View Full Amazon AWS Certified Security – Specialty SCS-C03 Exam Dumps and Practice Test Dumps.

 

Question 61

A security team wants to detect unexpected changes to security group configurations and receive an alert when a specific configuration becomes noncompliant. Which AWS service is most appropriate?

1. Amazon GuardDuty
2. AWS Config
3. Amazon Detective
4. AWS Shield

Correct Answer: 2

Explanation

AWS Config continuously records resource configurations and can evaluate them against defined rules. A security team can use Config rules to determine whether security groups comply with organizational requirements, such as avoiding unrestricted inbound access. When a configuration becomes noncompliant, Config can provide a compliance finding that can be integrated with notification or remediation workflows. This approach provides configuration-focused visibility rather than relying on threat detection services. Organizations should combine Config with preventive controls and appropriate remediation procedures for stronger security governance.

Question 62

An organization wants to prevent an IAM role from being used outside an approved AWS account during a cross-account access scenario. Which policy element can help enforce this restriction?

1. Resource tag
2. Security group rule
3. IAM condition
4. S3 lifecycle rule

Correct Answer: 3

Explanation

IAM policy conditions can evaluate contextual information associated with an AWS request and restrict access when the required condition is not satisfied. In cross-account scenarios, conditions can be used with supported context keys to constrain how a role or resource can be accessed. This provides an additional authorization guardrail beyond simply granting the role permissions. Security teams should verify the supported condition keys for the specific AWS service and test the resulting policy carefully because incorrect conditions can unintentionally block legitimate access.

Question 63

Which AWS service can help identify external access to resources and recommend whether permissions should be restricted?

1. AWS IAM Access Analyzer
2. AWS Shield Advanced
3. Amazon Inspector
4. AWS Audit Manager

Correct Answer: 1

Explanation

IAM Access Analyzer helps identify resources that are accessible from outside an AWS account or organization based on supported resource policies. It can help security teams discover unintended external access and determine whether resource-based permissions should be tightened. Access Analyzer can also support analysis of unused access and policy validation capabilities depending on the feature being used. It is particularly useful for reviewing resource policies that may unintentionally expose S3 buckets, IAM roles, KMS keys, or other supported resources.

Question 64

A company wants to allow an application to access an S3 bucket without routing the traffic through the public internet. Which solution should be considered?

1. Internet Gateway
2. NAT Gateway
3. VPC endpoint for Amazon S3
4. Public load balancer

Correct Answer: 3

Explanation

A VPC endpoint for Amazon S3 allows resources in a VPC to access supported S3 endpoints without requiring traffic to traverse the public internet. Endpoint policies can provide an additional layer of authorization by restricting which S3 actions or resources are accessible through the endpoint. This design can strengthen data-perimeter controls and reduce unnecessary internet exposure. Security teams should combine the endpoint with appropriate S3 bucket policies, IAM permissions, encryption, logging, and network architecture rather than treating the endpoint alone as a complete security control.

Question 65

Which security control can prevent an IAM principal from granting permissions that exceed an organization’s defined maximum permission set?

1. IAM permissions boundary
2. CloudTrail trail
3. VPC route table
4. AWS WAF rule

Correct Answer: 1

Explanation

An IAM permissions boundary establishes the maximum permissions that can be granted to an IAM user or role. Even if an identity-based policy attempts to grant additional permissions, the effective permissions cannot exceed the boundary. This makes permissions boundaries useful for delegated administration and environments where developers or teams can create IAM roles but must remain within an approved security scope. Boundaries do not themselves grant permissions, so organizations must still create appropriate identity-based policies and consider other authorization controls.

Question 66

A security team needs to identify vulnerable software packages installed on EC2 instances. Which AWS service is designed for this purpose?

1. Amazon Detective
2. AWS Artifact
3. Amazon Inspector
4. AWS Security Hub

Correct Answer: 3

Explanation

Amazon Inspector can assess supported AWS workloads for software vulnerabilities and other security exposures. For EC2 instances, it can identify vulnerabilities associated with installed packages and provide findings that help security teams prioritize remediation. Inspector findings can also be integrated into centralized security workflows. The service complements, rather than replaces, patch management. After vulnerabilities are identified, organizations should use appropriate operational processes such as Systems Manager Patch Manager, controlled application updates, or image replacement to remediate affected workloads.

Question 67

A company wants administrators to manage EC2 instances without opening inbound SSH ports. Which AWS capability is most appropriate?

