{"id":17264,"date":"2026-09-21T07:24:49","date_gmt":"2026-09-21T07:24:49","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=17264"},"modified":"2026-09-21T07:24:49","modified_gmt":"2026-09-21T07:24:49","slug":"amazon-aws-certified-security-specialty-scs-c02-practice-test-questions-and-exam-dumps-part16-q301-320","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/amazon-aws-certified-security-specialty-scs-c02-practice-test-questions-and-exam-dumps-part16-q301-320\/","title":{"rendered":"Amazon AWS Certified Security – Specialty SCS-C02 Practice Test Questions and Exam Dumps Part16 Q301-320"},"content":{"rendered":"

View Full <\/b>Amazon AWS Certified Security – Specialty SCS-C02 Exam Dumps<\/b><\/a> and Practice Test Dumps<\/b><\/h2>\n

 <\/p>\n

Question 301<\/b><\/h3>\n

Which KMS feature lets an application use the same key material across Regions?<\/b><\/p>\n

    \n
  1. Multi-Region key<\/span><\/li>\n
  2. Key alias<\/span><\/li>\n
  3. Grant token<\/span><\/li>\n
  4. Imported key<\/span><\/li>\n<\/ol>\n

    Correct Answer: 1<\/b><\/p>\n

    Explanation:<\/b><\/p>\n

    AWS KMS Multi-Region keys allow related KMS keys to share the same underlying key material across different AWS Regions. A primary key can have replica keys in other Regions, allowing applications with cross-Region architectures to perform cryptographic operations using related keys. Each key remains a regional KMS resource, but the shared key material provides continuity for supported encryption workflows. Key aliases provide friendly names, grant tokens support certain grant authorization scenarios, and imported keys concern externally supplied key material. Multi-Region keys are particularly useful when applications process encrypted data across multiple geographic Regions.<\/span><\/p>\n

    Question 302<\/b><\/h3>\n

    Which S3 capability gives applications separate policies for shared bucket access?<\/b><\/p>\n

      \n
    1. Object Lock<\/span><\/li>\n
    2. Access Point<\/span><\/li>\n
    3. Bucket Key<\/span><\/li>\n
    4. Inventory<\/span><\/li>\n<\/ol>\n

      Correct Answer: 3<\/b><\/p>\n

      Explanation:<\/b><\/p>\n

      S3 Access Points provide dedicated access endpoints with individual policies for applications or groups accessing a shared S3 bucket. This allows administrators to create separate access controls for different workloads without placing every application’s requirements into one large bucket policy. Access Points can be configured with network restrictions and permissions appropriate to particular use cases. Object Lock protects objects from modification or deletion, Bucket Keys optimize KMS request usage for SSE-KMS encryption, and Inventory produces object reports. Access Points are therefore the appropriate feature when multiple applications need distinct controlled access to shared S3 data.<\/span><\/p>\n

      Question 303<\/b><\/h3>\n

      Which IAM feature can prevent developers from creating excessively privileged roles?<\/b><\/p>\n

        \n
      1. Trust policy<\/span><\/li>\n
      2. Access key<\/span><\/li>\n
      3. Permissions boundary<\/span><\/li>\n
      4. Session tag<\/span><\/li>\n<\/ol>\n

        Correct Answer: 4<\/b><\/p>\n

        Explanation:<\/b><\/p>\n

        An IAM permissions boundary establishes the maximum permissions that an IAM identity can receive through applicable identity-based policies. This makes it useful when administrators delegate identity creation to developers but need to prevent those developers from creating roles with unrestricted privileges. The boundary does not grant permissions by itself; effective permissions must also be allowed by applicable policies. A trust policy controls who can assume a role, access keys provide programmatic credentials, and session tags provide attributes associated with a session. Permissions boundaries therefore provide a strong control for delegated IAM administration and privilege containment.<\/span><\/p>\n

        Question 304<\/b><\/h3>\n

        Which STS mechanism is commonly used for third-party cross-account access?<\/b><\/p>\n

          \n
        1. AssumeRole<\/span><\/li>\n
        2. GetCallerIdentity<\/span><\/li>\n
        3. DecodeAuthorizationMessage<\/span><\/li>\n
        4. GetAccessKeyInfo<\/span><\/li>\n<\/ol>\n

