View Full Amazon AWS Certified Security – Specialty SCS-C03 Exam Dumps and Practice Test Dumps.

 

Question 161

Which AWS service can identify changes to AWS resource configurations over time?

1. Amazon GuardDuty
2. AWS Shield
3. AWS Config
4. Amazon Macie

Correct Answer: 3

Explanation

AWS Config maintains configuration information for supported AWS resources and can provide a history of configuration changes. This allows security teams to determine how a resource changed, when a change occurred, and what its configuration looked like at a particular point in time. Config can also evaluate resources against compliance rules. This historical capability is useful during investigations involving unauthorized changes, configuration drift, or policy violations. Organizations should protect Config data and configure appropriate retention and access controls to preserve its investigative value.

Question 162

A company needs to prevent a compromised IAM user from accessing resources outside an approved AWS Region. Which IAM feature can support this requirement?

1. IAM policy condition using aws:RequestedRegion
2. S3 Object Lock
3. VPC Flow Logs
4. AWS WAF rate-based rules

Correct Answer: 1

Explanation

IAM policies can use supported global condition keys such as aws:RequestedRegion to restrict requests according to the AWS Region involved. An organization can use this type of condition as part of a regional access-control strategy when its workloads are approved only in specific Regions. The restriction should be designed carefully because some AWS services use global endpoints or have operations with regional behavior that requires special consideration. Security teams should test the policy across administrative and application workflows before enforcing it broadly.

Question 163

Which AWS service provides a managed control plane for securely connecting applications to services without requiring direct network exposure?

1. AWS PrivateLink
2. Amazon Inspector
3. AWS Artifact
4. Amazon Macie

Correct Answer: 1

Explanation

AWS PrivateLink provides private connectivity between VPCs and supported services without requiring traffic to traverse the public internet. It is commonly used when organizations need private access to services while maintaining stronger network isolation. Interface VPC endpoints can provide private connectivity to supported AWS services or endpoint services offered by other organizations. Security teams can control access using endpoint policies, security groups, and IAM. PrivateLink should be incorporated into an overall network architecture rather than being treated as a replacement for authorization controls.

Question 164

An organization wants to identify whether an IAM policy contains overly broad permissions before deploying it. Which capability is useful?

1. Amazon Detective
2. IAM policy validation
3. AWS Shield Advanced
4. Route 53 Resolver DNS Firewall

Correct Answer: 2

Explanation

IAM policy validation can identify policy syntax problems and certain security issues before or during policy management. This can help administrators catch errors such as malformed policy elements or potentially problematic permissions before they affect production access. Policy validation is different from runtime monitoring because it evaluates the policy itself rather than determining whether an actual compromise has occurred. Security teams should combine policy validation with IAM Access Analyzer, least-privilege reviews, testing, and periodic access analysis to maintain secure authorization configurations.

Question 165

Which AWS service can protect a web application by filtering requests based on country or geographic location?

1. AWS WAF
2. AWS KMS
3. Amazon Inspector
4. AWS Audit Manager

Correct Answer: 1

Explanation

AWS WAF supports geographic matching capabilities that allow organizations to create rules based on the geographic origin associated with client requests. This can help organizations implement application-specific geographic restrictions when required by business or security policies. Geographic filtering should be designed carefully because IP-based location information is not always perfectly accurate and legitimate users may connect through proxies or other infrastructure. Security teams should combine geographic controls with authentication, rate limiting, managed rules, and application-specific protections rather than relying on geography alone.

Question 166

A security architect needs to separate east-west traffic between application tiers so that a compromised web server cannot freely communicate with internal databases. Which approach is most appropriate?

1. Disable CloudTrail
2. Use network segmentation and restrictive security group rules
3. Make all subnets public
4. Store credentials in user data

Correct Answer: 2

Explanation

Network segmentation limits communication between workload tiers and can reduce lateral movement after a compromise. Security groups can restrict which sources are allowed to connect to database resources, while separate subnets and routing controls can provide additional isolation. For example, a database tier can accept traffic only from approved application security groups instead of broad network ranges. Segmentation should be combined with identity controls, encryption, monitoring, and vulnerability management. The objective is to ensure that compromise of one workload does not automatically provide unrestricted access to other tiers.

Question 167

Which AWS service can help identify and investigate suspicious relationships between users, IP addresses, and AWS resources after a security finding occurs?

1. AWS Certificate Manager
2. Amazon Detective
3. AWS Firewall Manager
4. Amazon Athena

Correct Answer: 2

Explanation

Amazon Detective analyzes security-related activity and relationships between entities to help investigators understand suspicious behavior. It can provide contextual information involving users, resources, IP addresses, and other supported entities associated with security events. This relationship-based analysis can help investigators develop timelines and identify connections that may not be obvious from an individual event. Detective is intended for investigation rather than primary prevention. Analysts should correlate its information with CloudTrail, GuardDuty, network telemetry, and other available evidence before making containment or recovery decisions.

