View Full Amazon AWS Certified Security – Specialty SCS-C03 Exam Dumps and Practice Test Dumps.

 

Question 181

Which AWS service can help detect unauthorized API activity involving an AWS account?

1. AWS Config
2. Amazon GuardDuty
3. AWS Certificate Manager
4. AWS Artifact

Correct Answer: 2

Explanation

Amazon GuardDuty analyzes supported AWS activity and other security signals to identify potentially malicious behavior. It can generate findings involving suspicious API activity, compromised credentials, unusual access patterns, and other threats. Security teams can investigate these findings using CloudTrail and other telemetry to determine whether the activity was authorized. GuardDuty is primarily a detection service, so organizations should combine it with preventive IAM controls, network security, logging, and incident-response procedures. Findings should be validated before high-impact remediation actions are automatically performed.

Question 182

A security administrator wants to prevent users from deleting a critical CloudTrail log bucket through their normal account permissions. Which design provides stronger protection?

1. Store logs in a separate security account with restricted administration
2. Give every administrator full S3 permissions
3. Disable S3 versioning
4. Store logs on the same EC2 instance generating them

Correct Answer: 1

Explanation

Storing security logs in a separate, tightly controlled security or logging account provides stronger isolation from workloads and administrators in individual accounts. This reduces the chance that an attacker who compromises a workload account can delete or alter the associated evidence. Organizations can further protect the centralized log repository with restrictive IAM policies, encryption, monitoring, and immutable storage where appropriate. Separation of duties is particularly valuable for security telemetry because attackers often attempt to remove evidence after gaining administrative access.

Question 183

Which AWS service can help identify whether an EC2 instance contains software with known vulnerabilities?

1. AWS Audit Manager
2. Amazon Inspector
3. Amazon Detective
4. AWS Shield

Correct Answer: 2

Explanation

Amazon Inspector assesses supported workloads for vulnerabilities and security exposures. For EC2 instances, it can identify vulnerabilities associated with installed software packages and provide findings that security teams can use to prioritize remediation. Inspector can continuously reassess supported resources as their state changes. The service does not automatically eliminate vulnerabilities in every scenario, so organizations need remediation processes such as patching, application updates, or replacement of affected machine images. Combining vulnerability findings with network reachability information can help teams better understand exposure.

Question 184

Which IAM capability allows permissions to be granted based on tags associated with an identity and a resource?

1. Attribute-based access control
2. Root user authentication
3. Security group filtering
4. Network address translation

Correct Answer: 1

Explanation

Attribute-based access control uses attributes such as tags when making authorization decisions. In AWS, IAM policies can use supported condition keys to compare principal and resource tags and determine whether an action should be allowed. ABAC can simplify access management in environments with many resources because policies can be designed around organizational attributes instead of individual resource names. However, tag governance is critical. Users who can modify security-relevant tags may potentially influence authorization decisions, so tag permissions should be tightly controlled and monitored.

Question 185

A company wants to automatically notify a security team whenever a high-severity Security Hub finding appears. Which AWS service can route the event to a notification target?

1. Amazon EventBridge
2. Amazon Macie
3. AWS Certificate Manager
4. AWS Direct Connect

Correct Answer: 1

Explanation

Amazon EventBridge can receive events from AWS services and route matching events to supported targets. Security teams can create rules that match specific Security Hub findings, such as findings with a particular severity or type, and then send those events to notification or remediation workflows. This enables near-real-time security automation without requiring analysts to manually monitor the Security Hub console continuously. Rules should be narrowly defined and tested carefully so that important findings are not missed and excessive notifications do not overwhelm security responders.

Question 186

Which AWS service provides centralized storage and normalization of security data from multiple sources using OCSF?

1. Amazon Security Lake
2. AWS Shield Advanced
3. AWS Config
4. Amazon Inspector

Correct Answer: 1

Explanation

Amazon Security Lake is designed to centralize security data from supported AWS, third-party, and other sources. It uses the Open Cybersecurity Schema Framework to normalize security information into a standardized format, making data easier to consume across security analytics and investigation tools. This can help organizations build broader security data pipelines without maintaining completely different processing logic for every source. Security Lake should be protected with appropriate access controls, retention policies, and encryption because centralized security data can contain highly sensitive operational information.

Question 187

A security engineer needs to restrict traffic between two application tiers based on security-group membership rather than fixed IP addresses. Which AWS control is appropriate?

1. Security group referencing
2. S3 bucket policy
3. AWS Artifact
4. CloudTrail event selector

Correct Answer: 1

Explanation

Security groups can reference other security groups when defining inbound rules for supported VPC communication. This allows an application tier to permit traffic from instances associated with a specific security group without relying on static IP addresses. The approach is useful when workloads scale or instances change because membership can remain the authorization basis. Security teams should still keep rules narrowly scoped and avoid unnecessary outbound permissions. Network ACLs, routing controls, and application authentication can provide additional layers of protection around sensitive application tiers.