1. AWS Direct Connect
2. AWS Systems Manager Session Manager
3. Amazon Route 53 Resolver
4. AWS Shield Advanced

Correct Answer: 2

Explanation

AWS Systems Manager Session Manager provides interactive access to managed instances without requiring administrators to expose inbound SSH or RDP ports. Access can be controlled using IAM policies, and session activity can be integrated with logging and auditing mechanisms. This reduces the attack surface associated with publicly reachable administrative ports. Before using Session Manager, the instances must satisfy the required Systems Manager prerequisites, including appropriate agent and connectivity configuration. Organizations should still apply least privilege and monitor administrative sessions.

Question 68

Which AWS feature is most appropriate for protecting a web application from common malicious HTTP requests such as SQL injection patterns?

1. AWS Network Firewall
2. Amazon GuardDuty
3. AWS WAF
4. Amazon Inspector

Correct Answer: 3

Explanation

AWS WAF is designed to inspect web requests and apply rules that can allow, block, or count requests based on characteristics of HTTP and HTTPS traffic. Managed rule groups can help detect common web application threats, including patterns associated with SQL injection and cross-site scripting. WAF can be deployed with supported AWS resources such as CloudFront and Application Load Balancers. Security teams should tune rules carefully because legitimate application traffic can sometimes resemble malicious patterns and produce false positives.

Question 69

An organization wants to protect a centralized security log repository from accidental deletion by administrators. Which S3 capability is particularly useful?

1. S3 Object Lock
2. S3 Transfer Acceleration
3. S3 Select
4. S3 Batch Operations

Correct Answer: 1

Explanation

S3 Object Lock can help prevent protected objects from being deleted or overwritten during configured retention periods. This is useful for security logs and other records where preservation is important for investigations, compliance, or ransomware resilience. Organizations can configure retention settings and, where appropriate, legal holds. Access to the bucket should still be tightly controlled because Object Lock is only one layer of protection. Security teams should also consider encryption, logging, versioning, lifecycle management, and restricted administrative access.

Question 70

Which AWS service can provide centralized governance controls across multiple AWS accounts by using preventive and detective controls?

1. AWS Control Tower
2. Amazon CloudFront
3. Amazon Macie
4. AWS Certificate Manager

Correct Answer: 1

Explanation

AWS Control Tower helps organizations establish and govern multi-account AWS environments using centralized controls and account-management capabilities. It can apply preventive and detective controls to help maintain organizational security and compliance requirements across accounts. Control Tower is particularly useful when organizations want standardized account configurations and governance mechanisms rather than managing every account independently. It can work alongside AWS Organizations, service control policies, AWS Config, and other security services to create layered governance across a multi-account environment.

Question 71

A security analyst wants to determine which API calls were made by a compromised IAM role shortly before a suspicious resource change. Which service should be examined first?

1. AWS CloudTrail
2. AWS Shield
3. Amazon Macie
4. AWS Firewall Manager

Correct Answer: 1

Explanation

AWS CloudTrail records AWS API activity and can provide important evidence during security investigations. Analysts can examine events to determine which principal performed an action, when the action occurred, what resource was targeted, and other available request context. This information can help establish a timeline surrounding a suspicious change. CloudTrail should be combined with other evidence such as application logs, VPC Flow Logs, and security-service findings when determining the full scope and root cause of an incident.

Question 72

Which AWS service can automatically rotate supported secrets so that applications do not need to use a permanently static credential?

1. AWS KMS
2. AWS Secrets Manager
3. AWS Artifact
4. Amazon Detective

Correct Answer: 2

Explanation

AWS Secrets Manager can securely store credentials and other sensitive information while supporting automated rotation for supported secret types and configurations. Rotation reduces the risk associated with long-lived static credentials and can help organizations meet credential-management requirements. Applications retrieve secrets when needed rather than embedding sensitive values directly in source code or configuration files. Security teams should ensure that applications have only the permissions required to retrieve specific secrets and that rotation procedures are tested to prevent service interruptions.

Question 73

An organization wants to inspect DNS queries leaving workloads in a VPC and block requests to known malicious domains. Which AWS service is designed for this purpose?

1. AWS Network Firewall
2. Route 53 Resolver DNS Firewall
3. AWS WAF
4. Amazon Inspector

Correct Answer: 2

Explanation

Route 53 Resolver DNS Firewall allows organizations to control DNS queries from resources within a VPC. Rules can be used to allow or block DNS requests based on domain lists and other supported criteria. This can help prevent workloads from resolving known malicious or unwanted domains and can provide an additional layer of outbound security. DNS Firewall is different from AWS WAF, which focuses on web requests, and Network Firewall, which provides broader network traffic inspection and filtering capabilities.

Question 74

A company wants to automatically execute a predefined sequence of remediation steps when a security incident is detected. Which AWS service can orchestrate such a workflow?

