Amazon Web ServicesExpert levelSCS-C02

SCS-C02 exam dumps: 503 free AWS Security Specialty practice questions

Free SCS-C02 practice questions for the AWS Certified Security - Specialty exam, with the correct answer and a full explanation for every option. Read the first 10 below, browse all 503 by number, or take a timed practice exam.

Question bank last updated December 2024

Start timed practice exam Browse all 503 questions

Free SCS-C02 practice questions

Questions 1 to 10 of 503

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

SCS-C02 Question 1

Select 3

Your company uses Amazon GuardDuty to monitor threats across AWS accounts and resources. Recently, GuardDuty detected an unusual volume of API requests coming from a specific IAM role associated with an EC2 instance. What steps should you take to investigate and mitigate the potential threat?

A
Review the CloudTrail logs for the IAM role to identify the source of the API requests.
B
Immediately delete the IAM role to stop unauthorized API calls.
C
Isolate the EC2 instance by moving it to a security group with no outbound access.
D
Analyze the GuardDuty findings for details on the suspicious activity, including IP addresses and affected resources.
E
Revoke all permissions from the IAM role to prevent further API activity.

Show answer and explanation

Correct answers: A, C, D

Explanation

When GuardDuty detects unusual activity, a systematic response is required. Reviewing CloudTrail logs provides insights into the source and scope of the threat. Isolating the EC2 instance prevents further propagation, and analyzing GuardDuty findings gives additional context about the suspicious behavior. Deleting the IAM role or revoking all permissions immediately can lead to disruption and should be avoided unless absolutely necessary.

A. Correct.
Reviewing CloudTrail logs is essential for understanding the source and scope of the suspicious API activity. It helps identify whether the activity is the result of a compromised resource or misconfiguration.
B. Incorrect.
Deleting the IAM role immediately is not recommended, as it could disrupt legitimate processes and make it more difficult to investigate the incident thoroughly.
C. Correct.
Isolating the EC2 instance by restricting its network access is a key step to contain the potential threat while you investigate further.
D. Correct.
Analyzing the GuardDuty findings provides context about the suspicious activity, such as the IP address, affected resources, and possible intent behind the activity.
E. Incorrect.
Revoking all permissions from the IAM role is overly disruptive and may impact production processes. A more strategic containment plan, such as isolating the instance and investigating logs, is preferred.

SCS-C02 Question 2

Select 2

Your organization uses AWS CloudTrail for logging API activity in your AWS environment. A security analyst reports suspicious activity related to IAM roles and requests your assistance in investigating the issue. To detect unauthorized access attempts to IAM roles and identify potential security threats, which combination of actions should you take?

A
Use Amazon CloudWatch Logs Insights to query CloudTrail logs for AssumeRole API events.
B
Set up a CloudWatch alarm to monitor for changes to IAM policies and roles.
C
Enable Amazon GuardDuty to detect unusual activity related to IAM roles.
D
Use AWS Config to review the historical configuration changes for IAM roles.
E
Enable AWS Security Hub to automatically block suspicious IAM role activity.

Show answer and explanation

Correct answers: A, C

Explanation

To effectively detect unauthorized access attempts to IAM roles and identify potential security threats, you should focus on analyzing relevant API activity and leveraging threat detection services. Querying AssumeRole events in CloudTrail logs helps identify unauthorized access attempts, while Amazon GuardDuty provides detection for unusual or anomalous activity related to IAM roles. Other options, such as AWS Config and Security Hub, provide valuable insights for compliance and aggregation but are not specifically targeted at detecting unauthorized role access in this scenario.

A. Correct.
Correct. Querying CloudTrail logs using CloudWatch Logs Insights allows you to analyze AssumeRole API events and identify unauthorized or unusual access attempts.
B. Incorrect.
Incorrect. Monitoring changes to IAM policies and roles is useful for compliance and configuration management but does not directly detect unauthorized access attempts to IAM roles.
C. Correct.
Correct. Amazon GuardDuty provides threat detection capabilities and can identify unusual activity related to IAM roles, such as anomalous API calls.
D. Incorrect.
Incorrect. AWS Config helps track configuration changes but does not provide direct detection of unauthorized access attempts or unusual activity.
E. Incorrect.
Incorrect. AWS Security Hub aggregates findings but does not automatically block suspicious activity. Blocking requires additional configuration or tools.

