View Full Amazon AWS Certified Security – Specialty SCS-C02 Exam Dumps and Practice Test Dumps

 

Question 121

Which AWS service helps centrally manage security policies across multiple AWS accounts?

1. AWS Firewall Manager
2. AWS Artifact
3. AWS Audit Manager
4. AWS Trusted Advisor

Correct Answer: 1

Explanation:

AWS Firewall Manager provides centralized management of firewall rules and security policies across multiple AWS accounts and resources within AWS Organizations. Security teams can define policies for services such as AWS WAF, AWS Shield Advanced, security groups, and Network Firewall, then apply those policies consistently across accounts. This reduces the need to configure protections separately in every environment. Firewall Manager is particularly useful in organizations with many accounts where centralized governance is required. AWS Artifact provides compliance documents, while Audit Manager helps collect audit evidence. Trusted Advisor provides recommendations across several AWS operational areas but does not centrally enforce firewall policies.

Question 122

What prevents a third-party role from being assumed by an unintended AWS account?

1. Security group referencing
2. External ID in the trust policy
3. S3 Object Ownership
4. VPC route filtering

Correct Answer: 2

Explanation:

An external ID helps protect cross-account role assumption from the confused deputy problem. When a third-party service or vendor accesses an AWS account on behalf of customers, the external ID provides an additional condition in the IAM role trust policy. The trusted role can require the caller to present a specific external ID before access is granted. This helps ensure that the third party cannot accidentally use its own privileged relationship to access another customer’s resources. Security groups control network traffic, S3 Object Ownership manages object ownership behavior, and route filtering does not establish trusted cross-account identity.

Question 123

Which S3 setting makes the bucket owner automatically own uploaded objects?

1. Bucket ACL inheritance
2. Object ACL synchronization
3. Bucket owner enforced
4. Ownership delegation mode

Correct Answer: 3

Explanation:

The S3 Object Ownership setting Bucket owner enforced disables access control lists and makes the bucket owner automatically own every object written to the bucket. This simplifies authorization because permissions can be managed through IAM policies and bucket policies rather than relying on object ACLs. It is especially useful when multiple accounts upload objects into a centralized bucket and the receiving account needs consistent ownership. With this configuration, ACL-based access control is disabled. Organizations commonly use this setting for centralized logging and data collection buckets because it reduces ownership and permission complications associated with cross-account uploads.

Question 124

Which feature protects CloudFront origins by allowing requests only through CloudFront?

1. Origin Access Control
2. Origin Shield
3. Cache policy
4. Response headers policy

Correct Answer: 1

Explanation:

CloudFront Origin Access Control (OAC) helps secure supported origins by allowing CloudFront to authenticate requests made to the origin. For an Amazon S3 origin, OAC can be combined with an S3 bucket policy that permits access from the CloudFront distribution while preventing direct public access to the bucket. This creates a controlled path in which users retrieve content through CloudFront rather than bypassing the distribution. Origin Shield is designed primarily to improve origin request efficiency. Cache policies determine caching behavior, while response headers policies control HTTP response headers. OAC therefore addresses origin access protection rather than caching or response customization.

Question 125

What does enabling EBS encryption by default accomplish for new EBS volumes?

1. Encrypts only manually selected snapshots
2. Requires a customer-managed key for every volume
3. Encrypts newly created EBS volumes automatically
4. Converts existing unencrypted volumes immediately

Correct Answer: 3

Explanation:

EBS encryption by default automatically encrypts newly created EBS volumes in a Region. It can also ensure that new snapshots created from encrypted volumes remain encrypted. Administrators can configure the default encryption behavior and, where appropriate, specify a KMS key for encryption. The setting does not retroactively encrypt existing unencrypted volumes. Existing resources require separate migration or encryption procedures. A customer-managed KMS key is not universally mandatory because AWS-managed keys can be used. This feature helps organizations establish encryption as a baseline control without requiring administrators or application teams to remember to enable encryption separately whenever new EBS volumes are created.

Question 126

Which KMS capability allows encrypted applications in multiple Regions to use related cryptographic keys?

1. Key aliases
2. Multi-Region keys
3. Imported key material
4. Grant tokens

Correct Answer: 2

Explanation:

AWS KMS Multi-Region keys allow related KMS keys to exist in different AWS Regions while sharing key material and key identifiers. This can simplify encryption workflows for applications that replicate encrypted data across Regions. A primary Multi-Region key can have replicas created in other Regions, and the related keys can be used for cryptographic operations within their respective Regions. Key aliases provide friendly names, imported key material concerns how material enters KMS, and grant tokens help with grant propagation. Multi-Region keys are therefore specifically designed for scenarios requiring coordinated cryptographic protection across geographically separated AWS environments.

Question 127

Which service provides managed certificate issuance and renewal for AWS-integrated applications?

