SCS-C02 Practice Exam — SCS-C02：Security - specialty

AWS Certified Security - Specialty SCS-C02

Exam information

This exam was retired on December 1, 2025 and merged into SCS-C03.

Many candidates reported that this question bank still covers 25% to 35% of content in the SCS-C03 exam. It is recommended that you study both SCS-C02 and SCS-C03 question banks thoroughly.

Sample questions

SCS-C02 · Q1

Topic 1 Question #1 A company has an AWS Lambda function that creates image thumbnails from larger images. The Lambda function needs read and write access to an Amazon S3 bucket in the same AWS account.Which solutions will provide the Lambda function this access? (Choose two.)

A.
Create an IAM user that has only programmatic access. Create a new access key pair. Add environmental variables to the Lambda function with the access key ID and secret access key. Modify the Lambda function to use the environmental variables at run time during communication with Amazon S3.
B.
Generate an Amazon EC2 key pair. Store the private key in AWS Secrets Manager. Modify the Lambda function to retrieve the private key from Secrets Manager and to use the private key during communication with Amazon S3.
C.
Create an IAM role for the Lambda function. Attach an IAM policy that allows access to the S3 bucket.
D.
Create an IAM role for the Lambda function. Attach a bucket policy to the S3 bucket to allow access. Specify the function's IAM role as the principal.
E.
Create a security group. Attach the security group to the Lambda function. Attach a bucket policy that allows access to the S3 bucket through the security group ID.

Answer: CD

This question tests core IAM and serverless security concepts from the SCS-C02 certification, specifically secure access configuration for Lambda to S3 in the same AWS account. The correct solutions follow AWS security best practices of using temporary, automatically managed credentials instead of long-term access keys, and least-privilege permission scoping. Both option C and D use Lambda execution roles, which are the AWS-recommended identity for Lambda functions to access other AWS services, and implement valid permission models for S3 access, either via identity-based policies attached to the role, or resource-based policies attached to the S3 bucket that grant access to the role principal. Option Analysis: A. Incorrect. Storing long-term IAM user access keys in Lambda environment variables violates AWS IAM security best practices tested in the SCS-C02 exam. This approach introduces unnecessary risk of credential exposure, requires manual credential rotation, and is redundant, as Lambda natively supports temporary credentials via execution roles. B. Incorrect. EC2 key pairs are designed for SSH authentication to EC2 instances, not for authenticating requests to Amazon S3. S3 uses IAM identities for access control, so EC2 private keys have no valid use case for S3 access, making this option technically invalid. C. Correct. Lambda execution roles are the standard, AWS-recommended mechanism for granting Lambda functions permissions to interact with other AWS services. Attaching an identity-based IAM policy with the required S3 read/write permissions directly to the Lambda execution role uses automatically rotated temporary credentials, follows least-privilege principles, and eliminates manual credential management, aligning with SCS-C02 secure IAM configuration requirements. D. Correct. S3 supports resource-based bucket policies that can grant access to specific IAM principals, including Lambda execution roles. When you specify the Lambda execution role as the principal in the S3 bucket policy with the required S3 permissions, Lambda uses the execution role's temporary credentials to authenticate to S3. This is a valid, secure configuration, often used when organizations prefer to centralize S3 access controls in bucket policies, which is a core S3 security concept tested in the exam. E. Incorrect. Security groups are stateful network firewalls that control traffic flow for resources, not IAM access control mechanisms for S3. S3 bucket policies cannot natively filter access based on security group IDs, and security groups do not grant IAM permissions to S3, so this option is invalid for the stated use case. Key Concepts: 1. Lambda Execution Roles: IAM roles that Lambda assumes when running function code, providing temporary, automatically rotated credentials for accessing other AWS services. This eliminates the need for hardcoded long-term credentials, a core security best practice for serverless workloads. 2. S3 Access Permission Models: S3 access can be granted via two valid models: identity-based policies attached to IAM principals (roles, users, groups), or resource-based bucket policies attached directly to S3 buckets that specify the allowed principal and actions. Both models are valid for same-account access use cases. 3. IAM Credential Best Practice: Long-term IAM user access keys are not recommended for service-to-service access. Temporary credentials via IAM roles reduce the risk of credential leakage and eliminate manual rotation overhead, a core identity security concept tested in the SCS-C02 exam. References: AWS Lambda Execution Role, https://docs.aws.amazon.com/lambda/latest/dg/lambda-intro-execution-role.html Using identity-based policies with Amazon S3, https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-iam-policies.html

