10 AWS Security Specialty Practice Questions That Mirror the Real Exam
Here are 10 multiple-choice questions designed to match the difficulty, style, and domain coverage of the AWS Security Specialty (SCS-C02) exam. The questions focus on practical application, troubleshooting, and architectural decisions rather than simple fact recall.
Intro: We recommend pairing this with 8 AWS CloudOps Engineer Practice Questions That Mirror the Real Exam.
This set of practice questions targets the core domains of the AWS Security Specialty exam: Incident Response, Logging and Monitoring, Infrastructure Security, Identity and Access Management, and Data Protection. Each question presents a realistic scenario requiring you to choose the most secure, cost-effective, or operationally efficient solution. Pay close attention to the wording—distractors often include services that are "almost right" but miss a critical requirement like cross-account access, encryption in transit, or least privilege.
If you want to plan your review before diving into these questions, this free AWS Certified Security - Specialty study plan can give you a schedule that fits your available time.
Question 1
A security engineer is configuring VPC Flow Logs for a VPC that spans three Availability Zones. The logs must be sent to a central Amazon S3 bucket in a different AWS account for long-term compliance retention. The engineer has already created the S3 bucket and the bucket policy allowing the VPC Flow Logs service to write. What additional step is required to ensure the flow logs are successfully delivered to the cross-account bucket?
A. Create a VPC endpoint for Amazon S3 in the source VPC.
B. Attach a resource-based policy to the S3 bucket allowing the VPC Flow Logs service principal from the source account.
C. Create an IAM role in the destination account and attach it to the VPC Flow Logs subscription.
D. Enable S3 bucket versioning to prevent overwriting of log files.
Answer: B
Explanation: VPC Flow Logs use a service-linked IAM role in the source account to deliver logs, but the destination S3 bucket policy must explicitly grant the delivery.logs.amazonaws.com service principal permission to write, regardless of account. Option A is unnecessary because Flow Logs use the public endpoint or a gateway endpoint, not an interface endpoint. Option C is wrong because the IAM role is in the source account, not the destination. Option D is a best practice but not a prerequisite for delivery.
Question 2
A company is using AWS KMS with a customer-managed key (CMK) to encrypt an Amazon RDS for PostgreSQL database. The security team wants to ensure that only a specific IAM role (DataAppRole) can decrypt data using this key, even if the role has kms:Decrypt permissions in its IAM policy. What is the most effective way to enforce this restriction?
A. Add a condition in the IAM policy for DataAppRole that requires kms:ViaService to be rds.amazonaws.com.
B. Modify the KMS key policy to deny kms:Decrypt for all principals except DataAppRole.
C. Use an S3 bucket policy to restrict access to the encrypted database backups.
D. Enable automatic key rotation for the CMK.
Answer: B
Explanation: The KMS key policy is the authoritative access control for a CMK. By explicitly denying kms:Decrypt to all principals except DataAppRole (using a Principal element with "AWS" and the role ARN), you override any IAM permissions. Option A is incorrect because kms:ViaService restricts the service through which the call is made, not the principal. Option C is irrelevant to the database itself. Option D affects key rotation, not access control.
Question 3
During a security incident, a Lambda function automatically terminated several EC2 instances that were compromised. The incident response team needs to capture the memory contents of the terminated instances for forensic analysis. What is the most effective way to preserve this data, assuming the instances are already terminated?
A. Use the EC2 console to create a snapshot of the EBS volumes from the terminated instances.
B. Restore the instances from the latest AMI and then use dd to capture memory.
C. Use AWS Backup to restore the instances to a new VPC and then perform a memory dump.
D. Recover the memory from the CloudWatch Logs that recorded instance metadata.
Answer: A
Explanation: While terminated instances cannot be rebooted, their EBS root and data volumes still exist and can be snapshotted for offline analysis. Memory (RAM) is volatile and lost upon termination, so options B and C are impossible. Option D is invalid because CloudWatch Logs do not capture RAM contents. Snapshotting the EBS volumes is the only viable forensic step post-termination.
Question 4
An application running on Amazon ECS Fargate needs to access an Amazon S3 bucket containing sensitive customer data. The security team requires that traffic between the task and S3 never traverses the public internet and that no IAM access keys are stored in the container. Which combination of steps will meet these requirements?
A. Attach an IAM role to the task and configure a VPC gateway endpoint for S3. If this interests you, 8 AWS Developer Associate Practice Questions That Mirror the Real Exam goes into more detail.
B. Store the IAM access keys in AWS Secrets Manager and retrieve them at runtime.
C. Attach an IAM role to the task and configure a VPC interface endpoint for S3.
D. Use an S3 access point with a bucket policy that restricts access to the VPC CIDR.
Answer: A
Explanation: For Fargate, you attach an IAM task role (not access keys) to grant permissions. A VPC gateway endpoint for S3 is free and keeps traffic within the AWS network, avoiding the internet. Option C is incorrect because an interface endpoint (ENI-based) is also valid for private connectivity but is more expensive and not required here; gateway endpoints are the standard for S3. Option B violates the no-keys requirement. Option D only restricts network origin, not the identity, and does not ensure private connectivity.
Question 5
A security engineer is designing a solution to collect and analyze AWS CloudTrail logs from 50 different AWS accounts into a single, centralized S3 bucket. The organization requires that the logs be immutable for 90 days to meet compliance. Which solution is most secure and cost-effective?
A. Use S3 Object Lock in governance mode with a retention period of 90 days.
B. Use S3 bucket versioning and enable MFA Delete.
C. Use S3 lifecycle rules to transition logs to S3 Glacier after 90 days.
D. Use AWS Organizations and a central logging account with an S3 bucket policy that denies s3:DeleteObject to all principals.
