View Full Amazon AWS Certified Security – Specialty SCS-C02 Exam Dumps and Practice Test Dumps

 

Question 101

Which IAM mechanism delegates temporary permissions to another AWS principal?

1. IAM group
2. Resource tag
3. IAM role
4. Account alias

Correct Answer: 3

Explanation:

An IAM role provides permissions that can be assumed by trusted principals, allowing them to obtain temporary security credentials. Roles are widely used for cross-account access, AWS workloads, and federated identities because they avoid the need to distribute long-term access keys. A trust policy determines who can assume a role, while the attached permissions policy defines what the role can do. IAM groups organize users, resource tags provide metadata for supported authorization conditions, and an account alias provides a human-readable sign-in identifier. Roles therefore provide the delegation mechanism described in the question.

Question 102

Which IAM policy component identifies the AWS resources affected?

1. Action
2. Resource
3. Condition
4. Effect

Correct Answer: 2

Explanation:

The Resource element specifies which AWS resources a policy statement applies to. Depending on the service and action, this can identify a specific resource ARN or a broader set of resources. Narrowly defining resources is an important least-privilege practice because it prevents permissions from automatically applying to unrelated resources. Action identifies the API operations being controlled, Condition adds contextual requirements, and Effect specifies whether access is allowed or denied. Carefully combining Action and Resource elements helps security teams create policies that provide only the access required for a particular workload or user.

Question 103

Which AWS service provides centralized account governance?

1. AWS Organizations
2. Amazon Kinesis
3. AWS AppSync
4. Amazon Polly

Correct Answer: 1

Explanation:

AWS Organizations provides centralized management and governance for multiple AWS accounts. It allows organizations to group accounts into organizational units, apply service control policies, and establish account-level governance structures. Organizations is particularly useful in multi-account security architectures because centralized administrators can establish guardrails while workload teams retain appropriate account-level responsibilities. Kinesis supports streaming data, AppSync provides managed GraphQL APIs, and Polly offers text-to-speech functionality. None of these services provides the account-management and organizational governance capabilities of AWS Organizations.

Question 104

Which CloudTrail option records control-plane operations?

1. Data events
2. Management events
3. Resolver queries
4. VPC flow records

Correct Answer: 2

Explanation:

CloudTrail management events record control-plane operations performed against AWS resources. Examples include creating, modifying, or deleting resources and changing account-level configurations. These events are important for security auditing because they can reveal administrative activity and configuration changes. Data events focus on resource-level operations for supported services, such as S3 object activity. Resolver queries provide DNS visibility, while VPC Flow Logs provide network traffic metadata. Management events are therefore the CloudTrail category used to record control-plane API activity.

Question 105

Which S3 protection prevents public access through common configuration paths?

1. S3 Inventory
2. S3 Select
3. S3 Block Public Access
4. S3 Storage Lens

Correct Answer: 3

Explanation:

S3 Block Public Access provides controls designed to prevent public access to S3 buckets and objects through several common configuration mechanisms. It can be applied at the account, bucket, or access-point level and is widely used as a preventive security baseline. The controls can help protect against accidental public bucket policies or access control configurations. S3 Inventory produces object reports, S3 Select supports querying object content, and Storage Lens provides usage and activity insights. These features do not provide the same preventive protection against public exposure.

Question 106

Which service can detect suspicious API behavior in an AWS account?

1. AWS Artifact
2. Amazon GuardDuty
3. AWS Backup
4. Amazon AppStream

Correct Answer: 2

Explanation:

Amazon GuardDuty analyzes supported AWS activity and telemetry to identify potentially malicious behavior. It can detect suspicious API patterns associated with compromised credentials, unusual access behavior, and other threats. Findings can be integrated with Security Hub, EventBridge, and other security workflows for investigation or automated response. AWS Artifact provides compliance documentation, AWS Backup manages backup operations, and AppStream provides application streaming. GuardDuty is specifically designed for managed threat detection and therefore is the appropriate service for identifying suspicious API behavior.

Question 107

Which AWS service continuously records resource configuration changes?

1. AWS Config
2. Amazon MQ
3. AWS CodeBuild
4. Amazon Neptune

Correct Answer: 1

Explanation:

AWS Config records configuration information for supported AWS resources and maintains configuration history. Security teams can use this information to identify changes, investigate configuration drift, and evaluate resources against security rules. Config is useful when an organization needs to determine what changed, when the change occurred, and whether the resulting configuration complies with established requirements. Amazon MQ provides managed message brokers, CodeBuild supports software builds, and Neptune provides graph database functionality. AWS Config is specifically designed for resource configuration recording and assessment.