1. Amazon S3
2. AWS Step Functions
3. AWS Artifact
4. Amazon Route 53

Correct Answer: 2

Explanation

AWS Step Functions can orchestrate multi-step workflows by coordinating AWS services and application functions. In security operations, a workflow can receive a finding, collect information, isolate a resource, preserve evidence, notify responders, and initiate additional remediation actions. Step Functions can provide structured execution and error handling for these processes. Organizations should design automated workflows carefully, especially when actions can affect production resources. Appropriate authorization, approval requirements, logging, and failure-handling mechanisms should be incorporated into security automation.

Question 75

Which AWS service can help collect and analyze network traffic metadata for resources in a VPC?

1. VPC Flow Logs
2. AWS Artifact
3. AWS Certificate Manager
4. Amazon Macie

Correct Answer: 1

Explanation

VPC Flow Logs capture information about network traffic to and from network interfaces in a VPC. Security teams can use this metadata to investigate unexpected communication, identify rejected connections, analyze traffic patterns, and support incident investigations. Flow Logs do not capture packet contents, so they should be combined with other logging and monitoring mechanisms when deeper inspection is required. Organizations should send flow logs to an appropriate destination, configure retention, and restrict access because network metadata can contain sensitive operational information.

Question 76

A security team wants to ensure that only approved network paths can reach sensitive workloads and wants to identify unintended connectivity before deployment. Which AWS capability is useful?

1. Amazon Inspector network reachability
2. AWS Artifact
3. Amazon Macie
4. AWS Certificate Manager

Correct Answer: 1

Explanation

Amazon Inspector network reachability capabilities can help identify network paths that may allow access to supported resources. This can help security teams discover unintended exposure and prioritize remediation before an attacker can exploit an accessible service. Network reachability analysis complements traditional vulnerability assessment because a vulnerability’s risk can depend on whether the affected resource is actually reachable. Teams should combine reachability information with security groups, network ACLs, routing, application architecture, and vulnerability findings when evaluating overall exposure.

Question 77

Which AWS capability allows an organization to create an isolated copy of an EC2 instance’s storage for forensic examination?

1. EBS snapshot
2. CloudFront distribution
3. Route 53 hosted zone
4. IAM policy version

Correct Answer: 1

Explanation

An Amazon EBS snapshot can provide a point-in-time copy of an EBS volume that can be preserved and used for forensic analysis. During an incident, investigators can use a snapshot to preserve evidence while avoiding unnecessary modifications to the original workload. The snapshot should be protected with appropriate access controls and encryption, and the investigation process should maintain documentation about evidence handling. Organizations should avoid modifying forensic copies during analysis and should establish procedures for retaining evidence according to legal and organizational requirements.

Question 78

A security team needs to determine whether an IAM policy grants permissions that are never actually used. Which IAM capability can assist with this analysis?

1. IAM Access Analyzer
2. AWS Shield
3. AWS Network Firewall
4. Amazon Inspector

Correct Answer: 1

Explanation

IAM Access Analyzer provides capabilities that can help organizations analyze access and identify unused permissions or other policy-related risks, depending on the configured analyzer and supported resource type. Identifying unused access can help security teams reduce unnecessary permissions and improve least-privilege implementation. Analysts should evaluate findings in the context of actual application requirements before removing access because infrequently used permissions may still be necessary for operational or emergency processes. Changes should be tested and monitored to avoid disrupting legitimate workloads.

Question 79

A company wants to validate that its security response process works before a real incident occurs. Which approach is most appropriate?

1. Conduct controlled security exercises and response simulations
2. Disable security monitoring temporarily
3. Remove incident-response documentation
4. Wait for an actual breach

Correct Answer: 1

Explanation

Controlled security exercises and response simulations allow organizations to validate incident-response procedures before a real security event occurs. Exercises can test detection, escalation, communication, containment, evidence preservation, recovery, and decision-making processes. AWS Fault Injection Service can also support controlled experiments for suitable workloads and resilience scenarios. Findings from exercises should be documented and used to improve runbooks, automation, permissions, monitoring, and communication procedures. Regular testing helps identify gaps that may remain hidden when response plans exist only as written documentation.

Question 80

A security architect wants to reduce the risk of credentials being exposed in application source code. Which approach is most appropriate?

1. Store credentials in application source files
2. Store credentials in AWS Secrets Manager and retrieve them at runtime
3. Place credentials in public S3 objects
4. Hard-code credentials into container images

Correct Answer: 2

Explanation

AWS Secrets Manager provides a managed location for storing sensitive credentials and other secrets outside application source code. Applications can retrieve secrets at runtime using IAM permissions, reducing the need to embed credentials in source files or container images. Secrets can also be rotated when supported, reducing the exposure associated with long-lived credentials. Security teams should restrict which workloads can retrieve each secret, monitor access, and avoid logging secret values. This approach supports stronger credential hygiene and reduces the risk of accidental exposure through source repositories.