Question 168

A company wants to require that all objects uploaded to a sensitive S3 bucket use AWS KMS-based server-side encryption. Which control can enforce this requirement?

1. S3 bucket policy
2. Amazon Inspector
3. AWS Shield
4. VPC route table

Correct Answer: 1

Explanation

An S3 bucket policy can deny object-upload requests that do not include the required server-side encryption settings. For a requirement involving AWS KMS encryption, the policy can use supported S3 condition keys to enforce the appropriate encryption configuration and, where necessary, a specific KMS key. This creates a preventive control rather than relying solely on monitoring after objects are uploaded. Security teams should also restrict use of the KMS key, monitor access, and verify that legitimate applications correctly provide the required encryption headers.

Question 169

Which AWS service can provide centralized protection policies for resources across multiple accounts and organizational units?

1. Amazon Macie
2. AWS Firewall Manager
3. AWS Artifact
4. Amazon CloudWatch

Correct Answer: 2

Explanation

AWS Firewall Manager helps organizations centrally manage supported security policies across multiple AWS accounts and organizational units. It is useful for enforcing consistent security controls in environments where individual teams operate separate accounts. Depending on the policy type, Firewall Manager can help manage AWS WAF, security groups, Network Firewall, and other supported protections. Centralized policy management can reduce configuration drift and simplify governance. Administrators should define appropriate account scopes and exclusions so that centralized policies do not interfere with legitimate application-specific requirements.

Question 170

A security team needs to determine whether traffic was accepted or rejected by a VPC network interface during an incident. Which telemetry is appropriate?

1. AWS Artifact records
2. VPC Flow Logs
3. AWS Certificate Manager logs
4. IAM credential reports

Correct Answer: 2

Explanation

VPC Flow Logs record metadata about network traffic associated with supported network interfaces and can indicate whether traffic was accepted or rejected. During an investigation, analysts can use this information to examine source and destination addresses, ports, protocols, and traffic patterns. Flow Logs do not provide packet payloads, so they cannot reveal the contents of communications. Security teams should correlate flow records with DNS logs, application logs, host telemetry, and threat-detection findings to build a more complete picture of suspicious network activity.

Question 171

Which AWS service can help automate operating-system patching for managed EC2 instances according to defined maintenance requirements?

1. AWS Systems Manager Patch Manager
2. Amazon GuardDuty
3. AWS WAF
4. Amazon Macie

Correct Answer: 1

Explanation

AWS Systems Manager Patch Manager can help organizations automate patching for supported managed instances according to defined patch baselines and maintenance requirements. Regular patching reduces exposure to known software vulnerabilities and can support organizational security standards. Security teams should define appropriate patch baselines, maintenance windows, testing procedures, and exception processes. Patch Manager complements vulnerability assessment services such as Amazon Inspector because identifying a vulnerability and applying the appropriate remediation are separate activities. Patch results should also be monitored to identify failed or incomplete updates.

Question 172

An organization wants to prevent a resource policy from granting access to principals outside its AWS organization. Which IAM policy condition can support this requirement?

1. aws:PrincipalOrgID
2. aws:SecureTransport
3. aws:MultiFactorAuthAge
4. aws:CurrentTime

Correct Answer: 1

Explanation

The aws:PrincipalOrgID condition key can be used in supported resource policies to restrict access based on the AWS Organizations identifier associated with the requesting principal. This can help organizations establish a stronger data perimeter by limiting access to principals belonging to the same organization. It is particularly useful in multi-account environments where legitimate cross-account access is required but external access should be prevented. Security teams should verify the exact policy behavior for each service and carefully test conditions before applying them to production resources.

Question 173

Which AWS service can provide a managed service for encrypting and controlling access to cryptographic keys used by AWS workloads?

1. AWS KMS
2. Amazon Detective
3. AWS Config
4. AWS Shield

Correct Answer: 1

Explanation

AWS Key Management Service provides centralized management of cryptographic keys used by supported AWS services and applications. KMS allows organizations to control key usage through key policies, IAM permissions, grants, and other supported mechanisms. It can also provide audit information about key operations through AWS logging services. Security teams should separate key administration from routine key usage where practical and follow least privilege. Proper key lifecycle management is also important, including rotation considerations, disabling keys, and planning for eventual key deletion.

Question 174

A company needs to provide private access from a VPC to an AWS service without using a public IP address. Which solution should be considered?

