{"id":22038,"date":"2026-09-25T10:35:59","date_gmt":"2026-09-25T10:35:59","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=22038"},"modified":"2026-09-25T10:35:59","modified_gmt":"2026-09-25T10:35:59","slug":"amazon-aws-certified-security-specialty-scs-c03-practice-test-questions-and-exam-dumps-part7-q121-140","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/amazon-aws-certified-security-specialty-scs-c03-practice-test-questions-and-exam-dumps-part7-q121-140\/","title":{"rendered":"Amazon AWS Certified Security – Specialty SCS-C03 Practice Test Questions and Exam Dumps Part7 Q121-140"},"content":{"rendered":"

View Full <\/b>Amazon AWS Certified Security – Specialty SCS-C03 Exam Dumps<\/b><\/a> and Practice Test Dumps.<\/b><\/h2>\n

 <\/p>\n

Question 121<\/b><\/h3>\n

Which AWS service can continuously monitor supported AWS workloads for known software vulnerabilities?<\/b><\/p>\n

    \n
  1. AWS Config<\/span><\/li>\n
  2. Amazon Inspector<\/span><\/li>\n
  3. Amazon Macie<\/span><\/li>\n
  4. AWS Shield<\/span><\/li>\n<\/ol>\n

    Correct Answer: 2<\/b><\/p>\n

    Explanation<\/b><\/p>\n

    Amazon Inspector is designed to continuously assess supported AWS workloads for software vulnerabilities and other security exposures. For EC2 instances, it can identify vulnerabilities associated with installed packages and provide findings that help security teams prioritize remediation. Inspector can also assess other supported workload types depending on the configured environment. Its findings can be integrated with centralized security workflows. Organizations should treat vulnerability detection as part of a broader process that includes patching, secure configurations, network controls, and ongoing monitoring.<\/span><\/p>\n

    Question 122<\/b><\/h3>\n

    An organization wants to prevent a specific IAM role from being used unless requests originate through an approved VPC endpoint. Which IAM capability can help enforce this requirement?<\/b><\/p>\n

      \n
    1. IAM policy condition keys<\/span><\/li>\n
    2. S3 lifecycle rules<\/span><\/li>\n
    3. AWS WAF managed rules<\/span><\/li>\n
    4. VPC route propagation<\/span><\/li>\n<\/ol>\n

      Correct Answer: 1<\/b><\/p>\n

      Explanation<\/b><\/p>\n

      IAM policies can use supported condition keys to evaluate request context and restrict access according to specific requirements. For supported scenarios, conditions can limit access based on information such as the VPC endpoint through which a request is made. This can strengthen data-perimeter controls by ensuring that sensitive resources are accessed through approved network paths. Security teams must verify the applicable condition keys for the AWS service involved and test policies carefully because unsupported or incorrectly configured conditions can unintentionally deny legitimate access.<\/span><\/p>\n

      Question 123<\/b><\/h3>\n

      A security operations team wants to receive findings from multiple AWS accounts in one centralized security view. Which solution is most appropriate?<\/b><\/p>\n

        \n
      1. Amazon CloudFront<\/span><\/li>\n
      2. AWS Security Hub<\/span><\/li>\n
      3. AWS Certificate Manager<\/span><\/li>\n
      4. Amazon Route 53<\/span><\/li>\n<\/ol>\n

        Correct Answer: 2<\/b><\/p>\n

        Explanation<\/b><\/p>\n

        AWS Security Hub provides centralized security visibility across AWS accounts and supported integrated security products. In a multi-account environment, findings from services such as GuardDuty, Inspector, and Macie can be aggregated for security operations. This allows analysts to review and prioritize findings from a consolidated location instead of switching between individual accounts. Organizations can also integrate Security Hub with automation and ticketing workflows. Proper account configuration and delegated administration should be established so that security teams can manage findings consistently.<\/span><\/p>\n

        Question 124<\/b><\/h3>\n

        Which AWS feature allows an organization to analyze whether a resource policy unintentionally grants access to an external principal?<\/b><\/p>\n

          \n
        1. IAM Access Analyzer<\/span><\/li>\n
        2. AWS Shield Advanced<\/span><\/li>\n
        3. Amazon Inspector<\/span><\/li>\n
        4. AWS Audit Manager<\/span><\/li>\n<\/ol>\n

