SCS-C02 practice questions

Q: Is this SCS-C02 practice test free?

Yes. All 15 SCS-C02 practice questions on this page are free, with instant scoring and a written explanation for each answer. You do not need an account and there is no time limit.

Q: How much does the real SCS-C02 exam cost?

The official price is $300. Cyber VK sells the same official SCS-C02 voucher for $279.99 — a saving of $20.01. The voucher is identical to one bought direct and is emailed within minutes of payment.

Q: Are these questions the same as the real SCS-C02 exam?

No. These are original practice questions written to match the published exam objectives and difficulty. They are not real exam questions — sharing or reproducing live exam content breaches every certification body's candidate agreement and can void your certification.

Q: How should I use this practice test?

Use it as a readiness check rather than a study tool. Work through the questions without notes, read the explanation for every answer including the ones you got right, and treat any domain where you miss more than a third as the area to revise before booking your exam.

Question 1

A company wants to store database credentials for an application running on Amazon EC2. The credentials must be rotated automatically every 30 days without any custom code being written by the team. Which AWS service meets this requirement?

Accepted Answer

AWS Secrets Manager provides built-in, managed rotation for supported database engines using AWS-provided Lambda rotation functions, so no custom code is required. Parameter Store stores secrets securely but has no native automatic rotation, and KMS only manages encryption keys, not the credentials themselves.

Question 2

A security engineer needs a record of every AWS API call made in an account, including the identity of the caller, the source IP address, and the time of the call. Which service should the engineer enable?

Accepted Answer

AWS CloudTrail records management and data plane API activity, capturing the caller identity, source IP, and timestamp for each event. AWS Config records resource configuration state rather than API calls, and CloudWatch Logs only stores logs that a service or agent delivers to it.

Question 3

An application in a private subnet must download patches from an Amazon S3 bucket without any traffic traversing the internet. Which solution meets this requirement with the LEAST cost?

Accepted Answer

A gateway VPC endpoint for S3 routes traffic over the AWS private network with no hourly or data processing charges, unlike a NAT gateway. The other options either send traffic across the internet or add significant cost and complexity.

Question 4

A security engineer must ensure that all objects uploaded to an Amazon S3 bucket are encrypted with a specific customer managed AWS KMS key. Uploads that do not specify that key must be rejected. What should the engineer do?

Accepted Answer

Only an explicit Deny in the bucket policy on the encryption header condition keys can reject non-conforming PutObject requests. Default encryption silently applies a key instead of rejecting the request, and it does not stop a client from specifying a different key.

Question 5

A company uses AWS Organizations. Security policy requires that no member account can disable AWS CloudTrail, even by an account's own administrator. What is the MOST effective way to enforce this?

Accepted Answer

An SCP sets the maximum available permissions for all principals in member accounts, including the root user, so a Deny there cannot be overridden locally. IAM policies and permissions boundaries can be modified by a local administrator, and Config remediation is reactive rather than preventive.

Question 6

Amazon GuardDuty generates a finding of type UnauthorizedAccess:EC2/SSHBruteForce for an EC2 instance. The security team wants an automated response that isolates the instance immediately while preserving it for forensic analysis. Which approach meets this requirement?

Accepted Answer

GuardDuty findings are delivered to EventBridge, where a rule can trigger a Lambda function that swaps in an isolation security group, cutting off traffic while leaving the instance and its volumes intact. Terminating or stopping the instance destroys memory-resident evidence, and Shield Advanced addresses DDoS, not host compromise.

Question 7

A security engineer must verify that CloudTrail log files delivered to Amazon S3 have not been modified or deleted after delivery. Which feature provides this assurance?

Accepted Answer

CloudTrail log file integrity validation creates hash-based digest files signed with a private key, allowing the engineer to prove whether log files were altered or removed after delivery. Encryption protects confidentiality but not integrity verification, and Macie and replication address different concerns.

