Amazon SCS-C02 Exam Dumps

AWS Certified Security - Specialty

969 Reviews

Exam Code	SCS-C02
Exam Name	AWS Certified Security - Specialty
Questions	467 Questions Answers With Explanation
Update Date	04, 25, 2026
Price	Was : $90 Today : $50 Was : $108 Today : $60 Was : $126 Today : $70

Add To Cart

Demo Questions

Question # 1

A company hosts a web application on an Apache web server. The application runs onAmazon EC2 instances that are in an Auto Scaling group. The company configured theEC2 instances to send the Apache web server logs to an Amazon CloudWatch Logs groupthat the company has configured to expire after 1 year.Recently, the company discovered in the Apache web server logs that a specific IP addressis sending suspicious requests to the web application. A security engineer wants to analyzethe past week of Apache web server logs to determine how many requests that the IPaddress sent and the corresponding URLs that the IP address requested.What should the security engineer do to meet these requirements with the LEAST effort?

A. Export the CloudWatch Logs group data to Amazon S3. Use Amazon Macie to query thelogs for the specific IP address and the requested URLs.
B. Configure a CloudWatch Logs subscription to stream the log group to an Am-azonOpenSearch Service cluster. Use OpenSearch Service to analyze the logs for the specificIP address and the requested URLs.
C. Use CloudWatch Logs Insights and a custom query syntax to analyze the CloudWatchlogs for the specific IP address and the requested URLs.
D. Export the CloudWatch Logs group data to Amazon S3. Use AWS Glue to crawl the S3bucket for only the log entries that contain the specific IP ad-dress. Use AWS Glue to viewthe results.

Show Answer

Question # 2

A company has a set of EC2 Instances hosted in IAM. The EC2 Instances have EBSvolumes which is used to store critical information. There is a business continuityrequirement to ensure high availability for the EBS volumes. How can you achieve this?

A. Use lifecycle policies for the EBS volumes
B. Use EBS Snapshots
C. Use EBS volume replication
D. Use EBS volume encryption

Show Answer

Question # 3

A company has a large fleet of Linux Amazon EC2 instances and Windows EC2 instancesthat run in private subnets. The company wants all remote administration to be performedas securely as possible in the AWS Cloud.Which solution will meet these requirements?

A. Do not use SSH-RSA private keys during the launch of new instances. Implement AWSSystems Manager Session Manager.
B. Generate new SSH-RSA private keys for existing instances. Implement AWS SystemsManager Session Manager.
C. Do not use SSH-RSA private keys during the launch of new instances. Configure EC2Instance Connect.
D. Generate new SSH-RSA private keys for existing instances. Configure EC2 InstanceConnect.

Show Answer

Question # 4

A security engineer must troubleshoot an administrator's inability to make an existingAmazon S3 bucket public in an account that is part of an organization n IAM Organizations.The administrator switched the role from the master account to a member account andthen attempted to make one S3 bucket public. This action was immediately deniedWhich actions should the security engineer take to troubleshoot the permissions issue?(Select TWO.)

A. Review the cross-account role permissions and the S3 bucket policy Verify that theAmazon S3 block public access option in the member account is deactivated.
B. Review the role permissions m the master account and ensure it has sufficient privilegesto perform S3 operations
C. Filter IAM CloudTrail logs for the master account to find the original deny event andupdate the cross-account role m the member account accordingly Verify that the AmazonS3 block public access option in the master account is deactivated.
D. Evaluate the SCPs covering the member account and the permissions boundary of therole in the member account for missing permissions and explicit denies.
E. Ensure the S3 bucket policy explicitly allows the s3 PutBucketPublicAccess action forthe role m the member account

Show Answer

Question # 5

A team is using AWS Secrets Manager to store an application database password. Only alimited number of IAM principals within the account can have access to the secret. The principals who require access to the secret change frequently. A security engineer mustcreate a solution that maximizes flexibility and scalability.Which solution will meet these requirements?

