View Full Amazon AWS Certified Security – Specialty SCS-C03 Exam Dumps and Practice Test Dumps.

 

Question 1

Which AWS service continuously analyzes AWS account activity to identify potential security threats and suspicious behavior?

1. Amazon GuardDuty
2. AWS Config
3. Amazon Macie
4. AWS Artifact

Correct Answer: 1

Explanation

Amazon GuardDuty is a managed threat detection service that continuously analyzes relevant AWS data sources to identify suspicious activity and potential threats. It can use signals such as AWS CloudTrail management events, VPC Flow Logs, and DNS activity to generate security findings. Security teams can integrate GuardDuty with services such as AWS Security Hub and EventBridge to centralize findings and automate responses. GuardDuty is designed for threat detection rather than configuration compliance or sensitive-data discovery, making it an important component of an AWS security monitoring strategy.

Question 2

A security team needs a centralized service to aggregate and normalize security findings from multiple AWS security services. Which service should the team use?

1. Amazon CloudWatch
2. AWS Security Hub
3. AWS CloudTrail
4. Amazon Inspector

Correct Answer: 2

Explanation

AWS Security Hub provides centralized aggregation and management of security findings from supported AWS security services and integrated third-party products. It can normalize findings into a consistent format, helping security teams analyze and prioritize security issues across multiple AWS accounts and Regions. Security Hub can also integrate with automation workflows for remediation. CloudWatch focuses primarily on monitoring and observability, while CloudTrail records API activity and Amazon Inspector focuses on vulnerability and exposure assessment. Security Hub is therefore appropriate when centralized security finding management is required.

Question 3

Which AWS service records API activity for resources across an AWS environment?

1. AWS Config
2. Amazon Detective
3. AWS CloudTrail
4. Amazon GuardDuty

Correct Answer: 3

Explanation

AWS CloudTrail records API activity and other account activity that can be used for security analysis, auditing, governance, and incident investigation. Organizations can create trails that deliver events to Amazon S3 and integrate CloudTrail with CloudWatch Logs or other security services. In a multi-account environment, an organization trail can help provide centralized visibility into account activity. CloudTrail records are especially valuable during investigations because analysts can determine which identity performed an action, what API operation occurred, and when the activity took place.

Question 4

A company wants to discover sensitive information such as personally identifiable information stored in Amazon S3. Which AWS service is designed for this purpose?

1. Amazon Macie
2. Amazon Inspector
3. Amazon Detective
4. AWS WAF

Correct Answer: 1

Explanation

Amazon Macie is designed to discover and protect sensitive data stored in Amazon S3. It uses machine learning and pattern matching to identify sensitive information and can help organizations understand where potentially sensitive data exists. Macie can also identify certain S3 security and access issues. This capability supports data classification, privacy requirements, and risk management. Amazon Inspector instead focuses on vulnerability and exposure assessment, while GuardDuty detects threats and Detective supports investigation. Macie is therefore the appropriate choice for sensitive-data discovery in S3.

Question 5

Which AWS service provides centralized collection and analysis of security-related data from multiple sources to support security operations?

1. AWS Backup
2. Amazon Security Lake
3. Amazon Cognito
4. AWS Certificate Manager

Correct Answer: 2

Explanation

Amazon Security Lake is designed to centrally collect security data from AWS, SaaS applications, on-premises environments, and supported third-party sources. It stores security-related information in a data lake and uses the Open Cybersecurity Schema Framework to normalize data from different sources. This can make security investigation, threat hunting, and analytics more efficient because analysts can work with standardized security information. Security Lake complements services such as Security Hub and GuardDuty by providing a broader centralized security-data foundation for an organization.

Question 6

An organization needs to identify EC2 instances with known software vulnerabilities. Which AWS service should it use?

1. Amazon Inspector
2. AWS Shield
3. Amazon Macie
4. AWS Artifact

Correct Answer: 1

Explanation

Amazon Inspector automatically assesses supported AWS workloads for software vulnerabilities and unintended network exposure. For EC2 instances, Inspector can identify known software vulnerabilities and provide findings that security teams can prioritize for remediation. It can also assess other supported resources, including container images and Lambda functions. Inspector is different from GuardDuty, which focuses on threat detection based on suspicious activity. Vulnerability findings can be integrated with security operations workflows so organizations can identify, prioritize, and remediate weaknesses before attackers exploit them.

Question 7

Which AWS service provides a managed firewall for controlling network traffic at the VPC level?