          Correct Answer: 1<\/b><\/p>\n

          Explanation<\/b><\/p>\n

          IAM Access Analyzer can analyze supported resource-based policies and identify access that may be available to external principals. This is useful for detecting unintended cross-account or public access. The findings can help administrators determine whether permissions should be reduced or whether the external access is intentional and documented. Access Analyzer does not automatically remove permissions, so organizations remain responsible for reviewing findings and implementing appropriate changes. Regular analysis helps maintain least privilege as resource policies evolve over time.<\/span><\/p>\n

          Question 125<\/b><\/h3>\n

          A company wants to ensure that security logs remain available even if an administrator attempts to delete them immediately after compromising an account. Which design provides stronger protection?<\/b><\/p>\n

            \n
          1. Store logs only on the compromised instance<\/span><\/li>\n
          2. Send logs to a separate protected logging account<\/span><\/li>\n
          3. Disable log retention<\/span><\/li>\n
          4. Allow all administrators to delete centralized logs<\/span><\/li>\n<\/ol>\n

            Correct Answer: 2<\/b><\/p>\n

            Explanation<\/b><\/p>\n

            Sending security logs to a separate, tightly controlled logging account can reduce the likelihood that an attacker who compromises a workload account can delete the associated evidence. A centralized logging architecture can provide stronger separation of duties and allow security teams to apply restrictive permissions to collected records. Additional protections such as encryption, immutable storage, monitoring, and carefully controlled administrative access can further strengthen the design. Organizations should establish retention requirements and ensure that log collection remains operational across all relevant accounts.<\/span><\/p>\n

            Question 126<\/b><\/h3>\n

            Which AWS service can automatically identify sensitive information such as financial data or credentials in Amazon S3?<\/b><\/p>\n

              \n
            1. AWS Config<\/span><\/li>\n
            2. Amazon Macie<\/span><\/li>\n
            3. AWS Firewall Manager<\/span><\/li>\n
            4. Amazon Inspector<\/span><\/li>\n<\/ol>\n

              Correct Answer: 2<\/b><\/p>\n

              Explanation<\/b><\/p>\n

              Amazon Macie is designed to discover and classify sensitive data stored in Amazon S3. It can use managed and custom data identifiers to detect information such as financial records, personally identifiable information, and certain credential-related data. Macie can provide findings that help security teams investigate potentially exposed or unexpectedly stored sensitive information. It should be combined with strong S3 access controls, encryption, monitoring, and appropriate data-retention practices. Discovering sensitive data is an important step toward applying suitable protection and governance controls.<\/span><\/p>\n

              Question 127<\/b><\/h3>\n

              A security engineer needs to determine which IAM principal changed a critical security group rule yesterday. Which service provides the relevant API activity history?<\/b><\/p>\n

                \n
              1. AWS CloudTrail<\/span><\/li>\n
              2. Amazon Macie<\/span><\/li>\n
              3. AWS Shield<\/span><\/li>\n
              4. AWS Certificate Manager<\/span><\/li>\n<\/ol>\n

                Correct Answer: 1<\/b><\/p>\n

                Explanation<\/b><\/p>\n

                AWS CloudTrail records API activity for supported AWS operations and can provide evidence about changes made to resources. A security engineer can use CloudTrail events to identify the principal associated with a security group modification, the time of the event, and other available request details. This information can help establish an administrative activity timeline during an investigation. CloudTrail should be configured with suitable retention and protection because security logs themselves can become valuable targets during an incident.<\/span><\/p>\n

                Question 128<\/b><\/h3>\n

                Which AWS capability can provide temporary credentials to an application that needs to access resources in another AWS account?<\/b><\/p>\n

                  \n
                1. AWS STS AssumeRole<\/span><\/li>\n
                2. S3 Object Lock<\/span><\/li>\n
                3. AWS WAF<\/span><\/li>\n
                4. Amazon GuardDuty<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 1<\/b><\/p>\n

