Amazon Web ServicesExpert levelSCS-C02

SCS-C02 exam dumps: 504 free AWS Security Specialty practice questions

Free SCS-C02 practice questions for the AWS Certified Security - Specialty exam, with the correct answer and a full explanation for every option. Read the first 10 below, browse all 504 by number, or take a timed practice exam.

Question bank last updated December 2024

Start timed practice exam Browse all 504 questions

Free SCS-C02 practice questions

Questions 1 to 10 of 504

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

SCS-C02 Question 1

Select 3

Your company uses Amazon GuardDuty to monitor threats across AWS accounts and resources. Recently, GuardDuty detected an unusual volume of API requests coming from a specific IAM role associated with an EC2 instance. What steps should you take to investigate and mitigate the potential threat?

  1. A

    Review the CloudTrail logs for the IAM role to identify the source of the API requests.

  2. B

    Immediately delete the IAM role to stop unauthorized API calls.

  3. C

    Isolate the EC2 instance by moving it to a security group with no outbound access.

  4. D

    Analyze the GuardDuty findings for details on the suspicious activity, including IP addresses and affected resources.

  5. E

    Revoke all permissions from the IAM role to prevent further API activity.

Show answer and explanation

Correct answers: A, C, D

Explanation

When GuardDuty detects unusual activity, a systematic response is required. Reviewing CloudTrail logs provides insights into the source and scope of the threat. Isolating the EC2 instance prevents further propagation, and analyzing GuardDuty findings gives additional context about the suspicious behavior. Deleting the IAM role or revoking all permissions immediately can lead to disruption and should be avoided unless absolutely necessary.

  • A. Correct.

    Reviewing CloudTrail logs is essential for understanding the source and scope of the suspicious API activity. It helps identify whether the activity is the result of a compromised resource or misconfiguration.

  • B. Incorrect.

    Deleting the IAM role immediately is not recommended, as it could disrupt legitimate processes and make it more difficult to investigate the incident thoroughly.

  • C. Correct.

    Isolating the EC2 instance by restricting its network access is a key step to contain the potential threat while you investigate further.

  • D. Correct.

    Analyzing the GuardDuty findings provides context about the suspicious activity, such as the IP address, affected resources, and possible intent behind the activity.

  • E. Incorrect.

    Revoking all permissions from the IAM role is overly disruptive and may impact production processes. A more strategic containment plan, such as isolating the instance and investigating logs, is preferred.

SCS-C02 Question 2

Select 2

Your organization uses AWS CloudTrail for logging API activity in your AWS environment. A security analyst reports suspicious activity related to IAM roles and requests your assistance in investigating the issue. To detect unauthorized access attempts to IAM roles and identify potential security threats, which combination of actions should you take?

  1. A

    Use Amazon CloudWatch Logs Insights to query CloudTrail logs for AssumeRole API events.

  2. B

    Set up a CloudWatch alarm to monitor for changes to IAM policies and roles.

  3. C

    Enable Amazon GuardDuty to detect unusual activity related to IAM roles.

  4. D

    Use AWS Config to review the historical configuration changes for IAM roles.

  5. E

    Enable AWS Security Hub to automatically block suspicious IAM role activity.

Show answer and explanation

Correct answers: A, C

Explanation

To effectively detect unauthorized access attempts to IAM roles and identify potential security threats, you should focus on analyzing relevant API activity and leveraging threat detection services. Querying AssumeRole events in CloudTrail logs helps identify unauthorized access attempts, while Amazon GuardDuty provides detection for unusual or anomalous activity related to IAM roles. Other options, such as AWS Config and Security Hub, provide valuable insights for compliance and aggregation but are not specifically targeted at detecting unauthorized role access in this scenario.

  • A. Correct.

    Correct. Querying CloudTrail logs using CloudWatch Logs Insights allows you to analyze AssumeRole API events and identify unauthorized or unusual access attempts.

  • B. Incorrect.

    Incorrect. Monitoring changes to IAM policies and roles is useful for compliance and configuration management but does not directly detect unauthorized access attempts to IAM roles.

  • C. Correct.

    Correct. Amazon GuardDuty provides threat detection capabilities and can identify unusual activity related to IAM roles, such as anomalous API calls.

  • D. Incorrect.

    Incorrect. AWS Config helps track configuration changes but does not provide direct detection of unauthorized access attempts or unusual activity.

  • E. Incorrect.

    Incorrect. AWS Security Hub aggregates findings but does not automatically block suspicious activity. Blocking requires additional configuration or tools.

SCS-C02 Question 3

Select 3

Your organization has implemented Amazon GuardDuty to monitor and detect potential security threats in your AWS environment. You receive an alert indicating that an EC2 instance is communicating with a known Command and Control (C2) server. What actions should you take to respond to this threat while minimizing the impact on other operations?

  1. A

    Isolate the EC2 instance by modifying its security group to deny all outbound traffic.

  2. B

    Stop the EC2 instance immediately to prevent further malicious activity.

  3. C

    Investigate the GuardDuty finding to gather additional details, such as the instance ID and the malicious IP address.

  4. D

    Take a memory snapshot of the EC2 instance to preserve forensic evidence before taking further action.

  5. E

    Reinstate the EC2 instance after deleting the finding from GuardDuty to resolve the alert.

Show answer and explanation

Correct answers: A, C, D

Explanation

When dealing with a potential compromise, the focus should be on containment, investigation, evidence preservation, and remediation. Isolating the instance ensures it cannot continue communicating with malicious actors, while gathering information and taking a memory snapshot allow for a thorough investigation. Immediate actions like stopping the instance or reinstating it without analysis may lead to data loss or further compromise.

  • A. Correct.

    Isolating the EC2 instance by modifying its security group to deny all outbound traffic is a valid initial containment step to prevent further communication with malicious actors.

  • B. Incorrect.

    Stopping the EC2 instance immediately could disrupt forensic analysis and evidence collection, so it is not recommended as the first action.

  • C. Correct.

    Investigating the GuardDuty finding is crucial to understanding the scope of the threat and collecting necessary details for a proper response.

  • D. Correct.

    Taking a memory snapshot of the EC2 instance preserves evidence that can be used for forensic analysis and incident investigation.

  • E. Incorrect.

    Reinstating the EC2 instance without proper investigation or remediation could expose your environment to further risks, making this a poor response.

SCS-C02 Question 4

Select 3

Your organization has deployed a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores logs in Amazon S3 and uses AWS WAF to monitor and block malicious traffic. Recently, your security team detected a spike in suspicious activity, including SQL injection attempts. Which steps should you take to investigate and mitigate this threat?

  1. A

    Enable AWS WAF logging and analyze the logs for malicious patterns.

  2. B

    Use Amazon GuardDuty to analyze VPC flow logs and identify suspicious IP addresses.

  3. C

    Enable Amazon Macie to classify sensitive data in Amazon S3 and monitor data access patterns.

  4. D

    Deploy an AWS Config rule to assess the security configuration of the EC2 instances.

  5. E

    Create new AWS WAF rules to block specific IP addresses identified in the analysis.

Show answer and explanation

Correct answers: A, B, E

Explanation

To investigate and mitigate the SQL injection threat, you should focus on tools and actions that help identify the malicious traffic source and block it. AWS WAF logging provides insights into the nature of the attack, while Amazon GuardDuty can identify suspicious IP addresses through flow log analysis. Finally, creating new WAF rules to block identified malicious IPs helps mitigate the attack. Other options, like Amazon Macie and AWS Config, are less relevant to the specific scenario.

  • A. Correct.

    Enabling AWS WAF logging is a critical step in identifying malicious patterns in incoming traffic. This helps you understand the nature of the threat and customize mitigation strategies.

  • B. Correct.

    Amazon GuardDuty can analyze VPC flow logs to identify suspicious activity such as communication with known malicious IPs. This is highly relevant for investigating the source of the threat.

  • C. Incorrect.

    Amazon Macie focuses on data classification and monitoring S3 access patterns. While useful for identifying data breaches, it is not directly applicable to detecting or mitigating SQL injection attempts.

  • D. Incorrect.

    AWS Config assesses resource configurations for compliance. Although helpful in identifying misconfigurations, it is not directly relevant to analyzing or mitigating SQL injection threats.

  • E. Correct.

    Creating new AWS WAF rules to block malicious IP addresses based on analysis is an effective mitigation step to prevent further SQL injection attempts.

SCS-C02 Question 5

Select 2

Your organization has recently experienced a security incident where an Amazon EC2 instance was compromised. To respond effectively, you need to design and implement an incident response plan specific to AWS. Which of the following actions should you include in your plan? (Choose TWO)

  1. A

    Isolate the compromised EC2 instance by modifying the associated security group to deny all inbound and outbound traffic.

  2. B

    Immediately delete the compromised EC2 instance to prevent further exploitation.

  3. C

    Implement Amazon GuardDuty to continuously monitor for suspicious activity and generate alerts.

  4. D

    Conduct a forensic analysis on the compromised EC2 instance by creating an Amazon EBS snapshot and preserving the instance's state.

