View Full Amazon AWS Certified Security – Specialty SCS-C03 Exam Dumps and Practice Test Dumps.

 

Question 81

Which AWS service can identify sensitive data stored in Amazon S3 buckets?

1. Amazon Detective
2. Amazon Inspector
3. Amazon Macie
4. AWS Shield

Correct Answer: 3

Explanation

Amazon Macie is designed to discover and help protect sensitive data stored in Amazon S3. It uses automated discovery and machine learning techniques to identify sensitive information and can generate findings when potentially sensitive data is detected. Security teams can use Macie to understand where sensitive information exists and investigate unexpected exposure. Macie complements access controls, encryption, logging, and data-loss prevention processes. It does not replace IAM or S3 bucket policies, which remain essential for controlling who can access protected objects.

Question 82

A company wants to require MFA when users perform sensitive IAM operations. Which policy mechanism can enforce this requirement?

1. IAM policy condition using MFA context
2. S3 lifecycle configuration
3. VPC route table
4. AWS WAF managed rule

Correct Answer: 1

Explanation

IAM policies can use MFA-related condition keys to require multi-factor authentication for sensitive operations. For example, an organization can require users to authenticate with MFA before performing particular actions or accessing protected resources. This provides an additional authentication control beyond a password or other primary credential. The policy must be designed carefully so that required administrative workflows remain functional. Organizations should also protect the root user with MFA and use stronger identity-management practices such as federation and temporary credentials whenever appropriate.

Question 83

Which AWS service provides a centralized location for security findings from multiple AWS security services?

1. Amazon CloudWatch
2. AWS Security Hub
3. AWS Certificate Manager
4. Amazon Route 53

Correct Answer: 2

Explanation

AWS Security Hub provides centralized aggregation and management of security findings from supported AWS services and integrated third-party products. It helps security teams review findings in a consolidated view instead of investigating each security service independently. Security Hub can also support automation through integrations with services such as EventBridge. This centralized approach can improve visibility across accounts and workloads. Organizations should still establish severity, ownership, remediation, and escalation processes because collecting findings alone does not automatically resolve security issues.

Question 84

An administrator needs temporary permissions to access an AWS account without creating a long-term access key. Which AWS service should be used?

1. AWS Artifact
2. Amazon Macie
3. AWS STS
4. AWS Config

Correct Answer: 3

Explanation

AWS Security Token Service provides temporary security credentials that can be used to access AWS resources for a limited period. Temporary credentials are useful for federation, cross-account access, applications, and other situations where permanent credentials would create unnecessary risk. They typically include an access key ID, secret access key, and session token. Security teams should grant only the permissions required for the session and configure appropriate session durations. Temporary credentials reduce the risks associated with distributing and storing long-lived access keys.

Question 85

Which AWS service can analyze relationships between AWS resources and help investigators understand the potential impact of a security event?

1. Amazon Detective
2. AWS Artifact
3. AWS Certificate Manager
4. Amazon Macie

Correct Answer: 1

Explanation

Amazon Detective helps security teams investigate security findings by analyzing relationships and activity associated with AWS resources. It can provide contextual information that helps analysts understand what happened, which resources were involved, and how activity may be connected. Detective is particularly useful after a suspicious event has been identified by another security service. It complements detection services such as GuardDuty and centralized finding services such as Security Hub. Investigators should combine Detective insights with CloudTrail, network logs, and application evidence.

Question 86

Which control is most appropriate for preventing resources in a development account from using services that the organization prohibits?

1. Security group
2. Service control policy
3. S3 bucket policy
4. IAM permissions boundary

Correct Answer: 2

Explanation

A service control policy can define permission guardrails for accounts within AWS Organizations. SCPs do not grant permissions themselves; instead, they limit the maximum permissions available to principals in affected accounts. This makes them useful for enforcing organization-wide restrictions, such as preventing the use of particular AWS services or actions. Administrators should understand that SCPs apply at the account or organizational level and must be combined with identity-based or resource-based policies that actually grant required permissions.

Question 87

A security analyst needs to determine whether an EC2 instance communicated with a suspicious IP address. Which log source is particularly useful for reviewing network connection metadata?

1. AWS Config
2. VPC Flow Logs
3. AWS Artifact
4. AWS Audit Manager

Correct Answer: 2

Explanation

VPC Flow Logs provide metadata about network traffic to and from network interfaces. Analysts can use them to investigate whether an EC2 instance communicated with a particular IP address, identify accepted or rejected traffic, and establish network activity timelines. Flow Logs do not contain packet payloads, so they cannot by themselves reveal the contents of communications. Security teams can combine flow-log information with GuardDuty findings, DNS logs, CloudTrail events, and host-level evidence to develop a more complete understanding of suspicious network activity.