SCS-C02 · Q2

Topic 1 Question #2 A security engineer is configuring a new website that is named example.com. The security engineer wants to secure communications with the website by requiring users to connect to example.com through HTTPS.Which of the following is a valid option for storing SSL/TLS certificates?

A.
Custom SSL certificate that is stored in AWS Key Management Service (AWS KMS)
B.
Default SSL certificate that is stored in Amazon CloudFront
C.
Custom SSL certificate that is stored in AWS Certificate Manager (ACM)
D.
Default SSL certificate that is stored in Amazon S3

Answer: C

The question requires identifying a valid storage location for an SSL/TLS certificate to enable HTTPS for the custom domain example.com. This aligns with two core SCS-C02 knowledge domains: Domain 2 (Data Protection) and Domain 3 (Infrastructure Security), specifically the requirement to secure data in transit via TLS encryption. The suggested answer is correct because AWS Certificate Manager (ACM) is a purpose-built AWS service designed to issue, renew, and store SSL/TLS certificates for custom domains, with native integration to all common AWS services that terminate TLS connections, including Application Load Balancers, Amazon CloudFront, and Amazon API Gateway. Storing a custom certificate for example.com in ACM allows direct association with these services to enforce HTTPS for end-user connections, fully meeting the scenario requirements. Option Analysis: A. Incorrect. AWS Key Management Service (AWS KMS) is designed for storage and lifecycle management of cryptographic keys used for encryption operations, not for storing SSL/TLS certificates. While KMS can be used to encrypt the private keys associated with certificates stored in ACM, it is not a valid repository for certificates used directly for TLS termination for custom domains, making this option invalid. B. Incorrect. Amazon CloudFront does not store default SSL certificates for custom user domains. The default CloudFront certificate is only applicable to the AWS-owned *.cloudfront.net domain, and cannot be used for a custom domain like example.com. Additionally, CloudFront is a content delivery service, not a certificate storage service, so this option is incorrect. C. Correct. AWS Certificate Manager (ACM) is the official AWS service for managing SSL/TLS certificates for custom domains. Custom certificates issued for or imported into ACM can be directly attached to AWS services that support TLS termination, enabling HTTPS connections to the custom domain example.com as required in the scenario. This aligns with SCS-C02 best practices for in-transit encryption and certificate management. D. Incorrect. Amazon S3 is an object storage service, not a certificate storage service. The default SSL certificate for S3 website endpoints applies only to AWS-owned S3 domain names, not custom user domains like example.com. S3 does not support attaching custom SSL certificates directly to its website endpoints, requiring integration with ACM and CloudFront for custom domain HTTPS, so this option is invalid. Key Concepts: 1. SSL/TLS Certificate Management: AWS Certificate Manager (ACM) is the native AWS service for provisioning, storing, and automating renewal of public and private SSL/TLS certificates, with native integration to AWS services that terminate TLS connections to enable in-transit encryption for workloads. 2. AWS Service Use Case Boundaries: Each AWS service has clearly defined use cases: KMS for cryptographic key management, CloudFront for content delivery, S3 for object storage, and ACM for certificate management. Confusing these boundaries is a common exam distractor. 3. Custom Domain HTTPS Requirements: To enable HTTPS for a custom registered domain on AWS, you must use a valid SSL/TLS certificate issued for that domain, stored in ACM, associated with the TLS termination point for your workload. References: AWS Certificate Manager User Guide - Overview of ACM, https://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html Best Practices for Managing TLS Certificates on AWS Whitepaper