  5. E

    Disable all IAM user accounts in the AWS account to prevent further unauthorized access.

Show answer and explanation

Correct answers: A, D

Explanation

An effective incident response plan should focus on containing the threat and preserving evidence for investigation. Isolating the compromised EC2 instance prevents further damage and keeps the environment secure, while creating an EBS snapshot ensures that evidence is preserved for forensic analysis. Proactive measures like GuardDuty and extreme actions like disabling all IAM users are not directly relevant to responding to the specific incident.

  • A. Correct.

    Isolating the compromised EC2 instance is a critical step in an incident response plan to prevent further exploitation while preserving the instance for investigation.

  • B. Incorrect.

    Deleting the instance eliminates valuable forensic evidence and hinders the ability to investigate the root cause of the incident.

  • C. Incorrect.

    While Amazon GuardDuty is a valuable monitoring tool, it is a proactive measure rather than a direct step in responding to an already compromised instance.

  • D. Correct.

    Conducting a forensic analysis by creating an EBS snapshot helps preserve evidence and aids in understanding the nature of the compromise.

  • E. Incorrect.

    Disabling all IAM user accounts is an extreme action that disrupts legitimate access and is not necessary in most incident response scenarios; instead, you should focus on reviewing and revoking only suspicious credentials.

SCS-C02 Question 6

Select 3

Your organization runs critical workloads on AWS and wants to ensure a robust incident response plan is in place. As part of the plan, you need to automate the detection of unauthorized changes to IAM policies and immediately isolate compromised instances. Which combination of AWS services and features should you use to meet this requirement effectively?

  1. A

    AWS CloudTrail with Amazon CloudWatch Alarms

  2. B

    AWS Config with AWS Config Rules

  3. C

    Amazon GuardDuty with AWS Lambda

  4. D

    AWS Systems Manager Session Manager

  5. E

    AWS Shield Advanced

Show answer and explanation

Correct answers: A, B, C

Explanation

To design and implement an effective incident response plan, you need a combination of services that can detect unauthorized changes and automate responses. AWS CloudTrail and CloudWatch enable tracking and alerting on API activity. AWS Config with Config Rules helps monitor and enforce compliance with IAM policy changes. Amazon GuardDuty can detect threats and, when integrated with AWS Lambda, can automate actions like isolating compromised instances. These tools together address both detection and response requirements effectively.

  • A. Correct.

    AWS CloudTrail with Amazon CloudWatch Alarms can help track API activity and trigger alarms for unauthorized changes, making it a crucial component for detecting incidents.

  • B. Correct.

    AWS Config with AWS Config Rules is vital for assessing compliance and detecting unauthorized changes to IAM policies in real-time.

  • C. Correct.

    Amazon GuardDuty with AWS Lambda is effective for threat detection and automated responses, such as isolating compromised instances.

  • D. Incorrect.

    AWS Systems Manager Session Manager is used for secure instance management but does not directly help with incident detection or automation of responses.

  • E. Incorrect.

    AWS Shield Advanced is used for DDoS protection and is not relevant for detecting IAM policy changes or isolating compromised instances.

SCS-C02 Question 7

Select 3

Your organization has recently adopted AWS and is designing an incident response plan to handle potential security breaches. As part of the plan, the organization wants to ensure that compromised resources are isolated automatically to prevent further damage. Which of the following actions should be included in the plan to achieve this goal?

  1. A

    Set up AWS Config rules to detect non-compliant resources and trigger AWS Lambda functions to isolate them.

  2. B

    Use AWS Systems Manager Automation documents (SSM Documents) to terminate compromised EC2 instances.

  3. C

    Create Amazon GuardDuty findings to automatically isolate the resource by moving it to a quarantine VPC using AWS Lambda.

  4. D

    Enable Detective to automatically isolate resources identified as part of a security anomaly.

  5. E

    Integrate AWS Security Hub with automation rules to isolate non-compliant resources using AWS Config and Lambda.

Show answer and explanation

Correct answers: A, C, E

Explanation

To design an effective incident response plan in AWS, it is essential to automate the isolation of compromised resources to prevent further damage. Using AWS Config rules and Lambda or GuardDuty findings with Lambda, resources can be moved to a quarantine VPC. Additionally, AWS Security Hub can orchestrate automated actions by integrating with AWS Config and Lambda to ensure non-compliant resources are isolated effectively. These approaches align with AWS best practices for incident response.

  • A. Correct.

    Correct: AWS Config rules can monitor resource compliance, and when a resource is deemed non-compliant (e.g., compromised), a Lambda function can be triggered to isolate it.

  • B. Incorrect.

    Incorrect: AWS Systems Manager Automation documents can perform various actions, but terminating an instance directly doesn't isolate it. Isolation typically involves network or resource containment rather than deletion.

  • C. Correct.

    Correct: GuardDuty findings can trigger AWS Lambda functions to move compromised resources to a quarantine VPC, effectively isolating them.

  • D. Incorrect.

    Incorrect: AWS Detective is a service for investigation and analysis of security incidents; it does not have built-in functionality for isolating resources.

  • E. Correct.

    Correct: AWS Security Hub integrates with automation tools like AWS Config and Lambda, enabling the isolation of non-compliant resources as part of a security response.

SCS-C02 Question 8

Select 4

Your company runs a multi-account AWS environment using AWS Organizations. You are tasked with designing an incident response plan for detecting and responding to potential security breaches. Which of the following actions should be included in your incident response plan to ensure effective detection and coordination across accounts?

  1. A

    Enable GuardDuty in the management account and configure it to aggregate findings from all member accounts.

  2. B

    Set up CloudTrail in every account and send logs to a centralized S3 bucket with appropriate permissions.

  3. C

    Use AWS Config to ensure CloudTrail is enabled and configured correctly in all accounts.

  4. D

    Implement a Security Hub administrator account to view and manage findings across all accounts.

  5. E

    Rely on manual log analysis during incidents to reduce costs associated with automated monitoring services.

Show answer and explanation

Correct answers: A, B, C, D

Explanation

An effective incident response plan in a multi-account AWS environment should prioritize centralized monitoring, log aggregation, and compliance enforcement. GuardDuty, CloudTrail, AWS Config, and Security Hub each play critical roles in ensuring comprehensive detection, logging, and response capabilities. Manual log analysis is not practical in modern cloud environments as it is slow and error-prone.

  • A. Correct.

    Correct. Enabling GuardDuty in the management account and aggregating findings from member accounts ensures centralized threat detection and monitoring, which is vital for incident response.

  • B. Correct.

    Correct. Centralizing CloudTrail logs in an S3 bucket allows for unified visibility and access to logs, which is essential for forensic analysis during incident responses.

  • C. Correct.

    Correct. AWS Config helps in ensuring that CloudTrail is consistently enabled and correctly configured across accounts, reducing the risk of misconfiguration that could hinder incident response.

  • D. Correct.

    Correct. Security Hub provides a centralized view of security findings across multiple accounts, enabling efficient coordination and response during incidents.

  • E. Incorrect.

    Incorrect. Relying on manual log analysis is not a best practice as it delays response times and is prone to human error. Automated monitoring services enhance detection and response capabilities.

SCS-C02 Question 9

Single answer

Your company is hosting a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores sensitive customer data in Amazon S3. You are tasked with ensuring that the data in transit between the clients and the S3 bucket is encrypted, and you need to ensure no unencrypted traffic is allowed. Which approach should you take to meet this requirement?

  1. A

    Enable server-side encryption (SSE) for the Amazon S3 bucket.

  2. B

    Require HTTPS by configuring an HTTPS listener on the ALB and redirect HTTP traffic to HTTPS.

  3. C

    Use AWS Certificate Manager (ACM) to manage SSL/TLS certificates and associate them with the ALB.

  4. D

    Create a bucket policy in Amazon S3 to deny any requests that do not use HTTPS.

Show answer and explanation

Correct answer: D

Explanation

To ensure data in transit is encrypted and unencrypted traffic is denied, you must enforce HTTPS for access to the S3 bucket. A bucket policy can be configured to deny any requests that do not use HTTPS, thereby meeting the requirement. Other options, such as enabling SSE or using ACM, address different aspects of security but do not explicitly enforce encrypted communication to the S3 bucket.

  • A. Incorrect.

    Enabling server-side encryption (SSE) protects data at rest in Amazon S3, not data in transit. This does not meet the requirement to ensure encrypted communication between clients and the bucket.

  • B. Incorrect.

    Requiring HTTPS for clients connecting to the ALB ensures encrypted communication to the load balancer but does not enforce encryption for traffic directly to the S3 bucket.

  • C. Incorrect.

    Using AWS Certificate Manager (ACM) simplifies SSL/TLS certificate management for the ALB, but it does not enforce encryption for data in transit to the S3 bucket.

  • D. Correct.

    Creating a bucket policy to deny requests that do not use HTTPS ensures that only encrypted communication is allowed for traffic in transit to the S3 bucket, meeting the requirement.

