View Full Amazon AWS Certified Security – Specialty SCS-C03 Exam Dumps and Practice Test Dumps.

 

Question 121

Which AWS service can continuously monitor supported AWS workloads for known software vulnerabilities?

1. AWS Config
2. Amazon Inspector
3. Amazon Macie
4. AWS Shield

Correct Answer: 2

Explanation

Amazon Inspector is designed to continuously assess supported AWS workloads for software vulnerabilities and other security exposures. For EC2 instances, it can identify vulnerabilities associated with installed packages and provide findings that help security teams prioritize remediation. Inspector can also assess other supported workload types depending on the configured environment. Its findings can be integrated with centralized security workflows. Organizations should treat vulnerability detection as part of a broader process that includes patching, secure configurations, network controls, and ongoing monitoring.

Question 122

An organization wants to prevent a specific IAM role from being used unless requests originate through an approved VPC endpoint. Which IAM capability can help enforce this requirement?

1. IAM policy condition keys
2. S3 lifecycle rules
3. AWS WAF managed rules
4. VPC route propagation

Correct Answer: 1

Explanation

IAM policies can use supported condition keys to evaluate request context and restrict access according to specific requirements. For supported scenarios, conditions can limit access based on information such as the VPC endpoint through which a request is made. This can strengthen data-perimeter controls by ensuring that sensitive resources are accessed through approved network paths. Security teams must verify the applicable condition keys for the AWS service involved and test policies carefully because unsupported or incorrectly configured conditions can unintentionally deny legitimate access.

Question 123

A security operations team wants to receive findings from multiple AWS accounts in one centralized security view. Which solution is most appropriate?

1. Amazon CloudFront
2. AWS Security Hub
3. AWS Certificate Manager
4. Amazon Route 53

Correct Answer: 2

Explanation

AWS Security Hub provides centralized security visibility across AWS accounts and supported integrated security products. In a multi-account environment, findings from services such as GuardDuty, Inspector, and Macie can be aggregated for security operations. This allows analysts to review and prioritize findings from a consolidated location instead of switching between individual accounts. Organizations can also integrate Security Hub with automation and ticketing workflows. Proper account configuration and delegated administration should be established so that security teams can manage findings consistently.

Question 124

Which AWS feature allows an organization to analyze whether a resource policy unintentionally grants access to an external principal?

1. IAM Access Analyzer
2. AWS Shield Advanced
3. Amazon Inspector
4. AWS Audit Manager

Correct Answer: 1

Explanation

IAM Access Analyzer can analyze supported resource-based policies and identify access that may be available to external principals. This is useful for detecting unintended cross-account or public access. The findings can help administrators determine whether permissions should be reduced or whether the external access is intentional and documented. Access Analyzer does not automatically remove permissions, so organizations remain responsible for reviewing findings and implementing appropriate changes. Regular analysis helps maintain least privilege as resource policies evolve over time.

Question 125

A company wants to ensure that security logs remain available even if an administrator attempts to delete them immediately after compromising an account. Which design provides stronger protection?

1. Store logs only on the compromised instance
2. Send logs to a separate protected logging account
3. Disable log retention
4. Allow all administrators to delete centralized logs

Correct Answer: 2

Explanation

Sending security logs to a separate, tightly controlled logging account can reduce the likelihood that an attacker who compromises a workload account can delete the associated evidence. A centralized logging architecture can provide stronger separation of duties and allow security teams to apply restrictive permissions to collected records. Additional protections such as encryption, immutable storage, monitoring, and carefully controlled administrative access can further strengthen the design. Organizations should establish retention requirements and ensure that log collection remains operational across all relevant accounts.

Question 126

Which AWS service can automatically identify sensitive information such as financial data or credentials in Amazon S3?

1. AWS Config
2. Amazon Macie
3. AWS Firewall Manager
4. Amazon Inspector

Correct Answer: 2

Explanation

Amazon Macie is designed to discover and classify sensitive data stored in Amazon S3. It can use managed and custom data identifiers to detect information such as financial records, personally identifiable information, and certain credential-related data. Macie can provide findings that help security teams investigate potentially exposed or unexpectedly stored sensitive information. It should be combined with strong S3 access controls, encryption, monitoring, and appropriate data-retention practices. Discovering sensitive data is an important step toward applying suitable protection and governance controls.

Question 127

A security engineer needs to determine which IAM principal changed a critical security group rule yesterday. Which service provides the relevant API activity history?

