View Full Amazon AWS Certified Security – Specialty SCS-C03 Exam Dumps and Practice Test Dumps.

 

Question 321

A company wants to prevent users from accidentally sharing an encrypted EBS snapshot with another AWS account. Which security control should be reviewed?

1. EBS encryption by default
2. EC2 instance metadata options
3. EBS snapshot sharing permissions
4. AWS WAF managed rules

Correct Answer: 3

Explanation

EBS snapshot sharing permissions determine which AWS accounts can access a snapshot. Security teams should review these permissions carefully because an improperly shared snapshot can expose the data contained within the associated volumes. Encryption provides protection for the snapshot data, but authorization still determines who can access the encrypted snapshot. Organizations should restrict snapshot sharing to explicitly approved accounts and regularly audit sharing configurations. Combining encryption, restrictive IAM policies, and monitoring of snapshot-related API activity helps reduce the risk of unintended cross-account data exposure.

Question 322

An organization wants CloudFront to access content in a private S3 bucket without making the bucket publicly accessible. Which feature should be configured?

1. S3 website endpoint
2. CloudFront Origin Access Control
3. S3 Transfer Acceleration
4. Public bucket policy

Correct Answer: 2

Explanation

CloudFront Origin Access Control allows a CloudFront distribution to access content in an S3 bucket while keeping the bucket itself private. The S3 bucket policy can be configured to allow access from the authorized CloudFront distribution rather than permitting public access. This architecture reduces the need to expose the S3 origin directly to internet users. Security teams should also review the bucket policy, CloudFront distribution settings, encryption requirements, and any alternate access paths to ensure that users cannot bypass CloudFront and directly retrieve protected objects.

Question 323

A security engineer needs to analyze CloudTrail S3 data events only for specific S3 buckets instead of recording data events for every bucket. Which CloudTrail feature can provide this filtering?

1. Advanced event selectors
2. CloudTrail digest files
3. CloudTrail Insights
4. Event history

Correct Answer: 1

Explanation

CloudTrail advanced event selectors allow organizations to define detailed criteria for the events they want to record. For S3 data events, selectors can be used to focus logging on specific resources and event types rather than collecting every possible data event. This can help control logging volume and costs while preserving important security visibility. Security teams should carefully identify high-value buckets and sensitive operations when designing selectors. Management events and other relevant data sources should still be evaluated separately so that important security activity is not unintentionally omitted.

Question 324

A security administrator wants to verify whether AWS security best-practice checks identify common configuration weaknesses in an account. Which service can provide these checks?

1. AWS Artifact
2. AWS Trusted Advisor
3. Amazon Macie
4. AWS Private CA

Correct Answer: 2

Explanation

AWS Trusted Advisor provides recommendations and checks across several categories, including security-related best practices for supported AWS resources and account configurations. Security teams can use these findings as an additional source of information when reviewing account posture. Trusted Advisor does not replace dedicated security services such as Security Hub, GuardDuty, Inspector, or Config. Instead, it can complement them by identifying certain account-level or configuration-related concerns. Organizations should evaluate each recommendation against their architecture and security requirements before making changes to production environments.

Question 325

A company wants to ensure that only approved Lambda functions can execute code using a particular deployment process. Which AWS Lambda security feature can help verify the authenticity of deployed code?

1. Lambda layers
2. Lambda aliases
3. Lambda environment variables
4. Lambda code signing

Correct Answer: 4

Explanation

AWS Lambda code signing can help organizations ensure that only code packages signed by trusted signing profiles are deployed to functions configured to require code signing. This provides an additional control against unauthorized or tampered deployment artifacts. Code signing should be integrated into the organization’s software delivery process so that approved build systems sign packages before deployment. Security teams should also restrict who can modify Lambda deployment configuration and signing profiles. Code signing complements IAM, CI/CD security, dependency management, and runtime monitoring rather than replacing those controls.

Question 326

A security team wants to identify whether an IAM policy grants permissions that are not necessary for an application’s current operation. Which approach is most useful?

1. Enable S3 Transfer Acceleration
2. Review IAM policy and access activity together
3. Disable CloudTrail
4. Use a public S3 bucket for testing

Correct Answer: 2

Explanation

Reviewing IAM policies together with actual access activity provides a stronger basis for identifying unnecessary permissions. Policy analysis can show what an identity is authorized to perform, while access activity can provide evidence about services or actions that have actually been used. Security teams should avoid removing permissions solely because they appear unused during a short observation period. Application dependencies and scheduled operations must be considered. A controlled permission-reduction process, followed by testing and monitoring, can gradually move identities toward least privilege without unnecessarily disrupting workloads.

Question 327

A company wants to send AWS WAF logs to a centralized destination for security analytics. Which capability should be configured?

