Amazon AWS Certified Security - Specialty (SCS-C01) Free Practice Test - 20 Questions
This practice set of 20 questions covers core security domains for the AWS Security Specialty exam. It tests your ability to design secure authorization mechanisms, implement data-at-rest controls, configure network security, and use monitoring and compliance services. You will encounter scenarios involving IAM policies, KMS, S3 encryption, VPC security, AWS Config, GuardDuty, and more. The explanations clarify why certain answers are correct, especially the overriding effect of explicit denies in IAM and the cross-account permissions required for services like KMS and S3 replication. Use this deck to reinforce your understanding of key concepts and decision points, but note that this is not an official exam blueprint.
What this SCS-C01 practice set measures
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
IAM and Authorization Mechanisms
This section from the practice bank emphasizes the nuances of AWS IAM policy evaluation. The first question highlights that an explicit deny overrides any allow, even if the allow is on a user policy and the deny comes from a group. Other questions test cross-account access for KMS keys (requiring key policy permissions and service-specific policies) and the use of IAM roles for EC2 instances to avoid storing long-term credentials. The region restriction question uses the 'aws:RequestedRegion' condition key. SCPs (Service Control Policies) are shown as a way to enforce account-wide restrictions, such as preventing CloudTrail from being disabled.
- Explicit deny always overrides any allow in IAM policy evaluation.
- Cross-account KMS access requires the key policy to allow the external principal.
- IAM roles with instance profiles provide secure temporary credentials for EC2.
- Use 'aws:RequestedRegion' condition to restrict actions to a specific region.
Data-at-Rest Encryption Controls
Multiple questions focus on encryption at rest using S3 and KMS. The practice bank covers enforcing a specific KMS key for S3 uploads via the 's3:x-amz-server-side-encryption-aws-kms-key-id' condition. It also compares SSE-S3 (simple default encryption) with SSE-KMS (more control but overhead). Automatic key rotation for customer-managed CMKs is discussed as a cost-effective compliance measure. The use of CloudHSM for dedicated hardware control is tested, along with the need to back up CloudHSM keys to a second HSM in another region for disaster recovery. Cross-account S3 replication with SSE-KMS requires proper KMS permissions on both source and destination keys.
- Use 's3:x-amz-server-side-encryption-aws-kms-key-id' to enforce a specific KMS key.
- SSE-S3 with a bucket policy denying unencrypted uploads is less overhead than SSE-KMS.
- Customer-managed CMKs can be automatically rotated annually at no extra cost.
- CloudHSM provides dedicated hardware; back up keys to another HSM in a different region.
Logging, Monitoring, and Incident Detection
The practice bank tests features for long-term log integrity, network traffic analysis, and threat detection. CloudTrail log file validation uses SHA-256 hashing and digital signatures to verify integrity over time. VPC Flow Logs capture network metadata (IPs, ports, protocols) to diagnose connectivity issues. GuardDuty findings like communication with malicious IPs indicate possible malware on EC2 instances. AWS Config with automatic remediation (via Systems Manager Automation) can correct configuration drift, such as public S3 buckets. Inspector assessments highlight vulnerabilities like outdated OSes. WAF IP sets block malicious IP addresses.
- CloudTrail log file validation ensures long-term integrity with hashing and signatures.
- VPC Flow Logs provide network traffic metadata for analysis.
- GuardDuty detects indicators of compromise such as communication with known malicious IPs.
- AWS Config with automation remediates non-compliant resource configurations.
Network Security and Application Security
This section covers fundamental VPC security distinctions: security groups are stateful and allow-only, while network ACLs are stateless and allow/deny. It also tests AWS WAF rule types (IP set match for blocking IPs), ACM certificate regionality (must request in each region), Secrets Manager for automatic rotation of database credentials, and CloudHSM backup strategies. The practice bank reinforces that understanding these differences is critical for designing secure network architectures and managing secrets and certificates properly.
- Security groups are stateful; NACLs are stateless.
- WAF IP set match conditions block or allow specific IPs.
- ACM certificates are region-specific; request separate certificates per region.
- Secrets Manager automatically rotates database credentials.
Practice Amazon AWS Certified Security - Specialty (SCS-C01) with real flashcards
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Static practice bank
Start the 20-question diagnostic
The complete question bank is embedded in this pre-rendered page. There is no database request or second content download when you begin.
