The AWS Certified Security – Specialty (SCS-C03) exam tests your skills in securing AWS environments. It is designed for security professionals looking to validate their expertise in AWS security.
You are configuring AWS Secrets Manager for sensitive information storage. What happens if you exceed the number of API calls per second for retries?
ARate limit enforced, further calls blocked
BAPI calls are queued until limits reset
CResponse with error, retries allowed forever
DRate limit warnings are sent via SMS
Explanation
Rate limits enforce quotas, blocking further calls; the other options misinterpret the API behavior.
Q262
Which AWS service helps to protect against DDoS attacks?
AAWS Shield
BAWS Firewall
CAWS Inspector
DAWS WAF
Explanation
AWS Shield is specifically designed for DDoS protection; others serve different purposes like application security.
Q263
A company needs to monitor AWS resources for compliance. Which service should they use?
AAmazon CloudWatch
BAWS Config
CAWS CloudTrail
DAWS IAM
Explanation
AWS Config tracks compliance of AWS resources, unlike CloudWatch and others that monitor different metrics.
Q264
What happens when an IAM policy denies permissions that are allowed by a different policy?
APermissions are granted
BPermissions are denied
CPermissions are overridden
DPermissions are assessed
Explanation
IAM policies follow an explicit deny rule, meaning any deny overrides allows.
Q265
Which service provides centralized logging for AWS resources?
AAWS CloudTrail
BAWS Shield
CAWS CloudFormation
DAWS Inspector
Explanation
CloudTrail logs AWS account activity; others do not provide centralized logging.
Q266
A company needs to enforce Multi-Factor Authentication (MFA) for all IAM users. What feature should be enabled?
AIAM Access Analyzer
BIAM Policies
CIAM MFA
DIAM Roles
Explanation
IAM MFA directly handles multi-factor authentication enforcement; others do not manage MFA settings specifically.
Q267
What happens when an IAM user's permissions are revoked but the user's session is still active?
AImmediate access is revoked immediately
BAccess remains until session expires
CUser requires new credentials
DAccess is temporarily granted
Explanation
Active sessions maintain permissions until expiration; revoked permissions take effect in new sessions.
Q268
Which AWS service can provide real-time threat detection?
AAWS GuardDuty
BAWS Shield
CAWS Inspector
DAWS Config
Explanation
AWS GuardDuty continuously monitors for malicious activity, while the others serve different purposes like attack protection or compliance.
Q269
A company needs to ensure their S3 buckets are not publicly accessible. What feature should they use?
ABucket Policy
BIAM Role
CPublic Access Block
DS3 Storage Class
Explanation
Public Access Block settings help prevent any public access, unlike other options which focus on permissions.
Q270
You are configuring an IAM Role for a Lambda function. What happens if the role has no permissions assigned?
ALambda executes without errors.
BLambda fails due to lack of permissions.
CLambda runs with default administrative rights.
DLambda waits for user approvals.
Explanation
Without permissions, the Lambda function cannot perform any actions required, while the others do not accurately reflect IAM behavior.