Question 188

Which AWS service can help protect applications from SQL injection and cross-site scripting patterns in HTTP requests?

1. AWS WAF
2. AWS KMS
3. Amazon Athena
4. AWS Audit Manager

Correct Answer: 1

Explanation

AWS WAF can inspect HTTP and HTTPS requests and apply managed or custom rules designed to identify common web application attacks. Managed rule groups can help detect patterns associated with threats such as SQL injection and cross-site scripting. WAF can be associated with supported application endpoints, including CloudFront distributions and Application Load Balancers. Security teams should monitor rule matches and tune configurations according to application behavior because legitimate requests can occasionally resemble attack patterns. WAF should complement secure coding, authentication, patching, and application testing.

Question 189

An organization needs to control which accounts can use a particular AWS service regardless of the IAM permissions configured within those accounts. Which control is most suitable?

1. Security group
2. Service control policy
3. S3 Object Lock
4. VPC endpoint

Correct Answer: 2

Explanation

Service control policies provide organization-level guardrails that can restrict actions or services across member accounts. Even if an IAM policy within an account grants an action, an applicable SCP can prevent that action from being performed. SCPs do not grant permissions; they define maximum available permissions for affected accounts and organizational units. Security teams can use them to enforce broad requirements such as restricting Regions or blocking selected services. SCPs should be carefully tested because an overly restrictive organizational policy can affect legitimate workloads.

Question 190

Which AWS service can help preserve and analyze a point-in-time copy of an EC2 instance’s attached storage during an investigation?

1. AWS Systems Manager
2. Amazon EBS snapshot
3. Amazon CloudFront
4. AWS WAF

Correct Answer: 2

Explanation

An Amazon EBS snapshot creates a point-in-time copy of an EBS volume and can be used to preserve storage evidence during a security investigation. Investigators can use the snapshot to create a separate volume for analysis while minimizing changes to the original evidence. Access to forensic snapshots should be tightly controlled and encryption should be used according to organizational requirements. Evidence-handling procedures should document when the snapshot was created and who accessed it. Other evidence sources may also be required for a complete forensic investigation.

Question 191

Which AWS service can help centrally apply and manage WAF policies across multiple accounts?

1. AWS Firewall Manager
2. Amazon Macie
3. AWS Artifact
4. Amazon Detective

Correct Answer: 1

Explanation

AWS Firewall Manager can centrally manage supported AWS WAF policies across multiple accounts and organizational units. This is useful for organizations that need consistent web application protections while allowing individual application teams to operate separate AWS accounts. Central policies can establish baseline protections and reduce configuration drift. Firewall Manager works with AWS Organizations and supported AWS security services. Security teams should define exceptions carefully because some applications may require specialized rules. Policy changes should be tested before broad deployment to avoid unintended application traffic blocking.

Question 192

A company wants to make sure a secret is not stored directly in an application’s source code. Which approach should be used?

1. Store the secret in AWS Secrets Manager and retrieve it when required
2. Store the secret in a public S3 object
3. Place the secret in a container image
4. Add the secret to a source-code repository

Correct Answer: 1

Explanation

AWS Secrets Manager provides a managed location for storing sensitive values such as passwords, tokens, and API credentials. Applications can retrieve secrets at runtime using IAM authorization rather than embedding them in source code or deployment artifacts. Secrets Manager can also support rotation for supported secret types. Security teams should grant applications access only to the specific secrets they require and monitor secret retrieval. Storing secrets in source repositories or container images creates unnecessary exposure because those artifacts may be copied, cached, or accessed by unintended users.

Question 193

Which AWS service can help determine whether a network configuration creates an unintended path to a resource?

1. Amazon Inspector
2. AWS Audit Manager
3. Amazon Macie
4. AWS Artifact

Correct Answer: 1

Explanation

Amazon Inspector includes network reachability capabilities for supported resources that can help identify potentially unintended network exposure. This analysis can provide valuable context when security teams evaluate vulnerable workloads because reachability influences the potential attack surface. Investigators can compare reachability results with security groups, network ACLs, route tables, and other network controls. Remediation may involve removing unnecessary routes, restricting security group rules, or moving resources into isolated network segments. Network analysis should be combined with vulnerability assessment and application-level security reviews.

Question 194

Which AWS feature can require requests to an S3 bucket to use HTTPS?

