The AWS Certified Security – Specialty (SCS-C03) exam tests your skills in securing AWS environments. It is designed for security professionals looking to validate their expertise in AWS security.
Which service provides automatic encryption for EBS volumes?
AEBS Encryption
BIAM Roles
CS3 Bucket Policies
DCloudTrail Logging
Explanation
EBS Encryption automatically encrypts data at rest, while the others serve different purposes.
Q302
A company needs to analyze sensitive data stored in S3. What should they do to ensure compliance with GDPR?
AEnable public access on the bucket
BUse IAM for access control
CEncrypt data in transit only
DRemove all duplicate data
Explanation
Using IAM allows precise access control, essential for GDPR compliance, unlike the other options which are risky or misleading.
Q303
What happens when you disable an IAM user's access key?
AAll user permissions are revoked
BUser cannot make API calls
CUser retains console access
DAccess key is reused automatically
Explanation
Disabling an access key prevents the user from making programmatic calls, while permissions and console access remain intact.
Q304
Which service provides encryption for data at rest in S3?
AS3 Managed Keys (SSE-S3)
BAWS Shield
CAmazon CloudFront
DAWS Global Accelerator
Explanation
S3 Managed Keys (SSE-S3) automatically encrypts data at rest, while the other options are unrelated to S3 encryption.
Q305
A company needs to restrict IAM user access based on conditions. What should they use?
AIAM Roles
BIAM Policies
CResource Tags
DService Control Policies (SCPs)
Explanation
IAM Policies define user permissions and can incorporate conditions, unlike roles, tags, or SCPs, which have different purposes.
Q306
What happens when an EC2 instance is terminated?
AEBS volumes are deleted
BIP addresses are reassigned
CAutomatic backups are saved
DInstance data is retained
Explanation
Terminating an EC2 instance by default deletes its associated instance store volumes, unless configured otherwise, while all other options are incorrect regarding instance termination.
Q307
Which AWS service provides automatic security auditing and compliance monitoring?
AAWS Config
BAmazon Inspector
CAWS CloudTrail
DAWS Shield
Explanation
AWS Config tracks configurations and compliance, while others do not focus solely on auditing.
Q308
A company needs to safeguard sensitive data in transit between its on-premises environment and AWS. Which solution is best?
AAWS Direct Connect
BAWS VPN
CAWS GuardDuty
DAWS Shield
Explanation
AWS VPN encrypts data during transit, unlike Direct Connect which is not encrypted by default.
Q309
What happens when you disable MFA for an IAM user who previously had it enabled?
AUser can't access the account anymore
BUser can access without MFA
CUser must reset their password
DUser retains MFA settings temporarily
Explanation
Disabling MFA allows access without MFA, following standard policy behavior.
Q310
Which AWS service helps you manage AWS Identity and Access Management policies collaboratively?
AAWS Organizations
BAWS IAM Access Analyzer
CAWS Config
DAWS CloudTrail
Explanation
AWS IAM Access Analyzer helps analyze and manage policies, while others focus on resource management or tracking activity.