The AWS Certified Security – Specialty (SCS-C03) exam tests your skills in securing AWS environments. It is designed for security professionals looking to validate their expertise in AWS security.
Which AWS service is primarily used for real-time log processing?
AAmazon Kinesis
BAWS Lambda
CAmazon RDS
DAWS CloudTrail
Explanation
Amazon Kinesis is designed for real-time log data processing, whereas others serve different purposes.
Q62
A company needs high availability for an S3 bucket. What should it enable?
ACross-Region Replication
BStandard Storage Class
CEventual Consistency
DS3 Lifecycle Policies
Explanation
Cross-Region Replication ensures high availability across regions, while others do not specifically address availability.
Q63
You are configuring AWS IAM roles for Lambda functions. What is the primary risk?
AOver-permissioning roles
BMissed CloudTrail logs
CLambda timeout errors
DS3 bucket name collision
Explanation
Over-permissioning roles can lead to security vulnerabilities, unlike the other options which are not primary issues.
Q64
Which AWS service provides automated compliance checks?
AAWS Config
BAmazon CloudWatch
CAWS CloudTrail
DAWS Lambda
Explanation
AWS Config enables you to monitor compliance with configurations while the others serve different monitoring or computing functions.
Q65
A company needs to enforce least privilege for its AWS IAM users. What is the best approach?
ACreate user groups with policies
BAssign IAM roles to users
CUse the root user for access
DAllow full access as a default
Explanation
Creating user groups with specific policies effectively enforces least privilege; roles cannot be directly assigned to users in this context.
Q66
You are configuring an Amazon S3 bucket policy. What happens if the policy denies access to a certain IP range?
AAccess is granted to all other IPs
BNo effect on other policies
CAll access to the bucket is denied
DAccess is limited to the denied range
Explanation
A deny statement in an S3 bucket policy overrides other permissions, thus access is totally denied.
Q67
Which AWS service provides real-time monitoring for your AWS resources?
AAmazon CloudWatch
BAWS Config
CAmazon Inspector
DAWS CloudTrail
Explanation
Amazon CloudWatch monitors AWS resources in real-time; the others serve different purposes.
Q68
A company needs to implement resource policies for their S3 buckets. What should they configure?
AAWS IAM Roles
BS3 Bucket Policies
CAWS Config Rules
DSecurity Groups
Explanation
S3 Bucket Policies are used specifically to manage access; IAM Roles and Security Groups serve other functions.
Q69
What happens when you apply a security group rule that blocks all outbound traffic?
ABlocked Inbound Traffic Only
BUnrestricted Outbound Traffic
CNo Network Connectivity
DAllows Specific IPs
Explanation
Blocking outbound traffic prevents all outbound connectivity; other options misinterpret the effect of security group rules.
Q70
Which AWS service is primarily used for monitoring AWS resources in real-time?
ACloudTrail
BCloudWatch
CConfig
DGuardDuty
Explanation
CloudWatch monitors AWS resources in real-time, while CloudTrail logs API calls, Config tracks compliance, and GuardDuty is for threat detection.