Question 88

Which AWS service can provide a managed public key infrastructure for issuing private certificates?

1. AWS Private Certificate Authority
2. Amazon Inspector
3. AWS Firewall Manager
4. Amazon GuardDuty

Correct Answer: 1

Explanation

AWS Private Certificate Authority provides a managed private certificate authority service that organizations can use to issue and manage private digital certificates. Private certificates can support internal applications, services, devices, and TLS-based authentication requirements. The service reduces the need to operate a certificate authority infrastructure entirely on-premises. Security teams should carefully protect CA permissions and establish certificate issuance policies because compromise or misuse of a private CA can affect many systems. Certificate lifecycle management should include issuance, renewal, revocation, and monitoring.

Question 89

A company wants to centrally manage firewall rules across multiple AWS accounts and Regions. Which service is designed for this purpose?

1. AWS Firewall Manager
2. Amazon Detective
3. AWS Artifact
4. Amazon Macie

Correct Answer: 1

Explanation

AWS Firewall Manager provides centralized management of firewall and security policies across AWS accounts and resources. It can help organizations apply consistent protections for supported AWS WAF configurations, security groups, Network Firewall policies, and other supported controls. This is especially useful in multi-account environments where manually maintaining security configurations can result in inconsistent controls. Firewall Manager works with AWS Organizations and can enforce centrally managed policies while allowing teams to maintain appropriate application-specific configurations within organizational guardrails.

Question 90

Which S3 security feature can help prevent a bucket from becoming publicly accessible because of an accidental access policy or ACL configuration?

1. S3 Versioning
2. S3 Transfer Acceleration
3. S3 Block Public Access
4. S3 Inventory

Correct Answer: 3

Explanation

Amazon S3 Block Public Access provides centralized controls that help prevent public access to S3 buckets and objects through several types of public policies and ACL configurations. It is an important preventive control because accidental changes to bucket permissions can otherwise expose sensitive data. Organizations can configure Block Public Access at the account, bucket, or other supported levels. This control should be combined with least-privilege IAM policies, bucket policies, encryption, logging, and continuous monitoring to provide comprehensive S3 security.

Question 91

Which AWS service records actions performed through the AWS Management Console, AWS CLI, and AWS SDKs?

1. Amazon GuardDuty
2. AWS CloudTrail
3. AWS WAF
4. Amazon Inspector

Correct Answer: 2

Explanation

AWS CloudTrail records AWS API activity generated through the console, command-line tools, SDKs, and supported AWS services. Events can include information about the identity that made a request, the action performed, the resource involved, and when the activity occurred. CloudTrail is therefore an important source of evidence for security investigations and auditing. Organizations should configure appropriate trails or event data stores, protect log destinations, establish retention requirements, and monitor significant events to detect suspicious administrative activity.

Question 92

A security team wants to detect potentially malicious behavior affecting AWS accounts and workloads. Which service is specifically designed for threat detection?

1. AWS Config
2. AWS Audit Manager
3. Amazon GuardDuty
4. AWS Artifact

Correct Answer: 3

Explanation

Amazon GuardDuty is a threat detection service that continuously analyzes supported AWS data sources and signals to identify potentially malicious or unauthorized activity. It can generate findings related to suspicious behavior involving accounts, workloads, and other supported resources. Security teams can investigate GuardDuty findings using services such as Security Hub and Detective. Findings should be validated and correlated with additional evidence when determining scope and impact. GuardDuty is a detection capability and should operate alongside preventive controls, logging, response procedures, and recovery processes.

Question 93

Which AWS capability can enforce organization-wide restrictions even when an administrator in an individual account has broad IAM permissions?

1. Security group
2. SCP
3. IAM access key
4. VPC endpoint

Correct Answer: 2

Explanation

Service control policies provide organization-level permission guardrails that can restrict what actions principals in member accounts are allowed to perform. An SCP does not grant permissions, but it can prevent actions even when an identity-based policy in the account would otherwise allow them. This makes SCPs valuable for enforcing centralized security requirements across multiple accounts. Administrators should carefully test SCP changes because overly restrictive policies can disrupt legitimate workloads. Exceptions and delegated administration requirements should be considered when designing organizational controls.

Question 94

Which encryption approach allows applications to encrypt large amounts of data efficiently while using AWS KMS to protect the encryption key?

