The AWS Certified Security – Specialty (SCS-C03) exam tests your skills in securing AWS environments. It is designed for security professionals looking to validate their expertise in AWS security.
Which AWS service enables you to monitor AWS resource configurations for compliance?
AAWS Config
BAWS CloudTrail
CAWS CloudWatch
DAmazon Inspector
Explanation
AWS Config provides continuous monitoring and compliance checking of AWS resource configurations, while the others focus on logging, performance monitoring, or security assessments.
Q332
A company needs to restrict access to an S3 bucket based on IP addresses. What feature should they use?
AS3 Block Public Access
BBucket Policy
CIAM Role
DS3 Lifecycle Policy
Explanation
Bucket Policies allow specifying access conditions, like IP addresses, whereas the others do not provide this level of granularity.
Q333
You are configuring AWS Multi-Factor Authentication (MFA). What happens if you lose your MFA device?
AUse another MFA device
BNo access until reset
CAccess through AWS Support
DEnter a backup code
Explanation
Losing access to your MFA device prevents you from signing in until it is removed or you reset it via the management console or API with sufficient privileges.
Q334
Which AWS service provides a centralized view of your AWS accounts’ security compliance?
AAWS Config
BAWS Security Hub
CAWS CloudTrail
DAWS IAM
Explanation
AWS Security Hub aggregates data from multiple sources to provide compliance and security insights, while the others serve different functions.
Q335
A company needs to securely store and manage encryption keys for their sensitive data. Which AWS service should they use?
AAWS KMS
BAWS Secrets Manager
CAWS S3
DAWS System Manager
Explanation
AWS KMS is specifically designed for managing encryption keys, while the others serve different purposes.
Q336
What happens when you enable AWS CloudTrail in your account?
AReal-time monitoring starts immediately.
BLogging starts for services in all regions.
CBilling alerts are triggered.
DAutomatic backup of data is enabled.
Explanation
CloudTrail logs API calls across all regions, while the other options are inaccurate descriptions of its functionality.
Q337
Which AWS service allows you to manage API access with fine-grained permissions?
AAWS IAM
BAWS Lambda
CAmazon S3
DAWS CloudFormation
Explanation
AWS IAM provides fine-grained access control, while the others don't serve this purpose.
Q338
A company needs to ensure that data in Amazon S3 is automatically encrypted in transit. What should they enable?
ABucket Policy
BS3 Object Lock
CSSL/TLS Configuration
DLifecycle Policy
Explanation
SSL/TLS ensures encryption in transit; the other options are unrelated to this.
Q339
You are configuring a VPC Security Group. What happens when you add a rule to allow all outbound traffic?
ABlocks all incoming traffic
BAllows all outbound traffic
CLimits traffic to VPN only
DPrevents traffic from private IP ranges
Explanation
Allowing all outbound traffic permits every outbound connection regardless of other rules.
Q340
Which service helps you manage AWS access centrally?
AAWS IAM
BAWS S3
CAWS RDS
DAWS EC2
Explanation
AWS IAM allows centralized access management, while others serve different functions.