                  Explanation<\/b><\/p>\n

                  AWS STS AssumeRole can provide temporary credentials for accessing resources through an IAM role. In a cross-account scenario, the target account establishes a trust relationship with the appropriate principal, while the role’s permissions define what the caller can do. Temporary credentials reduce the need for long-term access keys and support more secure delegated access. Security teams should carefully configure the trust policy, role permissions, session duration, and any applicable external identifiers or conditions to prevent unauthorized role assumption.<\/span><\/p>\n

                  Question 129<\/b><\/h3>\n

                  A security team wants to restrict which AWS actions delegated administrators can grant to newly created IAM roles. Which control is designed for this purpose?<\/b><\/p>\n

                    \n
                  1. CloudTrail trail<\/span><\/li>\n
                  2. IAM permissions boundary<\/span><\/li>\n
                  3. VPC Flow Logs<\/span><\/li>\n
                  4. AWS WAF rule<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 2<\/b><\/p>\n

                    Explanation<\/b><\/p>\n

                    IAM permissions boundaries allow organizations to define the maximum permissions that can be granted to an IAM identity. This is useful when delegated administrators need to create or manage roles but should not be able to create identities with unrestricted privileges. The boundary works as a limit on effective permissions and does not itself grant access. Organizations should combine boundaries with appropriate identity-based policies and, where applicable, service control policies. Regular policy review remains important because security requirements and delegated responsibilities can change.<\/span><\/p>\n

                    Question 130<\/b><\/h3>\n

                    Which AWS networking service can inspect and filter traffic flowing through a centralized VPC network security architecture?<\/b><\/p>\n

                      \n
                    1. Amazon Macie<\/span><\/li>\n
                    2. AWS Network Firewall<\/span><\/li>\n
                    3. AWS Audit Manager<\/span><\/li>\n
                    4. Amazon Detective<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 2<\/b><\/p>\n

                      Explanation<\/b><\/p>\n

                      AWS Network Firewall provides managed network traffic inspection and filtering capabilities for VPC environments. Security teams can create stateful and stateless rules to control network traffic according to organizational requirements. It can be integrated into centralized network architectures and used to help control traffic between network segments or toward external destinations. Network Firewall is different from AWS WAF, which focuses primarily on web application traffic. Effective deployments should also use routing controls, security groups, network ACLs, logging, and appropriate network segmentation.<\/span><\/p>\n

                      Question 131<\/b><\/h3>\n

                      A company needs to test whether its incident-response automation can isolate a compromised workload without waiting for a real attack. What approach is appropriate?<\/b><\/p>\n

                        \n
                      1. Controlled security exercise<\/span><\/li>\n
                      2. Permanent removal of monitoring<\/span><\/li>\n
                      3. Disabling IAM authorization<\/span><\/li>\n
                      4. Deleting the incident runbook<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 1<\/b><\/p>\n

                        Explanation<\/b><\/p>\n

                        Controlled security exercises allow organizations to test incident-response procedures and automation under planned conditions. A team can simulate a compromise and verify whether detection, notification, containment, evidence preservation, and recovery actions work as expected. These exercises can reveal missing permissions, broken automation, unclear ownership, and communication gaps before an actual incident occurs. Testing should be carefully scoped to avoid disrupting production workloads. Results should be documented and used to update response runbooks, automation workflows, escalation procedures, and technical controls.<\/span><\/p>\n

                        Question 132<\/b><\/h3>\n

                        Which AWS service can coordinate multiple steps in an automated security remediation workflow?<\/b><\/p>\n

                          \n
                        1. Amazon Route 53<\/span><\/li>\n
                        2. AWS Step Functions<\/span><\/li>\n
                        3. Amazon CloudFront<\/span><\/li>\n
                        4. AWS Artifact<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 2<\/b><\/p>\n

                          Explanation<\/b><\/p>\n

                          AWS Step Functions can coordinate multiple actions in an automated workflow and maintain the state of the process as individual steps execute. Security teams can use it to orchestrate activities such as receiving a finding, collecting information, invoking Lambda functions, isolating resources, creating tickets, and notifying responders. It can also provide error handling and controlled branching. Automated security workflows should use narrowly scoped IAM permissions and include validation steps for high-impact actions so that false positives do not cause unnecessary production disruption.<\/span><\/p>\n