A. Use a role-based approach by creating an IAM role with an inline permissions policy thatallows access to the secret. Update the IAM principals in the role trust policy as required.
B. Deploy a VPC endpoint for Secrets Manager. Create and attach an endpoint policy thatspecifies the IAM principals that are allowed to access the secret. Update the list of IAMprincipals as required.
C. Use a tag-based approach by attaching a resource policy to the secret. Apply tags to thesecret and the IAM principals. Use the aws:PrincipalTag and aws:ResourceTag IAMcondition keys to control access.
D. Use a deny-by-default approach by using IAM policies to deny access to the secretexplicitly. Attach the policies to an IAM group. Add all IAM principals to the IAM group.Remove principals from the group when they need access. Add the principals to the groupagain when access is no longer allowed.

Show Answer

Question # 6

A company has several workloads running on AWS. Employees are required toauthenticate using on-premises ADFS and SSO to access the AWS ManagementConsole. Developers migrated an existing legacy web application to an Amazon EC2instance. Employees need to access this application from anywhere on the internet, butcurrently, there is no authentication system built into the application.How should the Security Engineer implement employee-only access to this system withoutchanging the application?

A. Place the application behind an Application Load Balancer (ALB). Use Amazon Cognitoas authentication for the ALB. Define a SAML-based Amazon Cognito user pool andconnect it to ADFS.
B. Implement AWS SSO in the master account and link it to ADFS as an identity provider.Define the EC2 instance as a managed resource, then apply an IAM policy on theresource.
C. Define an Amazon Cognito identity pool, then install the connector on the ActiveDirectory server. Use the Amazon Cognito SDK on the application instance to authenticatethe employees using their Active Directory user names and passwords.
D. Create an AWS Lambda custom authorizer as the authenticator for a reverse proxy onAmazon EC2. Ensure the security group on Amazon EC2 only allows access from theLambda function.

Show Answer

Question # 7

An AWS account that is used for development projects has a VPC that contains twosubnets. The first subnet is named public-subnet-1 and has the CIDR block 192.168.1.0/24assigned. The other subnet is named private-subnet-2 and has the CIDR block192.168.2.0/24 assigned. Each subnet contains Amazon EC2 instances.Each subnet is currently using the VPC's default network ACL. The security groups that theEC2 instances in these subnets use have rules that allow traffic between each instancewhere required. Currently, all network traffic flow is working as expected between the EC2instances that are using these subnets.A security engineer creates a new network ACL that is named subnet-2-NACL with defaultentries. The security engineer immediately configures private-subnet-2 to use the newnetwork ACL and makes no other changes to the infrastructure. The security engineerstarts to receive reports that the EC2 instances in public-subnet-1 and public-subnet-2cannot communicate with each other.Which combination of steps should the security engineer take to allow the EC2 instancesthat are running in these two subnets to communicate again? (Select TWO.)

A. Add an outbound allow rule for 192.168.2.0/24 in the VPC's default network ACL.
B. Add an inbound allow rule for 192.168.2.0/24 in the VPC's default network ACL.
C. Add an outbound allow rule for 192.168.2.0/24 in subnet-2-NACL.
D. Add an inbound allow rule for 192.168.1.0/24 in subnet-2-NACL.
E. Add an outbound allow rule for 192.168.1.0/24 in subnet-2-NACL.

Show Answer

Question # 8

A Security Engineer has been tasked with enabling IAM Security Hub to monitor AmazonEC2 instances fix CVE in a single IAM account The Engineer has already enabled IAMSecurity Hub and Amazon Inspector m the IAM Management Console and has installed meAmazon Inspector agent on an EC2 instances that need to be monitored.Which additional steps should the Security Engineer lake 10 meet this requirement?

A. Configure the Amazon inspector agent to use the CVE rule package
B. Configure the Amazon Inspector agent to use the CVE rule package Configure SecurityHub to ingest from IAM inspector by writing a custom resource policy
C. Configure the Security Hub agent to use the CVE rule package Configure IAM Inspectorlo ingest from Security Hub by writing a custom resource policy
D. Configure the Amazon Inspector agent to use the CVE rule package Install an additionalIntegration library Allow the Amazon Inspector agent to communicate with Security Hub

Show Answer

Question # 9

An ecommerce company has a web application architecture that runs primarily oncontainers. The application containers are deployed on Amazon Elastic Container Service(Amazon ECS). The container images for the application are stored in Amazon ElasticContainer Registry (Amazon ECR).The company's security team is performing an audit of components of the application architecture. The security team identifies issues with some container images that arestored in the container repositories.The security team wants to address these issues by implementing continual scanning andon-push scanning of the container images. The security team needs to implement asolution that makes any findings from these scans visible in a centralized dashboard. Thesecurity team plans to use the dashboard to view these findings along with other securityrelatedfindings that they intend to generate in the future.There are specific repositories that the security team needs to exclude from the scanningprocess.Which solution will meet these requirements?

