The AWS Certified Security – Specialty (SCS-C03) exam tests your skills in securing AWS environments. It is designed for security professionals looking to validate their expertise in AWS security.
A company needs to restrict access to AWS resources based on conditions. Which feature should they employ?
AIAM Roles
BIAM Policies
CSecurity Groups
DS3 Bucket Policies
Explanation
IAM Policies can enforce conditional access, while roles and security groups do not offer this flexibility.
Q12
You are configuring AWS Secrets Manager for an application. What happens if a secret is deleted?
AIt is permanently lost immediately.
BIt goes into a recovery mode.
CIt can be restored within a time period.
DIt becomes inaccessible indefinitely.
Explanation
Deleted secrets in AWS Secrets Manager can be restored within the recovery window, making them recoverable.
Q13
Which service provides a managed WAF solution?
AAWS WAF
BAWS Shield
CAWS CloudFront
DAWS Firewall Manager
Explanation
AWS WAF is specifically designed for web application firewalls, while others serve different purposes.
Q14
A company needs to analyze logs from multiple AWS services. Which AWS service is best suited for this?
AAmazon Athena
BAmazon CloudWatch
CAWS Config
DAWS Trusted Advisor
Explanation
Amazon Athena allows SQL queries on S3-stored logs, while others focus on monitoring or compliance.
Q15
You are configuring IAM roles for EC2 instances. What happens if no IAM role is assigned?
AInstances will have limited access.
BInstances will have full access.
CInstances cannot access AWS services.
DInstances access services via default credentials.
Explanation
Without an IAM role, EC2 instances do not obtain any permissions for AWS services.
Q16
Which service provides a centralized view of AWS accounts?
AAWS Control Tower
BAWS Config
CAWS Secrets Manager
DAWS Shield
Explanation
AWS Control Tower helps manage multi-account environments, while others serve different purposes regarding compliance and secret management.
Q17
A company needs to enforce strict access control based on specific attributes of IAM users. What should they use?
AIAM Policies
BPolicy Conditions
CResource Policies
DAWS CLI
Explanation
Policy Conditions allow attribute-based access control, while the others don't address attribute conditions explicitly.
Q18
What happens when an AWS Lambda function times out during execution?
APartial execution is saved
BFunction retried automatically
CFailure reported to CloudTrail
DInvocation returns a timeout error
Explanation
A timeout during Lambda execution results in an invocation returning a timeout error, whereas the other options are incorrect responses to execution failure.
Q19
Which AWS service provides DDoS protection?
AAWS Shield
BAWS WAF
CAWS Firewall Manager
DAWS Config
Explanation
AWS Shield is specifically designed for DDoS protection; the others serve different security functions.
Q20
A company needs to log all IAM user activities continuously. What should they use?
AAWS CloudTrail
BAWS CloudWatch
CAWS Config
DAWS Inspector
Explanation
AWS CloudTrail captures all IAM user activity, while the others serve different monitoring or compliance purposes.