          Correct Answer: 2<\/b><\/p>\n

          Explanation:<\/b><\/p>\n

          AWS STS AssumeRole allows a trusted external principal to obtain temporary credentials for an IAM role in another AWS account. This is commonly used when a third-party provider needs controlled access to customer resources. The role trust policy can specify the trusted principal and additional conditions, such as an external ID, to strengthen the trust relationship. GetCallerIdentity returns information about the current identity, DecodeAuthorizationMessage helps interpret certain encoded authorization messages, and GetAccessKeyInfo identifies the account associated with an access key. AssumeRole is the standard mechanism for controlled cross-account temporary access.<\/span><\/p>\n

          Question 305<\/b><\/h3>\n

          Which S3 setting makes uploaded objects owned by the bucket account?<\/b><\/p>\n

            \n
          1. Bucket owner enforced<\/span><\/li>\n
          2. Versioning enabled<\/span><\/li>\n
          3. Object replication<\/span><\/li>\n
          4. Request payer<\/span><\/li>\n<\/ol>\n

            Correct Answer: 4<\/b><\/p>\n

            Explanation:<\/b><\/p>\n

            S3 Object Ownership with Bucket owner enforced makes the bucket-owning account the owner of objects uploaded to that bucket and disables ACLs for the bucket. This simplifies access management because ownership no longer depends on which AWS account uploaded the object. Administrators can instead rely primarily on IAM policies, bucket policies, and related controls. Versioning preserves multiple object versions, replication copies objects to other locations, and Requester Pays changes how request and data-transfer charges are handled. Bucket owner enforced is therefore the appropriate setting when centralized ownership and simplified authorization are required.<\/span><\/p>\n

            Question 306<\/b><\/h3>\n

            Which AWS service can identify exposed credentials through threat-detection findings?<\/b><\/p>\n

              \n
            1. AWS Artifact<\/span><\/li>\n
            2. Amazon GuardDuty<\/span><\/li>\n
            3. AWS Backup<\/span><\/li>\n
            4. Amazon EFS<\/span><\/li>\n<\/ol>\n

              Correct Answer: 1<\/b><\/p>\n

              Explanation:<\/b><\/p>\n

              Amazon GuardDuty provides managed threat detection and can generate findings associated with suspicious credential-related activity. Depending on the enabled protection features and available data sources, findings can indicate potentially compromised credentials, unusual API behavior, or other indicators of malicious activity. Artifact supplies compliance documentation, Backup protects recovery data, and EFS provides managed file storage. GuardDuty is designed to analyze security-relevant activity and produce findings for investigation. Security teams can then use those findings with services such as Security Hub and Detective to coordinate analysis and response.<\/span><\/p>\n

              Question 307<\/b><\/h3>\n

              Which service can inspect container images before deployment for known vulnerabilities?<\/b><\/p>\n

                \n
              1. Amazon Macie<\/span><\/li>\n
              2. AWS Config<\/span><\/li>\n
              3. Amazon Inspector<\/span><\/li>\n
              4. AWS Audit Manager<\/span><\/li>\n<\/ol>\n

                Correct Answer: 3<\/b><\/p>\n

                Explanation:<\/b><\/p>\n

                Amazon Inspector can assess container images stored in Amazon ECR for known software vulnerabilities. It examines supported packages and dependencies and generates findings when vulnerable components are identified. This allows development and security teams to discover issues before affected container images become active workloads. Macie focuses on sensitive data discovery, Config evaluates resource configurations, and Audit Manager gathers compliance evidence. Inspector’s container scanning capability is therefore relevant when an organization wants vulnerability visibility within its software supply chain and wants to address known package weaknesses before deployment.<\/span><\/p>\n

                Question 308<\/b><\/h3>\n

                Which AWS service helps investigate suspicious relationships between users and resources?<\/b><\/p>\n

                  \n
                1. AWS WAF<\/span><\/li>\n
                2. Amazon Detective<\/span><\/li>\n
                3. AWS Shield<\/span><\/li>\n
                4. Amazon Macie<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 2<\/b><\/p>\n