A. Use Amazon Inspector. Create inclusion rules in Amazon ECR to match repos-itoriesthat need to be scanned. Push Amazon Inspector findings to AWS Se-curity Hub.
B. Use ECR basic scanning of container images. Create inclusion rules in Ama-zon ECR tomatch repositories that need to be scanned. Push findings to AWS Security Hub.
C. Use ECR basic scanning of container images. Create inclusion rules in Ama-zon ECR tomatch repositories that need to be scanned. Push findings to Amazon Inspector.
D. Use Amazon Inspector. Create inclusion rules in Amazon Inspector to matchrepositories that need to be scanned. Push Amazon Inspector findings to AWS Config.

Show Answer

Question # 10

A company uses AWS Organizations and has production workloads across multiple AWSaccounts. A security engineer needs to design a solution that will proactively monitor forsuspicious behavior across all the accounts that contain production workloads.The solution must automate remediation of incidents across the production accounts. Thesolution also must publish a notification to an Amazon Simple Notification Service (AmazonSNS) topic when a critical security finding is detected. In addition, the solution must send all security incident logs to a dedicated account.Which solution will meet these requirements?

A. Activate Amazon GuardDuty in each production account. In a dedicated loggingaccount. aggregate all GuardDuty logs from each production account. Remediate incidentsby configuring GuardDuty to directly invoke an AWS Lambda function. Configure theLambda function to also publish notifications to the SNS topic.
B. Activate AWS security Hub in each production account. In a dedicated logging account.aggregate all security Hub findings from each production account. Remediate incidents byustng AWS Config and AWS Systems Manager. Configure Systems Manager to alsopub11Sh notifications to the SNS topic.
C. Activate Amazon GuardDuty in each production account. In a dedicated loggingaccount. aggregate all GuardDuty logs from each production account Remediate incidentsby using Amazon EventBridge to invoke a custom AWS Lambda function from theGuardDuty findings. Configure the Lambda function to also publish notifications to the SNStopic.
D. Activate AWS Security Hub in each production account. In a dedicated logging account.aggregate all Security Hub findings from each production account. Remediate incidents byusing Amazon EventBridge to invoke a custom AWS Lambda function from the SecurityHub findings. Configure the Lambda function to also publish notifications to the SNS topic.

Show Answer

Question # 11

A company's security engineer has been tasked with restricting a contractor's IAM accountaccess to the company's Amazon EC2 console without providing access to any other IAMservices The contractors IAM account must not be able to gain access to any other IAMservice, even it the IAM account rs assigned additional permissions based on IAM groupmembership What should the security engineer do to meet these requirements''

A. Create an mime IAM user policy that allows for Amazon EC2 access for the contractor'sIAM user
B. Create an IAM permissions boundary policy that allows Amazon EC2 access Associatethe contractor's IAM account with the IAM permissions boundary policy
C. Create an IAM group with an attached policy that allows for Amazon EC2 accessAssociate the contractor's IAM account with the IAM group
D. Create a IAM role that allows for EC2 and explicitly denies all other services Instruct thecontractor to always assume this role

Show Answer

Question # 12

A company Is planning to use Amazon Elastic File System (Amazon EFS) with its onpremisesservers. The company has an existing IAM Direct Connect connectionestablished between its on-premises data center and an IAM Region Security policy statesthat the company's on-premises firewall should only have specific IP addresses added tothe allow list and not a CIDR range. The company also wants to restrict access so that onlycertain data center-based servers have access to Amazon EFS How should a security engineer implement this solution''

