AWS SCS-C03 · Updated 2026
Free AWS Security Specialty Practice Exam (SCS-C03)
Full-length SCS-C03 mock exams with the same number of questions and time as the real exam. Detection, incident response, infrastructure, IAM, data protection and governance scenarios, answers explained, and your score by domain.
1. Choose a set
2. Choose a mode
65 questions · 2 hours 50 min · same as the real exam
You have an unfinished attempt on this set.
Questions 1–10Page 1 of 7
🏆
Question 1Data Protection
Brightvale Media stores customer invoices in an Amazon S3 bucket. A recent audit found that some internal scripts upload objects over plain HTTP. The security team must ensure that every request to the bucket uses TLS, regardless of which IAM principal makes it. The solution must require the least ongoing effort. Which solution BEST meets these requirements?
Correct answer: C. Add a bucket policy statement that denies all S3 actions when aws:SecureTransport is false.
A bucket policy Deny on aws:SecureTransport false applies to every principal and blocks any request that does not use TLS. IAM policies on individual roles miss other principals and must be maintained one by one. Default encryption protects data at rest, not in transit.
A bucket policy Deny on aws:SecureTransport false applies to every principal and blocks any request that does not use TLS. IAM policies on individual roles miss other principals and must be maintained one by one. Default encryption protects data at rest, not in transit.
Question 2Detection
Brightfield Media runs 60 AWS accounts in AWS Organizations and adds new accounts every month. The security team must capture management events from every account and every Region in one S3 bucket in a dedicated log archive account. New accounts must be covered automatically. Which solution BEST meets these requirements with the LEAST operational overhead?
Correct answer: B. Create an organization trail in the management account that writes to the log archive bucket.
An organization trail logs activity for all member accounts, including new ones, and can deliver to a bucket owned by another account. A StackSet also works but adds deployment overhead and lets account admins modify their local trails.
An organization trail logs activity for all member accounts, including new ones, and can deliver to a bucket owned by another account. A StackSet also works but adds deployment overhead and lets account admins modify their local trails.
Question 3Identity & Access
Harbor Lane Logistics runs 60 AWS accounts in AWS Organizations and manages its workforce in an external identity provider that supports SAML 2.0 and SCIM. Engineers must sign in once and reach the accounts they need with role-based access. When an employee leaves, access to every account must end as soon as HR disables the user. Which solution BEST meets these requirements with the least operational overhead?
Correct answer: D. Connect IAM Identity Center to the identity provider as an external IdP, enable SCIM provisioning, and assign permission sets to groups.
IAM Identity Center with an external IdP and SCIM keeps users and groups in sync automatically, so disabling a user in the IdP removes access everywhere. Per-account SAML roles also work, but configuring 60 accounts separately adds far more operational overhead.
IAM Identity Center with an external IdP and SCIM keeps users and groups in sync automatically, so disabling a user in the IdP removes access everywhere. Per-account SAML roles also work, but configuring 60 accounts separately adds far more operational overhead.
Question 4Infrastructure Security
A media company serves static files from an Amazon S3 bucket through an Amazon CloudFront distribution. A security review found that users can bypass CloudFront and download objects directly from the bucket. The objects are encrypted with SSE-KMS using a customer managed key. The company must make the objects reachable only through the distribution with the least operational overhead. Which solution BEST meets these requirements?
Correct answer: A. Use origin access control, scope the bucket and key policies to the distribution ARN, and block public access.
Origin access control signs origin requests with SigV4, supports SSE-KMS objects, and lets the bucket and key policies trust only the CloudFront service principal for that distribution. An origin access identity does not support objects encrypted with SSE-KMS, so it fails the encryption constraint.
Origin access control signs origin requests with SigV4, supports SSE-KMS objects, and lets the bucket and key policies trust only the CloudFront service principal for that distribution. An origin access identity does not support objects encrypted with SSE-KMS, so it fails the encryption constraint.
Question 5Data Protection
Kestrel Logistics runs internal microservices behind internal Application Load Balancers. The services use private DNS names that are not resolvable on the internet. The security team needs TLS certificates for these names, wants certificates to renew automatically, and does not want to operate its own certificate authority software on EC2. Which solution BEST meets these requirements?
Correct answer: B. Issue private certificates through AWS Certificate Manager from an AWS Private CA and attach them to the listeners.
AWS Private CA is a managed private CA, and private certificates issued through ACM are renewed by ACM automatically. Public ACM certificates require domain validation of publicly controlled names, which does not work for private-only names. Imported certificates, including self-signed ones, are not renewed by ACM.
