The AWS Certified Security – Specialty (SCS-C03) exam tests your skills in securing AWS environments. It is designed for security professionals looking to validate their expertise in AWS security.
Which service provides automated security assessments for applications deployed on AWS?
AAWS Inspector
BAWS Shield
CAWS Firewall Manager
DAWS CloudTrail
Explanation
AWS Inspector performs automated assessments, while the others focus on DDoS protection or logging.
Q182
A company needs to ensure that only authorized users can access sensitive S3 buckets. What feature should they implement?
AS3 Bucket Policy
BS3 Lifecycle Policy
CS3 Versioning
DS3 Event Notifications
Explanation
S3 Bucket Policies control access permissions, while the others manage lifecycle, versioning, and notify events.
Q183
What happens when you detach an IAM policy from a user?
AUser immediately loses all permissions.
BUser retains permissions from other policies.
CUser can still use console access.
DUser is locked out of AWS account.
Explanation
Detaching a policy removes specific permissions, but others may still be applicable from different policies.
Q184
Which AWS service allows you to centrally manage access across AWS services?
AAWS IAM
BAWS Config
CAWS Shield
DAWS WAF
Explanation
AWS IAM is designed for centralized access management, while the others focus on configuration, DDoS protection, or web application firewall services.
Q185
A company needs to enforce security compliance for temporary access to AWS resources. What solution is most appropriate?
AAWS Roles
BAWS Organizations
CAWS Identity Federation
DIAM Policies
Explanation
AWS Roles facilitate temporary access through assumption, while the other options focus on broader management and policy aspects.
Q186
You are configuring a VPC endpoint for S3 and find that your application still cannot access S3. What is the most likely reason?
AIncorrect VPC route table configuration
BS3 bucket not public
CVPC endpoint policy issues
DIAM user lacks permissions
Explanation
VPC endpoint policy issues can prevent access to S3, whereas the other options do not directly relate to VPC endpoint functionality.
Q187
Which AWS service provides real-time threat detection?
AAWS GuardDuty
BAWS Config
CAmazon CloudWatch
DAWS Inspector
Explanation
AWS GuardDuty detects threats through continuous monitoring, while others focus on compliance or performance.
Q188
A company needs to manage user permissions. Which approach should they use?
AIAM Policies
BCloudTrail Logs
CEC2 Security Groups
DS3 Encryption
Explanation
IAM Policies are designed to manage user permissions, while other options serve different functions.
Q189
What happens when a user uploads an object to S3 without enabling versioning?
APrevious versions are lost
BVersioning is automatically enabled
CObject is encrypted
DUser is notified of changes
Explanation
Without versioning, the previous object is overwritten and cannot be recovered.
Q190
Which service would you use to monitor AWS account activity in real-time?
AAWS CloudTrail
BAWS CloudFormation
CAWS Config
DAWS Lambda
Explanation
AWS CloudTrail is designed to log and monitor account activity, while the others manage resources or configuration.