A. Add the file-system-id efs IAM-region amazonIAM com URL to the allow list for the datacenter firewall Install the IAM CLI on the data center-based servers to mount the EFS filesystem in the EFS security group add the data center IP range to the allow list Mount theEFS using the EFS file system name
B. Assign an Elastic IP address to Amazon EFS and add the Elastic IP address to the allowlist for the data center firewall Install the IAM CLI on the data center-based servers tomount the EFS file system In the EFS security group, add the IP addresses of the datacenter servers to the allow list Mount the EFS using the Elastic IP address
C. Add the EFS file system mount target IP addresses to the allow list for the data centerfirewall In the EFS security group, add the data center server IP addresses to the allow listUse the Linux terminal to mount the EFS file system using the IP address of one of themount targets
D. Assign a static range of IP addresses for the EFS file system by contacting IAM SupportIn the EFS security group add the data center server IP addresses to the allow list Use theLinux terminal to mount the EFS file system using one of the static IP addresses

Show Answer

Question # 13

A Network Load Balancer (NLB) target instance is not entering the InService state. Asecurity engineer determines that health checks are failing.Which factors could cause the health check failures? (Select THREE.)

A. The target instance's security group does not allow traffic from the NLB.
B. The target instance's security group is not attached to the NLB.
C. The NLB's security group is not attached to the target instance.
D. The target instance's subnet network ACL does not allow traffic from the NLB.
E. The target instance's security group is not using IP addresses to allow traffic from theNLB.
F. The target network ACL is not attached to the NLB.

Show Answer

Question # 14

A security engineer recently rotated the host keys for an Amazon EC2 instance. Thesecurity engineer is trying to access the EC2 instance by using the EC2 Instance. Connectfeature. However, the security engineer receives an error (or failed host key validation.Before the rotation of the host keys EC2 Instance Connect worked correctly with this EC2instance.What should the security engineer do to resolve this error?

A. Import the key material into AWS Key Management Service (AWS KMS).
B. Manually upload the new host key to the AWS trusted host keys database.
C. Ensure that the AmazonSSMManagedInstanceCore policy is attached to the EC2instance profile.
D. Create a new SSH key pair for the EC2 instance.

Show Answer

Question # 15

A Security Engineer receives alerts that an Amazon EC2 instance on a public subnet isunder an SFTP brute force attack from a specific IP address, which is a known maliciousbot. What should the Security Engineer do to block the malicious bot?

A. Add a deny rule to the public VPC security group to block the malicious IP
B. Add the malicious IP to IAM WAF backhsted IPs
C. Configure Linux iptables or Windows Firewall to block any traffic from the malicious IPD. Modify the hosted zone in Amazon Route 53 and create a DNS sinkhole for themalicious IP

Show Answer

Question # 16

You work at a company that makes use of IAM resources. One of the key security policiesis to ensure that all data i encrypted both at rest and in transit. Which of the following is oneof the right ways to implement this.Please select:

A. Use S3 SSE and use SSL for data in transit
B. SSL termination on the ELB
C. Enabling Proxy Protocol
D. Enabling sticky sessions on your load balancer

Show Answer

Question # 17

A company discovers a billing anomaly in its AWS account. A security consultantinvestigates the anomaly and discovers that an employee who left the company 30 daysago still has access to the account.The company has not monitored account activity in the past.The security consultant needs to determine which resources have been deployed orreconfigured by the employee as quickly as possible.Which solution will meet these requirements?

A. In AWS Cost Explorer, filter chart data to display results from the past 30 days. Exportthe results to a data table. Group the data table by re-source.
B. Use AWS Cost Anomaly Detection to create a cost monitor. Access the detec-tionhistory. Set the time frame to Last 30 days. In the search area, choose the servicecategory.
C. In AWS CloudTrail, filter the event history to display results from the past 30 days.Create an Amazon Athena table that contains the data. Parti-tion the table by event source.
D. Use AWS Audit Manager to create an assessment for the past 30 days. Apply a usagebasedframework to the assessment. Configure the assessment to as-sess by resource.

