CertsPoint
Sign In Get Started
See all results for ""
Exams About Us
Sign In Get Started
Exam Overview
Exam Code SCS-C02
Exam Name Amazon AWS Certified Security - Specialty
Vendor Amazon
Total Questions 372
Last Updated 26-Oct, 2026
Free SCS-C02 Questions Get Premium Access
Why CertsPoint?
  • Latest & Verified Questions
  • Detailed Explanations
  • Regular Updates
  • Full-Length Practice Tests
  • Boost Your Exam Confidence

PDF Study Materials

Downloadable guides and resources

Practice Tests

Full-length tests with real exam experience

Progress Tracking

Monitor your performance and improvement

Study Anywhere

Access on desktop, tablet, and mobile

Excellent
4.6 (398 Up Votes)
Secure Payment Privacy Protected Money Back Guarantee

Free SCS-C02 Practice Questions

Explore 5 free practice questions for the Amazon SCS-C02 exam and review the answers and explanations to support your preparation.

  1. Question 1

    Single answer

    A company is developing a highly resilient application to be hosted on multiple Amazon EC2 instances . The application will store highly sensitive user data in Amazon RDS tables

    The application must

    • Include migration to a different IAM Region in the application disaster recovery plan.

    • Provide a full audit trail of encryption key administration events

    • Allow only company administrators to administer keys.

    • Protect data at rest using application layer encryption

    A Security Engineer is evaluating options for encryption key management

    Why should the Security Engineer choose IAM CloudHSM over IAM KMS for encryption key management in this situation?

    • Option A:

      The key administration event logging generated by CloudHSM is significantly moreextensive than IAM KMS.

      Correct
    • Option B:

      CloudHSM ensures that only company support staff can administer encryption keys, whereas IAM KMS allows IAM staff to administer keys

      Correct
    • Option C:

      The ciphertext produced by CloudHSM provides more robust protection against brute force decryption attacks than the ciphertext produced by IAM KMS

      Correct
    • Option D:

      CloudHSM provides the ability to copy keys to a different Region, whereas IAM KMS does not

      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: B

    Explanation

    CloudHSM allows full control of your keys such including Symmetric (AES), Asymmetric (RSA), Sha-256, SHA 512, Hash Based, Digital Signatures (RSA). On the other hand, AWS Key Management Service is a multi-tenant key storage that is owned and managed byAWS1.

  2. Question 2

    Single answer

    A company uses Amazon Elastic Kubernetes Service (Amazon EKS) clusters to run its Kubernetes-based applications. The company uses Amazon GuardDuty to protect the applications. EKS Protection is enabled in GuardDuty. However, the corresponding GuardDuty feature is not monitoring the Kubernetes-based applications.

    • Option A:

      Enable VPC flow logs for the VPC that hosts the EKS clusters.

      Correct
    • Option B:

      Assign the CloudWatchEventsFullAccess AWS managed policy to the EKS clusters.

      Correct
    • Option C:

      Ensure that the AmazonGuardDutyFullAccess AWS managed policy is attached to the GuardDuty service role.

      Correct
    • Option D:

      Enable the control plane logs in Amazon EKS. Ensure that the logs are ingested into Amazon CloudWatch.

      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: D

    Explanation

    To enable GuardDuty to monitor Kubernetes-based applications:

    Enable Control Plane Logs:

    GuardDuty uses control plane logs to detect malicious or unauthorized activity in Amazon EKS.

    Enable EKS control plane logs (API, audit, authenticator) and ingest them into CloudWatch.

  3. Question 3

    Single answer

    Your company has a set of EC2 Instances defined in IAM. These Ec2 Instances have strict security

    groups attached to them. You need to ensure that changes to the Security groups are noted and

    acted on accordingly. How can you achieve this?

    Please select:

    • Option A:

      Use Cloudwatch logs to monitor the activity on the Security Groups. Use filters to search for the changes and use SNS forthe notification.