SCS-C02 Question 10

Select 3

An e-commerce company is using an Amazon S3 bucket to store sensitive customer data. The security team wants to ensure that the data in the bucket is encrypted at all times and that the company maintains control over the encryption keys. Additionally, they need to audit access to the bucket and ensure that unauthorized access attempts are detected. Which combination of steps should the company take to meet these requirements?

  1. A

    Enable server-side encryption with AWS Key Management Service (SSE-KMS) and use a customer-managed KMS key.

  2. B

    Enable Amazon S3 bucket logging to track all access requests.

  3. C

    Enable AWS CloudTrail logging for S3 data events.

  4. D

    Use Amazon S3 server-side encryption with Amazon S3-managed keys (SSE-S3).

  5. E

    Enable Amazon Macie to monitor and classify sensitive data.

Show answer and explanation

Correct answers: A, C, E

Explanation

To meet the requirements, the company must first ensure data encryption with control over the encryption keys, which is achieved by using SSE-KMS with a customer-managed KMS key. AWS CloudTrail logging for S3 data events is essential for auditing access and identifying unauthorized access attempts. Additionally, Amazon Macie enhances security by detecting sensitive data and monitoring for anomalies, which helps fulfill the detection requirement. Bucket logging and SSE-S3 were not selected as they do not fully meet the stated requirements.

  • A. Correct.

    Correct. Enabling SSE-KMS with a customer-managed KMS key ensures that data is encrypted and the company retains control over the encryption keys.

  • B. Incorrect.

    Incorrect. While bucket logging can track access requests, it is not sufficient for auditing or detecting unauthorized access attempts compared to CloudTrail.

  • C. Correct.

    Correct. AWS CloudTrail data event logging for S3 can monitor and log all actions performed on the bucket, providing a detailed audit trail.

  • D. Incorrect.

    Incorrect. While SSE-S3 encrypts data, it does not provide the same level of key control as customer-managed KMS keys.

  • E. Correct.

    Correct. Amazon Macie helps detect sensitive data and monitor for anomalies, aiding in the detection of unauthorized access attempts.

Timed practice exam

Take a SCS-C02 practice test under exam conditions

65 questions in 170 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

What the SCS-C02 exam covers

Official AWS Certified Security - Specialty exam domains and weightings.

  • Threat Detection and Incident Response

    14% of exam

  • Security Logging and Monitoring

    18% of exam

  • Infrastructure Security

    20% of exam

  • Identity and Access Management

    16% of exam

  • Data Protection

    18% of exam

  • Management and Security Governance

    14% of exam

All 504 SCS-C02 practice questions

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them.