1. AWS WAF
2. AWS Network Firewall
3. Amazon GuardDuty
4. AWS Firewall Manager

Correct Answer: 2

Explanation

AWS Network Firewall is a managed network firewall service that provides traffic inspection and control for VPC environments. It can support stateful and stateless traffic filtering and can be used to enforce network security policies across workloads. AWS WAF is primarily designed to protect web applications from HTTP and HTTPS threats, while Network Firewall operates at the network level. Firewall Manager can centrally manage certain firewall and security policies across AWS accounts. Selecting the correct service depends on the layer and type of traffic requiring protection.

Question 8

A web application is receiving repeated malicious HTTP requests targeting common web vulnerabilities. Which AWS service can inspect and filter these requests?

1. AWS WAF
2. AWS KMS
3. Amazon Detective
4. AWS Config

Correct Answer: 1

Explanation

AWS WAF is a web application firewall that helps protect applications from common web exploits and unwanted HTTP or HTTPS traffic. It can use rules based on IP addresses, request characteristics, headers, geographic conditions, rate limits, and managed rule groups. AWS WAF can be associated with supported services such as Amazon CloudFront and Application Load Balancers. Security teams can use it to help mitigate common application-layer attacks while allowing legitimate requests to continue. Rule design should be carefully tested to reduce false positives and unintended blocking.

Question 9

Which AWS service can help determine why an Amazon EC2 instance was involved in suspicious activity by analyzing relationships between security events?

1. AWS Audit Manager
2. Amazon Detective
3. AWS Trusted Advisor
4. Amazon Macie

Correct Answer: 2

Explanation

Amazon Detective helps security teams investigate security findings by analyzing and visualizing relationships between resources, users, IP addresses, and activities. It can provide context around suspicious events and help investigators understand how an incident developed. Detective is particularly useful after a security finding has been identified because it supports deeper investigation rather than simply generating alerts. Analysts can use Detective alongside GuardDuty, CloudTrail, and other telemetry sources to determine the scope and potential cause of suspicious activity.

Question 10

A security administrator needs to prevent an IAM user from accessing AWS services unless the request comes through a specific approved VPC endpoint. Which IAM capability is most appropriate?

1. IAM policy condition keys
2. IAM groups
3. IAM password policy
4. AWS Organizations tags

Correct Answer: 1

Explanation

IAM policy condition keys allow policies to restrict access based on attributes associated with a request. For example, the aws:sourceVpce condition key can be used in appropriate policies to restrict access to requests originating through a specified VPC endpoint. This provides more precise authorization than simply granting or denying access to an IAM principal. Conditions can also evaluate factors such as source IP, requested Region, principal attributes, or transport security. Careful testing is necessary because restrictive conditions can unintentionally block legitimate access if the request path changes.

Question 11

Which AWS service allows administrators to provide temporary security credentials to workloads instead of embedding long-term access keys?

1. AWS STS
2. AWS Artifact
3. Amazon CloudFront
4. AWS Shield

Correct Answer: 1

Explanation

AWS Security Token Service provides temporary security credentials that can be used to access AWS resources. Temporary credentials reduce the need to distribute and store long-term access keys and can be scoped to specific permissions and durations. IAM roles commonly use STS to provide temporary credentials to AWS services, applications, and federated users. Organizations should follow least-privilege principles when defining role permissions and should avoid embedding long-term credentials in application code, configuration files, or container images.

Question 12

A company wants EC2 applications to access Amazon S3 without storing AWS access keys on the instances. What should the company use?

1. IAM role with an instance profile
2. IAM user’s access key
3. Root user credentials
4. Hard-coded application credentials

Correct Answer: 1

Explanation

An IAM role associated with an EC2 instance through an instance profile allows applications on the instance to obtain temporary credentials without storing long-term access keys. The role should contain only the permissions required by the workload. AWS provides temporary credentials through the instance metadata service, which supported applications can use through the AWS SDK or CLI. This approach improves credential management and reduces exposure associated with hard-coded secrets. Administrators should also protect access to instance metadata and apply appropriate network and application security controls.

Question 13

Which AWS service provides centralized management of workforce access to multiple AWS accounts using a single identity source?

1. AWS IAM Identity Center
2. Amazon Inspector
3. AWS Network Firewall
4. Amazon Security Lake

Correct Answer: 1

Explanation

AWS IAM Identity Center provides centralized workforce access management across AWS accounts and supported applications. It can integrate with an organization’s identity provider and allows administrators to assign users or groups access to AWS accounts through permission sets. This simplifies centralized identity management and reduces the need to maintain separate IAM users across multiple accounts. Organizations can apply least privilege by creating permission sets appropriate to specific job functions. Centralized workforce identity management also supports stronger authentication and more consistent access governance.

Question 14

Which AWS service is specifically designed to manage encryption keys used by AWS services and applications?

