View Full Amazon AWS Certified Security – Specialty SCS-C03 Exam Dumps and Practice Test Dumps.

 

Question 201

Which AWS service provides a managed, centralized repository for compliance reports and agreements that can support an organization’s audit process?

1. Amazon Detective
2. AWS Artifact
3. Amazon Inspector
4. AWS Shield

Correct Answer: 2

Explanation

AWS Artifact provides on-demand access to AWS security and compliance documentation, including reports and agreements relevant to regulatory and contractual requirements. Security and compliance teams can use these documents as supporting evidence when evaluating AWS services against organizational obligations. Artifact does not continuously monitor customer resources or enforce security controls. Instead, it provides documentation about AWS compliance and security practices. Organizations remain responsible for assessing how AWS services and their own configurations satisfy specific regulatory requirements under the shared responsibility model.

Question 202

A security engineer needs to allow a third-party SaaS provider to assume an IAM role without granting the provider permanent credentials. Which mechanism should be used?

1. IAM role with a trust policy and external ID
2. Long-lived IAM access key shared with the provider
3. Root user credentials
4. S3 public access

Correct Answer: 1

Explanation

An IAM role can provide temporary credentials to a trusted third party without requiring the organization to share long-lived access keys. For third-party access, an external ID can also be included in the role trust policy to help prevent the confused-deputy problem. The provider assumes the role through AWS Security Token Service and receives temporary credentials according to the role’s permissions. Organizations should restrict the trust policy and permissions carefully, monitor role usage, and avoid sharing permanent IAM user credentials with external services.

Question 203

Which IAM policy component determines who or what is allowed to assume an IAM role?

1. Permissions policy
2. Identity policy
3. Trust policy
4. Session policy

Correct Answer: 3

Explanation

An IAM role’s trust policy defines which principals are trusted to assume the role. This is different from the permissions policy attached to the role, which determines what actions can be performed after the role has been assumed. A secure design therefore requires both controls: the trust policy must limit who can obtain the role’s credentials, while the permissions policy must limit what those credentials can do. Security teams should review both policies because excessive trust or excessive permissions can independently create security exposure.

Question 204

A security administrator wants to restrict an IAM role so that even its attached permissions policy cannot grant access beyond a predefined maximum. Which feature should be configured?

1. Service control policy
2. Permissions boundary
3. Network ACL
4. Resource-based policy

Correct Answer: 2

Explanation

An IAM permissions boundary defines the maximum permissions that an identity-based policy can grant to an IAM user or role. It does not itself grant permissions. An action is allowed only when the applicable identity policies grant it and the permissions boundary permits it, along with any other relevant authorization controls. Permissions boundaries are useful when delegated administrators can create roles but must remain within centrally defined limits. Organizations should understand the interaction between boundaries, identity policies, resource policies, SCPs, and explicit denies.

Question 205

Which AWS feature can be used to encrypt EBS volumes automatically when new volumes are created in an AWS Region?

1. EBS encryption by default
2. S3 Block Public Access
3. CloudTrail organization trail
4. IAM Access Analyzer

Correct Answer: 1

Explanation

Amazon EBS encryption by default enables automatic encryption for newly created EBS volumes and supported snapshot-related operations in a Region. This helps organizations establish a consistent encryption baseline without requiring developers or administrators to remember to select encryption for every new volume. Organizations can use AWS KMS keys according to their encryption requirements and key-management architecture. Enabling the setting does not automatically solve every data-protection concern, so teams should still manage KMS permissions, key policies, backups, access controls, and monitoring appropriately.

Question 206

A company needs to ensure that only approved IAM principals can access a KMS key from another AWS account. Which control is especially important?

1. KMS key policy
2. Route table
3. Security group
4. CloudFront cache policy

Correct Answer: 1

Explanation

AWS KMS key policies are a fundamental authorization mechanism for customer managed KMS keys. For cross-account use, the key policy in the owning account must allow the appropriate external account or principals, while permissions in the external account must also authorize the intended KMS actions. Security teams should avoid broad principals and unnecessary permissions in key policies. Because KMS keys can protect highly sensitive information, administrators should carefully review key policy statements, grants, IAM permissions, and organizational restrictions before allowing cross-account cryptographic operations.

Question 207

Which KMS feature allows an application to provide additional authenticated information that must match when encrypted data is decrypted?

1. Key alias
2. Encryption context
3. Key rotation
4. Key ARN

Correct Answer: 2

Explanation

An AWS KMS encryption context is additional authenticated data supplied during encryption and required during decryption. It can help bind encrypted data to a particular purpose, resource, or application context. The encryption context is not secret, but it must match the value expected by the decryption operation. IAM and KMS policies can also reference encryption-context conditions for additional authorization control. This feature is useful when organizations want cryptographic operations to depend on specific contextual attributes rather than relying solely on possession of a KMS key.