Question 108

Which service stores secrets with optional automated rotation?

1. AWS Secrets Manager
2. Amazon ECR
3. AWS DataSync
4. Amazon FSx

Correct Answer: 1

Explanation:

AWS Secrets Manager securely stores sensitive information such as database credentials, API keys, and application secrets. It supports controlled retrieval through IAM and offers automated rotation for supported secret types. Applications can retrieve secrets at runtime rather than embedding long-term credentials in source code or configuration files. Amazon ECR stores container images, DataSync transfers data between storage environments, and FSx provides managed file systems. Secrets Manager is specifically designed for lifecycle management and secure retrieval of application secrets.

Question 109

Which VPC control filters traffic at the subnet boundary?

1. Security group
2. Network ACL
3. VPC endpoint
4. Transit Gateway

Correct Answer: 2

Explanation:

Network Access Control Lists operate at the subnet level and provide stateless traffic filtering. They contain numbered inbound and outbound rules, and the first matching rule determines whether traffic is allowed or denied. Because network ACLs are stateless, return traffic must be explicitly permitted where required. Security groups operate at the resource level and are stateful, VPC endpoints provide private service connectivity, and Transit Gateway connects networks through a central routing hub. Network ACLs are therefore the appropriate subnet-level network security control.

Question 110

Which AWS service protects web applications from malicious HTTP requests?

1. AWS WAF
2. Amazon SQS
3. AWS Glue
4. Amazon RDS

Correct Answer: 1

Explanation:

AWS WAF helps protect supported web applications by inspecting incoming HTTP and HTTPS requests against configured rules. Rules can identify characteristics associated with malicious or unwanted requests, including IP addresses, request headers, query strings, and known attack patterns. WAF can integrate with services such as CloudFront, Application Load Balancers, and API Gateway. SQS provides message queuing, Glue supports data integration, and RDS provides managed relational databases. WAF specifically addresses application-layer request filtering and web security.

Question 111

Which AWS service provides private DNS-based domain filtering?

1. Amazon Route 53 Resolver DNS Firewall
2. Amazon CloudFront
3. AWS Direct Connect
4. Amazon ElastiCache

Correct Answer: 1

Explanation:

Route 53 Resolver DNS Firewall allows organizations to control DNS queries originating from VPC resources. Administrators can create rule groups containing domain lists and determine how matching queries should be handled. This can help prevent workloads from resolving known malicious or unwanted domains. CloudFront provides content delivery, Direct Connect provides dedicated network connectivity, and ElastiCache provides managed in-memory caching. DNS Firewall specifically addresses domain-level filtering at the DNS resolution layer and can complement broader network security controls.

Question 112

Which AWS service centralizes security findings from supported sources?

1. AWS Security Hub
2. Amazon Athena
3. AWS Batch
4. Amazon WorkSpaces

Correct Answer: 1

Explanation:

AWS Security Hub provides centralized visibility into security findings from supported AWS services and integrated third-party products. It normalizes findings and helps security teams review issues across accounts and workloads through a consolidated security interface. Security Hub can also evaluate supported security standards and connect findings to automated response workflows. Athena is used for data analysis, Batch runs batch computing jobs, and WorkSpaces provides virtual desktops. Security Hub is specifically designed for centralized security finding management.

Question 113

Which AWS service helps investigate a security incident using activity relationships?

1. Amazon Detective
2. AWS Backup
3. Amazon Lex
4. AWS IoT Core

Correct Answer: 1

Explanation:

Amazon Detective helps analysts investigate security incidents by examining relationships among identities, resources, and activity within an AWS environment. It can provide additional context around findings and help investigators understand sequences of behavior associated with suspicious activity. Detective is useful after an alert has been generated because it focuses on investigation rather than simply prevention. AWS Backup manages recovery data, Lex supports conversational applications, and IoT Core provides connected-device capabilities. Detective is the AWS service specifically designed for contextual security investigation.

Question 114

Which service assesses supported workloads for software vulnerabilities?