1. Internet Gateway
2. VPC endpoint
3. Public NAT instance
4. Internet-facing load balancer

Correct Answer: 2

Explanation

A VPC endpoint can provide private connectivity from a VPC to supported AWS services without requiring resources to use public IP addresses for that service access. Depending on the service and endpoint type, organizations can use gateway or interface endpoints. Endpoint policies and security groups can provide additional restrictions for supported configurations. Private connectivity can reduce exposure and support data-perimeter requirements. However, security teams should still enforce identity-based authorization, encryption, logging, and service-specific controls because private network access does not automatically grant permission.

Question 175

Which AWS service can help an organization establish standardized multi-account governance and account provisioning?

1. AWS Control Tower
2. Amazon Inspector
3. AWS WAF
4. Amazon Macie

Correct Answer: 1

Explanation

AWS Control Tower provides capabilities for establishing and governing multi-account AWS environments. It can help organizations create standardized account configurations, apply governance controls, and manage organizational structures using supported landing-zone capabilities. This approach is useful when security requirements must be consistently applied across many accounts. Control Tower works alongside AWS Organizations and other AWS services rather than replacing them. Organizations should define account baselines, security logging requirements, identity controls, and governance responsibilities so that newly created accounts begin with an appropriate security posture.

Question 176

An application must authenticate users through an existing corporate identity provider instead of maintaining separate AWS passwords. Which approach is appropriate for workforce access?

1. Federated identity
2. Static IAM access keys
3. Shared root credentials
4. Anonymous access

Correct Answer: 1

Explanation

Federated identity allows users to authenticate through an existing identity provider and then obtain authorized access to AWS resources without requiring separate long-term AWS passwords for each user. AWS IAM Identity Center can integrate with supported identity providers and assign permission sets to workforce users. Federation improves centralized identity lifecycle management and can support organizational authentication requirements. Security teams should enforce strong authentication, least privilege, appropriate session duration, and timely deprovisioning when employees or contractors change roles or leave the organization.

Question 177

Which AWS capability can analyze security findings using a standardized schema such as OCSF to improve interoperability between security tools?

1. Amazon S3 Lifecycle
2. Amazon Security Lake
3. AWS Certificate Manager
4. Amazon Route 53

Correct Answer: 2

Explanation

Amazon Security Lake centralizes security data from AWS, third-party, and other supported sources and uses the Open Cybersecurity Schema Framework to normalize security information. A standardized schema can make security data easier to consume across different analytics and security tools. This can improve investigation workflows and support broader security operations. Organizations should carefully design data sources, retention, access controls, and integration requirements. Security Lake complements detection and response services by providing a centralized data foundation rather than acting as a replacement for individual security controls.

Question 178

A security administrator wants to verify whether a newly created IAM policy could unintentionally provide access to resources outside the intended trust boundary. Which service can assist with policy analysis?

1. IAM Access Analyzer
2. AWS Shield
3. Amazon Macie
4. AWS Network Firewall

Correct Answer: 1

Explanation

IAM Access Analyzer provides policy analysis capabilities that can help identify unintended access and validate supported IAM policies. Administrators can use its analysis features to identify potentially broad permissions or external access paths before they become security problems. This supports least-privilege implementation and more careful policy development. Access Analyzer should be used together with policy testing, permission reviews, and organizational guardrails because automated analysis cannot replace understanding the application’s legitimate access requirements. Security teams should also reassess policies when resources or organizational structures change.

Question 179

Which AWS service can help an organization evaluate whether security controls are operating according to defined compliance requirements?

1. AWS Audit Manager
2. Amazon CloudFront
3. AWS Shield
4. Amazon GuardDuty

Correct Answer: 1

Explanation

AWS Audit Manager helps organizations collect and organize evidence related to defined audit and compliance controls. It can gather evidence from supported AWS services and help map that evidence to assessment requirements. This allows security and compliance teams to monitor control-related information more systematically and reduce manual evidence collection. Audit Manager does not independently certify an organization as compliant. Teams remain responsible for implementing effective controls, investigating deficiencies, maintaining documentation, and determining whether their environment satisfies applicable regulatory or organizational requirements.

Question 180

A security team wants to restrict administrative access to an EC2 instance while avoiding publicly exposed SSH ports. Which AWS capability provides an interactive management session through AWS APIs?

1. AWS Direct Connect
2. AWS Systems Manager Session Manager
3. Amazon CloudFront
4. Route 53 Resolver

Correct Answer: 2

Explanation

AWS Systems Manager Session Manager provides interactive access to managed instances without requiring administrators to expose inbound SSH or RDP ports. Access can be controlled through IAM permissions, and session activity can be logged using supported AWS services. This reduces the attack surface associated with publicly reachable administrative services. Security teams should configure appropriate instance prerequisites, restrict who can start sessions, and monitor administrative activity. Session Manager should be part of a broader access-control strategy that includes least privilege, authentication controls, patching, and centralized auditing.