SCS-C02 Question 3

Select 3

Your organization has implemented Amazon GuardDuty to monitor and detect potential security threats in your AWS environment. You receive an alert indicating that an EC2 instance is communicating with a known Command and Control (C2) server. What actions should you take to respond to this threat while minimizing the impact on other operations?

A
Isolate the EC2 instance by modifying its security group to deny all outbound traffic.
B
Stop the EC2 instance immediately to prevent further malicious activity.
C
Investigate the GuardDuty finding to gather additional details, such as the instance ID and the malicious IP address.
D
Take a memory snapshot of the EC2 instance to preserve forensic evidence before taking further action.
E
Reinstate the EC2 instance after deleting the finding from GuardDuty to resolve the alert.

Show answer and explanation

Correct answers: A, C, D

Explanation

When dealing with a potential compromise, the focus should be on containment, investigation, evidence preservation, and remediation. Isolating the instance ensures it cannot continue communicating with malicious actors, while gathering information and taking a memory snapshot allow for a thorough investigation. Immediate actions like stopping the instance or reinstating it without analysis may lead to data loss or further compromise.

A. Correct.
Isolating the EC2 instance by modifying its security group to deny all outbound traffic is a valid initial containment step to prevent further communication with malicious actors.
B. Incorrect.
Stopping the EC2 instance immediately could disrupt forensic analysis and evidence collection, so it is not recommended as the first action.
C. Correct.
Investigating the GuardDuty finding is crucial to understanding the scope of the threat and collecting necessary details for a proper response.
D. Correct.
Taking a memory snapshot of the EC2 instance preserves evidence that can be used for forensic analysis and incident investigation.
E. Incorrect.
Reinstating the EC2 instance without proper investigation or remediation could expose your environment to further risks, making this a poor response.

SCS-C02 Question 4

Select 3

Your organization has deployed a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores logs in Amazon S3 and uses AWS WAF to monitor and block malicious traffic. Recently, your security team detected a spike in suspicious activity, including SQL injection attempts. Which steps should you take to investigate and mitigate this threat?

A
Enable AWS WAF logging and analyze the logs for malicious patterns.
B
Use Amazon GuardDuty to analyze VPC flow logs and identify suspicious IP addresses.
C
Enable Amazon Macie to classify sensitive data in Amazon S3 and monitor data access patterns.
D
Deploy an AWS Config rule to assess the security configuration of the EC2 instances.
E
Create new AWS WAF rules to block specific IP addresses identified in the analysis.

Show answer and explanation

Correct answers: A, B, E

Explanation

To investigate and mitigate the SQL injection threat, you should focus on tools and actions that help identify the malicious traffic source and block it. AWS WAF logging provides insights into the nature of the attack, while Amazon GuardDuty can identify suspicious IP addresses through flow log analysis. Finally, creating new WAF rules to block identified malicious IPs helps mitigate the attack. Other options, like Amazon Macie and AWS Config, are less relevant to the specific scenario.

A. Correct.
Enabling AWS WAF logging is a critical step in identifying malicious patterns in incoming traffic. This helps you understand the nature of the threat and customize mitigation strategies.
B. Correct.
Amazon GuardDuty can analyze VPC flow logs to identify suspicious activity such as communication with known malicious IPs. This is highly relevant for investigating the source of the threat.
C. Incorrect.
Amazon Macie focuses on data classification and monitoring S3 access patterns. While useful for identifying data breaches, it is not directly applicable to detecting or mitigating SQL injection attempts.
D. Incorrect.
AWS Config assesses resource configurations for compliance. Although helpful in identifying misconfigurations, it is not directly relevant to analyzing or mitigating SQL injection threats.
E. Correct.
Creating new AWS WAF rules to block malicious IP addresses based on analysis is an effective mitigation step to prevent further SQL injection attempts.

SCS-C02 Question 5

Select 2

Your organization has recently experienced a security incident where an Amazon EC2 instance was compromised. To respond effectively, you need to design and implement an incident response plan specific to AWS. Which of the following actions should you include in your plan? (Choose TWO)

A
Isolate the compromised EC2 instance by modifying the associated security group to deny all inbound and outbound traffic.
B
Immediately delete the compromised EC2 instance to prevent further exploitation.
C
Implement Amazon GuardDuty to continuously monitor for suspicious activity and generate alerts.
D
Conduct a forensic analysis on the compromised EC2 instance by creating an Amazon EBS snapshot and preserving the instance's state.
E
Disable all IAM user accounts in the AWS account to prevent further unauthorized access.