1. AWS PrivateLink
2. AWS CloudHSM
3. AWS Certificate Manager
4. AWS Secrets Manager

Correct Answer: 3

Explanation:

AWS Certificate Manager (ACM) provides managed SSL/TLS certificates that can be used with supported AWS services. Public ACM certificates can often be automatically renewed while they remain associated with supported services, reducing operational work for certificate lifecycle management. ACM can also work with private certificate authorities for private PKI use cases. PrivateLink provides private network connectivity, CloudHSM supplies dedicated hardware security modules, and Secrets Manager stores and manages secrets. ACM is therefore the appropriate service when an organization needs certificates for HTTPS or other TLS-enabled AWS-integrated applications without manually handling routine certificate renewal.

Question 128

What does an IAM session policy primarily do when a role is assumed?

1. Expands permissions beyond the role policy
2. Limits the permissions available during the session
3. Replaces the role trust relationship
4. Permanently modifies the role permissions

Correct Answer: 2

Explanation:

An IAM session policy can restrict the permissions available to a temporary session created when a role is assumed. The effective permissions are constrained by the role’s identity-based permissions together with applicable session restrictions and other policy controls. A session policy cannot grant permissions that the underlying role does not already allow. It is useful when an application or federation workflow needs temporary credentials with a narrower permission set than the role could otherwise provide. Session policies do not replace the role’s trust policy and do not permanently alter the IAM role configuration.

Question 129

Which AWS service can scan container images stored in Amazon ECR for software vulnerabilities?

1. Amazon Inspector
2. Amazon Detective
3. Amazon Macie
4. AWS Security Hub

Correct Answer: 1

Explanation:

Amazon Inspector can assess container images stored in Amazon Elastic Container Registry (ECR) for software vulnerabilities. It analyzes packages and known vulnerability information to help security teams identify potentially exploitable components before or during deployment. This capability complements other Inspector assessments for supported AWS workloads. Amazon Macie focuses on sensitive data discovery, Detective helps investigate security findings and suspicious activity, and Security Hub aggregates security findings from multiple AWS services and integrated products. Inspector is therefore the service directly associated with vulnerability assessment of supported ECR container images.

Question 130

Which control helps ensure an S3 object cannot be permanently deleted during a retention period?

1. S3 Transfer Acceleration
2. S3 Inventory
3. S3 Object Lock
4. S3 Select

Correct Answer: 3

Explanation:

S3 Object Lock provides write-once-read-many (WORM) protection for Amazon S3 objects. It can prevent objects from being deleted or overwritten for a specified retention period. Object Lock supports governance mode and compliance mode, with compliance mode providing stronger restrictions on changing or removing retention protections. This capability is useful for regulatory records, audit evidence, and other data requiring tamper-resistant retention. S3 Transfer Acceleration improves transfer performance, Inventory generates object reports, and Select provides query capabilities for object data. Object Lock directly addresses protection against deletion or modification during retention.

Question 131

Which AWS service records API activity in an account for security investigation?

1. Amazon Inspector
2. AWS CloudTrail
3. AWS Config
4. Amazon GuardDuty

Correct Answer: 2

Explanation:

AWS CloudTrail records AWS API activity and provides an audit trail of actions performed through the AWS Management Console, SDKs, command-line tools, and supported AWS services. CloudTrail events can contain information such as the identity making a request, the source address, the time of the operation, and the affected resource. Security teams can use these records to investigate unauthorized changes or suspicious activity. AWS Config focuses on resource configuration history and compliance, Inspector identifies vulnerabilities, and GuardDuty detects threats using multiple data sources. CloudTrail is therefore the primary AWS service for recording API activity.

Question 132

Which AWS service can discover sensitive information stored in Amazon S3 objects?

1. AWS Audit Manager
2. Amazon Macie
3. AWS Artifact
4. Amazon CloudWatch

Correct Answer: 2

Explanation:

Amazon Macie is designed to discover and help protect sensitive data stored in Amazon S3. It uses automated data discovery and sensitive data detection techniques to identify information such as credentials, financial information, and personally identifiable information within supported objects. Security teams can use Macie findings to investigate potentially exposed or improperly stored sensitive data. Audit Manager collects evidence for audits, Artifact provides AWS compliance documentation, and CloudWatch monitors operational metrics and logs. Macie is therefore the service specifically focused on discovering sensitive information in S3 data stores.

Question 133

What is the primary purpose of AWS Systems Manager Session Manager?

1. Secure interactive access to managed instances without inbound SSH
2. Automatic database encryption
3. Centralized certificate issuance
4. Object-level S3 retention

Correct Answer: 1

Explanation:

AWS Systems Manager Session Manager provides interactive shell access to supported managed instances without requiring inbound SSH or RDP access. Connections are established through the Systems Manager service, allowing organizations to reduce exposed management ports and simplify administrative access. Session activity can also be logged to supported AWS services depending on configuration. This approach can significantly reduce reliance on publicly reachable administrative endpoints. Session Manager does not issue certificates, encrypt databases automatically, or manage S3 retention. Its security value comes from providing controlled administrative access while reducing the need to expose traditional remote-management ports.

Question 134

Which KMS mechanism allows temporary permissions to use a customer managed key?