  1. 1.Your company uses Amazon GuardDuty to monitor threats across AWS accounts and resources. Recently, GuardDuty...
  2. 2.Your organization uses AWS CloudTrail for logging API activity in your AWS environment. A security analyst...
  3. 3.Your organization has implemented Amazon GuardDuty to monitor and detect potential security threats in your...
  4. 4.Your organization has deployed a web application on Amazon EC2 instances behind an Application Load Balancer...
  5. 5.Your organization has recently experienced a security incident where an Amazon EC2 instance was compromised....
  6. 6.Your organization runs critical workloads on AWS and wants to ensure a robust incident response plan is in...
  7. 7.Your organization has recently adopted AWS and is designing an incident response plan to handle potential...
  8. 8.Your company runs a multi-account AWS environment using AWS Organizations. You are tasked with designing an...
  9. 9.Your company is hosting a web application on Amazon EC2 instances behind an Application Load Balancer (ALB)....
  10. 10.An e-commerce company is using an Amazon S3 bucket to store sensitive customer data. The security team wants...
  11. 11.Your company is using Amazon S3 to store sensitive financial data. You have been tasked with ensuring that...
  12. 12.An organization has deployed several web applications on Amazon EC2 instances behind an Application Load...
  13. 13.Your organization has detected unauthorized activity in an Amazon S3 bucket containing sensitive data. As...
  14. 14.Your organization uses AWS services to host its web application, and you are responsible for designing an...
  15. 15.Your organization recently detected suspicious activity in its AWS environment, potentially indicating a...
  16. 16.Your company has detected unauthorized access to an Amazon S3 bucket containing sensitive data. As part of...
  17. 17.Your organization has recently identified unusual activity in an Amazon S3 bucket that contains sensitive...
  18. 18.Your company recently detected a security incident where an unauthorized IAM user accessed sensitive S3...
  19. 19.Your organization recently detected unusual activity on an Amazon EC2 instance, and an investigation reveals...
  20. 20.Your organization recently identified unauthorized access to sensitive data hosted in an Amazon S3 bucket....
  21. 21.An organization using AWS has developed an incident response plan to handle security breaches involving its...
  22. 22.An organization has developed an incident response plan for its AWS environment. During a simulated security...
  23. 23.A company is drafting its incident response plan for managing security incidents in its AWS environment....
  24. 24.Your organization has recently adopted an AWS Incident Response Plan (IRP). During a simulated security...
  25. 25.You are a Security Engineer managing a multi-account AWS environment. Your organization has integrated AWS...
  26. 26.An organization uses AWS Security Hub to monitor and manage security findings across multiple AWS accounts. A...
  27. 27.Your company uses AWS Security Hub to manage and analyze security findings. You are tasked with building a...
  28. 28.You are working as a security engineer for a company that uses AWS Security Hub to manage and monitor...
  29. 29.Your organization has deployed an e-commerce application on AWS that uses Amazon EC2 instances, an RDS...
  30. 30.Your company uses a centralized AWS account to manage security operations and monitor threats across multiple...
  31. 31.Your organization has deployed a web application on AWS using Amazon EC2 instances behind an Application Load...
  32. 32.Your organization hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB)....
  33. 33.A company is running an application on Amazon EC2 instances behind an Application Load Balancer (ALB) in a...
  34. 34.You are responsible for securing an application hosted on Amazon EC2 instances behind an Application Load...
  35. 35.Your organization is using Amazon S3 to store sensitive customer data and must ensure that this data is...
  36. 36.An organization is running a web application on Amazon EC2 instances behind an Application Load Balancer...
  37. 37.Your organization has recently migrated its workloads to AWS and wants to enhance its security posture by...
  38. 38.Your company has adopted a multi-account strategy on AWS. You want to ensure that all accounts are...
  39. 39.Your company has adopted a multi-account architecture using AWS Organizations. As part of the security...
  40. 40.Your company hosts a large-scale e-commerce platform on AWS that processes sensitive customer data. To...
  41. 41.Your company uses AWS CloudTrail to capture API activity logs across multiple AWS accounts. Additionally,...
  42. 42.An organization uses AWS services such as Amazon S3, AWS Lambda, and Amazon CloudFront. They suspect unusual...
  43. 43.An organization is using AWS CloudTrail to monitor API activity, AWS Config for resource configurations, and...
  44. 44.You are a Security Engineer working for a financial organization that has implemented AWS services to monitor...
  45. 45.Your organization uses Amazon GuardDuty to monitor for security threats and anomalies in AWS accounts. To...
  46. 46.An organization uses Amazon CloudWatch to monitor its AWS environment. They suspect unauthorized access...
  47. 47.An e-commerce company uses Amazon CloudWatch to monitor its application logs and identify potential security...
  48. 48.A security operations team is using Amazon CloudWatch to monitor an application running on AWS. They want to...
  49. 49.Your company uses multiple AWS accounts for different teams, and each account uses AWS Security Hub to...
  50. 50.You are a Security Engineer working for a large organization with multiple AWS accounts. Your team wants to...
  51. 51.Your organization has multiple AWS accounts managed via AWS Organizations. Each account generates security...
  52. 52.An organization uses multiple AWS accounts for different business units and has enabled AWS Security Hub in...
  53. 53.Your organization has detected unusual activity originating from an Amazon EC2 instance. Upon investigation,...
  54. 54.An organization has detected unusual behavior in an EC2 instance, indicating it may have been compromised....
  55. 55.Your organization has detected unusual activity in an Amazon EC2 instance, indicating it might have been...
  56. 56.Your organization has identified suspicious activity on an EC2 instance running in a VPC. It appears that...
  57. 57.Your company has a compliance requirement to ensure that all S3 buckets storing sensitive data are encrypted...
  58. 58.A company has several sensitive workloads running in their VPC. They want to ensure that all outbound...
  59. 59.A company has an application running on Amazon EC2 instances that accesses sensitive data stored in Amazon...
  60. 60.A company is using Amazon S3 buckets to store sensitive customer data. The Security team has discovered that...
  61. 61.Your organization uses AWS and has implemented CloudTrail for logging API activity. During a routine security...
  62. 62.Your organization has detected unauthorized access to an EC2 instance, and sensitive data might have been...
  63. 63.Your organization uses AWS CloudTrail to monitor API activity across its AWS accounts. You receive an alert...
  64. 64.Your company has detected suspicious activity in an Amazon EC2 instance and suspects it may be compromised....
  65. 65.Your organization has multiple teams working on separate cloud projects. To ensure compliance and security,...
  66. 66.An organization is running multiple applications in a single AWS account. To ensure secure resource isolation...
  67. 67.A company requires strict resource isolation for multiple teams working on different projects within a single...
  68. 68.An organization is designing a multi-tenant application where each tenant's data must be strictly isolated...
  69. 69.An organization is experiencing unexpected API calls being made to their AWS environment, which are coming...
  70. 70.Your organization is using Amazon S3 to store sensitive data, and an IAM user has reported that an S3 bucket...
  71. 71.Your organization has experienced unauthorized access to an S3 bucket containing sensitive data. The security...
  72. 72.An organization detects unauthorized access to an S3 bucket storing sensitive data. As a security engineer,...
  73. 73.Your company uses Amazon S3 to store sensitive customer data. As part of a compliance requirement, you need...
  74. 74.Your organization uses an AWS-based e-commerce platform, and you are tasked with capturing and analyzing...
  75. 75.Your company is using Amazon Kinesis Data Streams to process real-time clickstream data from a web...
  76. 76.An organization is using Amazon S3 to store sensitive customer data. They want to capture detailed access...
  77. 77.Your organization has enabled AWS CloudTrail to monitor API activity in your AWS environment. A security...
  78. 78.Your organization uses AWS CloudTrail to monitor API activity and Amazon CloudWatch Logs for centralized log...
  79. 79.Your company is investigating a potential security incident involving unauthorized API calls to your AWS...
  80. 80.An organization has enabled AWS CloudTrail to log API activity across its accounts. As part of a security...
  81. 81.Your organization has recently deployed an application running on Amazon EC2 instances behind an Application...
  82. 82.Your organization has deployed a web application using Amazon EC2 instances behind an Application Load...
  83. 83.An organization has recently been alerted about unauthorized access to one of their S3 buckets. They want to...
  84. 84.Your company uses Amazon S3 for storing sensitive data. To meet compliance requirements, you must enable...
  85. 85.Your organization has recently deployed a set of Amazon EC2 instances running critical applications. To meet...
  86. 86.You are a security engineer tasked with monitoring and responding to potential unauthorized access in your...
  87. 87.An organization has recently migrated its web application to AWS and wants to ensure that any unauthorized...
  88. 88.Your organization has recently deployed an application on AWS, which processes sensitive customer data. As...
  89. 89.An organization is hosting a web application behind an Application Load Balancer (ALB) in AWS. To meet...
  90. 90.A company is running a web application that stores sensitive customer data in an Amazon RDS database. The...
  91. 91.An organization has deployed an application on Amazon EC2 instances within a VPC. The application requires...
  92. 92.You are a Security Engineer tasked with securing an Amazon S3 bucket that stores sensitive customer data. The...
  93. 93.A large e-commerce company uses multiple AWS services to host its application. The security team wants to...
  94. 94.Your organization has deployed an application in AWS, and you are tasked with ensuring that critical security...
  95. 95.Your organization is running a critical application on AWS, and you need to ensure that any unauthorized...
  96. 96.An organization has built a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB....
  97. 97.An organization has set up an AWS Security Hub to monitor their cloud environment for security issues. They...
  98. 98.Your organization uses AWS Security Hub to monitor security findings across multiple AWS accounts. You want...
  99. 99.Your organization uses AWS Security Hub to monitor security findings across multiple accounts. You want to...
  100. 100.Your organization uses AWS Security Hub to monitor security findings across multiple accounts and regions....
  101. 101.Your organization is running workloads on AWS that require continuous monitoring for unusual activities and...
  102. 102.Your company has recently adopted AWS GuardDuty to monitor for malicious or unauthorized activity in your AWS...
  103. 103.Your organization has recently adopted a hybrid cloud environment with resources both on AWS and on-premises....
  104. 104.Your company has deployed a set of EC2 instances running a critical application in a VPC. The Security team...
  105. 105.A company has set up an Amazon GuardDuty detector in its AWS account to monitor for unauthorized and...
  106. 106.A company has configured AWS CloudTrail to log all API activity and is using Amazon GuardDuty for threat...
  107. 107.Your organization has implemented AWS CloudTrail for monitoring API activity in the AWS account. You notice...
  108. 108.Your organization uses AWS Security Hub to monitor and consolidate security findings across multiple AWS...
  109. 109.An organization is using AWS S3 to store sensitive customer data. To comply with compliance requirements,...
  110. 110.An organization is running a web application on Amazon EC2 instances behind an Application Load Balancer...
  111. 111.An organization is using Amazon S3 to store sensitive customer data. The security team has identified a...
  112. 112.Your organization is migrating sensitive workloads to AWS and requires a solution to generate, manage, and...
  113. 113.You are a security engineer managing your organization's AWS accounts. You have enabled AWS Security Hub...
  114. 114.Your organization uses AWS Security Hub to monitor and manage security across all AWS accounts in a...
  115. 115.Your organization uses AWS Security Hub to monitor and manage security findings across multiple AWS accounts....
  116. 116.Your organization uses AWS Security Hub to monitor and improve the security posture of its AWS accounts. You...
  117. 117.Your organization has configured an AWS environment to monitor security events. As a security administrator,...
  118. 118.Your organization has recently enabled AWS CloudTrail to monitor API activity in your AWS environment. During...
  119. 119.Your company has recently configured Amazon GuardDuty for threat detection across your AWS environment....
  120. 120.Your organization is using AWS CloudTrail to monitor API activities in your AWS account. You suspect a...
  121. 121.Your company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). As...
  122. 122.An organization wants to implement a centralized logging solution for their multi-account AWS environment....
  123. 123.Your organization requires centralized logging for all AWS accounts in a multi-account setup managed through...
  124. 124.An organization wants to ensure that all critical AWS services are logging their activities centrally for...
  125. 125.You are working as a security engineer for a company that uses Amazon S3 to store sensitive customer data....
  126. 126.An organization is migrating its on-premises workload to AWS and wants to ensure that all sensitive data is...
  127. 127.A company is using Amazon S3 to store sensitive customer data. The security team wants to ensure that all...