1. Amazon Inspector
2. Amazon Redshift
3. AWS Transit Gateway
4. Amazon Connect

Correct Answer: 1

Explanation:

Amazon Inspector continuously assesses supported AWS workloads for software vulnerabilities and other security issues. Depending on supported capabilities, it can evaluate resources such as EC2 instances, container images, and Lambda functions. Inspector findings help security teams prioritize vulnerabilities for remediation and improve the overall security posture of workloads. Redshift provides data warehousing, Transit Gateway connects networks, and Connect provides contact-center capabilities. Inspector is the service specifically focused on vulnerability assessment and management.

Question 115

Which KMS feature permits controlled cryptographic access without full key administration?

1. Key grant
2. KMS alias
3. Key deletion schedule
4. Key description

Correct Answer: 1

Explanation:

KMS grants provide a mechanism for delegating specific cryptographic permissions without necessarily giving the grantee full administrative control over a KMS key. Grants can specify which operations a principal may perform and can be useful when AWS services or applications need controlled access to encryption keys. An alias provides an alternative name for a key, a deletion schedule controls pending key deletion, and a key description is informational metadata. Grants are therefore particularly useful when organizations need to separate cryptographic usage from broader key administration.

Question 116

Which AWS service protects backup data against retention-period deletion?

1. AWS Backup Vault Lock
2. Amazon RDS Proxy
3. AWS Storage Gateway
4. Amazon EBS

Correct Answer: 1

Explanation:

AWS Backup Vault Lock helps protect backup recovery points by enforcing retention-related restrictions. Depending on the configuration, protected recovery points can be prevented from being deleted or changed during the retention period. This provides an important layer of protection against accidental deletion and malicious attempts to destroy backup data. RDS Proxy manages database connections, Storage Gateway connects on-premises environments with AWS storage, and EBS provides block storage. Vault Lock specifically addresses the immutability and retention requirements associated with protected backup recovery points.

Question 117

Which AWS feature provides temporary credentials to trusted external identities?

1. AWS Security Token Service
2. Amazon S3
3. AWS CloudFormation
4. Amazon DynamoDB

Correct Answer: 1

Explanation:

AWS Security Token Service, or AWS STS, provides temporary security credentials to trusted principals. It plays an important role in federation, cross-account access, and workload authentication. Temporary credentials have limited lifetimes and can be associated with specific permissions, reducing dependence on long-term access keys. Amazon S3 provides object storage, CloudFormation manages infrastructure deployment, and DynamoDB provides NoSQL database capabilities. STS is the service responsible for issuing temporary credentials that can be used by authorized external or internal identities.

Question 118

Which S3 control records multiple versions of stored objects?

1. S3 Versioning
2. S3 Object Lock
3. S3 Access Points
4. S3 Transfer Acceleration

Correct Answer: 1

Explanation:

S3 Versioning preserves multiple versions of objects in a bucket. When objects are overwritten or deleted, previous versions can remain available according to the bucket’s configuration and applicable permissions. Versioning can help recover from accidental deletions and overwrites and is commonly combined with other S3 protection mechanisms. Object Lock focuses on retention and immutability, Access Points provide specialized access configurations, and Transfer Acceleration improves data-transfer performance. Versioning specifically provides the ability to retain and recover previous object versions.

Question 119

Which AWS service provides managed TLS certificates?

1. AWS Certificate Manager
2. Amazon QuickSight
3. AWS CodePipeline
4. Amazon Kinesis

Correct Answer: 1

Explanation:

AWS Certificate Manager, or ACM, provides managed SSL/TLS certificates for supported AWS services and workloads. It simplifies certificate provisioning and can automatically renew eligible certificates, reducing the operational burden of certificate lifecycle management. TLS certificates help establish encrypted connections and authenticate supported endpoints. QuickSight provides business intelligence, CodePipeline supports continuous delivery workflows, and Kinesis handles streaming data. ACM is specifically designed to manage certificates used for secure network communication.

Question 120

Which security architecture keeps audit logs outside workload administrators’ control?

1. Centralized logging account
2. Application-local log files
3. Developer-owned storage bucket
4. Shared administrator repository

Correct Answer: 1

Explanation:

A centralized logging account can separate security and audit data from ordinary workload administration. Logs from multiple accounts can be delivered into protected storage where access is restricted to authorized security personnel and automated systems. This architecture reduces the ability of workload administrators to alter or delete evidence associated with their own activities. Local application logs, developer-owned buckets, and shared administrator repositories provide weaker separation because the same personnel managing workloads may also control the audit records. Centralized security logging therefore supports stronger separation of duties and audit integrity.