Show Answer

Question # 18

While securing the connection between a company's VPC and its on-premises data center,a Security Engineer sent a ping command from an on-premises host(IP address 203.0.113.12) to an Amazon EC2 instance (IP address 172.31.16.139). Theping command did not return a response. The flow log in the VPC showed the following:2 123456789010 eni-1235b8ca 203.0.113.12 172.31.16.139 0 0 1 4 336 14329170271432917142 ACCEPT OK2 123456789010 eni-1235b8ca 172.31.16.139 203.0.113.12 0 0 1 4 336 14329170941432917142 REJECT OKWhat action should be performed to allow the ping to work?

A. In the security group of the EC2 instance, allow inbound ICMP traffic.
B. In the security group of the EC2 instance, allow outbound ICMP traffic.
C. In the VPC's NACL, allow inbound ICMP traffic.
D. In the VPC's NACL, allow outbound ICMP traffic.

Show Answer

Question # 19

A company has deployed Amazon GuardDuty and now wants to implement automation forpotential threats. The company has decided to start with RDP brute force attacks that comefrom Amazon EC2 instances in the company’s AWS environment. A security engineerneeds to implement a solution that blocks the detected communication from a suspiciousinstance until investigation and potential remediation can occur.Which solution will meet these requirements?

A. Configure GuardDuty to send the event to an Amazon Kinesis data stream. Process theevent with an Amazon Kinesis Data Analytics for Apache Flink application that sends anotification to the company through Amazon Simple Notification Service (Amazon SNS).Add rules to the network ACL to block traffic to and from the suspicious instance.
B. Configure GuardDuty to send the event to Amazon EventBridge (Amazon CloudWatchEvents). Deploy an AWS WAF web ACL. Process the event with an AWS Lambda functionthat sends a notification to the company through Amazon Simple Notification Service(Amazon SNS) and adds a web ACL rule to block traffic to and from the suspiciousinstance.
C. Enable AWS Security Hub to ingest GuardDuty findings and send the event to AmazonEventBridge (Amazon CloudWatch Events). Deploy AWS Network Firewall. Process theevent with an AWS Lambda function that adds a rule to a Network Firewall firewall policy toblock traffic to and from the suspicious instance.
D. Enable AWS Security Hub to ingest GuardDuty findings. Configure an Amazon Kinesisdata stream as an event destination for Security Hub. Process the event with an AWSLambda function that replaces the security group of the suspicious instance with a securitygroup that does not allow any connections.

Show Answer

Question # 20

A security engineer needs to see up an Amazon CloudFront distribution for an Amazon S3bucket that hosts a static website. The security engineer must allow only specified IPaddresses to access the website. The security engineer also must prevent users fromaccessing the website directly by using S3 URLs.Which solution will meet these requirements?

A. Generate an S3 bucket policy. Specify cloudfront amazonaws com as the principal. Usethe aws Sourcelp condition key to allow access only if the request conies from the specifiedIP addresses.
B. Create a CloudFront origin access identity (OAl). Create the S3 bucket policy so thatonly the OAl has access. Create an AWS WAF web ACL and add an IP set rule. Associatethe web ACL with the CloudFront distribution.
C. Implement security groups to allow only the specified IP addresses access and torestrict S3 bucket access by using the CloudFront distribution.
D. Create an S3 bucket access point to allow access from only the CloudFront distribution.Create an AWS WAF web ACL and add an IP set rule. Associate the web ACL with theCloudFront distribution.

Show Answer

Question # 21

A company needs to follow security best practices to deploy resources from an AWSCloudFormation template. The CloudFormation template must be able to configuresensitive database credentials.The company already uses AWS Key Management Service (AWS KMS) and AWS SecretsManager.Which solution will meet the requirements?

A. Use a dynamic reference in the CloudFormation template to reference the databasecredentials in Secrets Manager.
B. Use a parameter in the CloudFormation template to reference the database credentials.Encrypt the CloudFormation template by using AWS KMS.
C. Use a SecureString parameter in the CloudFormation template to reference thedatabase credentials in Secrets Manager.
D. Use a SecureString parameter in the CloudFormation template to reference anencrypted value in AWS KMS

Show Answer

Question # 22

A company wants to monitor the deletion of AWS Key Management Service (AWS KMS)customer managed keys. A security engineer needs to create an alarm that will notify thecompany before a KMS key is deleted. The security engineer has configured theintegration of AWS CloudTrail with Amazon CloudWatch.What should the security engineer do next to meet these requirements?