  128. 128.Your company is hosting an application on Amazon EC2 instances behind an Application Load Balancer (ALB). The...
  129. 129.An organization is using AWS to host its applications and wants to ensure that logs are properly collected...
  130. 130.An organization wants to monitor and log all API activity within its AWS account to ensure compliance and...
  131. 131.An organization is investigating unusual activity in their AWS environment. They suspect unauthorized API...
  132. 132.A company wants to monitor and troubleshoot issues related to unauthorized API calls and suspicious activity...
  133. 133.An organization has enabled AWS CloudTrail for auditing purposes and configured it to deliver logs to an S3...
  134. 134.A company is using Amazon CloudWatch Logs to monitor activity in their AWS environment. The security team...
  135. 135.You are tasked with configuring logging for an AWS application that uses multiple services, including Amazon...
  136. 136.Your organization has recently deployed an application on Amazon EC2 instances. The security team wants to...
  137. 137.Your organization has recently enabled AWS CloudTrail to monitor API activity in your AWS account. Compliance...
  138. 138.Your company has configured Amazon CloudWatch Logs to capture application logs and store them in log groups....
  139. 139.An organization is using CloudTrail to monitor API activity in their AWS environment. They want to ensure...
  140. 140.An organization is using AWS CloudTrail to monitor API activity across its accounts. The security team wants...
  141. 141.An organization is using AWS CloudTrail to log API activity in their environment. Recently, they noticed that...
  142. 142.An organization has enabled AWS CloudTrail to log API activity across its AWS accounts. However, the security...
  143. 143.Your organization uses Amazon S3 to store application logs and has S3 server access logging enabled for...
  144. 144.A company has enabled AWS CloudTrail for auditing purposes. However, the security team notices that some API...
  145. 145.Your company runs a web application that stores sensitive customer data in Amazon S3. Compliance requirements...
  146. 146.Your company is hosting a multi-tier web application on AWS. The application uses an Amazon RDS MySQL...
  147. 147.A company has deployed their application on Amazon EC2 instances behind an Application Load Balancer (ALB)....
  148. 148.Your organization has implemented an Amazon S3 bucket to store sensitive customer data. The security team has...
  149. 149.Your organization is conducting a forensic investigation to analyze a potential data breach in an S3 bucket....
  150. 150.Your organization is using an Amazon S3 bucket to store critical application logs. The logs need to be...
  151. 151.An organization uses AWS services for its workloads and wants to monitor and audit its infrastructure for...
  152. 152.Your organization uses AWS CloudTrail, Amazon S3, and Amazon CloudWatch Logs to monitor and secure its AWS...
  153. 153.Your organization has implemented an application hosted on AWS that processes sensitive customer data. To...
  154. 154.Your organization has recently experienced a security incident involving unauthorized changes to IAM...
  155. 155.A financial services company wants to monitor and log all user activities across its AWS environment,...
  156. 156.Your organization recently implemented AWS services for their infrastructure. As a security engineer, you are...
  157. 157.An organization wants to enable AWS CloudTrail to log all API activity in their environment. The security...
  158. 158.An organization wants to enable logging for its Amazon S3 buckets to capture access requests and store the...
  159. 159.An organization is setting up centralized logging for all AWS accounts in its environment. An S3 bucket in...
  160. 160.Your organization has set up AWS CloudTrail to log all API activity in your AWS environment. The logs are...
  161. 161.An organization needs to analyze security logs from multiple AWS accounts in near real-time. The solution...
  162. 162.A company needs to analyze security-related logs from multiple AWS services, such as AWS CloudTrail, Amazon...
  163. 163.Your organization wants to analyze application logs generated by multiple AWS resources in near real-time to...
  164. 164.Your organization needs to analyze security logs from multiple AWS accounts in near real-time to detect...
  165. 165.Your organization is using an S3 bucket to store sensitive financial data. The Chief Information Security...
  166. 166.Your organization is running a sensitive workload on Amazon EC2 instances. To meet compliance requirements,...
  167. 167.Your organization is using an Amazon S3 bucket to store sensitive customer data. You have been tasked with...
  168. 168.A financial institution is using AWS CloudTrail to monitor API activity across its AWS accounts. To meet...
  169. 169.A security team wants to analyze captured VPC Flow Logs to identify unusual network activity and potential...
  170. 170.Your organization has enabled VPC Flow Logs for troubleshooting and analyzing network traffic patterns in a...
  171. 171.Your organization has recently enabled AWS CloudTrail to capture API activity logs across all AWS accounts in...
  172. 172.Your organization is investigating a potential security incident, and you need to analyze VPC Flow Logs to...
  173. 173.Your organization has recently detected unusual activity in an AWS account, such as sudden API call spikes...
  174. 174.Your organization has enabled AWS CloudTrail and is using AWS CloudWatch Logs to monitor API activity....
  175. 175.An organization has enabled AWS CloudTrail to monitor API activity and detect unusual behavior. They want to...
  176. 176.An organization wants to monitor unusual activity patterns in its AWS environment to detect potential...
  177. 177.An organization has enabled AWS CloudTrail logging to monitor API activity across its AWS account. The...
  178. 178.You are a security engineer tasked with analyzing unexpected API activity in your AWS environment. You decide...
  179. 179.An organization is using AWS CloudTrail to monitor API activity in their AWS environment. A security engineer...
  180. 180.An organization is running a web application on Amazon EC2 instances behind an Application Load Balancer...
  181. 181.Your organization has deployed a web application on Amazon EC2 instances in a public subnet. To enhance...
  182. 182.An organization is hosting a multi-tier web application in AWS. The application consists of public-facing web...
  183. 183.An organization is hosting a web application on Amazon EC2 instances within a public subnet in a VPC. The...
  184. 184.An e-commerce company is using an Amazon CloudFront distribution to deliver their website content to...
  185. 185.Your company is hosting a web application on Amazon CloudFront backed by an Application Load Balancer (ALB)....
  186. 186.An organization is hosting a web application on Amazon CloudFront with an Amazon S3 bucket as its origin. The...
  187. 187.You are managing a web application hosted on Amazon CloudFront with an S3 bucket as the origin. The...
  188. 188.Your company is hosting a mission-critical application on Amazon EC2 instances within a single AWS region. To...
  189. 189.A company is running its web application on Amazon EC2 instances behind an Application Load Balancer (ALB)....
  190. 190.An organization is using AWS to host its web application and has implemented AWS WAF (Web Application...
  191. 191.An organization is using Amazon S3 to store sensitive customer data. To comply with regulatory requirements,...
  192. 192.An e-commerce company is using an application hosted behind an Application Load Balancer (ALB) and...
  193. 193.A media streaming company is using Amazon CloudFront to distribute its content globally. To protect its...
  194. 194.Your company hosts a web application that serves global users. The application is behind an Application Load...
  195. 195.Your company hosts a web application behind an Application Load Balancer (ALB) deployed with Amazon...
  196. 196.Your company is hosting a web application on AWS using Amazon EC2 instances behind an Application Load...
  197. 197.You are managing a high-traffic e-commerce application hosted on AWS. Recently, your application experienced...
  198. 198.You are managing a web application hosted on Amazon EC2 instances behind an Application Load Balancer (ALB)...
  199. 199.Your organization has deployed a web application on AWS using an Application Load Balancer (ALB) and Amazon...
  200. 200.You are designing a secure multi-tier web application architecture on AWS. The application consists of a...
  201. 201.You are designing a secure and scalable web application on AWS using a layered architecture. The application...
  202. 202.Your organization is designing a highly secure web application architecture on AWS. The architecture consists...
  203. 203.Your company operates a web application that follows a layered architecture with a public-facing Amazon...
  204. 204.Your organization has deployed a three-tier architecture on AWS, consisting of a public-facing web tier in an...
  205. 205.Your company has deployed a web application running in an Amazon VPC. The application is fronted by an...
  206. 206.Your organization has deployed a web application on AWS using an Auto Scaling group of EC2 instances behind...
  207. 207.Your company has deployed a multi-tier web application on AWS using an Elastic Load Balancer (ELB), a fleet...
  208. 208.Your company has recently adopted AWS Organizations to centralize the management of multiple AWS accounts. As...
  209. 209.Your company stores sensitive customer data in an Amazon S3 bucket. To comply with security policies, you...
  210. 210.Your organization is building a secure architecture for a new web application hosted on Amazon EC2 instances...
  211. 211.Your organization uses an Amazon S3 bucket to store sensitive customer data. The security team has recently...
  212. 212.Your organization has deployed a web application in a public subnet of a VPC. The application is accessible...
  213. 213.Your company has deployed a web application hosted on Amazon EC2 instances in a VPC. These instances are...
  214. 214.An organization has deployed an application in a VPC with private and public subnets. The application servers...
  215. 215.Your company is hosting a three-tier web application in AWS. The application consists of web servers,...
  216. 216.A company has multiple VPCs in a single AWS Region for development, staging, and production environments. The...
  217. 217.Your company has multiple VPCs in the same AWS Region, and you need to enable secure inter-VPC connectivity...
  218. 218.Your organization has two VPCs in the same AWS region, VPC-A and VPC-B. VPC-A hosts a critical database with...
  219. 219.Your organization has deployed multiple VPCs across different AWS Regions to separate environments such as...
  220. 220.An organization is investigating a potential data exfiltration incident in their AWS environment. They want...
  221. 221.You are a security engineer reviewing your organization's network monitoring strategy within AWS. The goal is...
  222. 222.Your organization is experiencing unusual traffic patterns in a specific Amazon VPC, and you suspect a...
  223. 223.Your company has implemented an EC2-based application in a VPC that processes sensitive customer data. To...
  224. 224.A company has deployed a VPN connection between their on-premises data center and their VPC in AWS using a...
  225. 225.Your company has deployed a VPC in AWS and established a Site-to-Site VPN connection between the VPC and your...
  226. 226.Your organization has set up a Site-to-Site VPN between your on-premises data center and an Amazon VPC. After...
  227. 227.Your company has deployed a corporate application in an Amazon VPC, and you need to securely connect the...
  228. 228.Your organization needs to establish a secure and reliable connection between its on-premises data center and...
  229. 229.Your organization wants to establish a secure and reliable connection between its on-premises data center and...
  230. 230.Your company has an on-premises data center that requires a secure and consistent connection to AWS. The...
  231. 231.Your organization is planning to establish a secure and reliable connection between its on-premises data...
  232. 232.Your company is deploying an application on Amazon EC2 instances within an Auto Scaling group behind an...
  233. 233.Your organization runs a highly sensitive machine learning workload on Amazon EC2 instances. As part of a...
  234. 234.Your organization is running a web application on Amazon EC2 instances behind an Application Load Balancer...
  235. 235.Your organization has deployed a web application on Amazon EC2 instances behind an Application Load Balancer...
  236. 236.An organization wants to improve its security posture by implementing enhanced logging and monitoring for its...
  237. 237.A company is using Amazon S3 to store sensitive financial data. To meet compliance requirements, the company...
  238. 238.An organization is using AWS Organizations to manage multiple AWS accounts. The Security team needs to ensure...
  239. 239.A company uses an Amazon S3 bucket to store sensitive financial data. The Security team has mandated that...
  240. 240.You are a security engineer tasked with ensuring that all Amazon EC2 instances in your environment are kept...
  241. 241.A company needs to ensure their Amazon EC2 instances running a critical application are always patched with...
  242. 242.Your organization is using Amazon EC2 instances to host a critical application. To ensure security and...
  243. 243.An organization uses EC2 instances to host critical applications. As part of their security and compliance...
  244. 244.Your organization has an Amazon EC2 instance running an application that needs access to objects stored in an...
  245. 245.An organization has deployed an EC2 instance that needs to access an S3 bucket to store logs. The security...
  246. 246.You are building a web application hosted on an Amazon EC2 instance that needs to upload files to an S3...
  247. 247.An application running on an Amazon EC2 instance requires access to an Amazon S3 bucket to retrieve...
  248. 248.An organization is using Amazon Elastic Container Service (ECS) to manage its containerized workloads. They...
  249. 249.Your organization uses Amazon Elastic Container Registry (Amazon ECR) to store container images and Amazon...
  250. 250.Your organization leverages Amazon EC2 instances and Amazon Elastic Container Registry (Amazon ECR) to run...
  251. 251.Your organization is running a containerized application using Amazon Elastic Kubernetes Service (Amazon...
  252. 252.An organization has deployed a critical application on Amazon EC2 instances running Amazon Linux. The...