1. Key deletion schedule
2. Key grant
3. Alias replication
4. Key metadata tag

Correct Answer: 2

Explanation:

A KMS grant provides delegated, temporary permissions to perform specific operations on a KMS key. Grants are useful when an AWS service or application needs access to a key without modifying the key policy for every individual use case. A grant can specify operations such as encryption or decryption and identify the principal that receives the permissions. Key deletion schedules control when keys can be deleted, aliases provide alternate names, and tags help organize resources. Grants are especially useful for AWS services that need controlled access to customer-managed KMS keys while keeping key authorization manageable.

Question 135

Which AWS service evaluates resources against defined configuration compliance rules?

1. Amazon Detective
2. AWS Config
3. Amazon Macie
4. AWS CloudHSM

Correct Answer: 2

Explanation:

AWS Config continuously evaluates supported AWS resources against configuration rules and records resource configuration changes. Organizations can use managed or custom Config rules to determine whether resources meet security and compliance requirements. For example, a rule might evaluate whether storage resources have encryption enabled or whether certain network configurations meet organizational requirements. Config can generate compliance results and integrate with remediation workflows. Detective focuses on investigation, Macie discovers sensitive data, and CloudHSM provides dedicated cryptographic hardware. AWS Config is therefore the appropriate service when the primary requirement is continuous evaluation of resource configuration against defined compliance conditions.

Question 136

What does S3 Bucket Keys primarily reduce?

1. DNS query volume
2. KMS request traffic for SSE-KMS objects
3. CloudTrail event storage
4. VPC endpoint latency

Correct Answer: 2

Explanation:

S3 Bucket Keys reduce the number of requests made to AWS KMS when Amazon S3 uses SSE-KMS encryption. Instead of making a separate KMS request for every object operation that requires encryption context handling, S3 can use a bucket-level key to reduce the frequency of direct KMS interactions. This can lower KMS request volume and potentially reduce related costs while maintaining encryption with SSE-KMS. Bucket Keys do not reduce DNS traffic, CloudTrail storage requirements, or VPC endpoint latency. They are specifically an S3 encryption optimization for workloads containing many objects protected with AWS KMS.

Question 137

Which IAM policy controls who is allowed to assume an IAM role?

1. Permissions boundary
2. Trust policy
3. Session policy
4. Resource tag policy

Correct Answer: 2

Explanation:

An IAM role’s trust policy defines which principals are trusted to assume the role. It establishes the role’s trust relationship and can include conditions such as required external IDs or MFA. This is different from the role’s permissions policy, which determines what actions the role can perform after it has been assumed. A permissions boundary limits the maximum permissions available to an identity, while a session policy can further restrict temporary session permissions. Understanding the distinction between trust and permissions policies is essential when troubleshooting cross-account access or federated authentication scenarios.

Question 138

Which AWS service provides dedicated hardware security modules for cryptographic operations?

1. AWS CloudHSM
2. AWS WAF
3. Amazon GuardDuty
4. AWS Firewall Manager

Correct Answer: 1

Explanation:

AWS CloudHSM provides dedicated hardware security modules that allow customers to generate, store, and use cryptographic keys in hardware designed for secure key management. It is useful for workloads requiring control over cryptographic operations and specific compliance or key-management requirements. CloudHSM differs from AWS KMS because customers have more direct control over the dedicated HSM environment and cryptographic configuration. AWS WAF protects web applications, GuardDuty detects threats, and Firewall Manager centrally manages certain security policies. CloudHSM is therefore the appropriate choice when dedicated HSM infrastructure is required for cryptographic processing.

Question 139

Which feature helps detect IAM resources granting access that may not be required?

1. CloudTrail Insights
2. IAM Access Analyzer
3. AWS Shield
4. Amazon Inspector

Correct Answer: 2

Explanation:

IAM Access Analyzer helps identify resource-based policies that grant access outside an intended trust boundary and can also provide findings related to unused access capabilities. These insights can help security teams review permissions and reduce unnecessary access. Access Analyzer is useful for analyzing policies involving resources such as S3 buckets, IAM roles, KMS keys, and other supported resources. CloudTrail Insights focuses on unusual API activity, Shield protects against DDoS attacks, and Inspector identifies vulnerabilities. Access Analyzer therefore provides capabilities specifically aimed at improving identity and resource authorization visibility.

Question 140

Which service can centrally enforce security policies across AWS Organizations accounts and resources?

1. Amazon Detective
2. AWS Artifact
3. AWS Firewall Manager
4. Amazon Macie

Correct Answer: 3

Explanation:

AWS Firewall Manager allows security administrators to centrally configure and enforce supported security policies across accounts in AWS Organizations. Policies can cover services and protections such as AWS WAF, Shield Advanced, security groups, and AWS Network Firewall. This centralized approach helps organizations maintain consistent security controls as new accounts and resources are added. Detective is focused on security investigations, Artifact provides compliance documentation, and Macie discovers sensitive data in S3. Firewall Manager is therefore the appropriate service when the requirement is centralized policy enforcement across an organization’s AWS environment.