SCS-C02 · Q3

Topic 1 Question #3 A security engineer needs to develop a process to investigate and respond to potential security events on a company's Amazon EC2 instances. All the EC2 instances are backed by Amazon Elastic Block Store (Amazon EBS). The company uses AWS Systems Manager to manage all the EC2 instances and has installed Systems Manager Agent (SSM Agent) on all the EC2 instances.The process that the security engineer is developing must comply with AWS security best practices and must meet the following requirements:A compromised EC2 instance's volatile memory and non-volatile memory must be preserved for forensic purposes.A compromised EC2 instance's metadata must be updated with corresponding incident ticket information.A compromised EC2 instance must remain online during the investigation but must be isolated to prevent the spread of malware.Any investigative activity during the collection of volatile data must be captured as part of the process.Which combination of steps should the security engineer take to meet these requirements with the LEAST operational overhead? (Choose three.)

A.
Gather any relevant metadata for the compromised EC2 instance. Enable termination protection. Isolate the instance by updating the instance's security groups to restrict access. Detach the instance from any Auto Scaling groups that the instance is a member of. Deregister the instance from any Elastic Load Balancing (ELB) resources.
B.
Gather any relevant metadata for the compromised EC2 instance. Enable termination protection. Move the instance to an isolation subnet that denies all source and destination traffic. Associate the instance with the subnet to restrict access. Detach the instance from any Auto Scaling groups that the instance is a member of. Deregister the instance from any Elastic Load Balancing (ELB) resources.
C.
Use Systems Manager Run Command to invoke scripts that collect volatile data.
D.
Establish a Linux SSH or Windows Remote Desktop Protocol (RDP) session to the compromised EC2 instance to invoke scripts that collect volatile data.
E.
Create a snapshot of the compromised EC2 instance's EBS volume for follow-up investigations. Tag the instance with any relevant metadata and incident ticket information.
F.
Create a Systems Manager State Manager association to generate an EBS volume snapshot of the compromised EC2 instance. Tag the instance with any relevant metadata and incident ticket information.

Answer: ACE

This question assesses knowledge of AWS EC2 incident response and forensic best practices, with a focus on minimal operational overhead using existing Systems Manager deployments. The correct combination ACE meets all stated requirements while adhering to AWS security standards: it preserves both volatile and non-volatile memory for forensics, updates instance metadata with incident ticket details, keeps the instance online during investigation while isolating it to prevent malware spread, and captures all investigative activity during volatile data collection. Each selected option leverages pre-configured tooling and low-effort operations to meet requirements without unnecessary administrative work. Option Analysis: A. Correct. This option delivers the required isolation with minimal operational overhead: enabling termination protection prevents accidental deletion of the compromised instance, updating security groups to restrict access isolates the instance without taking it offline, and detaching from Auto Scaling Groups and deregistering from load balancers stops production traffic from reaching the instance or triggering automatic replacement of the instance. This approach is far lower effort than moving the instance to a separate isolation subnet, making it the optimal choice for low overhead. B. Incorrect. Moving an EC2 instance to an isolation subnet requires modifying ENI subnet associations, potential IP address reconfiguration, and additional network changes that introduce unnecessary operational overhead compared to simply updating security group rules. Both approaches deliver equivalent isolation, so this option fails the least operational overhead requirement. C. Correct. Since SSM Agent is already installed on all instances, Systems Manager Run Command allows the security engineer to run volatile data collection scripts without opening inbound SSH/RDP ports on the instance. All Run Command execution activity is natively logged to AWS CloudTrail, which satisfies the requirement to capture all investigative activity during volatile data collection, with no additional access configuration required. D. Incorrect. Establishing SSH/RDP sessions to the compromised instance requires opening inbound ports for these protocols, which introduces additional risk of attacker exploitation and increases operational overhead of managing access to the compromised host. It also lacks the native, consistent audit logging provided by SSM Run Command, so it fails both security and overhead requirements. E. Correct. EBS snapshots are point-in-time copies of non-volatile EBS volume data, which preserves non-volatile memory for follow-up forensic investigations. Tagging the instance with incident ticket information directly updates the instance's metadata as required, and this is a one-off, low-effort operation that requires no additional persistent configuration. F. Incorrect. Systems Manager State Manager is designed for persistent, recurring configuration enforcement, not one-off incident response tasks like creating a single forensic snapshot. Setting up a State Manager association for this use case introduces unnecessary operational overhead for a temporary, single-use task, making it less optimal than the one-step snapshot process in option E. Key Concepts: 1. EC2 Incident Response Forensics Best Practices: AWS recommends preserving volatile memory by keeping compromised instances running during initial investigation, isolating instances without shutting them down, enabling termination protection to avoid accidental evidence loss, and maintaining immutable audit logs of all investigative activity. 2. AWS Systems Manager Run Command: A managed capability that enables secure, auditable command execution on EC2 instances without requiring open inbound ports or direct user access to the instance, with all execution activity logged to CloudTrail for compliance and incident tracking. 3. EBS Forensic Snapshots: Point-in-time, read-only copies of EBS volumes that preserve non-volatile disk data for forensic analysis. Snapshots can be copied to isolated security accounts for investigation without modifying or impacting the original compromised instance or EBS volume. References: AWS Security Incident Response Guide, https://docs.aws.amazon.com/whitepapers/latest/aws-security-incident-response-guide/aws-security-incident-response-guide.html AWS Systems Manager Run Command Documentation, https://docs.aws.amazon.com/systems-manager/latest/userguide/execute-remote-commands.html

