AWS Certified Security Specialty AWS Certified Security Specialty Free Practice Test — 30 Questions
This practice bank focuses on securing AWS environments against sophisticated threats, with heavy emphasis on S3 data protection, IAM policy evaluation, detective controls, and compliance frameworks (GDPR, PCI DSS, SOX, CCPA). Key decisions involve selecting the correct combination of AWS services for incident response, automated remediation, and continuous compliance monitoring. Knowledge areas include understanding Service Control Policy (SCP) guardrails, CloudTrail data events, GuardDuty anomaly detection, Security Hub aggregation, and KMS key management. The set also tests the ability to implement least privilege and enforce encryption using bucket policies and IAM roles.
What this AWS Certified Security Specialty AWS Certified Security Specialty practice set measures
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
Understanding Access Control and Policy Evaluation
Access control in AWS involves multiple layers: IAM policies, SCPs, bucket policies, and service control policies. The practice bank tests comprehension of how these interact, particularly when an SCP at the root OU denies an action, it overrides IAM allows. Additionally, resource-based policies (like S3 bucket policies) can grant cross-account access. Scenarios require analyzing whether an action will be allowed or denied based on explicit denies, allows, and default denies. The principle of least privilege is a recurring theme, with correct answers often restricting actions to specific resources or conditions.
- SCPs act as guardrails, not granting permissions but setting maximum allowed actions.
- IAM policies are identity-based; resource-based policies grant access to the resource itself.
- How to use condition keys like 's3:x-amz-server-side-encryption' to enforce encryption on upload.
Detective Controls and Incident Response
To detect and respond to threats like data exfiltration, the practice set emphasizes using Amazon GuardDuty for anomaly detection, AWS Security Hub for aggregating findings, AWS CloudTrail for API auditing, and AWS Config for configuration compliance. The correct approach often involves a combination of these services, such as enabling CloudTrail data events for S3 object-level activity and integrating findings into Security Hub. Incident response steps prioritize immediate containment (e.g., modifying bucket policies to revoke public access) followed by forensic analysis using CloudTrail and GuardDuty findings.
- CloudTrail data events are required to log S3 object-level operations like GetObject.
- GuardDuty uses machine learning to detect anomalous API access patterns.
- Security Hub provides a unified view of alerts from multiple AWS services.
Data Protection and Encryption
Protecting data at rest and in transit is critical. The practice bank focuses on using AWS KMS for encryption key management, particularly Customer Managed Keys (CMKs) for compliance with regulations like PCI DSS. Scenarios require configuring S3 bucket policies to enforce encryption on upload using condition keys, and selecting the appropriate encryption method (SSE-KMS vs SSE-S3). Additionally, data in transit is protected by enforcing TLS 1.2+ via Application Load Balancers. KMS key policies and IAM policies must be properly configured to allow only authorized principals to use the CMK.
- Use KMS Customer Managed Keys to meet audit and compliance requirements for key lifecycle.
- S3 bucket policies can deny PutObject if encryption headers do not match required values.
- TLS enforcement for API endpoints is achieved through load balancer configurations.
Compliance and Multi-Account Governance
Organizations with multiple AWS accounts need centralized governance. The practice set covers AWS Control Tower for landing zones, AWS Security Hub for cross-account aggregation of findings, and AWS Config for compliance rules across accounts. SCPs are used to enforce data residency and security baselines. Automated remediation via Security Hub integrating with Config rules (and Lambda) ensures rapid response to misconfigurations. Scenarios often involve meeting GDPR, PCI DSS, or SOX requirements through these services, with correct answers leveraging service-linked roles for cross-account data sharing.
- Security Hub can aggregate findings from member accounts using a service-linked role.
- AWS Control Tower establishes a secure multi-account environment with guardrails.
- Config remediation actions can be triggered automatically from Security Hub findings.
