AWS Security Specialty Practice - 60 Free Security...

Q: How many questions are in this practice set?

This practice set contains 60 questions with detailed explanations.

Q: What topics does this practice cover?

It covers the key topics and question types for AWS Certified Security - Specialty (SCS-C02), including vocabulary, grammar, reading, and practical test skills.

Q: Are there explanations for every question?

Yes, every question includes a clear explanation so you can understand the correct answer and learn from mistakes.

Q: Can I save my progress and mistakes?

Your wrong answers, favorites, scores, and study streak are saved in your browser, so you can review them on the same device.

Q: What practice modes are available?

You can practice randomly, take a timed mock exam, filter by difficulty, type, and topic, search questions, and review wrong answers.

Question 1

Which AWS service continuously monitors accounts and workloads for threats and generates security findings?

Select an answer Amazon GuardDutyAmazon Route 53AWS CloudFormationAmazon Elasticsearch

Question 2

Which data sources does Amazon GuardDuty analyze?

Select an answer S3 event notifications onlyCloudWatch billing alarmsCloudTrail events, VPC Flow Logs, and DNS logsEC2 instance storage only

Question 3

Which AWS service provides a central place to aggregate security findings from multiple accounts?

Select an answer AWS LambdaAWS Security HubAWS CloudFormationAmazon ECS

Question 4

Which AWS service provides managed incident response and remediation workflows?

Select an answer Amazon Simple Storage ServiceAmazon QuickSightAWS App MeshAWS Systems Manager Incident Manager

Question 5

Which AWS service protects applications from distributed denial-of-service attacks?

Select an answer AWS GlueAmazon AthenaAWS CodePipelineAWS Shield

Question 6

Which AWS service provides a managed web application firewall?

Select an answer AWS WAFAmazon GuardDutyAWS CloudTrailAmazon Inspector

Question 7

Which AWS service scans EC2 instances and container images for software vulnerabilities?

Select an answer AWS Certificate ManagerAWS Transfer FamilyAmazon InspectorAmazon CloudWatch

Question 8

What is the first priority during an AWS security incident?

Select an answer Publish the incident publiclyPreserve evidence and contain the impactDelete all logsTerminate every account

Question 9

Which AWS service can detect cryptocurrency mining activity on EC2 instances?

Select an answer Amazon GuardDutyAmazon S3 GlacierAWS Direct ConnectAmazon Lex

Question 10

Match each AWS security service to its main purpose.

Amazon GuardDutyAWS Security HubAmazon InspectorAWS WAF

Question 11

Which AWS service records API calls in an AWS account for auditing?

Select an answer Amazon Route 53AWS CloudTrailAmazon VPC Flow LogsAWS Budgets

Question 12

Which AWS feature captures metadata about network traffic in a VPC?

Select an answer AWS ConfigAmazon GuardDutyVPC Flow LogsCloudTrail

Question 13

Which service stores and monitors application and system logs?

Select an answer AWS Certificate ManagerAmazon ECRAmazon CloudWatch LogsAmazon S3 Glacier

Question 14

Which CloudTrail feature can help detect whether log files were modified?

Select an answer Log file validationS3 versioningLifecycle policiesBucket replication

Question 15

Which agent should you install on EC2 instances to send operating system logs to CloudWatch?

Select an answer AWS CLIAmazon ECS agentAWS WAF agentCloudWatch agent

Question 16

Which CloudWatch Logs feature extracts numeric values from log events to create metrics?

Select an answer Export tasksMetric filtersAlarm actionsLog groups

Question 17

Which feature lets you query and analyze logs stored in CloudWatch Logs?

Select an answer AWS WAFAmazon GuardDutyAWS ShieldCloudWatch Logs Insights

Question 18

Which AWS approach centralizes CloudTrail logs from all accounts in an organization?

Select an answer Organization trail that delivers to one S3 bucketSeparate trails in each region onlyVPC peeringSecurity groups

Question 19

Which CloudWatch feature sends a notification when a security metric crosses a threshold?

Select an answer SubscriptionsAlarmsDashboardsLog groups

Question 20

Match each AWS logging feature to its purpose.

AWS CloudTrailVPC Flow LogsCloudWatch LogsCloudWatch Logs Insights

Question 21

Which VPC component filters traffic at the instance level?

Select an answer Security groupNetwork ACLRoute tableInternet gateway

Question 22

Which VPC component filters traffic at the subnet level?

Select an answer Security groupEBS volumeNAT gatewayNetwork ACL

Question 23

Which AWS service provides private connectivity from a VPC to supported services without traversing the internet?

Select an answer AWS Site-to-Site VPNAmazon CloudFrontAWS PrivateLinkAWS Direct Connect

Question 24

Which AWS service connects many VPCs and on-premises networks through a central hub?

Select an answer AWS AppSyncAWS Transit GatewayAWS ShieldAmazon Cognito

Question 25

Which AWS service provides a managed network firewall for a VPC?

Select an answer Amazon InspectorAWS Network FirewallAWS WAFAWS Shield

Question 26

Which AWS service lets you manage EC2 instances without opening SSH ports or using public IP addresses?

Select an answer AWS Systems Manager Session ManagerAWS Direct ConnectAWS Global AcceleratorAmazon Route 53

Question 27

What is a bastion host used for?

