Amazon SCS-C02 AWS Certified Security – Specialty (SCS-C02) Free Practice Test — 30 Questions
This practice bank covers core security concepts tested in the AWS Certified Security – Specialty (SCS-C02) exam. It includes risk assessment frameworks (NIST CSF, RMF), compliance standards (PCI-DSS, HIPAA, GDPR), and AWS security services (CloudTrail, Systems Manager, PrivateLink, KMS, IAM). You will encounter scenario-based questions that require applying least privilege, defense in depth, encryption strategies, and automated remediation. The set also tests understanding of the shared responsibility model and zero trust architecture. Use this analysis to reinforce decision-making in real-world AWS security scenarios.
What this SCS-C02 practice set measures
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
Risk Management and Compliance Frameworks
Multiple questions test your ability to apply risk scores (likelihood × impact) and prioritize risks. For example, data breaches with likelihood 4 and impact 5 yield the highest risk score of 20. The NIST Cybersecurity Framework's Identify function requires comprehensive risk assessments, while the Protect function is exemplified by implementing multi-factor authentication. You must distinguish between actions that align with framework phases.
- Calculate risk scores by multiplying likelihood and impact; higher scores indicate greater risk.
- The Identify function involves asset identification and risk assessment; Protect involves safeguards like MFA.
- PCI-DSS compliance demands active remediation (e.g., input validation for SQLi) not just scanning.
- CIS Control 1 prioritizes comprehensive, regularly updated hardware and software inventories.
Encryption and Key Management
Encryption questions emphasize using TLS for data in transit and AES-256 for data at rest, with secure key management via AWS KMS. In serverless architectures, both S3 encryption (at rest) and HTTPS (in transit) are required. The shared responsibility model places data encryption and access control on the customer, while AWS secures the infrastructure. Avoid app-level encryption without centralized key management.
- TLS for data in transit and AES-256 with KMS for data at rest is a comprehensive encryption strategy.
- In serverless, use KMS for S3 encryption and enable HTTPS; default S3 encryption alone is insufficient.
- Customer manages encryption and compliance; AWS provides secure infrastructure.
- Relying solely on HTTPS without a key management system is a security gap.
AWS Security Services for Automation and Monitoring
AWS Systems Manager automation documents can remediate non-compliant instances by applying patches via scheduled runs. CloudTrail combined with Lambda and SNS enables real-time alerts on unauthorized API calls. SOAR platforms integrate SIEM and ticketing for automated incident response with audit trails. CloudWatch alarms and log retention settings fulfill regulatory logging requirements.
- Create Systems Manager Automation documents and schedule them to apply patches automatically.
- CloudTrail logs + Lambda trigger + SNS alerts provide real-time security monitoring.
- SOAR platforms automate workflows and maintain audit trails for compliance.
- Configure CloudWatch alarms on CloudTrail logs and set log retention to 18 months.
Identity and Access Management (IAM) and Zero Trust
IAM policies with MFA requirement attached to roles enforce least privilege. Zero Trust Architecture uses dynamic access control evaluating identity, context, and data sensitivity in real time. AWS Managed Microsoft AD provides full compatibility for migrating Active Directory. Role-based access control (RBAC) is preferred over shared accounts or overly broad bucket policies.
- Attach IAM policies requiring MFA to roles for fine-grained, role-based access.
- Zero Trust requires dynamic evaluation of user identity, context, and data sensitivity.
- AWS Managed Microsoft AD offers full Microsoft AD features and automated maintenance.
- RBAC ensures users only have necessary permissions; avoid shared accounts or broad policies.
Practice Amazon SCS-C02 AWS Certified Security – Specialty (SCS-C02) with real flashcards
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Static practice bank
Start the 30-question diagnostic
The complete question bank is embedded in this pre-rendered page. There is no database request or second content download when you begin.
A financial institution is in the process of implementing a Risk Management Framework (RMF) to enhance its security posture. The institution has identified several risks associated with its cloud services, including data breaches, compliance violations, and service disruptions. As part of the RMF, the institution must prioritize these risks based on their potential impact and likelihood. If the institution assigns a likelihood score of 4 (on a scale of 1 to 5) to data breaches, an impact score of 5 for compliance violations, and a likelihood score of 3 for service disruptions with an impact score of 4, which risk should the institution prioritize for mitigation based on a risk assessment matrix that uses the formula: Risk Score = Likelihood × Impact?
Study workflow
Turn one SCS-C02 attempt into a study plan
- 1
Calculate Risk Scores
Multiply likelihood (1-5) by impact (1-5) to get a risk score. Prioritize risks with the highest scores. For example, likelihood 4 × impact 5 = 20. Use this method to compare data breaches, compliance violations, and service disruptions.
- 2
Apply the NIST Cybersecurity Framework
Map each security action to the appropriate CSF function: Identify (risk assessment), Protect (safeguards like MFA), Detect (monitoring), Respond (incident handling), Recover (restoration). Focus on actions that align with the function's purpose.
- 3
Remediate EC2 Compliance with Systems Manager
Create an Automation document that checks for missing patches and applies them. Associate it with a compliance rule in Systems Manager Compliance, or schedule the document to run periodically. This automates patch remediation across instances.
- 4
Set Up Real-Time Security Alerts
Enable CloudTrail to log API calls. Create a Lambda function that filters logs for unauthorized access attempts (e.g., AccessDenied errors). Configure the Lambda to publish to an SNS topic that alerts the security team. Retain logs for required duration (e.g., 18 months).
- 5
Implement Least Privilege with MFA
Define IAM roles based on job functions. Create a policy that allows necessary actions on sensitive resources and requires MFA. Attach the policy to the role, not individual users, to simplify management and enforce authentication.
FAQ
Questions about this SCS-C02 practice page
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
How do I choose between AWS PrivateLink and VPN for connecting on-premises to AWS?+
PrivateLink creates private endpoints within your VPC, keeping traffic off the public internet and reducing exposure. VPN uses the public internet with encryption but may introduce latency. For compliance and minimal risk, PrivateLink is preferred when accessing AWS services privately.
In Zero Trust, what does dynamic access control mean?+
Dynamic access control evaluates the user's identity, request context (time, device, location), and data sensitivity in real time before granting access. This enforces least privilege and prevents lateral movement, aligning with PCI-DSS and GDPR requirements.
What is the difference between Security Groups and Network ACLs for restricting access?+
When using a third-party payment processor, how do I ensure PCI-DSS compliance?+
Verify the processor is PCI-DSS compliant and assessed by a Qualified Security Assessor (QSA). Avoid storing cardholder data unless absolutely necessary and compliant. Use strong authentication and minimize storage to reduce breach impact.
What is the primary benefit of AWS KMS over client-side encryption?+
AWS KMS centralizes key management, automates key rotation, and integrates with AWS services. Client-side encryption adds complexity and requires you to manage keys yourself. KMS ensures secure key storage and access control, reducing the risk of key compromise.
Build the next review session
Browse another free bank or use the study strategy guide to turn your misses into spaced review.