                  Explanation:<\/b><\/p>\n

                  Amazon Detective is designed to help security teams investigate activity surrounding security findings by analyzing relationships among users, resources, IP addresses, API activity, and other available signals. Instead of simply identifying an alert, it helps analysts understand the context and connections surrounding that activity. AWS WAF filters web requests, Shield provides DDoS protection, and Macie discovers sensitive data in S3. Detective is therefore appropriate when investigators need additional context to understand how identities, resources, and activities may be connected during a security investigation.<\/span><\/p>\n

                  Question 309<\/b><\/h3>\n

                  Which AWS feature can require encryption keys to be accessed only through approved conditions?<\/b><\/p>\n

                    \n
                  1. KMS key policy<\/span><\/li>\n
                  2. S3 lifecycle rule<\/span><\/li>\n
                  3. CloudFront cache policy<\/span><\/li>\n
                  4. Route 53 record policy<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 1<\/b><\/p>\n

                    Explanation:<\/b><\/p>\n

                    A KMS key policy controls access to a customer managed KMS key and can include conditions that restrict how principals may use the key. Administrators can use supported condition keys to impose requirements related to principals, encryption context, source services, or other request attributes. This allows key authorization to be more restrictive than simply granting broad cryptographic permissions. S3 lifecycle rules control object transitions and expiration, CloudFront cache policies influence caching behavior, and Route 53 record policies concern DNS routing. KMS key policies are therefore the primary authorization mechanism for controlling access to KMS keys.<\/span><\/p>\n

                    Question 310<\/b><\/h3>\n

                    Which AWS service can block malicious HTTP requests using managed rule groups?<\/b><\/p>\n

                      \n
                    1. AWS Network Firewall<\/span><\/li>\n
                    2. Amazon GuardDuty<\/span><\/li>\n
                    3. AWS WAF<\/span><\/li>\n
                    4. AWS Shield<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 4<\/b><\/p>\n

                      Explanation:<\/b><\/p>\n

                      AWS WAF protects web applications by inspecting HTTP and HTTPS requests and applying configured web access control rules. Managed rule groups can provide protections against common web-based threats without requiring administrators to build every detection pattern themselves. WAF can be associated with supported services such as CloudFront and Application Load Balancers. Network Firewall operates at the network firewall layer, GuardDuty detects suspicious activity, and Shield provides DDoS protection. WAF is therefore the service specifically intended to filter malicious web requests before they reach protected applications.<\/span><\/p>\n

                      Question 311<\/b><\/h3>\n

                      Which VPC mechanism lets workloads privately reach a supported AWS service?<\/b><\/p>\n

                        \n
                      1. VPC endpoint<\/span><\/li>\n
                      2. Internet gateway<\/span><\/li>\n
                      3. NAT gateway<\/span><\/li>\n
                      4. Public IP address<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 2<\/b><\/p>\n

                        Explanation:<\/b><\/p>\n

                        VPC endpoints allow resources inside a VPC to communicate privately with supported AWS services without requiring an internet gateway or public IP address for the service connection. Endpoint types include gateway endpoints and interface endpoints, depending on the target service and connectivity model. Internet gateways provide general internet connectivity, NAT gateways allow private resources to initiate outbound internet connections, and public IP addresses expose resources through public networking. VPC endpoints are therefore useful when organizations want AWS service traffic to remain on private network paths and reduce unnecessary exposure to public connectivity.<\/span><\/p>\n

                        Question 312<\/b><\/h3>\n

                        Which AWS service can enforce organization-wide security group controls?<\/b><\/p>\n

                          \n
                        1. AWS Config<\/span><\/li>\n
                        2. AWS Firewall Manager<\/span><\/li>\n
                        3. Amazon Detective<\/span><\/li>\n
                        4. AWS Audit Manager<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 3<\/b><\/p>\n

                          Explanation:<\/b><\/p>\n

                          AWS Firewall Manager provides centralized administration of supported security group policies across accounts and resources in AWS Organizations. Security teams can use it to establish common controls and reduce configuration differences between accounts. This is particularly valuable in large environments where application teams manage their own resources but must still comply with centrally defined network security requirements. Config evaluates resource configurations, Detective supports investigations, and Audit Manager collects compliance evidence. Firewall Manager is specifically designed to distribute and maintain supported firewall and security group policies across organizational environments.<\/span><\/p>\n