1. AWS KMS
2. Amazon Macie
3. AWS CloudTrail
4. Amazon Detective

Correct Answer: 1

Explanation

AWS Key Management Service allows organizations to create and manage cryptographic keys and control their use through IAM and key policies. KMS integrates with many AWS services so that data can be encrypted at rest without requiring applications to implement their own cryptographic key-management infrastructure. Administrators can control key usage, monitor activity through CloudTrail, and manage key lifecycle operations. Proper separation of duties, least privilege, and appropriate key policies are important because excessive permissions around cryptographic keys can expose protected data.

Question 15

An organization must ensure that an Amazon S3 bucket is accessible only through a designated VPC endpoint. Which policy mechanism can enforce this requirement?

1. S3 bucket policy using a VPC endpoint condition
2. EC2 security group only
3. CloudWatch alarm
4. Amazon Inspector rule

Correct Answer: 1

Explanation

An Amazon S3 bucket policy can use conditions such as aws:sourceVpce to restrict requests to a specific VPC endpoint. This allows organizations to create a resource-level authorization control that limits how clients can reach the bucket. A security group cannot directly enforce S3 bucket access because security groups control network traffic associated with supported network interfaces and resources rather than S3 authorization. Combining a restrictive bucket policy with Block Public Access, encryption, logging, and appropriate IAM permissions can provide stronger protection for sensitive S3 data.

Question 16

Which AWS service can automatically record configuration changes to AWS resources and evaluate them against desired security configurations?

1. AWS Config
2. Amazon GuardDuty
3. AWS Shield Advanced
4. Amazon Cognito

Correct Answer: 1

Explanation

AWS Config records resource configurations and changes and can evaluate resources against defined configuration rules. Organizations can use Config to determine whether resources comply with security requirements, such as encryption, restricted access, or approved configurations. Config can also support centralized compliance monitoring across multiple AWS accounts and Regions. It differs from CloudTrail because CloudTrail primarily records API activity, while Config focuses on resource configuration state and changes. Config findings can be integrated with broader governance and remediation workflows.

Question 17

Which security architecture best reduces the risk of compromise spreading between workloads in different application tiers?

1. Network segmentation
2. Shared administrator credentials
3. Public subnet placement
4. Unrestricted security groups

Correct Answer: 1

Explanation

Network segmentation separates workloads into controlled network boundaries and restricts communication between those boundaries. In a typical multi-tier application, web, application, and database components can be placed in different subnets or security zones with narrowly defined communication paths. This reduces unnecessary connectivity and can limit lateral movement if one workload is compromised. AWS provides several mechanisms for implementing segmentation, including VPC subnets, security groups, network ACLs, and AWS Network Firewall. The appropriate design depends on application dependencies and security requirements.

Question 18

A company needs to centrally enforce security policies across multiple AWS accounts, including rules for AWS WAF and security groups. Which service is designed for this purpose?

1. AWS Firewall Manager
2. Amazon CloudWatch
3. AWS Certificate Manager
4. Amazon Athena

Correct Answer: 1

Explanation

AWS Firewall Manager centrally manages firewall and security policies across AWS Organizations accounts. It can help administrators apply and maintain policies for supported services such as AWS WAF, AWS Shield Advanced, security groups, and AWS Network Firewall. Centralized management is valuable in multi-account environments because manually maintaining security policies in every account can create inconsistencies and gaps. Firewall Manager can help ensure that required controls are automatically applied to resources that meet defined policy scopes, supporting consistent security governance across the organization.

Question 19

Which AWS service can securely store database passwords and application secrets while supporting controlled retrieval by applications?

1. AWS Secrets Manager
2. Amazon S3 Glacier
3. AWS CloudTrail
4. Amazon Route 53

Correct Answer: 1

Explanation

AWS Secrets Manager securely stores sensitive information such as database credentials, API keys, and application secrets. Applications can retrieve secrets programmatically instead of embedding credentials directly in source code or configuration files. Secrets Manager supports access control through IAM policies and can also support automatic rotation for compatible secrets. Centralizing secrets management reduces the risk associated with hard-coded credentials and simplifies lifecycle management. Applications should request only the secrets they require, and access to Secrets Manager should be restricted according to least-privilege principles.

Question 20

A security team wants to detect whether a security group allows unintended network paths to sensitive resources. Which AWS capability is most appropriate?

1. AWS Network Access Analyzer
2. Amazon Macie
3. AWS Audit Manager
4. Amazon Cognito

Correct Answer: 1

Explanation

AWS Network Access Analyzer helps identify unintended network access paths within AWS environments. It can evaluate network configurations and determine whether resources can communicate in ways that violate defined network access requirements. This capability can help security teams identify overly permissive security groups, network ACLs, routing configurations, and other connectivity issues. By analyzing actual network paths against intended requirements, organizations can reduce unnecessary exposure and improve segmentation. It complements other security controls such as security groups, Network Firewall, and VPC architecture reviews.