SCS-C02 · Q4

Topic 1 Question #4 A company has an organization in AWS Organizations. The company wants to use AWS CloudFormation StackSets in the organization to deploy various AWS design patterns into environments. These patterns consist of Amazon EC2 instances, Elastic Load Balancing (ELB) load balancers, Amazon RDS databases, and Amazon Elastic Kubernetes Service (Amazon EKS) clusters or Amazon Elastic Container Service (Amazon ECS) clusters.Currently, the company’s developers can create their own CloudFormation stacks to increase the overall speed of delivery. A centralized CI/CD pipeline in a shared services AWS account deploys each CloudFormation stack.The company's security team has already provided requirements for each service in accordance with internal standards. If there are any resources that do not comply with the internal standards, the security team must receive notification to take appropriate action. The security team must implement a notification solution that gives developers the ability to maintain the same overall delivery speed that they currently have.Which solution will meet these requirements in the MOST operationally efficient way?

A.
Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the security team's email addresses to the SNS topic. Create a custom AWS Lambda function that will run the aws cloudformation validate-template AWS CLI command on all CloudFormation templates before the build stage in the CI/CD pipeline. Configure the CI/CD pipeline to publish a notification to the SNS topic if any issues are found.
B.
Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the security team's email addresses to the SNS topic. Create custom rules in CloudFormation Guard for each resource configuration. In the CI/CD pipeline, before the build stage, configure a Docker image to run the cfn-guard command on the CloudFormation template. Configure the CI/CD pipeline to publish a notification to the SNS topic if any issues are found.
C.
Create an Amazon Simple Notification Service (Amazon SNS) topic and an Amazon Simple Queue Service (Amazon SQS) queue. Subscribe the security team's email addresses to the SNS topic. Create an Amazon S3 bucket in the shared services AWS account. Include an event notification to publish to the SQS queue when new objects are added to the S3 bucket. Require the developers to put their CloudFormation templates in the S3 bucket. Launch EC2 instances that automatically scale based on the SQS queue depth. Configure the EC2 instances to use CloudFormation Guard to scan the templates and deploy the templates if there are no issues. Configure the CI/CD pipeline to publish a notification to the SNS topic if any issues are found.
D.
Create a centralized CloudFormation stack set that includes a standard set of resources that the developers can deploy in each AWS account. Configure each CloudFormation template to meet the security requirements. For any new resources or configurations, update the CloudFormation template and send the template to the security team for review. When the review is completed, add the new CloudFormation stack to the repository for the developers to use.