      Correct
    • Option B:

       Use Cloudwatch metrics to monitor the activity on the Security Groups. Use filters to search for the changes and use SNS forthe notification.

      Correct
    • Option C:

      Use IAM inspector to monitor the activity on the Security Groups. Use filters to search for the changes and use SNS f the notification. 

      Correct
    • Option D:

      Use Cloudwatch events to be triggered for any changes to the Security Groups. Configure the Lambda function for email notification as well.

      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: D

    Explanation

    The below diagram from an IAM blog shows how security groups can be monitored 

     Option A is invalid because you need to use Cloudwatch Events to check for chan,

    Option B is invalid because you need to use Cloudwatch Events to check for chang

    Option C is invalid because IAM inspector is not used to monitor the activity on Security Groups

    he correct answer is: Use Cloudwatch events to be triggered for any changes to the Security Groups.

    Configure the Lambda function for email notification as well.

  4. Question 4

    Single answer

    A company needs to implement DNS Security Extensions (DNSSEC) for a specific subdomain. The subdomain is already registered with Amazon Route 53. A security engineer has enabled DNSSEC signing and has created a key-signing key (KSK). When the security engineer tries to test the configuration, the security engineer receives an error for a broken trust chain.

    What should the security engineer do to resolve this error?

    • Option A:

      Replace the KSK with a zone-signing key (ZSK)


      Correct
    • Option B:

      Deactivate and then activate the KSK.

      Correct
    • Option C:

      Create a Delegation Signer (DS) record in the parent hosted zone.

      Correct
    • Option D:

      Create a Delegation Signer (DS) record in the subdomain.

      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: C

    Explanation

    When implementing DNSSEC for a subdomain in Amazon Route 53 and encountering a broken trust chain error, creating a Delegation Signer (DS) record in the parent hosted zone is the correct approach. The DS record is essential for establishing the trust chain between the parent and child zones by linking the DNSSEC-signed subdomain to its parentdomain. This step is crucial for DNS resolvers to validate the authenticity of DNS responses, thereby resolving the broken trust chain issue and ensuring the integrity and authenticity of the DNS data for the secured subdomain.

  5. Question 5

    Multiple answers

    ccA security engineer receives an IAM abuse email message. According to the message, an Amazon EC2 instance that is running in the security engineer's IAM account is sending phishing email messages.

    The EC2 instance is part of an application that is deployed in production. The application runs on many EC2 instances behind an Application Load Balancer. The instances run in an AmazonEC2 Auto Scaling group across multiple subnets and multiple Availability Zones.

    The instances normally communicate only over the HTTP. HTTPS, and MySQL protocols. Upon investigation, the security engineer discovers that email messages are being sent over port 587. All other traffic is normal.

    The security engineer must create a solution that contains the compromised EC2 instance, preserves forensic evidence for analysis, and minimizes application downtime. Which combination of steps must the security engineer take to meet these requirements? (Select THREE.)

    • Option A:

      Add an outbound rule to the security group that is attached to the compromised EC2 instance to deny traffic to 0.0.0.0/0 and port 587.

      Correct
    • Option B:

      Add an outbound rule to the network ACL for the subnet that contains the compromised EC2 instance to deny traffic to 0.0.0.0/0 and port 587.

      Correct
    • Option C:

      Gather volatile memory from the compromised EC2 instance. Suspend the compromised EC2 instance from the Auto Scaling group. Then take a snapshot of the compromised EC2 instance. 

      Correct
    • Option D:

      Take a snapshot of the compromised EC2 instance. Suspend the compromised EC2 instance from the Auto Scaling group. Then gather volatile memory from the compromised EC2 instance.

      Correct
    • Option E:

      Move the compromised EC2 instance to an isolated subnet that has a network ACL that has no inbound rules or outbound rules.

      Correct
    • Option F:

      Replace the existing security group that is attached to the compromised EC2 instance with a new security group that has no inbound rules or outbound rules.

      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: A, C, E