A security engineer is reviewing an IAM policy attached to a user. The policy allows 's3:GetObject' on 'arn:aws:s3:::example-bucket/*'. There is also a deny-all policy attached via a group. Which of the following describes the effective access?
Show hint
Design and implement a scalable and secure authorization mechanism
Study workflow
Turn one SCS-C01 attempt into a study plan
- 1
Create an IAM Role for EC2 to Access S3
1. Open IAM console and create a new role for EC2. 2. Attach a policy that grants necessary S3 permissions. 3. Name the role and create it. 4. Launch an EC2 instance and assign the IAM role via instance profile. 5. The instance will automatically retrieve temporary credentials from the instance metadata service. No long-term keys are stored on the instance.
- 2
Enforce SSE-KMS on S3 Uploads for a Specific Key
1. Identify the KMS key ARN you want to enforce. 2. Write an S3 bucket policy with a Deny effect that uses the condition 's3:x-amz-server-side-encryption-aws-kms-key-id' with StringNotEquals the key ARN. 3. Also include a condition to require encryption (e.g., 's3:x-amz-server-side-encryption' equals 'aws:kms'). 4. Attach the policy to the bucket. 5. Test by uploading without the proper key encryption; the request should be denied.
- 3
Enable Automatic Remediation for Public S3 Buckets Using AWS Config
1. Open AWS Config console and ensure recording is on. 2. Create a Config rule that checks if S3 bucket public access is blocked (e.g., rule 's3-bucket-public-read-prohibited'). 3. In the remediation action, choose an AWS Systems Manager Automation document that sets the bucket to private. 4. Configure auto-remediation to run when non-compliant. 5. Test by making a bucket public; Config will trigger remediation automatically.
- 4
Set Up Cross-Account S3 Replication with SSE-KMS
1. In the source account, create an IAM role with permissions to read from the source bucket and to use the source KMS key (kms:Decrypt, kms:GenerateDataKey). 2. In the destination account, create a bucket and a KMS key (if needed). 3. Update the source KMS key policy to allow the replication role from the source account. 4. Configure S3 replication on the source bucket, specifying the destination bucket and the IAM role. 5. Ensure the destination bucket policy allows replication from the source account.
- 5
Store and Automatically Rotate Database Credentials with Secrets Manager
1. Open Secrets Manager console and choose 'Store a new secret'. 2. Select 'Credentials for RDS database' and enter username/password. 3. Select the RDS instance and set the rotation period (e.g., 30 days). 4. Secrets Manager will create a Lambda function to rotate credentials. 5. Access the secret via API calls in your application – Secrets Manager returns current credentials and automatically updates them on schedule.
FAQ
Questions about this SCS-C01 practice page
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
What is the difference between an explicit deny and an implicit deny in IAM?+
An explicit deny is a statement in a policy that denies an action, and it overrides any allow. An implicit deny occurs when no allow statement permits an action, but it can be overridden by an explicit allow. The practice set question 1 demonstrates that an explicit deny from a group policy overrides an explicit allow on a user policy.
Can I use a KMS grant to give cross-account access to a KMS key?+
No, KMS grants are account-specific and cannot be used cross-account. For cross-account access, you must modify the key policy to include the external account or principal as a user. The practice set question 3 clarifies that a key policy must explicitly allow the external role.
How does CloudTrail log file integrity validation work?+
CloudTrail creates digest files that are hashed and signed with a private key. You can verify the log files by comparing their SHA-256 hashes against the digests. This ensures the logs have not been modified since delivery. Question 4 in the practice set confirms this feature is for long-term integrity.
What is the advantage of using SSE-S3 over SSE-KMS for S3 encryption?+
SSE-S3 uses Amazon-managed keys and does not require you to manage KMS keys, permissions, or costs. It also automatically enables default encryption on the bucket with no overhead. The practice set question 13 highlights that SSE-S3 with a bucket policy denying unencrypted uploads is the least configuration overhead approach.
Why are ACM certificates region-specific?+
ACM stores certificates in the region where they are requested. To serve traffic from multiple regions, you need a separate certificate per region. CloudFront can use a certificate from US East (N. Virginia) only, but for regional Elastic Load Balancers or API Gateways, you must request a certificate in each region. This is covered in the practice set question 15.
Build the next review session
Browse another free bank or use the study strategy guide to turn your misses into spaced review.