Show answer and explanation

Correct answers: A, D

Explanation

An effective incident response plan should focus on containing the threat and preserving evidence for investigation. Isolating the compromised EC2 instance prevents further damage and keeps the environment secure, while creating an EBS snapshot ensures that evidence is preserved for forensic analysis. Proactive measures like GuardDuty and extreme actions like disabling all IAM users are not directly relevant to responding to the specific incident.

A. Correct.
Isolating the compromised EC2 instance is a critical step in an incident response plan to prevent further exploitation while preserving the instance for investigation.
B. Incorrect.
Deleting the instance eliminates valuable forensic evidence and hinders the ability to investigate the root cause of the incident.
C. Incorrect.
While Amazon GuardDuty is a valuable monitoring tool, it is a proactive measure rather than a direct step in responding to an already compromised instance.
D. Correct.
Conducting a forensic analysis by creating an EBS snapshot helps preserve evidence and aids in understanding the nature of the compromise.
E. Incorrect.
Disabling all IAM user accounts is an extreme action that disrupts legitimate access and is not necessary in most incident response scenarios; instead, you should focus on reviewing and revoking only suspicious credentials.

SCS-C02 Question 6

Select 3

Your organization runs critical workloads on AWS and wants to ensure a robust incident response plan is in place. As part of the plan, you need to automate the detection of unauthorized changes to IAM policies and immediately isolate compromised instances. Which combination of AWS services and features should you use to meet this requirement effectively?

A
AWS CloudTrail with Amazon CloudWatch Alarms
B
AWS Config with AWS Config Rules
C
Amazon GuardDuty with AWS Lambda
D
AWS Systems Manager Session Manager
E
AWS Shield Advanced

Show answer and explanation

Correct answers: A, B, C

Explanation

To design and implement an effective incident response plan, you need a combination of services that can detect unauthorized changes and automate responses. AWS CloudTrail and CloudWatch enable tracking and alerting on API activity. AWS Config with Config Rules helps monitor and enforce compliance with IAM policy changes. Amazon GuardDuty can detect threats and, when integrated with AWS Lambda, can automate actions like isolating compromised instances. These tools together address both detection and response requirements effectively.

A. Correct.
AWS CloudTrail with Amazon CloudWatch Alarms can help track API activity and trigger alarms for unauthorized changes, making it a crucial component for detecting incidents.
B. Correct.
AWS Config with AWS Config Rules is vital for assessing compliance and detecting unauthorized changes to IAM policies in real-time.
C. Correct.
Amazon GuardDuty with AWS Lambda is effective for threat detection and automated responses, such as isolating compromised instances.
D. Incorrect.
AWS Systems Manager Session Manager is used for secure instance management but does not directly help with incident detection or automation of responses.
E. Incorrect.
AWS Shield Advanced is used for DDoS protection and is not relevant for detecting IAM policy changes or isolating compromised instances.

SCS-C02 Question 7

Select 3

Your organization has recently adopted AWS and is designing an incident response plan to handle potential security breaches. As part of the plan, the organization wants to ensure that compromised resources are isolated automatically to prevent further damage. Which of the following actions should be included in the plan to achieve this goal?

A
Set up AWS Config rules to detect non-compliant resources and trigger AWS Lambda functions to isolate them.
B
Use AWS Systems Manager Automation documents (SSM Documents) to terminate compromised EC2 instances.
C
Create Amazon GuardDuty findings to automatically isolate the resource by moving it to a quarantine VPC using AWS Lambda.
D
Enable Detective to automatically isolate resources identified as part of a security anomaly.
E
Integrate AWS Security Hub with automation rules to isolate non-compliant resources using AWS Config and Lambda.

Show answer and explanation

Correct answers: A, C, E

Explanation

To design an effective incident response plan in AWS, it is essential to automate the isolation of compromised resources to prevent further damage. Using AWS Config rules and Lambda or GuardDuty findings with Lambda, resources can be moved to a quarantine VPC. Additionally, AWS Security Hub can orchestrate automated actions by integrating with AWS Config and Lambda to ensure non-compliant resources are isolated effectively. These approaches align with AWS best practices for incident response.

