View Full Amazon AWS Certified Security – Specialty SCS-C02 Exam Dumps and Practice Test Dumps

 

Question 141

Which AWS feature helps prevent accidental use of an old KMS key version?

1. Key policy conditions
2. Automatic key rotation
3. Alias deletion
4. Grant retirement

Correct Answer: 2

Explanation:

AWS KMS automatic key rotation periodically generates new cryptographic key material for supported customer managed symmetric keys while maintaining the same logical KMS key. Applications generally continue using the same key identifier or alias without requiring changes to their configuration. Previous key material remains available for decrypting data that was encrypted under earlier versions, while new encryption operations use the current material. This reduces the operational burden associated with manual cryptographic key rotation. Key policies control authorization, aliases provide alternate names, and grant retirement removes grants. Automatic rotation is therefore the relevant feature for regularly refreshing key material without changing the logical key.

Question 142

Which S3 control prevents objects from being permanently removed before retention expires?

1. Multipart Upload
2. Object Lock retention
3. Storage Lens
4. Lifecycle transition

Correct Answer: 2

Explanation:

S3 Object Lock retention can prevent protected objects from being permanently deleted or overwritten until the configured retention period ends. This capability is useful for records that must remain immutable for legal, regulatory, or organizational reasons. Retention can be configured for individual objects or through default retention settings on a bucket. Lifecycle rules can transition or expire objects according to configured schedules, while Multipart Upload handles large-object uploads and Storage Lens provides usage and activity insights. Object Lock is specifically designed to enforce WORM-style retention requirements and is therefore the appropriate control when immutability is the primary security objective.

Question 143

Which AWS service provides centralized sign-in for workforce users across AWS accounts?

1. IAM Identity Center
2. Amazon Cognito
3. AWS Directory Service
4. AWS Resource Groups

Correct Answer: 1

Explanation:

IAM Identity Center provides centralized workforce access to multiple AWS accounts and supported applications. Administrators can create or connect users and groups, assign permission sets, and provide users with a centralized sign-in experience. Permission sets define the access that users receive when entering particular AWS accounts. This reduces the need to create separate IAM users in every account. Amazon Cognito is primarily designed for application users, Directory Service provides managed directory capabilities, and Resource Groups organizes resources. IAM Identity Center is therefore the appropriate service for centrally managing workforce access across an AWS multi-account environment.

Question 144

What does an AWS KMS grant allow a principal to do?

1. Bypass all organization policies
2. Receive specified cryptographic permissions
3. Delete a protected key immediately
4. Change an AWS account owner

Correct Answer: 2

Explanation:

A KMS grant delegates specified permissions on a KMS key to a principal. The grant can allow supported cryptographic operations and can include constraints that limit how the permissions are used. Grants are commonly useful when AWS services or applications need controlled access to customer-managed keys without requiring frequent changes to the key policy. A grant does not bypass broader AWS authorization controls, transfer account ownership, or allow immediate deletion of a protected key. Security architects should evaluate grants together with key policies and IAM permissions when determining the effective authorization path for encrypted workloads.

Question 145

Which service can identify unusual API activity patterns in CloudTrail events?

1. Amazon Detective
2. CloudTrail Insights
3. AWS Config
4. Amazon Macie

Correct Answer: 2

Explanation:

CloudTrail Insights analyzes CloudTrail management events to identify unusual activity patterns, such as sudden increases in API calls that differ from established behavior. These insights can help security and operations teams investigate potentially suspicious activity or unexpected operational changes. CloudTrail continues to provide the underlying event history, while Insights adds analytical detection capabilities for supported activity patterns. AWS Config focuses on resource configuration changes, Macie focuses on sensitive data in S3, and Detective supports broader security investigations. CloudTrail Insights is therefore the most directly relevant feature when the requirement is identifying anomalous API activity.

Question 146

Which option provides private connectivity from a VPC to a supported AWS service?

1. Internet gateway routing
2. VPC endpoint
3. NAT instance forwarding
4. Public load balancer

Correct Answer: 4

Explanation:

A VPC endpoint provides private connectivity between resources in a VPC and supported AWS services without requiring traffic to traverse the public internet. Depending on the service and endpoint type, organizations can use interface or gateway endpoints. Endpoint policies can also help restrict which resources or actions are permitted through certain endpoint configurations. Internet gateways and public load balancers involve public network paths, while a NAT instance is primarily used for outbound internet connectivity from private resources. Private endpoints therefore provide an important network security control for reducing unnecessary public exposure.

Question 147

Which AWS service can automatically rotate supported database credentials stored as secrets?