                          Question 133<\/b><\/h3>\n

                          Which AWS service provides managed protection against distributed denial-of-service attacks for supported AWS resources?<\/b><\/p>\n

                            \n
                          1. AWS Shield<\/span><\/li>\n
                          2. Amazon Inspector<\/span><\/li>\n
                          3. AWS Config<\/span><\/li>\n
                          4. Amazon Macie<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 1<\/b><\/p>\n

                            Explanation<\/b><\/p>\n

                            AWS Shield provides managed DDoS protection for supported AWS resources. Shield Standard offers baseline protection automatically for certain AWS services, while Shield Advanced provides additional capabilities for eligible resources and use cases. DDoS protection can be strengthened by combining Shield with services such as CloudFront, Route 53, and AWS WAF. Security architects should also design applications for resilience and understand normal traffic patterns. DDoS protection is one component of availability security and should be supported by monitoring and incident-response procedures.<\/span><\/p>\n

                            Question 134<\/b><\/h3>\n

                            An organization wants to query large amounts of security log data stored in Amazon S3 without managing database servers. Which service is suitable?<\/b><\/p>\n

                              \n
                            1. AWS Config<\/span><\/li>\n
                            2. Amazon Athena<\/span><\/li>\n
                            3. AWS Shield<\/span><\/li>\n
                            4. Amazon Inspector<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 2<\/b><\/p>\n

                              Explanation<\/b><\/p>\n

                              Amazon Athena allows organizations to query data stored in Amazon S3 using SQL without provisioning or managing traditional database servers. Security teams can use Athena to investigate large collections of CloudTrail events, VPC Flow Logs, and other appropriately structured datasets. Query performance and cost can be improved through efficient data formats, partitioning, and appropriate storage organization. Access to security log data should be restricted using IAM and bucket policies. Athena is particularly useful for retrospective analysis and investigation of historical security events.<\/span><\/p>\n

                              Question 135<\/b><\/h3>\n

                              Which AWS service can help enforce consistent firewall policies across an organization’s AWS accounts?<\/b><\/p>\n

                                \n
                              1. AWS Firewall Manager<\/span><\/li>\n
                              2. Amazon GuardDuty<\/span><\/li>\n
                              3. AWS Certificate Manager<\/span><\/li>\n
                              4. AWS Audit Manager<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 1<\/b><\/p>\n

                                Explanation<\/b><\/p>\n

                                AWS Firewall Manager helps centrally manage supported firewall and security policies across multiple AWS accounts and resources. It is useful in organizations that need consistent controls while operating a multi-account AWS environment. Depending on the supported policy type, Firewall Manager can manage protections involving AWS WAF, security groups, Network Firewall, and other security controls. It can work with AWS Organizations to apply policies to selected accounts or organizational units. Centralized management reduces configuration drift and simplifies security governance at scale.<\/span><\/p>\n

                                Question 136<\/b><\/h3>\n

                                A security architect wants to prevent direct internet access to a private database subnet while allowing required application communication. Which design principle should be applied?<\/b><\/p>\n

                                  \n
                                1. Place the database in a private subnet and restrict routes and security-group access<\/span><\/li>\n
                                2. Assign a public IP to the database<\/span><\/li>\n
                                3. Allow inbound access from <\/span>0.0.0.0\/0<\/span><\/li>\n
                                4. Place all workloads in one public subnet<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 1<\/b><\/p>\n

                                  Explanation<\/b><\/p>\n

                                  Sensitive databases should generally be placed in private subnets without direct internet exposure. Network routing and security group rules can then restrict access to only the application components that require database connectivity. This design reduces the externally reachable attack surface and supports network segmentation. Additional controls such as encryption, authentication, monitoring, and database-specific security settings should also be implemented. Security architects should document approved communication paths and regularly review network configurations to ensure that accidental routes or overly broad rules do not weaken the intended isolation.<\/span><\/p>\n

                                  Question 137<\/b><\/h3>\n

                                  Which AWS service can help collect evidence continuously for an audit assessment based on defined controls?<\/b><\/p>\n

                                    \n
                                  1. Amazon Detective<\/span><\/li>\n
                                  2. AWS Audit Manager<\/span><\/li>\n
                                  3. Amazon GuardDuty<\/span><\/li>\n
                                  4. AWS WAF<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 2<\/b><\/p>\n