AWS Private CA is a managed private CA, and private certificates issued through ACM are renewed by ACM automatically. Public ACM certificates require domain validation of publicly controlled names, which does not work for private-only names. Imported certificates, including self-signed ones, are not renewed by ACM.
Question 6Detection
Kestrel Health stores lab reports in one S3 bucket. The security team needs a near real-time alert, with the calling IAM identity, whenever an object in that bucket is downloaded. An existing multi-Region trail records only management events. Which solution BEST meets these requirements?
Correct answer: A. Log S3 data events for that bucket on the trail and match GetObject with an EventBridge rule.
GetObject is a data event, so the trail must log data events for the bucket before EventBridge can match it. Server access logs are delivered on a best-effort basis, often hours later, so they cannot support near real-time alerting.
GetObject is a data event, so the trail must log data events for the bucket before EventBridge can match it. Server access logs are delivered on a best-effort basis, often hours later, so they cannot support near real-time alerting.
Question 7Identity & Access
Northwind Analytics uses IAM Identity Center. An administrator creates a permission set that references a customer managed policy named DataReadOnly and assigns it to 12 accounts. Provisioning succeeds in two accounts but fails in the other ten. The policy must stay a customer managed policy so account owners can see it. What should the administrator do?
Correct answer: D. Create DataReadOnly with the same name and path in the ten accounts, then reprovision the permission set.
A permission set only stores a reference to a customer managed policy, so a policy with the same name and path must already exist in every account where the permission set is provisioned. An inline policy would fix provisioning, but it breaks the stated requirement to keep a customer managed policy.
A permission set only stores a reference to a customer managed policy, so a policy with the same name and path must already exist in every account where the permission set is provisioned. An inline policy would fix provisioning, but it breaks the stated requirement to keep a customer managed policy.
Question 8Data Protection
Fernhill Health has a production Amazon RDS for PostgreSQL DB instance that was created without encryption. A new compliance rule requires the database to be encrypted at rest with a customer managed AWS KMS key. A short maintenance window is acceptable. Which approach BEST meets the requirement?
Correct answer: A. Take a snapshot, copy it with encryption using the customer managed key, and restore a new instance from the copy.
RDS cannot enable encryption on an existing unencrypted instance, but an encrypted copy of a snapshot can be restored as a new encrypted instance. You also cannot create an encrypted read replica from an unencrypted instance in the same way. EBS default encryption does not apply to existing RDS storage.
RDS cannot enable encryption on an existing unencrypted instance, but an encrypted copy of a snapshot can be restored as a new encrypted instance. You also cannot create an encrypted read replica from an unencrypted instance in the same way. EBS default encryption does not apply to existing RDS storage.
Question 9Infrastructure Security
An online retailer exposes a login API behind an Application Load Balancer. The API receives credential stuffing traffic, with some source IP addresses sending thousands of requests per minute. Legitimate users rarely send more than a few login requests in a short period. The company wants abusive IP addresses blocked automatically on the login path only, without affecting any other path. Which solution BEST meets these requirements?
Correct answer: C. Add an AWS WAF rate-based rule with a scope-down statement that matches the login URI path.
A rate-based rule counts requests per source IP and blocks offenders automatically, and a scope-down statement limits counting to the login path. Shield Advanced automatic mitigation protects the whole resource against DDoS patterns and is not a path-specific control for credential stuffing.
A rate-based rule counts requests per source IP and blocks offenders automatically, and a scope-down statement limits counting to the login path. Shield Advanced automatic mitigation protects the whole resource against DDoS patterns and is not a path-specific control for credential stuffing.
Question 10Detection
Orchid Retail sends its CloudTrail trail to a CloudWatch Logs log group. The security team wants an email when more than five failed AWS Management Console sign-ins occur within 10 minutes. They want to use native services and avoid writing code. Which solution BEST meets these requirements?
Correct answer: A. Create a metric filter for failed ConsoleLogin events and an alarm with a threshold of five in 10 minutes.
A metric filter turns matching log events into a metric, and a CloudWatch alarm can apply a count threshold over a time window. An EventBridge rule fires on each event individually and cannot count events across a window.
A metric filter turns matching log events into a metric, and a CloudWatch alarm can apply a count threshold over a time window. An EventBridge rule fires on each event individually and cannot count events across a window.
Question 11Data Protection
Account A at Orion Payments owns a customer managed KMS key that encrypts files in a shared S3 bucket. An application role in Account B must decrypt those files. The security team wants to follow least privilege and keep control of the key in Account A. Which configuration BEST meets these requirements?