1. AWS Secrets Manager
2. AWS Certificate Manager
3. AWS Artifact
4. Amazon Inspector

Correct Answer: 1

Explanation:

AWS Secrets Manager can automatically rotate supported secrets by using rotation workflows, often implemented through AWS Lambda. For supported database credentials, the rotation process can update the credential in the target database and the corresponding secret while applications retrieve the current value from Secrets Manager. Automated rotation reduces the need for long-lived static credentials and helps organizations establish regular credential changes. Certificate Manager manages certificates, Artifact provides compliance-related documentation, and Inspector performs vulnerability assessments. Secrets Manager is therefore the appropriate service when an organization needs centralized storage and automated rotation of application or database credentials.

Question 148

What is the main security benefit of using AWS Private CA?

1. Public DNS filtering
2. Private certificate lifecycle management
3. Network packet inspection
4. Centralized API auditing

Correct Answer: 2

Explanation:

AWS Private Certificate Authority (Private CA) enables organizations to create and manage their own private certificate authorities within AWS. It can issue private certificates for internal applications, services, devices, and other resources that require trusted TLS identities without using publicly trusted certificates. Administrators can establish certificate hierarchies and manage certificate issuance and revocation according to organizational requirements. DNS filtering, packet inspection, and API auditing are handled by other AWS services. Private CA is particularly useful for internal PKI environments where certificates must be trusted by organizational systems but should not be publicly trusted by internet clients.

Question 149

Which IAM control sets the maximum permissions an identity can receive?

1. Resource policy
2. Permissions boundary
3. Session tag
4. Trust relationship

Correct Answer: 2

Explanation:

An IAM permissions boundary defines the maximum permissions that an IAM user or role can receive through identity-based policies. Even if an identity policy grants an action, the action must also be permitted within the boundary for the effective permission to allow it. Permissions boundaries are useful for delegated administration because they allow teams to create or manage identities while restricting the maximum privilege those identities can obtain. Resource policies control access to supported resources, session tags provide contextual attributes, and trust relationships determine who can assume roles. The permissions boundary therefore serves as a guardrail around an identity’s maximum effective permissions.

Question 150

Which AWS service helps investigate relationships between security findings and resource activity?

1. Amazon Detective
2. AWS Firewall Manager
3. Amazon Macie
4. AWS Certificate Manager

Correct Answer: 1

Explanation:

Amazon Detective helps security teams investigate security findings by analyzing and visualizing relationships among users, resources, network activity, and other relevant signals. It can provide context that helps analysts understand what happened before, during, and after suspicious activity. Detective is intended for investigation rather than primary prevention. Firewall Manager centrally manages supported security policies, Macie discovers sensitive data, and Certificate Manager handles certificate lifecycle functions. Detective can therefore be particularly useful after a security finding has been generated and analysts need additional context to determine the scope and sequence of related activity.

Question 151

Which S3 feature helps restrict access through a specific application or organizational use case?

1. S3 Access Point
2. S3 Inventory
3. S3 Transfer Acceleration
4. S3 Storage Lens

Correct Answer: 1

Explanation:

S3 Access Points provide dedicated access configurations for shared S3 data. Each access point can have its own policy and network origin restrictions, allowing organizations to create separate access paths for different applications, teams, or use cases without maintaining one extremely complex bucket policy. This can simplify authorization for large shared datasets. S3 Inventory generates object metadata reports, Transfer Acceleration helps optimize long-distance uploads and downloads, and Storage Lens provides storage visibility and usage metrics. Access Points are therefore particularly useful when different consumers require distinct authorization controls for the same underlying S3 bucket.

Question 152

Which security control can require MFA before a privileged role is assumed?

1. S3 lifecycle configuration
2. IAM trust-policy condition
3. CloudTrail event selector
4. EBS snapshot policy

Correct Answer: 2

Explanation:

An IAM role trust policy can include conditions that require multi-factor authentication for role assumption. The aws:MultiFactorAuthPresent condition key can be used in appropriate trust-policy configurations to require MFA when a principal attempts to assume the role. This is useful for protecting sensitive administrative roles and reducing the risk associated with compromised long-term credentials. S3 lifecycle rules control object management, CloudTrail event selectors determine which events are recorded, and EBS snapshot policies address snapshot management. MFA requirements belong to the authentication and authorization path, making the role trust policy the appropriate control.

Question 153

What does CloudTrail Lake primarily provide?

1. Managed SQL-style analysis of collected activity events
2. Automated EC2 vulnerability patching
3. Private DNS resolution
4. S3 object classification

Correct Answer: 1

Explanation:

CloudTrail Lake provides a managed environment for collecting, storing, querying, and analyzing CloudTrail activity events. Security teams can use event data stores and SQL-based queries to investigate account activity without building and maintaining a separate log-analysis pipeline for every investigation. This can be useful for compliance reviews, incident response, and historical security analysis. CloudTrail Lake is distinct from services that patch EC2 systems, provide private DNS resolution, or classify S3 objects. Its central purpose is to make CloudTrail activity data easier to retain and analyze within a managed AWS environment.

Question 154

Which AWS service helps enforce organization-wide security policies on supported resources?