Answer: B

This scenario requires a solution that validates CloudFormation templates against custom internal security standards, alerts the security team of non-compliance, maintains existing developer delivery speed, and is operationally efficient. The suggested answer B leverages native AWS policy-as-code tooling integrated directly into the existing centralized CI/CD pipeline to meet all requirements. CloudFormation Guard is purpose-built to define custom rules that align with internal security standards for EC2, ELB, RDS, EKS, and ECS resources covered in the scenario. Running the validation in the pre-build stage of the existing pipeline does not require changes to developer workflows, so delivery speed remains unchanged. SNS notifications to the security team for non-compliant templates satisfy the alert requirement, and the solution uses existing pipeline infrastructure with minimal additional overhead, making it the most operationally efficient option. This approach aligns with SCS-C02 core domains of infrastructure security, DevSecOps shift-left controls, and security monitoring. Option Analysis: A. Incorrect. The aws cloudformation validate-template CLI command only validates CloudFormation template syntax and basic structural correctness, it cannot evaluate resource configurations against custom internal security standards. This means it will fail to detect non-compliant resource settings such as unencrypted RDS instances, public-facing EC2 instances, or overly permissive load balancer security groups, which is the core requirement of the scenario. B. Correct. CloudFormation Guard is a native AWS policy-as-code tool designed explicitly to evaluate CloudFormation templates against custom security and operational rules, which directly maps to the internal security standards requirement. Integrating the cfn-guard scan into the pre-build stage of the existing CI/CD pipeline requires no changes to developer workflows, so delivery speed is maintained. SNS notifications to the security team for non-compliant templates meet the alert requirement, and the solution has minimal operational overhead as it leverages existing pipeline infrastructure. C. Incorrect. This solution introduces unnecessary, high-overhead infrastructure including an S3 bucket, SQS queue, and auto-scaling EC2 instances to perform template scanning, which increases operational complexity and cost. It also requires developers to change their existing workflow to upload templates to the designated S3 bucket, which will slow down delivery speed, violating the scenario requirements. It is far less operationally efficient than integrating validation directly into the existing CI/CD pipeline. D. Incorrect. This approach restricts developers to only use pre-approved centralized StackSets, removing their existing ability to create their own CloudFormation stacks. The required manual security review for new template configurations introduces significant latency, which drastically reduces delivery speed, violating the core requirement to maintain existing developer delivery speed. Key Concepts: 1. Infrastructure as Code (IaC) Security Validation: This SCS-C02 core concept covers evaluating IaC templates against security policies prior to deployment to prevent misconfigurations, a key DevSecOps best practice. CloudFormation Guard is the native AWS tool for building and enforcing custom policy rules for CloudFormation templates. 2. Shift-Left Security in CI/CD Pipelines: This principle, tested extensively in the Security Specialty exam, involves embedding security controls early in the software delivery lifecycle to avoid disrupting development velocity. Integrating security checks directly into existing CI/CD workflows ensures controls are enforced without slowing delivery. 3. Security Alerting with Amazon SNS: SNS is a foundational AWS service for targeted, real-time security notifications, a core component of security monitoring and incident response domains covered in the SCS-C02 exam. References: AWS CloudFormation Guard User Guide, https://docs.aws.amazon.com/cfn-guard/latest/ug/what-is-guard.html AWS Well-Architected Framework DevSecOps Lens: CI/CD Pipelines

SCS-C02 · Q5

Topic 1 Question #5 A company is migrating one of its legacy systems from an on-premises data center to AWS. The application server will run on AWS, but the database must remain in the on-premises data center for compliance reasons. The database is sensitive to network latency. Additionally, the data that travels between the on-premises data center and AWS must have IPsec encryption.Which combination of AWS solutions will meet these requirements? (Choose two.)