                          Question 313<\/b><\/h3>\n

                          Which CloudTrail feature can record activity against individual DynamoDB items?<\/b><\/p>\n

                            \n
                          1. Management events<\/span><\/li>\n
                          2. Data events<\/span><\/li>\n
                          3. Insight events<\/span><\/li>\n
                          4. Digest events<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 4<\/b><\/p>\n

                            Explanation:<\/b><\/p>\n

                            CloudTrail data events provide visibility into data-plane operations involving supported resources. For supported DynamoDB configurations, data events can record item-level API activity, providing more detailed visibility than management events. Management events primarily capture control-plane operations such as creating, updating, or deleting resources. Insight events identify unusual API activity patterns, while digest files support CloudTrail log integrity validation. Data events are therefore appropriate when security teams need detailed records of operations performed directly against supported data resources rather than only administrative changes.<\/span><\/p>\n

                            Question 314<\/b><\/h3>\n

                            Which AWS service can apply automated responses to centralized security findings?<\/b><\/p>\n

                              \n
                            1. AWS Security Hub<\/span><\/li>\n
                            2. Amazon EFS<\/span><\/li>\n
                            3. AWS Artifact<\/span><\/li>\n
                            4. Amazon Route 53<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 1<\/b><\/p>\n

                              Explanation:<\/b><\/p>\n

                              AWS Security Hub supports automation rules that can automatically update or modify supported security findings based on defined criteria. Organizations can use these rules to standardize repetitive security operations, such as changing finding status, assigning ownership information, or applying other supported updates. This can reduce manual effort when security teams receive large numbers of findings from multiple integrated sources. EFS provides file storage, Artifact supplies compliance documents, and Route 53 provides DNS services. Security Hub automation is therefore useful when organizations want consistent handling of centralized security findings.<\/span><\/p>\n

                              Question 315<\/b><\/h3>\n

                              Which AWS service can store secrets without placing passwords directly in application code?<\/b><\/p>\n

                                \n
                              1. AWS Config<\/span><\/li>\n
                              2. AWS Secrets Manager<\/span><\/li>\n
                              3. Amazon CloudFront<\/span><\/li>\n
                              4. AWS Shield<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 2<\/b><\/p>\n

                                Explanation:<\/b><\/p>\n

                                AWS Secrets Manager provides secure storage and controlled retrieval of sensitive information such as passwords, API credentials, and database secrets. Applications can retrieve secrets programmatically rather than embedding permanent credentials in source code or configuration files. Secrets Manager also supports rotation workflows for supported use cases, helping reduce the lifetime of sensitive credentials. Config evaluates resource configurations, CloudFront delivers content, and Shield protects against DDoS attacks. Secrets Manager is therefore the appropriate service when an application needs centralized protection and lifecycle management for sensitive credentials.<\/span><\/p>\n

                                Question 316<\/b><\/h3>\n

                                Which AWS service can evaluate resources against predefined security standards?<\/b><\/p>\n

                                  \n
                                1. Amazon Inspector<\/span><\/li>\n
                                2. AWS Security Hub<\/span><\/li>\n
                                3. AWS CloudHSM<\/span><\/li>\n
                                4. Amazon Cognito<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 3<\/b><\/p>\n

                                  Explanation:<\/b><\/p>\n

                                  AWS Security Hub can evaluate an AWS environment against supported security standards and controls, helping organizations identify resources or configurations that do not satisfy selected requirements. It combines this posture-management capability with centralized security findings from supported services and integrations. Inspector focuses primarily on vulnerability assessment, CloudHSM provides dedicated hardware security modules, and Cognito manages application identities. Security Hub is therefore appropriate when an organization needs centralized security posture information alongside findings and control evaluations.<\/span><\/p>\n

                                  Question 317<\/b><\/h3>\n

                                  Which AWS service can automatically rotate supported database credentials stored as secrets?<\/b><\/p>\n