A. Specify the deletion time of the key material during KMS key creation. Create a customAWS Config rule to assess the key's scheduleddeletion. Configure the rule to trigger upon a configuration change. Send a message to anAmazon Simple Notification Service (Amazon SNS) topic if the key is scheduled fordeletion.
B. Create an Amazon EventBridge rule to detect KMS API calls of DeleteAlias. Create anAWS Lambda function to send an Amazon Simple Notification Service (Amazon SNS)message to the company. Add the Lambda function as the target of the EventBridge rule.
C. Create an Amazon EventBridge rule to detect KMS API calls of DisableKey andScheduleKeyDeletion. Create an AWS Lambda function to send an Amazon SimpleNotification Service (Amazon SNS) message to the company. Add the Lambda function asthe target of the EventBridge rule.
D. Create an Amazon Simple Notification Service (Amazon SNS) policy to detect KMS APIcalls of RevokeGrant and ScheduleKeyDeletion.Create an AWS Lambda function to generate the alarm and send the notification to thecompany. Add the Lambda function as the target of the SNS policy.

Show Answer

Question # 23

A company that uses AWS Organizations is migrating workloads to AWS. The compa-nysapplication team determines that the workloads will use Amazon EC2 instanc-es, AmazonS3 buckets, Amazon DynamoDB tables, and Application Load Balancers. For eachresource type, the company mandates that deployments must comply with the followingrequirements:• All EC2 instances must be launched from approved AWS accounts.• All DynamoDB tables must be provisioned with a standardized naming convention.• All infrastructure that is provisioned in any accounts in the organization must be deployedby AWS CloudFormation templates.Which combination of steps should the application team take to meet these re-quirements?(Select TWO.)

A. Create CloudFormation templates in an administrator AWS account. Share the stacksets with an application AWS account. Restrict the template to be used specifically by theapplication AWS account.
B. Create CloudFormation templates in an application AWS account. Share the output withan administrator AWS account to review compliant resources. Restrict output to only theadministrator AWS account.
C. Use permissions boundaries to prevent the application AWS account from provisioningspecific resources unless conditions for the internal compli-ance requirements are met.
D. Use SCPs to prevent the application AWS account from provisioning specific resourcesunless conditions for the internal compliance requirements are met.
E. Activate AWS Config managed rules for each service in the application AWS account.

Show Answer

Question # 24

A company maintains an open-source application that is hosted on a public GitHubrepository. While creating a new commit to the repository, an engineer uploaded their IAMaccess key and secret access key. The engineer reported the mistake to a manager, andthe manager immediately disabled the access key.The company needs to assess the impact of the exposed access key. A security engineermust recommend a solution that requires the least possible managerial overhead.Which solution meets these requirements?

A. Analyze an IAM Identity and Access Management (IAM) use report from IAM TrustedAdvisor to see when the access key was last used.
B. Analyze Amazon CloudWatch Logs for activity by searching for the access key.
C. Analyze VPC flow logs for activity by searching for the access key
D. Analyze a credential report in IAM Identity and Access Management (IAM) to see whenthe access key was last used.

Show Answer

Question # 25

A company manages three separate IAM accounts for its production, development, and test environments, Each Developer is assigned a unique IAM user under the developmentaccount. A new application hosted on an Amazon EC2 instance in the developer accountrequires read access to the archived documents stored in an Amazon S3 bucket in theproduction account.How should access be granted?

A. Create an IAM role in the production account and allow EC2 instances in thedevelopment account to assume that role using the trust policy. Provide read access for therequired S3 bucket to this role.
B. Use a custom identity broker to allow Developer IAM users to temporarily access the S3bucket.
C. Create a temporary IAM user for the application to use in the production account.
D. Create a temporary IAM user in the production account and provide read access toAmazon S3. Generate the temporary IAM user's access key and secret key and storethese on the EC2 instance used by the application in the development account.

Show Answer