A.
AWS Site-to-Site VPN
B.
AWS Direct Connect
C.
AWS VPN CloudHub
D.
VPC peering
E.
NAT gateway

Answer: AB

The scenario defines two non-negotiable requirements for hybrid connectivity: consistent low network latency to support the latency-sensitive on-premises database, and IPsec encryption for all data traveling between AWS and the on-premises data center. The combination of AWS Direct Connect and AWS Site-to-Site VPN satisfies both requirements aligned with AWS Security Specialty best practices for hybrid network architecture. Direct Connect provides a dedicated, private physical connection between the on-premises data center and AWS, eliminating the variable latency and jitter associated with public internet connectivity to deliver the stable performance required for the database. Running AWS Site-to-Site VPN over the Direct Connect connection adds the mandatory IPsec encryption for in-transit data, without introducing the performance penalties of running a VPN over the public internet. This pairing is a standard well-architected pattern for security and performance sensitive hybrid workloads that meet compliance obligations for encryption and low latency. Option Analysis: A. AWS Site-to-Site VPN: Correct. This service natively uses IPsec protocol to encrypt all traffic between on-premises networks and AWS VPCs, directly satisfying the requirement for IPsec encryption of data in transit. When deployed over a Direct Connect connection instead of the public internet, it retains its encryption capabilities while avoiding the latency associated with public internet transport, making it ideal for this scenario. B. AWS Direct Connect: Correct. This service provides a dedicated, private network link between the on-premises data center and AWS, delivering consistent, low latency connectivity that meets the performance requirements of the latency-sensitive database. It serves as the underlying high-performance transport for the Site-to-Site VPN connection to avoid public internet performance limitations. C. AWS VPN CloudHub: Incorrect. VPN CloudHub is a hub-and-spoke architecture designed to connect multiple geographically dispersed on-premises sites to AWS and to each other, for multi-site connectivity use cases. It does not address the low latency requirement as it operates over the public internet by default, and is unnecessary for the single on-premises data center to AWS connection described in the scenario. D. VPC peering: Incorrect. VPC peering is a service that enables private connectivity between two AWS VPCs, and does not support connectivity between AWS VPCs and on-premises data centers, so it is irrelevant to this hybrid use case. E. NAT gateway: Incorrect. NAT gateway is a managed service that provides outbound internet access for resources in private VPC subnets, and does not facilitate encrypted, low latency connectivity between on-premises environments and AWS, so it does not meet any of the stated requirements. Key Concepts: 1. Hybrid Connectivity Security: This Security Specialty domain covers evaluating and selecting connectivity options between on-premises and AWS environments that align with performance, security, and compliance requirements, including tradeoffs between latency, cost, and encryption capabilities. 2. In-Transit Encryption for Hybrid Workloads: IPsec is a standardized protocol for encrypting IP layer network traffic, and AWS Site-to-Site VPN is the native AWS service that implements IPsec encryption for traffic between on-premises networks and AWS, a common control required for compliance with data protection regulations. 3. Direct Connect and VPN Integration: AWS supports deploying Site-to-Site VPN over Direct Connect virtual interfaces to combine the low, consistent latency of dedicated Direct Connect connections with the IPsec encryption provided by Site-to-Site VPN, a validated pattern for sensitive hybrid workloads. References: AWS Site-to-Site VPN User Guide, https://docs.aws.amazon.com/vpn/latest/s2svpn/what-is.html AWS Direct Connect User Guide: Configure a Site-to-Site VPN over Direct Connect, https://docs.aws.amazon.com/directconnect/latest/UserGuide/set-ipsec-vpn.html

FAQ

How many practice questions are available for SCS-C02?

This question bank includes 307 SCS-C02 practice questions covering single and multiple choice, each with answers and explanations.

Are SCS-C02 practice questions available in Chinese and English?

Yes, SCS-C02 practice questions are provided in both Chinese and English.

Can I try SCS-C02 practice questions for free?

Yes. Free sample questions are available on this page, and the full question bank is available after signing up on Zhangxuetu.

Try practice questions Get the question bank

SCS-C02 Practice Exam — SCS-C02：Security - specialty

Exam information

Sample questions

FAQ

Related exams