A. Correct.
Correct: AWS Config rules can monitor resource compliance, and when a resource is deemed non-compliant (e.g., compromised), a Lambda function can be triggered to isolate it.
B. Incorrect.
Incorrect: AWS Systems Manager Automation documents can perform various actions, but terminating an instance directly doesn't isolate it. Isolation typically involves network or resource containment rather than deletion.
C. Correct.
Correct: GuardDuty findings can trigger AWS Lambda functions to move compromised resources to a quarantine VPC, effectively isolating them.
D. Incorrect.
Incorrect: AWS Detective is a service for investigation and analysis of security incidents; it does not have built-in functionality for isolating resources.
E. Correct.
Correct: AWS Security Hub integrates with automation tools like AWS Config and Lambda, enabling the isolation of non-compliant resources as part of a security response.

SCS-C02 Question 8

Select 4

Your company runs a multi-account AWS environment using AWS Organizations. You are tasked with designing an incident response plan for detecting and responding to potential security breaches. Which of the following actions should be included in your incident response plan to ensure effective detection and coordination across accounts?

A
Enable GuardDuty in the management account and configure it to aggregate findings from all member accounts.
B
Set up CloudTrail in every account and send logs to a centralized S3 bucket with appropriate permissions.
C
Use AWS Config to ensure CloudTrail is enabled and configured correctly in all accounts.
D
Implement a Security Hub administrator account to view and manage findings across all accounts.
E
Rely on manual log analysis during incidents to reduce costs associated with automated monitoring services.

Show answer and explanation

Correct answers: A, B, C, D

Explanation

An effective incident response plan in a multi-account AWS environment should prioritize centralized monitoring, log aggregation, and compliance enforcement. GuardDuty, CloudTrail, AWS Config, and Security Hub each play critical roles in ensuring comprehensive detection, logging, and response capabilities. Manual log analysis is not practical in modern cloud environments as it is slow and error-prone.

A. Correct.
Correct. Enabling GuardDuty in the management account and aggregating findings from member accounts ensures centralized threat detection and monitoring, which is vital for incident response.
B. Correct.
Correct. Centralizing CloudTrail logs in an S3 bucket allows for unified visibility and access to logs, which is essential for forensic analysis during incident responses.
C. Correct.
Correct. AWS Config helps in ensuring that CloudTrail is consistently enabled and correctly configured across accounts, reducing the risk of misconfiguration that could hinder incident response.
D. Correct.
Correct. Security Hub provides a centralized view of security findings across multiple accounts, enabling efficient coordination and response during incidents.
E. Incorrect.
Incorrect. Relying on manual log analysis is not a best practice as it delays response times and is prone to human error. Automated monitoring services enhance detection and response capabilities.

SCS-C02 Question 9

Single answer

Your company is hosting a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores sensitive customer data in Amazon S3. You are tasked with ensuring that the data in transit between the clients and the S3 bucket is encrypted, and you need to ensure no unencrypted traffic is allowed. Which approach should you take to meet this requirement?

A
Enable server-side encryption (SSE) for the Amazon S3 bucket.
B
Require HTTPS by configuring an HTTPS listener on the ALB and redirect HTTP traffic to HTTPS.
C
Use AWS Certificate Manager (ACM) to manage SSL/TLS certificates and associate them with the ALB.
D
Create a bucket policy in Amazon S3 to deny any requests that do not use HTTPS.

Show answer and explanation

Correct answer: D

Explanation

To ensure data in transit is encrypted and unencrypted traffic is denied, you must enforce HTTPS for access to the S3 bucket. A bucket policy can be configured to deny any requests that do not use HTTPS, thereby meeting the requirement. Other options, such as enabling SSE or using ACM, address different aspects of security but do not explicitly enforce encrypted communication to the S3 bucket.

A. Incorrect.
Enabling server-side encryption (SSE) protects data at rest in Amazon S3, not data in transit. This does not meet the requirement to ensure encrypted communication between clients and the bucket.
B. Incorrect.
Requiring HTTPS for clients connecting to the ALB ensures encrypted communication to the load balancer but does not enforce encryption for traffic directly to the S3 bucket.
C. Incorrect.
Using AWS Certificate Manager (ACM) simplifies SSL/TLS certificate management for the ALB, but it does not enforce encryption for data in transit to the S3 bucket.
D. Correct.
Creating a bucket policy to deny requests that do not use HTTPS ensures that only encrypted communication is allowed for traffic in transit to the S3 bucket, meeting the requirement.

SCS-C02 Question 10

Select 3

An e-commerce company is using an Amazon S3 bucket to store sensitive customer data. The security team wants to ensure that the data in the bucket is encrypted at all times and that the company maintains control over the encryption keys. Additionally, they need to audit access to the bucket and ensure that unauthorized access attempts are detected. Which combination of steps should the company take to meet these requirements?