Question 208

An organization wants to reduce the number of long-lived IAM access keys used by workloads running outside AWS. Which AWS service can provide temporary AWS credentials to those workloads using X.509 certificates?

1. IAM Roles Anywhere
2. AWS Secrets Manager
3. AWS Artifact
4. Amazon Macie

Correct Answer: 1

Explanation

IAM Roles Anywhere allows workloads outside AWS to obtain temporary AWS credentials by using X.509 certificates and configured trust anchors. This can reduce dependence on long-lived IAM access keys for servers, applications, or other workloads operating outside AWS environments. The workload receives temporary credentials associated with an IAM role and can then access authorized AWS resources. Organizations should protect private keys, establish appropriate trust anchors, restrict role permissions, and monitor credential usage. This approach supports stronger credential lifecycle management for hybrid environments.

Question 209

Which IAM capability can help identify permissions that an IAM principal has but has not used recently?

1. IAM Access Analyzer unused access analysis
2. AWS WAF managed rules
3. Amazon Macie
4. AWS Network Firewall

Correct Answer: 1

Explanation

IAM Access Analyzer provides capabilities that can help organizations identify unused access associated with supported IAM identities and permissions. Security teams can use this information to review excessive privileges and remove permissions that are no longer necessary. This supports least-privilege management over time rather than relying only on the permissions originally assigned. Before removing access, administrators should verify whether permissions are required for infrequent operational tasks. Changes should be tested carefully to avoid disrupting legitimate workloads while reducing unnecessary authorization paths.

Question 210

A security team wants to identify IAM users whose access keys may have become unnecessary after applications were migrated to IAM roles. Which AWS capability can assist with credential review?

1. IAM credential report
2. Amazon Detective
3. AWS Shield Advanced
4. AWS Network Firewall

Correct Answer: 1

Explanation

The IAM credential report provides information about credentials associated with IAM users, including password and access-key-related status information. Security teams can use it to identify potentially unused or outdated credentials during periodic access reviews. This is particularly useful when organizations migrate workloads from long-lived IAM access keys to roles and temporary credentials. Reviewing the report can support credential cleanup and reduce unnecessary authentication mechanisms. Administrators should validate operational dependencies before disabling or deleting credentials and should combine credential reviews with broader IAM access analysis.

Question 211

Which AWS service can help organizations centrally manage certificates for private applications and internal certificate authorities?

1. AWS Private Certificate Authority
2. Amazon Athena
3. AWS Audit Manager
4. Amazon GuardDuty

Correct Answer: 1

Explanation

AWS Private Certificate Authority provides managed private certificate authority capabilities for issuing and managing certificates used by internal applications, devices, and services. It can support private PKI architectures where certificates are not intended to be publicly trusted. Organizations can establish certificate authorities, define issuance controls, and manage certificate lifecycles according to their security requirements. Private CA is different from a public certificate service because its trust model is controlled by the organization. Strong CA permissions and private-key protection are essential to maintaining trust in the PKI.

Question 212

A company needs to revoke trust in a private certificate before its natural expiration date. Which PKI capability addresses this requirement?

1. Certificate revocation
2. DNS forwarding
3. Security group referencing
4. S3 lifecycle expiration

Correct Answer: 1

Explanation

Certificate revocation allows an organization to invalidate a certificate before its scheduled expiration when the certificate should no longer be trusted. This may be necessary when a private key is compromised, a device is decommissioned, or certificate issuance was incorrect. In a private PKI environment, certificate lifecycle procedures should define when revocation is required and how relying applications determine certificate status. AWS Private Certificate Authority supports private certificate management workflows, while organizations remain responsible for configuring applications and trust relationships correctly.

Question 213

Which AWS service can help protect Amazon S3 data by automatically encrypting new objects using server-side encryption with an AWS owned key?

1. Amazon S3 server-side encryption
2. AWS Network Firewall
3. Amazon Detective
4. AWS Audit Manager

Correct Answer: 1

Explanation

Amazon S3 supports server-side encryption for objects stored in S3. Depending on the configured encryption option, AWS can manage the encryption keys without requiring customers to maintain the underlying key material. Server-side encryption helps protect data at rest, but authorization and access controls remain essential because encryption does not determine which principals can retrieve objects. Organizations should select the encryption approach that matches their security, compliance, and key-management requirements and should verify that bucket policies and IAM permissions prevent unauthorized access.

Question 214

A security administrator wants to require a particular KMS key whenever applications upload sensitive objects to an S3 bucket. Which control is most appropriate?