Answer: A
Explanation: S3 Object Lock in governance mode prevents any user (even the bucket owner) from deleting or overwriting objects for the specified retention period, unless they have special permissions. Option B (versioning + MFA Delete) prevents accidental deletion but does not prevent overwriting existing versions. Option C handles storage tiering, not immutability. Option D is weak because an IAM policy can be changed unless you use an SCP, and it does not prevent overwrites.
Question 6
An organization uses AWS Organizations with multiple accounts. A security analyst needs to ensure that no IAM user in any child account can create an access key for another IAM user. Which preventive control is the most effective?
A. Add an SCP that denies iam:CreateAccessKey for all IAM users in all child accounts.
B. Enable CloudTrail and create a CloudWatch alarm to notify when iam:CreateAccessKey is called.
C. Use AWS Config managed rule iam-user-no-policies-check to detect non-compliance.
D. Require all IAM users to use temporary credentials via SSO instead of access keys.
Answer: A
Explanation: Service Control Policies (SCPs) are the only preventive control that can restrict actions at the account level, regardless of the IAM permissions granted to the user. Option B is detective, not preventive. Option C detects policy misuse but does not stop the action. Option D is a best practice but does not technically prevent a user with permissions from creating an access key if they have it.
Question 7
A company runs a web application behind an Application Load Balancer (ALB) in a VPC. The security team wants to block specific IP addresses that are launching brute-force attacks. The solution must be managed centrally and must not require changes to the application code. What is the most appropriate service to implement this?
A. Network ACLs on the ALB's subnet.
B. AWS WAF attached to the ALB with an IP set rule.
C. Security group rules on the ALB.
D. AWS Shield Advanced with automatic application layer mitigation.
Answer: B For a deeper dive, check out How Hard Is AWS Security Specialty, Really? An Honest Difficulty Rating.
Explanation: AWS WAF is designed for Layer 7 filtering and can be attached to an ALB to block IP addresses via IP set rules, with no code changes. Option A (NACLs) is stateless and works at Layer 3/4 but is harder to manage centrally for a dynamic list and does not provide Layer 7 context. Option C (security groups) cannot block specific IPs for a load balancer (they are stateful and typically allow all inbound on port 80/443). Option D (Shield Advanced) provides DDoS protection but is not the primary tool for manual IP blocking.
Question 8
A data scientist needs to download a 10 GB encrypted file from an Amazon S3 bucket using an IAM role that has s3:GetObject permission. The file is encrypted with SSE-KMS. The download fails with an AccessDenied error. The S3 bucket policy allows the role to get objects. What is the most likely cause of the failure?
A. The role does not have kms:Decrypt permission on the KMS key.
B. The S3 bucket has a lifecycle rule that deleted the object.
C. The role is missing s3:ListBucket permission.
D. The file is too large for a single GetObject operation.
Answer: A
Explanation: When using SSE-KMS, the S3 service decrypts the object on your behalf. The calling principal must have kms:Decrypt permission on the specific KMS key, in addition to s3:GetObject. Option B is possible but less likely and would give a 404 error, not AccessDenied. Option C would cause a 403 only if the user tries to list the bucket, not for a direct GetObject by key. Option D is incorrect because S3 supports multi-part downloads for large files; the error would not be AccessDenied.
Question 9
An organization is migrating to AWS and wants to use AWS Directory Service for Microsoft AD to authenticate users to an EC2 Windows fleet. The security team requires that all authentication events be logged and sent to Amazon CloudWatch Logs for real-time analysis. Which service should be used to stream the Windows security event logs?
A. Amazon GuardDuty.
B. AWS CloudTrail.
C. Amazon EventBridge (CloudWatch Events).
D. The Amazon CloudWatch Logs agent (unified) with a subscription filter.
Answer: D
Explanation: The unified CloudWatch Logs agent can be installed on Windows to collect security event logs (e.g., Event ID 4624/4625) and send them to CloudWatch Logs. Option A (GuardDuty) uses VPC DNS and Flow Logs, not Windows event logs. Option B (CloudTrail) captures AWS API calls, not OS-level events. Option C (EventBridge) can process events but does not collect logs from EC2 instances directly.
Question 10
A security engineer is designing a data encryption strategy for Amazon S3. The compliance team requires that all objects be encrypted at rest, and that the encryption keys be rotated at least once a year. The engineer wants to minimize operational overhead. Which solution meets these requirements?
A. Use SSE-S3 (Amazon S3-managed keys) and enable automatic key rotation.
B. Use SSE-KMS with a customer-managed key and enable automatic key rotation.
C. Use SSE-KMS with an AWS-managed key (aws/s3) and enable automatic key rotation.
D. Use client-side encryption with a custom key stored in AWS Secrets Manager.
Answer: B
Explanation: SSE-KMS with a customer-managed key allows you to enable automatic yearly rotation (the default is yearly) and gives you full control over the key policy and audit trail. Option A (SSE-S3) provides encryption but does not allow you to manage or rotate the keys—they are rotated by AWS but you cannot control the schedule. Option C (AWS-managed key) is rotated every three years, which does not meet the one-year requirement. Option D (client-side) adds operational overhead and does not automatically rotate.
Closing:
These scenarios reflect the critical thinking required for the Security Specialty exam—where the difference between a correct and incorrect answer often hinges on a subtle detail like "cross-account" vs. "same account," or "preventive" vs. "detective" controls. To further sharpen your skills, practice with timed mock tests that mirror the real exam's difficulty and question distribution.
When you want a quick check of your current weak areas before taking a timed mock, this free AWS Certified Security - Specialty readiness check can point you to the topics that need more review.
Sharpen your recall under pressure — full-length AWS Certified Security - Specialty mock tests are designed to simulate the real thing.