  253. 253.Your organization has deployed an Amazon EC2 instance running a critical application. To comply with security...
  254. 254.Your organization is deploying an Amazon EC2 instance to host a critical web application. As part of the...
  255. 255.An organization is running a web application on Amazon EC2 instances in a public subnet. To enhance...
  256. 256.An organization has deployed an application in a VPC. Users are reporting that they are unable to connect to...
  257. 257.Your organization is hosting a web application on Amazon EC2 instances behind an Application Load Balancer...
  258. 258.Your company is experiencing connectivity issues with a web application hosted in a private subnet of a VPC....
  259. 259.An application running in a private subnet of your VPC is unable to connect to an external third-party API...
  260. 260.Your company has a multi-account AWS environment, and you are tasked with ensuring that all accounts adhere...
  261. 261.An organization wants to secure its Amazon S3 bucket that stores sensitive financial records. They require...
  262. 262.Your organization runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB)....
  263. 263.An organization is hosting a web application in AWS that processes sensitive customer data. The application...
  264. 264.Your organization is investigating connectivity issues between an Amazon EC2 instance in a private subnet and...
  265. 265.Your organization has set up a multi-tier application in AWS, consisting of a public-facing web tier in a...
  266. 266.Your organization has been experiencing network connectivity issues between an EC2 instance in a private...
  267. 267.Your company has deployed a three-tier web application in AWS. You are tasked with verifying the network...
  268. 268.An organization is running a web application on Amazon EC2 instances behind an Application Load Balancer...
  269. 269.Your organization has deployed an application on Amazon EC2 instances in a private subnet behind an...
  270. 270.You are designing a secure application that processes sensitive data over a network. The application needs to...
  271. 271.Your company has an application hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The...
  272. 272.Your organization has detected unusual activity originating from a specific IP range in your VPC. To...
  273. 273.Your organization has noticed an unusual number of failed DNS resolution attempts to external domains, which...
  274. 274.You are a security engineer investigating a potential data exfiltration attempt in your AWS environment. To...
  275. 275.Your company has been experiencing unauthorized access attempts to specific resources in your AWS...
  276. 276.An organization wants to allow developers to access an Amazon S3 bucket only from their corporate network and...
  277. 277.Your organization uses AWS Organizations with a centralized management account and several member accounts. A...
  278. 278.An organization needs to grant developers temporary access to an Amazon S3 bucket for testing purposes. The...
  279. 279.A company is designing a multi-account AWS environment and wants to ensure that administrators in the central...
  280. 280.A company is using an Amazon S3 bucket to store sensitive data. They want to ensure that only users...
  281. 281.Your company has implemented a multi-account strategy in AWS and uses AWS Organizations to manage all...
  282. 282.An organization wants to provide its developers the ability to assume an IAM Role to access an S3 bucket in...
  283. 283.Your company uses an Amazon RDS MySQL database instance to store sensitive customer data. To improve...
  284. 284.Your organization uses AWS Key Management Service (KMS) to manage encryption keys for sensitive data stored...
  285. 285.An organization is using Amazon S3 to store sensitive data. The security team needs to ensure that the S3...
  286. 286.A company is using Amazon RDS for its database workloads. The security team requires that all database...
  287. 287.Your company uses an Amazon S3 bucket to store sensitive financial data. To comply with regulatory...
  288. 288.An organization wants to centralize access management for its employees across multiple AWS accounts and...
  289. 289.Your organization has implemented AWS IAM Identity Center (AWS Single Sign-On) to centrally manage access to...
  290. 290.A company wants to enable single sign-on (SSO) for their employees to access multiple AWS accounts and...
  291. 291.An organization wants to provide its employees with seamless access to both AWS Management Console and other...
  292. 292.An organization is running a serverless application on AWS using Amazon API Gateway, AWS Lambda, and Amazon...
  293. 293.An organization leverages Amazon EC2 instances to run critical workloads. To access an S3 bucket, the...
  294. 294.A company wants to create a secure mechanism for developers to access AWS resources temporarily without...
  295. 295.An organization is using an application running on Amazon EC2 instances that require access to an Amazon S3...
  296. 296.An application running in your AWS account is failing to authenticate to an S3 bucket. The application...
  297. 297.An application running on an EC2 instance is failing to access an S3 bucket. The instance has an IAM role...
  298. 298.An application running in your AWS environment is failing to access an S3 bucket. The application is using an...
  299. 299.A developer is trying to access an S3 bucket but is receiving an 'Access Denied' error. As a security...
  300. 300.A company has an S3 bucket named 'secure-data-bucket' that stores sensitive data. The Security team has...
  301. 301.A company is using AWS Organizations with Service Control Policies (SCPs) applied to Organizational Units...
  302. 302.An organization has an internal application running on an Amazon EC2 instance within a private subnet. The...
  303. 303.Your organization uses an S3 bucket to store sensitive financial reports. To enhance security, you are tasked...
  304. 304.A company stores sensitive customer data in an Amazon S3 bucket. To comply with regulatory requirements, the...
  305. 305.You are a Security Engineer at a company that uses an S3 bucket to store sensitive customer data. You have...
  306. 306.A company is running critical workloads on Amazon EC2 instances within a VPC. The company requires that all...
  307. 307.Your company runs an application hosted on Amazon EC2 instances behind an Application Load Balancer (ALB)....
  308. 308.Your company has recently implemented an S3 bucket to store financial reports. These reports must only be...
  309. 309.Your organization uses AWS and has implemented an S3 bucket to store sensitive data. The security team wants...
  310. 310.Your organization is designing an access control strategy for an S3 bucket that stores sensitive financial...
  311. 311.An organization has several S3 buckets containing sensitive data. The security team wants to ensure that only...
  312. 312.An organization has created an IAM policy to grant specific permissions to a group of developers. The policy...
  313. 313.An organization is using an S3 bucket to store sensitive financial documents. The following bucket policy has...
  314. 314.An organization is using an S3 bucket to store sensitive customer data. They need to implement a bucket...
  315. 315.An organization wants to grant an IAM user the ability to start and stop EC2 instances, but only in a...
  316. 316.An application hosted on an EC2 instance is receiving 'Access Denied' errors when attempting to access an S3...
  317. 317.An application running on an EC2 instance is unable to access an S3 bucket, despite an IAM role being...
  318. 318.A company has an application running on an Amazon EC2 instance that needs access to an Amazon S3 bucket. The...
  319. 319.A developer is unable to access an Amazon S3 bucket despite having a policy attached to their IAM role that...
  320. 320.An organization needs to ensure that sensitive customer data stored in Amazon S3 is protected from...
  321. 321.Your organization stores sensitive customer data in an Amazon S3 bucket. To comply with internal security...
  322. 322.Your organization stores sensitive financial data in an Amazon S3 bucket. To comply with regulatory...
  323. 323.An organization uses Amazon S3 to store sensitive customer data. The security team wants to ensure that all...
  324. 324.Your organization needs to securely transmit sensitive customer data between its e-commerce application...
  325. 325.An organization is building a financial application that manages sensitive customer data. To comply with...
  326. 326.Your company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). To...
  327. 327.Your company runs a web application on Amazon EC2 instances behind an ALB (Application Load Balancer) and...
  328. 328.You are configuring an Amazon S3 bucket to store sensitive customer data. To comply with your organization's...
  329. 329.Your company has an application hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The...
  330. 330.An organization has deployed a web application on Amazon EC2 instances behind an Application Load Balancer...
  331. 331.A company stores sensitive customer data in an S3 bucket and needs to enforce strict security controls to...
  332. 332.A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The...
  333. 333.An organization is hosting a web application on Amazon EC2 instances behind an Application Load Balancer...
  334. 334.Your company has an application running on Amazon EC2 instances behind an Application Load Balancer (ALB)....
  335. 335.An application hosted on an Amazon EC2 instance needs to communicate securely with an Amazon RDS database. As...
  336. 336.Your company is setting up a Site-to-Site VPN connection between its on-premises data center and an Amazon...
  337. 337.Your organization has recently established a hybrid cloud environment using AWS. To securely connect your...
  338. 338.Your company has established a VPN connection between its on-premises data center and an Amazon VPC using an...
  339. 339.Your company has deployed a site-to-site VPN connection between your on-premises data center and your AWS VPC...
  340. 340.A company wants to provide secure remote access to its Amazon EC2 instances for system administrators. The...
  341. 341.A company requires secure remote access to its Amazon EC2 instances without opening SSH or RDP ports to the...
  342. 342.An organization wants to provide secure remote access for their administrators to manage Amazon EC2...
  343. 343.Your company has prohibited the use of public-facing bastion hosts for connecting to EC2 instances. Instead,...
  344. 344.Your organization has deployed Amazon EC2 instances in a private subnet without public IP addresses. You need...
  345. 345.Your organization uses AWS Systems Manager Session Manager for secure shell access to Amazon EC2 instances. A...
  346. 346.Your company uses AWS Systems Manager Session Manager to connect securely to Amazon EC2 instances without...
  347. 347.Your organization has implemented AWS Systems Manager Session Manager to securely manage EC2 instances...
  348. 348.You are setting up a secure website using Amazon CloudFront as a content delivery network and an Application...
  349. 349.An organization is hosting a web application behind an Application Load Balancer (ALB) in AWS. They want to...
  350. 350.You are deploying a web application that uses HTTPS for secure communication. The application is fronted by...
  351. 351.Your organization is hosting a web application behind an Application Load Balancer (ALB) in AWS. To enhance...
  352. 352.You are designing a data storage solution for a healthcare application that must comply with HIPAA...
  353. 353.Your company is storing sensitive customer data in Amazon S3. You are tasked with ensuring the...
  354. 354.Your company stores sensitive customer data in an Amazon S3 bucket. To ensure compliance with regulatory...
  355. 355.You are designing a storage solution for sensitive financial data in Amazon S3. The data must be encrypted at...
  356. 356.An organization is using Amazon S3 to store sensitive financial data. The security team is tasked with...
  357. 357.Your organization is using Amazon S3 to store sensitive data. To ensure compliance and prevent unauthorized...
  358. 358.An organization is using AWS Key Management Service (AWS KMS) to encrypt sensitive data stored in Amazon S3....
  359. 359.Your organization leverages AWS Organizations with multiple accounts and has enabled AWS CloudTrail in the...
  360. 360.Your organization stores sensitive financial data in an Amazon S3 bucket. Compliance requirements mandate...
  361. 361.You are designing a secure file storage application on AWS where customers upload sensitive documents. The...
  362. 362.A financial services company processes sensitive customer data on Amazon S3. They want to ensure that all...
  363. 363.A company is storing sensitive customer data in Amazon S3 and needs to ensure the data is encrypted both in...
  364. 364.An organization needs to ensure the integrity of sensitive files stored in an Amazon S3 bucket. The security...
  365. 365.Your company is storing critical documents in an Amazon S3 bucket, and you need to implement a mechanism to...
  366. 366.An e-commerce company stores sensitive customer order data on Amazon S3. The security team is instructed to...
  367. 367.An organization is using Amazon S3 to store important log files that must remain unchanged to meet compliance...
  368. 368.An organization is using an Amazon S3 bucket to store sensitive financial reports. They want to ensure that...
  369. 369.You are tasked with securing an Amazon S3 bucket that stores sensitive financial reports. The bucket must...
  370. 370.Your organization uses Amazon S3 to store sensitive financial data. You are tasked with ensuring that only...
  371. 371.An organization uses an Amazon S3 bucket to store sensitive financial reports. The bucket must allow access...
  372. 372.An organization uses an IAM role to allow its EC2 instances to access an S3 bucket. Recently, some EC2...
  373. 373.An application running on Amazon EC2 instances needs to access objects stored in an S3 bucket. The EC2...
  374. 374.An organization is using an EC2 instance to run a critical application. They want the instance to securely...
  375. 375.Your organization uses an AWS Lambda function that requires access to an S3 bucket to retrieve input files...
  376. 376.Your company manages sensitive customer data stored in Amazon S3. As part of the organization's security...
  377. 377.A company stores sensitive customer data in Amazon S3. Compliance requirements mandate that the data must be...
  378. 378.Your organization needs to store sensitive customer data in Amazon S3. The compliance requirements dictate...