1. WAF logging
2. S3 Object Lock
3. IAM Access Analyzer
4. AWS Backup

Correct Answer: 1

Explanation

AWS WAF logging can provide detailed information about web requests evaluated by a web ACL. These logs can be delivered to supported destinations for centralized analysis and monitoring. Security teams can use the information to investigate blocked requests, identify attack patterns, tune rules, and understand legitimate traffic that may have triggered protections. WAF logging should be protected with appropriate permissions and retention controls because security logs can contain sensitive request information. Organizations should combine WAF logs with application logs and other security telemetry when investigating web attacks.

Question 328

A security engineer needs to determine whether a specific EC2 instance is reachable from another resource through the configured network path. Which tool should be used?

1. Amazon Inspector
2. AWS Network Firewall
3. VPC Reachability Analyzer
4. Amazon GuardDuty

Correct Answer: 3

Explanation

VPC Reachability Analyzer is designed to analyze network paths between specified AWS resources and determine whether connectivity is possible based on the configured network components. It can evaluate route tables, security groups, network ACLs, and other relevant networking configuration. This helps security teams validate intended segmentation and troubleshoot unexpected connectivity without manually reviewing every component. Reachability Analyzer focuses on network configuration rather than application vulnerabilities or threat detection. It should therefore be used alongside services such as Inspector and GuardDuty when performing broader workload security assessments.

Question 329

A company wants to require certificate validation for internal applications using certificates issued by an organization-controlled private certificate authority. Which AWS service provides the private CA capability?

1. AWS WAF
2. AWS Private CA
3. Amazon Macie
4. Amazon Detective

Correct Answer: 2

Explanation

AWS Private Certificate Authority provides managed private certificate authority capabilities for organizations that need certificates for internal applications, services, devices, or private networks. A private CA can issue certificates under an organization’s controlled trust hierarchy. Security teams can use this capability to establish trusted TLS communication without relying on publicly trusted certificates. Access to the CA should be tightly controlled because unauthorized certificate issuance can undermine trust relationships. Certificate lifecycle management, revocation requirements, and renewal processes should also be incorporated into the organization’s security architecture.

Question 330

A security administrator wants to use AWS Config to search configuration data across resources using structured queries rather than checking resources individually. Which capability supports this requirement?

1. Config advanced queries
2. Config remediation actions
3. Config conformance packs
4. Config recorder

Correct Answer: 1

Explanation

AWS Config advanced queries allow administrators to query resource configuration information using a structured query language across supported configuration data. This can help security teams identify resources matching specific conditions without manually inspecting each account or resource. For example, administrators can search for resources with particular configuration attributes and use the results to support security reviews. Advanced queries provide visibility rather than automatically correcting configurations. Organizations can combine them with Config rules, aggregators, remediation actions, and centralized governance to build a broader configuration-management process.

Question 331

A security team wants to detect suspicious activity performed inside supported Amazon EKS workloads. Which GuardDuty capability is designed to provide runtime visibility for supported containers?

1. GuardDuty trusted IP lists
2. GuardDuty Runtime Monitoring
3. GuardDuty IP reputation lists
4. GuardDuty S3 Protection

Correct Answer: 2

Explanation

GuardDuty Runtime Monitoring provides runtime security visibility for supported workloads, including supported container environments. It can help detect suspicious behavior that may occur after an attacker gains access to a running workload. Runtime observations can add context that may not be available from control-plane activity alone. Security teams should configure the capability according to the supported workload requirements and integrate resulting findings into their investigation process. Runtime monitoring should complement strong IAM permissions, container image security, network segmentation, patching, and workload hardening.

Question 332

A company needs to determine which AWS account or principal performed a sensitive API operation recorded by CloudTrail. Which information in the event is most useful for identifying the caller?

1. eventTime
2. awsRegion
3. userIdentity
4. eventSource

Correct Answer: 3

Explanation

The userIdentity element in a CloudTrail event provides information about the identity associated with the API request. Depending on the authentication method, it can contain details about an IAM user, assumed role, federated identity, AWS service, or other supported identity type. Investigators can use this information together with fields such as event name, source IP address, and session context to reconstruct activity. Correctly interpreting identity information is especially important during incident response because temporary credentials and assumed roles can make the original human or workload identity less obvious.

Question 333

A security administrator wants to prevent an S3 bucket from being accessed through an unintended public access path even if an administrator accidentally adds a permissive bucket policy. Which account-level control can provide additional protection?

1. S3 Block Public Access
2. S3 Transfer Acceleration
3. S3 Inventory
4. S3 Batch Operations

Correct Answer: 1

Explanation

S3 Block Public Access provides controls designed to prevent public access configurations for S3 resources. It can help protect against accidental exposure caused by permissive bucket or access point policies and related public-access settings. Organizations can configure Block Public Access at the account or bucket level according to their requirements. Security teams should still review IAM policies, resource policies, access points, and application architecture because Block Public Access is specifically focused on public exposure. It should be treated as one layer within a broader S3 security strategy.

Question 334

A company wants to make an encrypted copy of an EBS snapshot in another AWS Region for disaster recovery. Which approach should the security team consider?