A
Enable server-side encryption with AWS Key Management Service (SSE-KMS) and use a customer-managed KMS key.
B
Enable Amazon S3 bucket logging to track all access requests.
C
Enable AWS CloudTrail logging for S3 data events.
D
Use Amazon S3 server-side encryption with Amazon S3-managed keys (SSE-S3).
E
Enable Amazon Macie to monitor and classify sensitive data.

Show answer and explanation

Correct answers: A, C, E

Explanation

To meet the requirements, the company must first ensure data encryption with control over the encryption keys, which is achieved by using SSE-KMS with a customer-managed KMS key. AWS CloudTrail logging for S3 data events is essential for auditing access and identifying unauthorized access attempts. Additionally, Amazon Macie enhances security by detecting sensitive data and monitoring for anomalies, which helps fulfill the detection requirement. Bucket logging and SSE-S3 were not selected as they do not fully meet the stated requirements.

A. Correct.
Correct. Enabling SSE-KMS with a customer-managed KMS key ensures that data is encrypted and the company retains control over the encryption keys.
B. Incorrect.
Incorrect. While bucket logging can track access requests, it is not sufficient for auditing or detecting unauthorized access attempts compared to CloudTrail.
C. Correct.
Correct. AWS CloudTrail data event logging for S3 can monitor and log all actions performed on the bucket, providing a detailed audit trail.
D. Incorrect.
Incorrect. While SSE-S3 encrypts data, it does not provide the same level of key control as customer-managed KMS keys.
E. Correct.
Correct. Amazon Macie helps detect sensitive data and monitor for anomalies, aiding in the detection of unauthorized access attempts.

Timed practice exam

Take a SCS-C02 practice test under exam conditions

65 questions in 170 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

What the SCS-C02 exam covers

Official AWS Certified Security - Specialty exam domains and weightings.

Threat Detection and Incident Response
14% of exam
Security Logging and Monitoring
18% of exam
Infrastructure Security
20% of exam
Identity and Access Management
16% of exam
Data Protection
18% of exam
Management and Security Governance
14% of exam

SCS-C02 practice questions 1 to 100 of 503

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them. The bank is split into 6 pages of up to 100 questions.

SCS-C02 exam dumps FAQ

Are these SCS-C02 dumps real exam questions?

No. These are original practice questions written to the AWS Certified Security - Specialty exam objectives, not questions copied from a live exam. Memorising leaked questions violates Amazon Web Services's candidate agreement and stops working the moment the question pool rotates. Use this bank to check your understanding of each domain and to find the topics you still need to study.

How many SCS-C02 practice questions are there?

503 questions, each with the correct answer, an explanation of the answer, and a note on why every other option is wrong. The first 10 are on this page and every question has its own page linked below.

Are the SCS-C02 exam dumps free?

Yes. Every question, answer and explanation on this page and the linked question pages is free to read without an account. A free HydraNode account adds timed practice exams, scoring and progress tracking across attempts.

How do I take a timed SCS-C02 practice test?

Sign in and start the AWS Certified Security - Specialty exam on HydraNode. A session gives you 65 questions drawn from this bank in 170 minutes, then a score report with a per-question review.

What topics does the SCS-C02 exam cover?

The official exam domains are: Threat Detection and Incident Response; Security Logging and Monitoring; Infrastructure Security; Identity and Access Management; Data Protection; Management and Security Governance.

More AWS exam dumps

All AWS exams

AIF-C01230 questions

AWS Certified AI Practitioner exam dumps

AWS Certified AI Practitioner

ANS-C01512 questions

AWS Advanced Networking Specialty exam dumps

AWS Certified Advanced Networking - Specialty

CLF-C02341 questions

AWS Certified Cloud Practitioner exam dumps

AWS Certified Cloud Practitioner

DEA-C01549 questions

AWS Data Engineer Associate exam dumps

AWS Certified Data Engineer - Associate

DOP-C02410 questions

AWS DevOps Engineer Professional exam dumps

AWS Certified DevOps Engineer - Professional

DVA-C02398 questions

AWS Developer Associate exam dumps

AWS Certified Developer - Associate

MLS-C01388 questions

AWS Machine Learning Specialty exam dumps

AWS Certified Machine Learning - Specialty

MLA-C01457 questions

AWS Machine Learning Engineer Associate exam dumps

AWS Certified Machine Learning Engineer - Associate