  379. 379.An organization is managing sensitive financial data stored in Amazon S3. They want to enforce strict...
  380. 380.An organization has deployed an application on Amazon EC2 instances in a VPC. The security team has noticed...
  381. 381.An organization uses Amazon S3 to store sensitive financial data. To comply with security and compliance...
  382. 382.Your company has deployed an application in AWS that stores sensitive customer data in an Amazon S3 bucket....
  383. 383.An organization is using AWS CloudTrail to monitor API activity in their AWS account. To enhance the security...
  384. 384.Your organization uses Amazon S3 to store log files. To optimize costs, you want to automatically transition...
  385. 385.Your company stores critical logs in an Amazon S3 bucket. These logs must be retained for seven years to meet...
  386. 386.Your company is using Amazon S3 to store confidential business data. To optimize costs and comply with data...
  387. 387.An organization wants to optimize costs by automatically transitioning and expiring objects stored in Amazon...
  388. 388.Your organization operates in a highly regulated industry and must comply with strict data retention policies...
  389. 389.Your organization operates in the healthcare industry and must comply with HIPAA regulations regarding data...
  390. 390.Your organization operates in a regulated industry and must comply with data retention standards that mandate...
  391. 391.Your organization is required to comply with government-mandated data retention standards that dictate...
  392. 392.Your company is building a serverless application on AWS that requires storing and accessing sensitive...
  393. 393.A company is building a serverless application on AWS that processes sensitive customer data. The application...
  394. 394.A company is using AWS Secrets Manager to securely store and manage their application credentials. The...
  395. 395.Your organization uses AWS Lambda to process sensitive customer data. The Lambda functions require access to...
  396. 396.An organization has deployed its web application on Amazon EC2 instances behind an Application Load Balancer...
  397. 397.An organization has recently migrated its web application to an Amazon EC2 instance. To enhance security,...
  398. 398.An organization is planning to deploy a web application on Amazon EC2 instances behind an Elastic Load...
  399. 399.An organization is using AWS to host its applications and wants to ensure that its S3 buckets are protected...
  400. 400.Your company uses AWS Secrets Manager to store database credentials. A security audit has revealed that many...
  401. 401.Your organization uses AWS Secrets Manager to securely store database credentials for multiple environments...
  402. 402.Your organization uses AWS Secrets Manager to store and rotate database credentials. A developer has...
  403. 403.Your company is using an Amazon RDS database to store sensitive customer information. To enhance security,...
  404. 404.An organization is using AWS Systems Manager Parameter Store to manage sensitive application configuration...
  405. 405.An organization stores sensitive database credentials in AWS Systems Manager Parameter Store as SecureString...
  406. 406.Your organization is using AWS Systems Manager Parameter Store to store sensitive database credentials as...
  407. 407.A company uses AWS Systems Manager Parameter Store to store sensitive database credentials as SecureString...
  408. 408.Your organization uses AWS Key Management Service (KMS) to manage encryption keys for securing sensitive...
  409. 409.An organization is using AWS KMS to encrypt sensitive data stored in their S3 buckets. They have created a...
  410. 410.Your organization is using AWS Key Management Service (KMS) to manage encryption keys for sensitive data. You...
  411. 411.Your organization uses AWS Key Management Service (KMS) to secure sensitive data. You need to encrypt a large...
  412. 412.Your company is undergoing a security audit to ensure compliance with industry standards. As part of the...
  413. 413.An organization wants to ensure compliance with security policies and regulatory standards across all AWS...
  414. 414.Your organization is undergoing a security compliance audit and needs to ensure that all IAM users have...
  415. 415.An organization is using AWS Organizations to manage multiple AWS accounts. The security team wants to...
  416. 416.An organization wants to centrally manage multiple AWS accounts to enforce consistent security policies,...
  417. 417.Your organization is rapidly expanding its cloud infrastructure and frequently creating new AWS accounts for...
  418. 418.Your organization is rapidly expanding and plans to onboard multiple AWS accounts for different business...
  419. 419.Your organization is undergoing rapid growth, and the security team has been tasked with centrally managing...
  420. 420.A company is using Amazon S3 to store sensitive financial documents. The security team requires that all...
  421. 421.A company is running a web application on EC2 instances behind an Application Load Balancer (ALB). The...
  422. 422.Your organization uses Amazon S3 to store sensitive customer data. To comply with regulatory requirements,...
  423. 423.Your organization has implemented Amazon S3 to store sensitive financial reports. As part of compliance...
  424. 424.Your company has adopted a multi-account AWS strategy to isolate workloads for better security and...
  425. 425.An organization is adopting a multi-account strategy in AWS to improve security and operational efficiency....
  426. 426.You are a Security Engineer at a company that has adopted a multi-account strategy using AWS Organizations....
  427. 427.Your organization has adopted a multi-account strategy using AWS Organizations. The security team wants to...
  428. 428.Your company uses AWS Organizations to manage multiple AWS accounts. The Security Team needs to delegate...
  429. 429.Your organization uses AWS Organizations to manage multiple AWS accounts. The Security team wants to delegate...
  430. 430.Your organization uses AWS Organizations to manage multiple accounts. The security team wants to delegate...
  431. 431.Your organization uses AWS Organizations to manage multiple AWS accounts. The Security team wants to delegate...
  432. 432.Your organization has adopted AWS Organizations to manage multiple AWS accounts. You are tasked with ensuring...
  433. 433.An organization has implemented AWS Control Tower to manage multiple accounts within their AWS Organization....
  434. 434.An organization uses AWS Organizations and has implemented Service Control Policies (SCPs) to establish...
  435. 435.Your organization is using AWS Organizations to manage multiple accounts. The security team has implemented...
  436. 436.Your company has just created a new AWS account for a critical production workload. As part of the initial...
  437. 437.Your company recently set up an AWS account, and as part of the security review, you need to ensure that the...
  438. 438.Your organization has recently set up an AWS account for a new project. As the Security Lead, you are tasked...
  439. 439.Your organization has recently set up a new AWS account. As a security best practice, what steps should you...
  440. 440.A company has two AWS accounts: 'Account A' and 'Account B'. Account A hosts an S3 bucket that contains...
  441. 441.An organization named OrgA wants to allow an external partner, OrgB, to access an S3 bucket in its AWS...
  442. 442.An organization, Organization A, wants to provide temporary access to its Amazon S3 bucket to an external...
  443. 443.An organization named 'Account A' needs to allow a development team in another AWS account, 'Account B', to...
  444. 444.An organization wants to automate the deployment of their cloud resources across multiple AWS accounts and...
  445. 445.Your organization uses AWS CloudFormation templates to provision infrastructure resources across multiple...
  446. 446.An organization wants to implement a secure and consistent deployment strategy for their cloud resources....
  447. 447.Your company has adopted Infrastructure as Code (IaC) using AWS CloudFormation to ensure a secure and...
  448. 448.A company is hosting a mission-critical application on Amazon EC2 instances within a VPC. The application...
  449. 449.Your company utilizes an Amazon S3 bucket to store sensitive customer data. To ensure compliance with...
  450. 450.You are a Security Engineer at a company that uses AWS Organizations to manage multiple accounts. The company...
  451. 451.Your company has deployed an application that stores sensitive customer data in an Amazon S3 bucket. To...
  452. 452.You are tasked with deploying an AWS CloudFormation template that provisions critical resources, including an...
  453. 453.Your organization uses AWS CloudFormation to deploy infrastructure as code (IaC). As part of a security...
  454. 454.Your organization is using AWS CloudFormation to manage infrastructure as code (IaC). As part of improving...
  455. 455.You are responsible for managing the security of your AWS environment, and your team uses AWS CloudFormation...
  456. 456.An organization is implementing a tagging strategy to enhance security and governance across their AWS...
  457. 457.An organization is managing a large number of AWS resources across multiple accounts and regions. They want...
  458. 458.Your company has been facing challenges in managing resources across AWS accounts due to inconsistent tagging...
  459. 459.Your company has recently adopted a tagging strategy to better manage and secure resources in AWS. As the...
  460. 460.Your organization uses multiple AWS accounts for different teams and projects. To ensure consistent...
  461. 461.Your company is managing multiple AWS accounts as part of an AWS Organizations setup. You need to enforce...
  462. 462.Your organization manages multiple AWS accounts under a single AWS Organization. You are tasked with ensuring...
  463. 463.Your organization has multiple AWS accounts managed under an AWS Organizations setup. You need a solution to...
  464. 464.Your organization requires increased visibility and control over its AWS infrastructure to ensure compliance...
  465. 465.An organization has multiple AWS accounts and uses AWS Organizations to manage them. The security team wants...
  466. 466.Your company uses multiple AWS accounts within an AWS Organization. The Security team wants to monitor and...
  467. 467.Your organization requires real-time visibility into API calls made to the AWS environment for compliance and...
  468. 468.Your organization is required to maintain compliance with a regulatory standard that mandates encryption for...
  469. 469.Your company is using AWS Config to evaluate compliance of resources against a set of organizational...
  470. 470.An organization uses AWS Config to monitor compliance of its resources with internal security policies. The...
  471. 471.Your company has implemented an AWS Config rule to ensure that all S3 buckets are encrypted with server-side...
  472. 472.An organization needs to secure sensitive customer data stored in an Amazon S3 bucket. The security team...
  473. 473.A company has deployed a web application on Amazon EC2 instances behind an Application Load Balancer (ALB)....
  474. 474.An organization is deploying a new web application on Amazon EC2 instances behind an Application Load...
  475. 475.Your company has a critical application hosted on Amazon EC2 instances in a VPC. The application requires...
  476. 476.Your company stores sensitive financial data in Amazon S3. To meet compliance requirements, you need to...
  477. 477.Your organization stores sensitive data in Amazon S3 buckets and needs to ensure that data classification is...
  478. 478.Your organization wants to classify sensitive data stored in Amazon S3 buckets and ensure compliance with...
  479. 479.Your organization stores sensitive customer data in S3 buckets across multiple AWS accounts. To ensure...
  480. 480.Your organization has a security compliance requirement to ensure that all Amazon S3 buckets are configured...
  481. 481.Your organization has implemented AWS Config to monitor and evaluate the configurations of AWS resources. You...
  482. 482.Your company is using multiple AWS services and resources in production. As part of a compliance requirement,...
  483. 483.Your company recently implemented AWS Config to track the configuration changes of your AWS resources. As the...
  484. 484.An organization performs a security review of its AWS architecture and notices that sensitive data stored in...
  485. 485.An organization has several AWS accounts consolidated under AWS Organizations. During a recent security...
  486. 486.Your organization is conducting an architectural review to identify potential security gaps and optimize...
  487. 487.An organization is conducting an architectural review of its AWS environment to identify security gaps and...
  488. 488.Your organization uses Amazon S3 to store sensitive customer information. Compliance regulations dictate that...
  489. 489.An organization uses an S3 bucket to store sensitive financial documents. The security team requires that the...
  490. 490.Your organization wants to enforce strict security controls on how developers can access production S3...
  491. 491.Your organization uses an S3 bucket to store sensitive financial data. The bucket is configured with...
  492. 492.Your organization uses AWS and has recently noticed unexpected increases in monthly costs. You have been...
  493. 493.A financial services company notices a sudden spike in its AWS usage costs for a specific service in a...
  494. 494.An organization has observed an unexpected spike in their AWS costs. As a security specialist, you are tasked...
  495. 495.Your organization has noticed an unexpected spike in AWS costs for the current month. As a Security Engineer,...
  496. 496.Your company has deployed a web application on Amazon EC2 instances behind an Application Load Balancer...
  497. 497.Your organization runs a web application on AWS using an Amazon EC2 instance behind an Application Load...
  498. 498.Your organization has deployed a web application on AWS using Amazon EC2 instances behind an Application Load...
  499. 499.Your company is deploying a new web application on AWS. To minimize the attack surface of the application,...
  500. 500.An organization is designing a highly secure architecture for an application that processes sensitive...
  501. 501.You are a security engineer reviewing an existing application deployed on AWS to ensure it aligns with the...
  502. 502.Your organization is reviewing its security practices using the AWS Well-Architected Framework. As part of...
  503. 503.Your organization is designing an application architecture using the AWS Well-Architected Framework. As part...
  504. 504.