1. AWS CloudTrail
2. Amazon Macie
3. AWS Shield
4. AWS Certificate Manager

Correct Answer: 1

Explanation

AWS CloudTrail records API activity for supported AWS operations and can provide evidence about changes made to resources. A security engineer can use CloudTrail events to identify the principal associated with a security group modification, the time of the event, and other available request details. This information can help establish an administrative activity timeline during an investigation. CloudTrail should be configured with suitable retention and protection because security logs themselves can become valuable targets during an incident.

Question 128

Which AWS capability can provide temporary credentials to an application that needs to access resources in another AWS account?

1. AWS STS AssumeRole
2. S3 Object Lock
3. AWS WAF
4. Amazon GuardDuty

Correct Answer: 1

Explanation

AWS STS AssumeRole can provide temporary credentials for accessing resources through an IAM role. In a cross-account scenario, the target account establishes a trust relationship with the appropriate principal, while the role’s permissions define what the caller can do. Temporary credentials reduce the need for long-term access keys and support more secure delegated access. Security teams should carefully configure the trust policy, role permissions, session duration, and any applicable external identifiers or conditions to prevent unauthorized role assumption.

Question 129

A security team wants to restrict which AWS actions delegated administrators can grant to newly created IAM roles. Which control is designed for this purpose?

1. CloudTrail trail
2. IAM permissions boundary
3. VPC Flow Logs
4. AWS WAF rule

Correct Answer: 2

Explanation

IAM permissions boundaries allow organizations to define the maximum permissions that can be granted to an IAM identity. This is useful when delegated administrators need to create or manage roles but should not be able to create identities with unrestricted privileges. The boundary works as a limit on effective permissions and does not itself grant access. Organizations should combine boundaries with appropriate identity-based policies and, where applicable, service control policies. Regular policy review remains important because security requirements and delegated responsibilities can change.

Question 130

Which AWS networking service can inspect and filter traffic flowing through a centralized VPC network security architecture?

1. Amazon Macie
2. AWS Network Firewall
3. AWS Audit Manager
4. Amazon Detective

Correct Answer: 2

Explanation

AWS Network Firewall provides managed network traffic inspection and filtering capabilities for VPC environments. Security teams can create stateful and stateless rules to control network traffic according to organizational requirements. It can be integrated into centralized network architectures and used to help control traffic between network segments or toward external destinations. Network Firewall is different from AWS WAF, which focuses primarily on web application traffic. Effective deployments should also use routing controls, security groups, network ACLs, logging, and appropriate network segmentation.

Question 131

A company needs to test whether its incident-response automation can isolate a compromised workload without waiting for a real attack. What approach is appropriate?

1. Controlled security exercise
2. Permanent removal of monitoring
3. Disabling IAM authorization
4. Deleting the incident runbook

Correct Answer: 1

Explanation

Controlled security exercises allow organizations to test incident-response procedures and automation under planned conditions. A team can simulate a compromise and verify whether detection, notification, containment, evidence preservation, and recovery actions work as expected. These exercises can reveal missing permissions, broken automation, unclear ownership, and communication gaps before an actual incident occurs. Testing should be carefully scoped to avoid disrupting production workloads. Results should be documented and used to update response runbooks, automation workflows, escalation procedures, and technical controls.

Question 132

Which AWS service can coordinate multiple steps in an automated security remediation workflow?

1. Amazon Route 53
2. AWS Step Functions
3. Amazon CloudFront
4. AWS Artifact

Correct Answer: 2

Explanation

AWS Step Functions can coordinate multiple actions in an automated workflow and maintain the state of the process as individual steps execute. Security teams can use it to orchestrate activities such as receiving a finding, collecting information, invoking Lambda functions, isolating resources, creating tickets, and notifying responders. It can also provide error handling and controlled branching. Automated security workflows should use narrowly scoped IAM permissions and include validation steps for high-impact actions so that false positives do not cause unnecessary production disruption.

Question 133

Which AWS service provides managed protection against distributed denial-of-service attacks for supported AWS resources?

1. AWS Shield
2. Amazon Inspector
3. AWS Config
4. Amazon Macie

Correct Answer: 1

Explanation

AWS Shield provides managed DDoS protection for supported AWS resources. Shield Standard offers baseline protection automatically for certain AWS services, while Shield Advanced provides additional capabilities for eligible resources and use cases. DDoS protection can be strengthened by combining Shield with services such as CloudFront, Route 53, and AWS WAF. Security architects should also design applications for resilience and understand normal traffic patterns. DDoS protection is one component of availability security and should be supported by monitoring and incident-response procedures.

Question 134

An organization wants to query large amounts of security log data stored in Amazon S3 without managing database servers. Which service is suitable?