                                    Explanation<\/b><\/p>\n

                                    AWS Audit Manager helps automate evidence collection for supported audit and compliance requirements. It can organize evidence from AWS services and map collected information to controls within an assessment framework. This can reduce manual evidence-gathering effort and provide a more consistent view of control-related information. Audit Manager does not determine that an organization is compliant by itself. Teams must still implement the required controls, validate their effectiveness, address gaps, and maintain appropriate documentation for auditors and other stakeholders.<\/span><\/p>\n

                                    Question 138<\/b><\/h3>\n

                                    A company wants to protect encryption keys used by applications while keeping key management centralized. Which AWS service should it use?<\/b><\/p>\n

                                      \n
                                    1. AWS Key Management Service<\/span><\/li>\n
                                    2. Amazon Inspector<\/span><\/li>\n
                                    3. AWS WAF<\/span><\/li>\n
                                    4. Amazon Detective<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 1<\/b><\/p>\n

                                      Explanation<\/b><\/p>\n

                                      AWS Key Management Service provides centralized creation and management of cryptographic keys used by supported AWS services and applications. KMS can control who may use keys through key policies and IAM permissions, while audit information can be captured through AWS logging capabilities. Applications can use KMS for encryption operations or as part of envelope-encryption designs. Security teams should carefully manage key administrators and key users because excessive permissions can undermine data protection. Key lifecycle planning should include rotation, access review, backup considerations, and deletion procedures.<\/span><\/p>\n

                                      Question 139<\/b><\/h3>\n

                                      Which AWS service can identify potentially exposed sensitive information in S3 and provide findings for security investigation?<\/b><\/p>\n

                                        \n
                                      1. AWS Firewall Manager<\/span><\/li>\n
                                      2. Amazon Macie<\/span><\/li>\n
                                      3. AWS Network Firewall<\/span><\/li>\n
                                      4. AWS Systems Manager<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 2<\/b><\/p>\n

                                        Explanation<\/b><\/p>\n

                                        Amazon Macie helps discover and classify sensitive data stored in Amazon S3 and can generate findings when it identifies potentially sensitive information or security-related conditions. Security teams can use these findings to investigate where sensitive data exists and whether access controls are appropriate. Macie can help organizations prioritize protection of high-value information, but it does not replace S3 authorization or encryption controls. Sensitive data findings should be reviewed alongside bucket policies, IAM permissions, encryption settings, logging, and organizational data-handling requirements.<\/span><\/p>\n

                                        Question 140<\/b><\/h3>\n

                                        An organization wants to use tags such as <\/b>Department=Finance<\/b> and <\/b>Environment=Production<\/b> when deciding whether an IAM principal can access a resource. Which authorization model supports this approach?<\/b><\/p>\n

                                          \n
                                        1. Network segmentation<\/span><\/li>\n
                                        2. Role chaining<\/span><\/li>\n
                                        3. Attribute-based access control<\/span><\/li>\n
                                        4. DDoS protection<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 3<\/b><\/p>\n

                                          Explanation<\/b><\/p>\n

                                          Attribute-based access control uses attributes associated with identities and resources to make authorization decisions. In AWS, IAM policy conditions can evaluate supported tags and other attributes, allowing organizations to create scalable access rules based on characteristics such as department, project, or environment. ABAC can reduce the need for large numbers of resource-specific policies when tagging is consistently managed. However, organizations must protect tag modification permissions because unauthorized changes to security-relevant tags could potentially alter access decisions. Regular access reviews remain essential.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full Amazon AWS Certified Security – Specialty SCS-C03 Exam Dumps and Practice Test Dumps.   Question 121 Which AWS service can continuously monitor supported AWS workloads for known software vulnerabilities? AWS Config Amazon Inspector Amazon Macie AWS Shield Correct Answer: 2 Explanation Amazon Inspector is designed to continuously assess supported AWS workloads for software […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/22038"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=22038"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/22038\/revisions"}],"predecessor-version":[{"id":22039,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/22038\/revisions\/22039"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=22038"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=22038"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=22038"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}