Practice AWS Certified Security Specialty AWS Certified Security Specialty with real flashcards
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Static practice bank
Start the 30-question diagnostic
The complete question bank is embedded in this pre-rendered page. There is no database request or second content download when you begin.
A cybersecurity operations center (SOC) team is experiencing a significant surge in evasive, multi-stage attacks that bypass their existing perimeter defenses and signature-based intrusion detection systems. The current incident response playbook is largely manual and reactive, leading to prolonged detection and remediation times. The team\'s leadership recognizes the need for a fundamental shift in their security strategy to counter these advanced threats effectively. Which of the following strategic adjustments would best equip the SOC to adapt to this evolving threat landscape and improve its overall resilience?
Study workflow
Turn one AWS Certified Security Specialty AWS Certified Security Specialty attempt into a study plan
- 1
Contain a Suspected S3 Data Exfiltration
Immediately modify the S3 bucket policy to deny all public access and revoke any overly permissive statements. Then, enable CloudTrail data events for the affected bucket (if not already enabled) to capture object-level API calls. Review GuardDuty findings for anomalous patterns. Use Security Hub to centralize alerts and initiate an incident response playbook.
- 2
Enforce Encryption on S3 Object Uploads
Create a KMS Customer Managed Key and attach a key policy granting necessary permissions. Attach an S3 bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header set to 'aws:kms' and the key ID matches the CMK ARN. Test the policy with a sample upload to confirm enforcement.
- 3
Set Up Cross-Account Security Hub Aggregation
In the administrator account, enable Security Hub and designate it as the administrator. In member accounts, accept the invitation and enable Security Hub. Use the service-linked role AWS Security Hub provisions in member accounts to automatically share findings. Verify aggregation by checking the administrator account's dashboard for findings from all accounts.
- 4
Automate Remediation of Public S3 Buckets
Create an AWS Config rule (e.g., 's3-bucket-public-read-prohibited') and attach a remediation action using AWS Systems Manager Automation or a Lambda function that applies a bucket policy restricting public access. In Security Hub, configure custom action rules to trigger the remediation automatically when findings from Config appear.
- 5
Audit IAM Policies for Least Privilege on S3
Use AWS IAM Access Analyzer to generate policy findings. Deploy a custom AWS Config rule that evaluates IAM policies for wildcard actions on sensitive S3 buckets (e.g., 's3:GetObject' on 'confidential-bucket'). For non-compliant policies, automatically invoke a Lambda function that removes the wildcard and replaces it with specific ARNs.
FAQ
Questions about this exam practice page
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
How do Service Control Policies (SCPs) interact with IAM policies in AWS Organizations?+
SCPs define the maximum permissions for all IAM principals in the affected accounts. They do not grant permissions; they act as guardrails. If an SCP denies an action, it overrides any IAM allow. IAM policies can only grant permissions that are within the SCP boundaries.
What is the difference between CloudTrail management events and data events for S3?+
Management events log operations on S3 bucket configurations (e.g., creating a bucket). Data events log object-level operations (e.g., GetObject, PutObject) and must be explicitly enabled. For investigating data exfiltration, data events are essential to see which objects were accessed.
How does Amazon GuardDuty detect anomalous S3 activity?+
GuardDuty uses machine learning and threat intelligence to analyze CloudTrail management and data events, VPC Flow Logs, and DNS logs. It identifies unusual patterns such as spikes in read requests from unfamiliar IP ranges or suspicious API calls that may indicate compromise.
What is the role of AWS Config in security compliance?+
How can I enforce that all S3 uploads use a specific KMS key?+
Attach an S3 bucket policy that denies s3:PutObject unless the request includes the condition keys 's3:x-amz-server-side-encryption' (set to 'aws:kms') and 's3:x-amz-server-side-encryption-aws-kms-key-id' matching your CMK ARN. This ensures no object can be uploaded without using the designated key.
Build the next review session
Browse another free bank or use the study strategy guide to turn your misses into spaced review.