                                    \n
                                  1. AWS Secrets Manager<\/span><\/li>\n
                                  2. AWS Artifact<\/span><\/li>\n
                                  3. Amazon Macie<\/span><\/li>\n
                                  4. AWS CloudTrail<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 4<\/b><\/p>\n

                                    Explanation:<\/b><\/p>\n

                                    AWS Secrets Manager supports automated rotation for supported secrets and databases through configured rotation workflows. Rotation can periodically change credentials while updating the stored secret so applications can retrieve the current value securely. This reduces dependence on long-lived passwords and supports stronger credential lifecycle management. Artifact provides compliance documentation, Macie discovers sensitive data, and CloudTrail records AWS activity. Secrets Manager is specifically designed to manage the storage, retrieval, and rotation of application credentials and other sensitive secrets.<\/span><\/p>\n

                                    Question 318<\/b><\/h3>\n

                                    Which AWS service provides private certificate issuance for internal workloads?<\/b><\/p>\n

                                      \n
                                    1. AWS Certificate Manager Private CA<\/span><\/li>\n
                                    2. Amazon GuardDuty<\/span><\/li>\n
                                    3. AWS Network Firewall<\/span><\/li>\n
                                    4. AWS Audit Manager<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 1<\/b><\/p>\n

                                      Explanation:<\/b><\/p>\n

                                      AWS Certificate Manager Private Certificate Authority provides managed private certificate authority capabilities for organizations that need to issue certificates for internal applications, services, devices, or private infrastructure. It allows organizations to create private certificate hierarchies without operating traditional certificate authority servers themselves. GuardDuty detects threats, Network Firewall filters network traffic, and Audit Manager collects compliance evidence. Private CA is therefore the appropriate AWS capability when internal workloads require certificates that are trusted within an organization’s private environment rather than certificates issued by a public certificate authority.<\/span><\/p>\n

                                      Question 319<\/b><\/h3>\n

                                      Which backup control can protect recovery points from early deletion?<\/b><\/p>\n

                                        \n
                                      1. Backup plan<\/span><\/li>\n
                                      2. Backup Vault Lock<\/span><\/li>\n
                                      3. Backup report<\/span><\/li>\n
                                      4. Backup selection<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 2<\/b><\/p>\n

                                        Explanation:<\/b><\/p>\n

                                        AWS Backup Vault Lock provides retention enforcement for recovery points stored in a backup vault. Depending on its configuration, it can prevent protected recovery points from being deleted or having their retention periods reduced before the required period expires. This creates an additional protection layer against accidental deletion and certain malicious actions affecting backups. A backup plan defines when and how backups are created, backup selections identify resources, and reports provide information about backup activity. Vault Lock specifically addresses the requirement to preserve backup data for a defined retention period.<\/span><\/p>\n

                                        Question 320<\/b><\/h3>\n

                                        Which AWS capability can trigger remediation when a configuration change occurs?<\/b><\/p>\n

                                          \n
                                        1. Amazon Macie<\/span><\/li>\n
                                        2. AWS Artifact<\/span><\/li>\n
                                        3. Amazon EventBridge<\/span><\/li>\n
                                        4. AWS CloudHSM<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 3<\/b><\/p>\n

                                          Explanation:<\/b><\/p>\n

                                          Amazon EventBridge can receive events from AWS services and route matching events to targets that perform automated actions. A configuration-related event can therefore trigger a remediation workflow, such as invoking Lambda or Systems Manager Automation. This event-driven model helps security teams respond consistently when resources change in ways that violate organizational requirements. Macie focuses on sensitive data discovery, Artifact provides compliance documentation, and CloudHSM supplies dedicated cryptographic hardware. EventBridge is therefore useful for connecting security events and configuration changes to automated remediation processes.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full Amazon AWS Certified Security – Specialty SCS-C02 Exam Dumps and Practice Test Dumps   Question 301 Which KMS feature lets an application use the same key material across Regions? Multi-Region key Key alias Grant token Imported key Correct Answer: 1 Explanation: AWS KMS Multi-Region keys allow related KMS keys to share the same […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/17264"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=17264"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/17264\/revisions"}],"predecessor-version":[{"id":17265,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/17264\/revisions\/17265"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=17264"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=17264"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=17264"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}