1. S3 bucket policy with an encryption-related condition
2. Route 53 Resolver rule
3. Network ACL
4. IAM credential report

Correct Answer: 1

Explanation

An S3 bucket policy can enforce encryption requirements by denying object uploads that do not meet specified encryption conditions. For example, a policy can require server-side encryption using a designated KMS key. This creates a preventive control at the storage boundary instead of relying solely on application developers to configure encryption correctly. Security teams should test the policy against all legitimate upload paths and ensure the required principals have permission to use the KMS key. Logging and monitoring can then provide additional assurance that encryption requirements remain effective.

Question 215

Which AWS service can help identify whether an IAM resource policy unintentionally grants access to an external principal?

1. AWS IAM Access Analyzer
2. Amazon Inspector
3. AWS Shield
4. Amazon CloudWatch

Correct Answer: 1

Explanation

IAM Access Analyzer analyzes resource-based policies and can identify resources that are accessible from outside the intended trust boundary. This is particularly useful for detecting unintended external access to resources such as S3 buckets, IAM roles, KMS keys, and other supported resources. Security teams can investigate findings and modify policies when external access is unnecessary. Access Analyzer does not replace policy review or organizational governance. It should be used alongside least-privilege design, continuous monitoring, and periodic reviews of resource-based permissions.

Question 216

Which AWS capability allows an organization to create policy checks that help validate IAM policies before deployment?

1. IAM Access Analyzer policy validation
2. AWS Shield Advanced
3. Amazon Macie
4. AWS Backup Vault Lock

Correct Answer: 1

Explanation

IAM Access Analyzer provides policy validation capabilities that can help identify issues in IAM policies before they are deployed. Policy validation can surface warnings, errors, or recommendations related to policy structure and permissions. This supports a preventive approach by catching potential authorization problems during development rather than after deployment. Security teams should still perform contextual review because a syntactically valid policy may grant more access than an application actually requires. Automated validation works best when combined with least privilege and deployment review processes.

Question 217

A security team wants to prevent administrators from accidentally granting unrestricted access through newly created IAM roles. Which combination provides a strong organizational control?

1. Permissions boundaries and restrictive governance policies
2. Public S3 buckets and access keys
3. Security groups and DNS records
4. CloudFront distributions and WAF rules

Correct Answer: 1

Explanation

Permissions boundaries can limit the maximum permissions available to IAM roles and users created by delegated administrators. Organizational governance policies, such as SCPs, can provide an additional upper-level restriction across accounts. Together, these controls can reduce the risk that delegated administrators accidentally create identities with excessive privileges. Neither control replaces careful IAM policy design. Security teams should establish approved role-creation patterns, monitor policy changes, and periodically review permissions. This layered approach helps maintain least privilege while still allowing teams to administer their environments.

Question 218

A company wants to prevent accidental deletion of backup recovery points even if an administrator’s IAM permissions would normally allow deletion. Which AWS capability is designed for this purpose?

1. AWS Backup Vault Lock
2. Amazon Inspector
3. AWS Private CA
4. Amazon CloudFront

Correct Answer: 1

Explanation

AWS Backup Vault Lock can help protect backup recovery points against deletion or alteration according to configured retention controls. It is designed to support backup immutability requirements and can provide an additional defense against accidental or malicious changes to backups. This is especially important for ransomware resilience because attackers may attempt to destroy recovery data after compromising administrative credentials. Organizations should design retention periods carefully and verify recovery procedures. Backup protection should complement broader identity controls, monitoring, incident response, and disaster-recovery planning.

Question 219

Which AWS service can help assess whether an application has appropriate resilience across its AWS architecture?

1. AWS Resilience Hub
2. Amazon Macie
3. AWS WAF
4. AWS Artifact

Correct Answer: 1

Explanation

AWS Resilience Hub helps organizations assess and manage application resilience against disruptions. It can evaluate application resources and configurations against defined resilience requirements and provide recommendations for improving resilience. From a security perspective, resilient architectures can reduce the impact of failures, operational incidents, and certain disruptive attacks. Resilience Hub is not a replacement for vulnerability management or security monitoring. Organizations should use it alongside backup, disaster recovery, incident response, identity controls, and network protections to establish a broader resilience strategy.

Question 220

A security administrator wants to ensure that only authorized principals can create or modify resources in a specific AWS Region. Which IAM policy condition can help restrict API requests by Region?

1. aws:SourceIp
2. aws:RequestedRegion
3. aws:PrincipalTag
4. aws:SecureTransport

Correct Answer: 2

Explanation

The aws:RequestedRegion global condition key can be used in IAM policies to control access based on the AWS Region targeted by an API request. Organizations can use this condition to restrict workloads or users from operating in Regions that are not approved for their environment. This can support governance, data-residency, and security requirements. Administrators should carefully evaluate services with global endpoints and exceptions before enforcing the restriction. Region-based controls should complement, rather than replace, identity, resource, network, and organizational security policies.