to support integrity verification. This can be particularly important when logs are being used for incident investigation, compliance evidence, or forensic analysis. Log validation does not replace access controls, so organizations should also protect the S3 destination from unauthorized modification or deletion. S3 lifecycle rules manage object retention, IAM Credential Reports describe user credentials, and VPC endpoint policies control endpoint access.

Question 97

Which AWS service manages encryption keys for supported workloads?

1. AWS Key Management Service
2. Amazon DynamoDB Accelerator
3. AWS Migration Hub
4. Amazon Connect

Correct Answer: 1

Explanation:

AWS Key Management Service, or AWS KMS, enables organizations to create, manage, and use cryptographic keys for protecting data. KMS integrates with numerous AWS services and can support encryption for resources such as S3 objects, EBS volumes, databases, and other workloads. Administrators can control key usage through key policies and IAM permissions. DynamoDB Accelerator provides caching, Migration Hub supports migration tracking, and Connect provides contact-center functionality. KMS is the AWS service specifically designed for centralized cryptographic key management.

Question 98

Which control can require MFA before sensitive IAM actions?

1. IAM group
2. IAM policy condition
3. Resource tag
4. Account alias

Correct Answer: 2

Explanation:

An IAM policy condition can require MFA for selected actions by evaluating the appropriate MFA-related condition key. This allows organizations to apply stronger authentication requirements to sensitive operations while maintaining more flexible controls for lower-risk activities. MFA conditions can be combined with specific actions and resources to implement granular authorization rules. IAM groups organize users but do not themselves enforce MFA requirements, while resource tags and account aliases are not authentication controls. Policy conditions provide the mechanism for incorporating MFA status into AWS authorization decisions.

Question 99

Which AWS service provides managed DDoS protection for supported resources?

1. AWS Shield
2. Amazon Redshift
3. AWS DataSync
4. Amazon Textract

Correct Answer: 1

Explanation:

AWS Shield is a managed DDoS protection service for supported AWS resources. Shield Standard provides automatic protection against common network and transport-layer DDoS attacks, while Shield Advanced offers additional capabilities for eligible workloads. DDoS protection can be strengthened by combining Shield with AWS WAF, resilient architecture, monitoring, and appropriate network controls. Redshift provides data warehousing, DataSync transfers data between storage systems, and Textract extracts information from documents. These services do not provide the specialized DDoS protection delivered by AWS Shield.

Question 100

Which service helps automate security remediation from event triggers?

1. AWS Lambda
2. Amazon Neptune
3. Amazon SES
4. AWS Snow Family

Correct Answer: 1

Explanation:

AWS Lambda can execute custom code automatically when triggered by security-related events. For example, an EventBridge rule can invoke a Lambda function after a security finding is generated, allowing predefined remediation logic to run. A function could perform actions such as modifying a security group, disabling a compromised credential, or updating a resource configuration, depending on the organization’s response design. Neptune provides graph database capabilities, SES provides email delivery, and Snow Family supports edge computing and data transfer. Lambda therefore provides the compute mechanism for event-driven security automation.