Select an answer A load balancerA DNS serverA backup vaultA hardened jump host for administrative access

Question 28

Which AWS service lets you apply service control policies across an organization?

Select an answer AWS CloudTrailAmazon GuardDutyAWS OrganizationsAmazon CloudWatch

Question 29

Which AWS service provides secure encrypted tunnels between on-premises networks and AWS?

Select an answer AWS Elastic BeanstalkAmazon AthenaAWS Site-to-Site VPNAmazon S3

Question 30

Match each VPC security component to its purpose.

Security groupNetwork ACLAWS PrivateLinkAWS Network Firewall

Question 31

What is an IAM role?

Select an answer An identity with permissions that principals can assumeA username and passwordA root accountAn S3 bucket

Question 32

What is an IAM policy?

Select an answer A network routeA database schemaA backup planA JSON document that defines permissions

Question 33

Which AWS service issues temporary security credentials?

Select an answer Amazon EBSAWS STSAmazon Route 53AWS Certificate Manager

Question 34

What does an IAM trust policy define?

Select an answer Which principals can assume a roleWhich S3 buckets existWhich VPCs are peeredWhich log groups are created

Question 35

What does least privilege mean?

Select an answer Granting all users full administrator accessRemoving all IAM usersUsing only the root accountGranting only the permissions required to do a job

Question 36

Which AWS service provides workforce identity federation across AWS accounts and applications?

Select an answer AWS WAFAmazon InspectorAWS IAM Identity CenterAmazon GuardDuty

Question 37

What is an IAM permission boundary?

Select an answer An S3 lifecycle ruleA CloudWatch alarmA limit on the maximum permissions an identity can receiveA network firewall rule

Question 38

Which IAM condition key can require multifactor authentication?

Select an answer ec2:ResourceTagaws:MultiFactorAuthPresentaws:SourceIpaws:TagKeys

Question 39

Which IAM best practice applies to the AWS root user?

Select an answer Enable MFA and avoid daily useShare the password with the teamDisable MFA for convenienceUse root for every deployment

Question 40

Match each IAM concept to its purpose.

IAM roleIAM policyAWS STSPermission boundary

Question 41

Which AWS service creates and manages encryption keys?

Select an answer Amazon QuickSightAWS KMSAmazon GuardDutyAWS CloudTrail

Question 42

Which AWS service securely stores and automatically rotates database credentials and secrets?

Select an answer Amazon S3AWS Certificate ManagerAmazon ECRAWS Secrets Manager

Question 43

Which AWS service manages SSL/TLS certificates for AWS services?

Select an answer AWS Certificate ManagerAWS KMSAmazon GuardDutyAWS Config

Question 44

What is envelope encryption?

Select an answer Using one password for all dataDeleting all encryption keysEncrypting a data key with a master key and using the data key for dataStoring keys as plaintext

Question 45

Which S3 encryption option uses an AWS-managed key automatically?

Select an answer SSE-S3SSE-CClient-side encryptionNo encryption

Question 46

Which mechanism protects data in transit to AWS?

Select an answer IAM policiesTLSEBS snapshotsS3 versioning

Question 47

Which AWS service provides dedicated single-tenant hardware security modules?

Select an answer AWS KMSAWS WAFAmazon GuardDutyAWS CloudHSM

Question 48

Which S3 feature prevents objects from being deleted or overwritten for a fixed period?

Select an answer Cross-region replicationCloudFrontObject LockLifecycle policies

Question 49

Which AWS service centralizes encryption keys and integrates with many AWS services?

Select an answer Amazon EFSAWS GlueAmazon AthenaAWS KMS

Question 50

Match each data protection service to its purpose.

AWS KMSAWS Secrets ManagerAWS Certificate ManagerAWS CloudHSM

Question 51

Which AWS service provides compliance reports, certifications, and agreements?

Select an answer AWS CloudTrailAmazon S3AWS ArtifactAmazon GuardDuty

Question 52

Which AWS service tracks resource configurations and evaluates them against rules?

Select an answer AWS Direct ConnectAWS ConfigAWS CloudFormationAmazon Route 53

Question 53

Which AWS service helps you centrally manage accounts, budgets, and service control policies?

Select an answer Amazon InspectorAWS OrganizationsAmazon CloudWatchAWS WAF

Question 54

What is a service control policy?

Select an answer An S3 bucket policyA VPC routeA CloudWatch dashboardA policy that limits permissions available in member accounts

Question 55

Which AWS Config feature bundles multiple rules for compliance frameworks?

Select an answer Conformance packsMetric filtersLog groupsAlarms

Question 56

Which AWS service provides recommendations for security, cost, performance, and reliability?

Select an answer AWS WAFAmazon InspectorAWS Trusted AdvisorAmazon GuardDuty

Question 57

Which AWS service can automatically remediate noncompliant resources?

Select an answer AWS ShieldAmazon QuickSightAWS Config with remediation actionsAmazon Route 53

Question 58

Which AWS service provides a single dashboard for security posture and compliance?

Select an answer AWS App RunnerAWS Security HubAWS CodeBuildAmazon ECS

Question 59

Which AWS Organizations feature restricts the AWS services an account can use?

Select an answer VPC flow logsCloudWatch dashboardsS3 lifecycle policiesService control policies

Question 60

Match each governance service to its purpose.

AWS ArtifactAWS ConfigAWS OrganizationsAWS Trusted Advisor