1. Amazon Cognito
2. AWS Firewall Manager
3. AWS Private CA
4. Amazon CloudWatch

Correct Answer: 2

Explanation:

AWS Firewall Manager helps security teams centrally configure and enforce supported security policies across AWS Organizations. Depending on the policy type, administrators can manage protections involving AWS WAF, Shield Advanced, security groups, Network Firewall, and other supported controls. This centralized model is valuable when organizations have many AWS accounts and need consistent security requirements. Cognito manages application identities, Private CA manages private certificates, and CloudWatch provides monitoring and observability capabilities. Firewall Manager is therefore the service most directly aligned with centralized security-policy enforcement across a multi-account AWS environment.

Question 155

Which mechanism can add contextual attributes to temporary IAM sessions?

1. Session tags
2. S3 metadata
3. KMS aliases
4. Route table entries

Correct Answer: 1

Explanation:

IAM session tags allow attributes to be passed into temporary sessions created through role assumption or federation workflows. These tags can be referenced by IAM policies to implement attribute-based access control (ABAC). For example, an organization may use department or project attributes to determine which resources a temporary session can access. This can reduce the need to create many nearly identical policies for individual users or roles. S3 metadata describes objects, KMS aliases provide alternate key names, and route table entries control network routing. Session tags are specifically designed to carry authorization-related context into temporary IAM sessions.

Question 156

Which service can provide centralized network firewall policy management across accounts?

1. AWS Artifact
2. AWS Firewall Manager
3. Amazon GuardDuty
4. AWS Audit Manager

Correct Answer: 2

Explanation:

AWS Firewall Manager provides centralized management of supported firewall and security policies across accounts in an AWS Organization. Security administrators can establish policies that apply consistently to designated accounts, organizational units, or resources. This helps prevent security controls from drifting as environments expand. GuardDuty detects potential threats, Audit Manager collects evidence for audits, and Artifact provides access to AWS compliance documentation. Firewall Manager is specifically designed for centralized enforcement and management of supported network and application protection controls, making it appropriate when the requirement involves consistent firewall policy administration across multiple accounts.

Question 157

Which option best protects a private S3 bucket from direct public exposure?

1. Public read ACL
2. Block Public Access settings
3. Anonymous bucket policy
4. Website endpoint configuration

Correct Answer: 2

Explanation:

S3 Block Public Access provides centralized controls designed to prevent public access configurations from exposing S3 buckets and objects. The settings can block public ACLs and policies or prevent public access from being granted through supported configuration paths. Organizations commonly enable these controls broadly as a security baseline, then create narrowly scoped exceptions only when required. Public read ACLs and anonymous bucket policies intentionally introduce public access, while website endpoint configurations are associated with static website hosting and can require careful access design. Block Public Access is therefore a foundational control for reducing accidental public exposure.

Question 158

Which AWS capability helps investigate compromised credentials using resource and activity relationships?

1. Amazon Detective
2. AWS PrivateLink
3. AWS Certificate Manager
4. Amazon ECR

Correct Answer: 1

Explanation:

Amazon Detective helps analysts investigate suspicious activity by building contextual relationships among identities, resources, network interactions, and security events. When credentials are suspected of being compromised, investigators can use this context to examine related activity and understand the broader sequence of events. This differs from preventive services that establish private network connections or issue certificates. ECR provides container image storage and related capabilities but is not primarily an investigation platform. Detective is therefore suited to the investigative stage of incident response, where security teams need contextual evidence rather than only an isolated security finding.

Question 159

Which KMS option allows an administrator to use a friendly name instead of a key ID?

1. Key alias
2. Grant token
3. Encryption context
4. Key material import

Correct Answer: 1

Explanation:

A KMS alias provides a human-readable name that can reference a KMS key. Applications and administrators can use aliases to simplify key identification and reduce dependence on hard-coded key identifiers. An alias can also be updated to point to a different key when appropriate, which can support operational key-management workflows. Grant tokens are associated with grant propagation, encryption context provides additional authenticated context for certain cryptographic operations, and imported key material concerns externally sourced cryptographic material. Aliases therefore improve manageability and readability when applications or administrators need to reference KMS keys.

Question 160

Which AWS service can collect evidence to support compliance audits?

1. Amazon Inspector
2. AWS Audit Manager
3. Amazon Route 53
4. AWS PrivateLink

Correct Answer: 2

Explanation:

AWS Audit Manager helps organizations collect and organize evidence related to compliance requirements. It can continuously gather relevant evidence from supported AWS services and map that evidence to control frameworks. This reduces manual effort when preparing for audits and helps security teams maintain an organized view of compliance activities. Inspector focuses on vulnerability assessment, Route 53 provides DNS services, and PrivateLink provides private connectivity. Audit Manager is therefore the appropriate choice when the primary requirement is collecting and managing evidence that demonstrates how an AWS environment aligns with defined audit controls.