1. Envelope encryption
2. DNS encryption
3. Security group encryption
4. IAM policy encryption

Correct Answer: 1

Explanation

Envelope encryption uses a data key to encrypt application data while a separate key, such as an AWS KMS key, protects the data key. This approach allows applications to encrypt large amounts of data efficiently without sending all plaintext data through KMS for encryption. The encrypted data key can be stored with the encrypted data and later decrypted when access is authorized. AWS services commonly use envelope encryption as part of their encryption architectures, helping combine efficient data encryption with centralized key-management controls.

Question 95

A company needs to ensure that a web application is protected from unusually high request rates that could indicate abuse. Which AWS WAF capability is appropriate?

1. IP address allow list only
2. Rate-based rule
3. S3 bucket policy
4. IAM role

Correct Answer: 2

Explanation

AWS WAF rate-based rules can help detect and control excessive request rates from clients that exceed a configured threshold. They are useful for mitigating certain forms of request flooding, automated abuse, and other high-volume HTTP traffic patterns. A rate-based rule can be combined with additional WAF rules and application-specific protections. Security teams should select thresholds based on legitimate traffic patterns because overly aggressive limits can block valid users. Rate-based rules should be viewed as one layer within a broader application security strategy.

Question 96

Which AWS service helps organizations collect evidence to support audits against compliance frameworks?

1. Amazon Detective
2. AWS Audit Manager
3. Amazon GuardDuty
4. AWS Network Firewall

Correct Answer: 2

Explanation

AWS Audit Manager helps organizations collect and organize evidence that can support audits and compliance assessments. It can continuously gather evidence from supported AWS services and help map collected information to defined control requirements. This reduces the need to manually gather every piece of evidence for an assessment. Audit Manager does not itself make an organization compliant; organizations remain responsible for implementing appropriate controls and validating their effectiveness. Security and compliance teams can use its evidence capabilities alongside AWS Config, CloudTrail, and organizational policies.

Question 97

A security architect wants private connectivity between VPCs without exposing application traffic to the public internet. Which AWS networking capability is appropriate for connecting VPCs through a centralized network architecture?

1. AWS Transit Gateway
2. Amazon CloudFront
3. AWS WAF
4. Amazon Macie

Correct Answer: 1

Explanation

AWS Transit Gateway can provide centralized connectivity between multiple VPCs and supported networks. It is useful in environments where many VPCs need controlled communication without creating a complex mesh of individual connections. Security teams can use routing tables and network controls to segment traffic and restrict which networks can communicate. Transit Gateway should be combined with security groups, network ACLs, Network Firewall, and appropriate route controls when sensitive workloads require strong segmentation. Centralized architecture also simplifies network governance and monitoring.

Question 98

Which IAM approach allows permissions to be assigned according to attributes such as department, project, or environment?

1. Static access keys
2. Attribute-based access control
3. Security group rules
4. Network ACLs

Correct Answer: 2

Explanation

Attribute-based access control uses attributes, often represented through tags, to determine whether an identity should receive access to a resource. In AWS, IAM policy conditions can evaluate supported principal and resource tags to create scalable authorization models. ABAC can reduce the need to create separate policies for every individual resource or user when organizational attributes are consistently managed. Successful implementation requires reliable tagging standards, controlled tag modification permissions, and carefully designed IAM conditions to prevent unauthorized access through manipulated attributes.

Question 99

A security team wants to receive an event when a GuardDuty finding is generated and automatically invoke a remediation function. Which combination is appropriate?

1. AWS EventBridge and AWS Lambda
2. Amazon S3 and CloudFront
3. AWS Artifact and AWS Audit Manager
4. Amazon Route 53 and AWS Certificate Manager

Correct Answer: 1

Explanation

Amazon EventBridge can receive events generated by supported AWS services, including security findings, and route matching events to targets such as AWS Lambda. A security team can use this combination to automate responses to specific GuardDuty findings. For example, a workflow could invoke a Lambda function that applies a predefined containment action or creates an incident ticket. Automated remediation should use narrowly scoped IAM permissions and include safeguards, logging, and error handling because an incorrect automated action can affect legitimate production resources.

Question 100

Which security principle requires granting users and workloads only the permissions necessary to perform their required tasks?

1. Defense in depth
2. Least privilege
3. Nonrepudiation
4. Fault tolerance

Correct Answer: 2

Explanation

The principle of least privilege requires users, applications, and services to receive only the permissions necessary to perform their legitimate tasks. Applying least privilege reduces the potential impact of compromised credentials, accidental actions, and unauthorized activity. AWS organizations can implement this principle through IAM policies, roles, permission boundaries, resource policies, SCPs, and conditions. Permissions should be reviewed regularly because access requirements change over time. Tools such as IAM Access Analyzer can help identify opportunities to reduce unnecessary or unused access.