Question 8

A web application behind an Application Load Balancer is being targeted by SQL injection attempts from many distinct IP addresses. Which solution blocks these requests with the LEAST operational effort?

Accepted Answer

AWS WAF inspects HTTP request content and the AWS managed SQL injection rule group blocks these attacks without the team writing or maintaining rules. Network ACLs and security groups filter only by IP, port, and protocol, and Shield Advanced targets DDoS rather than application-layer injection.

Question 9

A company must encrypt data in Amazon S3 using key material that it generates and controls in its on-premises HSM, while still using AWS KMS for encryption operations. Which approach meets this requirement?

Accepted Answer

KMS supports importing external key material, so the organization generates the key in its own HSM while KMS performs cryptographic operations for S3. S3 default encryption cannot reference CloudHSM directly, and AWS-generated keys do not satisfy the customer-controlled key material requirement.

Question 10

An IAM role in Account A must be assumable only by a specific third-party vendor account, and the vendor must present a value that the company issues to prevent the confused deputy problem. Which configuration is correct?

Accepted Answer

The sts:ExternalId condition in the trust policy ensures the vendor must supply the unique identifier the company issued, which is the AWS-recommended defense against the confused deputy problem. IP conditions and MFA do not address a third party being tricked into using its own credentials on another customer's behalf, and long-lived IAM user keys are discouraged.

Question 11

A security engineer must centrally inspect all outbound HTTPS traffic from hundreds of VPCs and block requests to domains that are not on an approved list, without decrypting the traffic. Which solution meets this requirement?

Accepted Answer

AWS Network Firewall in a centralized inspection VPC behind Transit Gateway can filter HTTPS by the TLS SNI field, enforcing a domain allow list for all attached VPCs without TLS decryption. DNS Firewall is bypassed by direct-IP or alternate resolvers, WAF cannot be attached to an internet gateway, and IP-based NACLs are unmanageable for domains behind CDNs.

Question 12

After an incident, a security engineer discovers that an IAM role's long-term permissions were used by a session whose temporary credentials were exfiltrated. The engineer must immediately invalidate all existing sessions for that role while keeping the role usable for new, legitimate sessions. What should the engineer do?

Accepted Answer

A Deny policy conditioned on aws:TokenIssueTime being before a specified timestamp revokes every session issued prior to that moment while allowing newly issued sessions to work, which is exactly what the IAM console's "Revoke sessions" action creates. Deleting the role breaks legitimate access, and IAM roles do not have access keys to rotate.

Question 13

A company must retain CloudTrail logs for seven years in a way that guarantees no one, including the security administrator, can delete or overwrite them before the retention period expires. Which configuration meets this requirement?

Accepted Answer

Compliance mode prevents any user, including the root user, from deleting or altering a locked object version until the retention period expires. Governance mode can be bypassed by a privileged principal, lifecycle policies only change storage class, and MFA Delete still permits deletion by an authorized user.

Question 14

A security team wants to be alerted when unencrypted personally identifiable information is discovered in Amazon S3 buckets across the organization. Which service should they use?

Accepted Answer

Amazon Macie uses machine learning and pattern matching to discover and classify sensitive data such as PII in S3 buckets and reports findings to Security Hub and EventBridge. Inspector scans workloads for software vulnerabilities, and Detective analyzes activity for investigations rather than classifying stored data.

Question 15

A security analyst investigating a GuardDuty finding needs to quickly visualize the API call history and network activity of a suspect IAM role over the past several weeks, with related findings correlated automatically. Which service is designed for this task?

Accepted Answer

Amazon Detective automatically ingests CloudTrail, VPC Flow Logs, and GuardDuty findings into a behavior graph with prebuilt visualizations for investigating entities over time. Security Hub aggregates and prioritizes findings but does not build the investigative graph, and Athena requires the analyst to construct queries manually.

SCS-C02 — SCS-C02 AWS Certified Security Specialty Exam Voucher | Buy Online Official Practice Test

Free Practice Test

SCS-C02 practice test — common questions