SCS-C02 exam dumps FAQ

Are these SCS-C02 dumps real exam questions?

No. These are original practice questions written to the AWS Certified Security - Specialty exam objectives, not questions copied from a live exam. Memorising leaked questions violates Amazon Web Services's candidate agreement and stops working the moment the question pool rotates. Use this bank to check your understanding of each domain and to find the topics you still need to study.

How many SCS-C02 practice questions are there?

504 questions, each with the correct answer, an explanation of the answer, and a note on why every other option is wrong. The first 10 are on this page and every question has its own page linked below.

Are the SCS-C02 exam dumps free?

Yes. Every question, answer and explanation on this page and the linked question pages is free to read without an account. A free HydraNode account adds timed practice exams, scoring and progress tracking across attempts.

How do I take a timed SCS-C02 practice test?

Sign in and start the AWS Certified Security - Specialty exam on HydraNode. A session gives you 65 questions drawn from this bank in 170 minutes, then a score report with a per-question review.

What topics does the SCS-C02 exam cover?

The official exam domains are: Threat Detection and Incident Response; Security Logging and Monitoring; Infrastructure Security; Identity and Access Management; Data Protection; Management and Security Governance.

More AWS exam dumps

All AWS exams
AIF-C01231 questions

AWS Certified AI Practitioner exam dumps

AWS Certified AI Practitioner

ANS-C01513 questions

AWS Advanced Networking Specialty exam dumps

AWS Certified Advanced Networking - Specialty

CLF-C02342 questions

AWS Certified Cloud Practitioner exam dumps

AWS Certified Cloud Practitioner

DEA-C01550 questions

AWS Data Engineer Associate exam dumps

AWS Certified Data Engineer - Associate

DOP-C02411 questions

AWS DevOps Engineer Professional exam dumps

AWS Certified DevOps Engineer - Professional

DVA-C02399 questions

AWS Developer Associate exam dumps

AWS Certified Developer - Associate

MLS-C01389 questions

AWS Machine Learning Specialty exam dumps

AWS Certified Machine Learning - Specialty

MLA-C01458 questions

AWS Machine Learning Engineer Associate exam dumps

AWS Certified Machine Learning Engineer - Associate