1. AWS Config
2. Amazon Athena
3. AWS Shield
4. Amazon Inspector

Correct Answer: 2

Explanation

Amazon Athena allows organizations to query data stored in Amazon S3 using SQL without provisioning or managing traditional database servers. Security teams can use Athena to investigate large collections of CloudTrail events, VPC Flow Logs, and other appropriately structured datasets. Query performance and cost can be improved through efficient data formats, partitioning, and appropriate storage organization. Access to security log data should be restricted using IAM and bucket policies. Athena is particularly useful for retrospective analysis and investigation of historical security events.

Question 135

Which AWS service can help enforce consistent firewall policies across an organization’s AWS accounts?

1. AWS Firewall Manager
2. Amazon GuardDuty
3. AWS Certificate Manager
4. AWS Audit Manager

Correct Answer: 1

Explanation

AWS Firewall Manager helps centrally manage supported firewall and security policies across multiple AWS accounts and resources. It is useful in organizations that need consistent controls while operating a multi-account AWS environment. Depending on the supported policy type, Firewall Manager can manage protections involving AWS WAF, security groups, Network Firewall, and other security controls. It can work with AWS Organizations to apply policies to selected accounts or organizational units. Centralized management reduces configuration drift and simplifies security governance at scale.

Question 136

A security architect wants to prevent direct internet access to a private database subnet while allowing required application communication. Which design principle should be applied?

1. Place the database in a private subnet and restrict routes and security-group access
2. Assign a public IP to the database
3. Allow inbound access from 0.0.0.0/0
4. Place all workloads in one public subnet

Correct Answer: 1

Explanation

Sensitive databases should generally be placed in private subnets without direct internet exposure. Network routing and security group rules can then restrict access to only the application components that require database connectivity. This design reduces the externally reachable attack surface and supports network segmentation. Additional controls such as encryption, authentication, monitoring, and database-specific security settings should also be implemented. Security architects should document approved communication paths and regularly review network configurations to ensure that accidental routes or overly broad rules do not weaken the intended isolation.

Question 137

Which AWS service can help collect evidence continuously for an audit assessment based on defined controls?

1. Amazon Detective
2. AWS Audit Manager
3. Amazon GuardDuty
4. AWS WAF

Correct Answer: 2

Explanation

AWS Audit Manager helps automate evidence collection for supported audit and compliance requirements. It can organize evidence from AWS services and map collected information to controls within an assessment framework. This can reduce manual evidence-gathering effort and provide a more consistent view of control-related information. Audit Manager does not determine that an organization is compliant by itself. Teams must still implement the required controls, validate their effectiveness, address gaps, and maintain appropriate documentation for auditors and other stakeholders.

Question 138

A company wants to protect encryption keys used by applications while keeping key management centralized. Which AWS service should it use?

1. AWS Key Management Service
2. Amazon Inspector
3. AWS WAF
4. Amazon Detective

Correct Answer: 1

Explanation

AWS Key Management Service provides centralized creation and management of cryptographic keys used by supported AWS services and applications. KMS can control who may use keys through key policies and IAM permissions, while audit information can be captured through AWS logging capabilities. Applications can use KMS for encryption operations or as part of envelope-encryption designs. Security teams should carefully manage key administrators and key users because excessive permissions can undermine data protection. Key lifecycle planning should include rotation, access review, backup considerations, and deletion procedures.

Question 139

Which AWS service can identify potentially exposed sensitive information in S3 and provide findings for security investigation?

1. AWS Firewall Manager
2. Amazon Macie
3. AWS Network Firewall
4. AWS Systems Manager

Correct Answer: 2

Explanation

Amazon Macie helps discover and classify sensitive data stored in Amazon S3 and can generate findings when it identifies potentially sensitive information or security-related conditions. Security teams can use these findings to investigate where sensitive data exists and whether access controls are appropriate. Macie can help organizations prioritize protection of high-value information, but it does not replace S3 authorization or encryption controls. Sensitive data findings should be reviewed alongside bucket policies, IAM permissions, encryption settings, logging, and organizational data-handling requirements.

Question 140

An organization wants to use tags such as Department=Finance and Environment=Production when deciding whether an IAM principal can access a resource. Which authorization model supports this approach?

1. Network segmentation
2. Role chaining
3. Attribute-based access control
4. DDoS protection

Correct Answer: 3

Explanation

Attribute-based access control uses attributes associated with identities and resources to make authorization decisions. In AWS, IAM policy conditions can evaluate supported tags and other attributes, allowing organizations to create scalable access rules based on characteristics such as department, project, or environment. ABAC can reduce the need for large numbers of resource-specific policies when tagging is consistently managed. However, organizations must protect tag modification permissions because unauthorized changes to security-relevant tags could potentially alter access decisions. Regular access reviews remain essential.