1. Disable encryption before copying
2. Copy the snapshot to the destination Region with appropriate encryption
3. Make the snapshot public first
4. Store the snapshot in an S3 public bucket

Correct Answer: 2

Explanation

EBS snapshots can be copied across AWS Regions, and the destination copy can use appropriate encryption settings. This supports disaster recovery while maintaining protection for stored volume data. Security teams should ensure that the destination Region has the required KMS key and that the users or services performing the copy have appropriate permissions. Cross-Region copies should also be governed by retention and access policies. Making a snapshot public or disabling encryption would create unnecessary exposure and is inconsistent with a secure disaster-recovery design.

Question 335

A company wants to ensure that newly issued private certificates are automatically renewed before expiration when supported by the certificate configuration. Which AWS service manages this lifecycle?

1. AWS Certificate Manager
2. AWS Artifact
3. Amazon GuardDuty
4. AWS Firewall Manager

Correct Answer: 1

Explanation

AWS Certificate Manager can manage the lifecycle of certificates issued through supported AWS Certificate Manager certificate authorities and integrations. Automatic renewal can reduce the risk of service interruptions caused by expired certificates when the required validation and deployment conditions are satisfied. Security teams should monitor renewal status and verify that renewed certificates are correctly deployed to the relevant services. Certificate lifecycle automation reduces operational risk but does not eliminate the need to protect private keys, control certificate issuance permissions, and monitor certificate-related activity.

Question 336

A security team wants to identify potentially suspicious API activity by comparing unusual behavior against a user’s or role’s normal activity patterns. Which AWS service is designed for security investigation using behavioral relationships?

1. Amazon Inspector
2. Amazon Detective
3. AWS Artifact
4. AWS Config

Correct Answer: 2

Explanation

Amazon Detective helps security teams investigate findings by analyzing related activity and behavioral relationships across supported AWS resources and identities. Instead of examining isolated events individually, investigators can use Detective to explore connections among users, roles, IP addresses, resources, and activity patterns. This can provide additional context when determining the scope and nature of a security incident. Detective is primarily an investigation service rather than a preventive access-control mechanism. Organizations can use its findings alongside GuardDuty, CloudTrail, Security Hub, and other security telemetry.

Question 337

A security administrator needs to restrict an S3 bucket so that requests must use a particular VPC endpoint. Which policy condition is appropriate?

1. aws:SourceIp
2. aws:PrincipalOrgID
3. aws:SourceVpce
4. aws:RequestedRegion

Correct Answer: 3

Explanation

The aws:SourceVpce condition key can be used in supported resource policies to restrict access based on the VPC endpoint through which a request is made. For S3, this can help ensure that access to sensitive buckets follows an intended private network path. Security teams should verify that all legitimate applications use the approved endpoint before enforcing a restrictive condition. This control should be combined with IAM authorization, encryption, logging, and other S3 security mechanisms because restricting the network path alone does not determine whether a principal should have access.

Question 338

A security team wants to review the AWS responsibilities that remain with the customer when using a managed AWS service. Which concept provides the appropriate framework?

1. AWS shared responsibility model
2. S3 Object Lock
3. AWS Shield
4. IAM Access Analyzer

Correct Answer: 1

Explanation

The AWS shared responsibility model defines how security responsibilities are divided between AWS and the customer. AWS is responsible for security of the underlying cloud infrastructure, while customers remain responsible for security controls that depend on their services, configurations, data, identities, and workloads. The exact division varies by service. Security teams should use the model when determining which controls they must implement themselves. Understanding these responsibilities helps prevent assumptions that AWS automatically manages every aspect of an application’s identity, data protection, network configuration, or operating environment.

Question 339

A company uses Infrastructure as Code and wants to identify insecure resource configurations before they are deployed. Which approach is most appropriate?

1. Wait for production incidents and investigate afterward
2. Disable security validation in the deployment pipeline
3. Perform security validation during the deployment pipeline
4. Make all resources publicly accessible for testing

Correct Answer: 3

Explanation

Security validation during the Infrastructure as Code deployment pipeline allows organizations to identify risky configurations before resources reach production. Automated checks can evaluate templates and infrastructure definitions against security requirements and organizational policies. This approach can reduce the cost and impact of correcting security issues because problems are identified earlier in the development lifecycle. Security teams should establish meaningful rules that address issues such as overly permissive access, exposed resources, and insecure network configurations. Pipeline checks should complement runtime monitoring and continuous configuration assessment.

Question 340

A security team wants to identify whether an Amazon ECR container image contains known software vulnerabilities before deployment. Which AWS service provides this capability?

1. AWS Config
2. Amazon Macie
3. Amazon GuardDuty
4. Amazon Inspector

Correct Answer: 4

Explanation

Amazon Inspector can assess supported Amazon ECR container images for known software vulnerabilities. This allows organizations to identify vulnerable packages and dependencies before container images are deployed into production environments. Security teams can integrate vulnerability findings into development and deployment workflows so that high-risk images receive remediation before release. Container image scanning should be combined with secure image-building practices, trusted registries, dependency management, and runtime protections. Regular rescanning is also important because newly disclosed vulnerabilities can affect packages that were previously considered safe.