1. S3 bucket policy using aws:SecureTransport
2. Security group outbound rule
3. AWS WAF rate rule
4. Route 53 DNS policy

Correct Answer: 1

Explanation

An S3 bucket policy can use the aws:SecureTransport condition key to deny requests that are not made through secure transport. This provides a preventive control that helps ensure data is transmitted to the bucket over HTTPS rather than unencrypted HTTP. Security teams should test the policy with all legitimate clients and integrations because an incorrect deny statement can disrupt applications. Secure transport is only one layer of data protection and should be combined with encryption at rest, strong authorization, logging, and appropriate network controls.

Question 195

Which AWS service can help organizations establish a baseline of governance controls when creating a multi-account AWS environment?

1. AWS Control Tower
2. Amazon GuardDuty
3. AWS WAF
4. Amazon Athena

Correct Answer: 1

Explanation

AWS Control Tower provides capabilities for setting up and governing multi-account AWS environments with standardized configurations and controls. It can help organizations establish account structures, governance requirements, and baseline security controls. Control Tower works with AWS Organizations and supported AWS services to provide centralized governance. This can reduce configuration inconsistencies between accounts and make security requirements easier to enforce. Organizations should define additional workload-specific controls because a governance baseline does not automatically address every application, data, network, or identity security requirement.

Question 196

A security analyst wants to search CloudTrail records for a sequence of suspicious API operations across multiple AWS accounts. Which approach is most suitable?

1. Analyze centralized CloudTrail data using an appropriate query and analytics service
2. Disable CloudTrail after collecting the first event
3. Review only EC2 system logs
4. Delete older CloudTrail records

Correct Answer: 1

Explanation

Centralized CloudTrail data can be analyzed using query and analytics services such as Amazon Athena when the records are stored in Amazon S3. This approach allows analysts to search large volumes of API events across accounts and establish timelines for suspicious activity. Centralization also makes it easier to correlate events from multiple environments. Security teams should preserve appropriate retention, protect log integrity, and use restrictive access policies. Queries should focus on relevant identities, actions, resources, timestamps, and source information during an investigation.

Question 197

Which AWS service can provide private connectivity to supported AWS services from a VPC without requiring an internet gateway?

1. AWS PrivateLink or supported VPC endpoint
2. AWS Shield
3. Amazon Macie
4. AWS Audit Manager

Correct Answer: 1

Explanation

VPC endpoints can provide private connectivity from resources in a VPC to supported AWS services without requiring traffic to use an internet gateway. Interface endpoints use AWS PrivateLink technology for supported services, while gateway endpoints are available for services such as Amazon S3 and DynamoDB. Endpoint policies and network controls can further restrict access where supported. Private connectivity can reduce internet exposure and support security architecture requirements, but it does not replace IAM authorization, encryption, logging, or service-specific security controls.

Question 198

An organization wants to determine which AWS resources are reachable from an internet-facing entry point before deploying a workload. Which security concept should be prioritized?

1. Network reachability analysis
2. S3 lifecycle management
3. Certificate renewal
4. Audit evidence collection

Correct Answer: 1

Explanation

Network reachability analysis helps organizations understand whether a resource can be reached through configured network paths. This is valuable before deployment because security teams can identify unintended exposure caused by route tables, security groups, network ACLs, load balancers, or other network components. Understanding reachability alongside vulnerability information can improve risk assessment and prioritization. Teams should verify the intended architecture and restrict unnecessary paths before production deployment. Network reachability is complementary to vulnerability scanning because it focuses on exposure rather than solely on software weaknesses.

Question 199

Which AWS service can help an organization automatically rotate supported database credentials stored as secrets?

1. AWS Secrets Manager
2. AWS CloudTrail
3. Amazon Detective
4. AWS Network Firewall

Correct Answer: 1

Explanation

AWS Secrets Manager supports automatic rotation for supported secret types and configurations, including certain database credentials. Rotation changes the stored credential according to an established process and allows applications to retrieve the current secret rather than relying on a permanently static password. This reduces the security risk associated with long-lived credentials. Organizations should test rotation before enabling it in production because applications must handle credential changes correctly. IAM permissions should also be limited so that only authorized workloads can retrieve each secret.

Question 200

A security team wants to test whether a workload can tolerate a controlled failure without compromising security or availability objectives. Which AWS service can support controlled fault experiments?

1. AWS Fault Injection Service
2. AWS Artifact
3. Amazon Macie
4. AWS Certificate Manager

Correct Answer: 1

Explanation

AWS Fault Injection Service allows organizations to conduct controlled fault injection experiments against supported AWS workloads. Security and resilience teams can use carefully designed experiments to evaluate how applications respond to failures and whether recovery mechanisms operate as expected. Experiments should have clear objectives, safeguards, monitoring, and rollback procedures to limit unintended impact. Results can reveal weaknesses in resilience, monitoring, incident response, and recovery processes. Controlled testing is valuable because documented procedures may not perform as expected under real operational pressure.