Correct answer: D. Add Account B to the key policy for kms:Decrypt, and attach an IAM policy in Account B that allows the role kms:Decrypt on the key ARN.
Cross-account KMS access requires the key policy in the owning account to allow the external account, and the external account must also delegate that permission to its principal with an IAM policy. Granting kms:* breaks least privilege. Aliases cannot point to keys in another account, and KMS keys are not shared through Resource Access Manager.
Cross-account KMS access requires the key policy in the owning account to allow the external account, and the external account must also delegate that permission to its principal with an IAM policy. Granting kms:* breaks least privilege. Aliases cannot point to keys in another account, and KMS keys are not shared through Resource Access Manager.
Question 12Detection
Talon Logistics wants to know which EC2 instances look up domain names that appear on a threat intelligence list. The team will analyze the data with its own tools. The instances use the default Route 53 Resolver in each VPC. Which data source BEST meets this requirement?
Correct answer: B. Route 53 Resolver query logging for each VPC, sent to S3.
Resolver query logs record the domain names that resources in a VPC query, along with the source instance. VPC Flow Logs capture IP addresses and ports but never the domain names that were resolved.
Resolver query logs record the domain names that resources in a VPC query, along with the source instance. VPC Flow Logs capture IP addresses and ports but never the domain names that were resolved.
Question 13Identity & Access
A small startup still uses IAM users for a team of eight administrators in a single account. A security review requires that these users cannot perform any action unless they signed in with MFA. Users must still be able to sign in without MFA the first time so they can register a device. Which approach BEST meets this requirement?
Correct answer: C. Attach a Deny on all actions except MFA setup when aws:MultiFactorAuthPresent is false, using BoolIfExists.
A Deny with BoolIfExists on aws:MultiFactorAuthPresent blocks any request made without MFA, while the excluded actions let a new user register a device first. An Allow with an MFA condition does not stop other policies from granting access without MFA, and the IAM password policy has no MFA requirement setting.
A Deny with BoolIfExists on aws:MultiFactorAuthPresent blocks any request made without MFA, while the excluded actions let a new user register a device first. An Allow with an MFA condition does not stop other policies from granting access without MFA, and the IAM password policy has no MFA requirement setting.
Question 14Infrastructure Security
A gaming company runs a public API on EC2 instances with Elastic IP addresses and serves game assets through Amazon CloudFront. Leadership wants financial protection against scaling charges caused by DDoS attacks. The team also wants 24/7 help from AWS DDoS specialists during an attack. The company has a Business Support plan and currently relies only on default AWS protections. Which solution BEST meets these requirements?
Correct answer: B. Subscribe to Shield Advanced, protect the Elastic IPs and the distribution, and authorize the Shield Response Team.
Shield Advanced adds DDoS cost protection for protected resources and access to the Shield Response Team, which requires Business or Enterprise Support. Shield Standard is automatic and free, but it includes neither cost protection nor access to DDoS specialists.
Shield Advanced adds DDoS cost protection for protected resources and access to the Shield Response Team, which requires Business or Enterprise Support. Shield Standard is automatic and free, but it includes neither cost protection nor access to DDoS specialists.
Question 15Data Protection
Lumen Analytics encrypts application data with AWS KMS in us-east-1 and replicates the data to eu-west-1 for disaster recovery. During a Regional outage, the recovery workload in eu-west-1 must decrypt the data without calling KMS in us-east-1 and without re-encrypting it. Which solution BEST meets these requirements?
Correct answer: D. Use a multi-Region primary key in us-east-1 and create a replica key in eu-west-1.
Multi-Region keys share the same key ID and key material, so a replica in eu-west-1 can decrypt ciphertext produced by the primary in us-east-1 without cross-Region calls. A separate key with the same alias has different key material and cannot decrypt the data. Cross-Region permission still depends on KMS in us-east-1, which is unavailable in the outage.
Multi-Region keys share the same key ID and key material, so a replica in eu-west-1 can decrypt ciphertext produced by the primary in us-east-1 without cross-Region calls. A separate key with the same alias has different key material and cannot decrypt the data. Cross-Region permission still depends on KMS in us-east-1, which is unavailable in the outage.
Question 16Detection
Wavecrest Insurance lets customers upload claim documents to an S3 bucket. The security team must scan every new object for malware and tag infected files so a downstream process can block them. They want a managed service and no scanning servers to maintain. Which solution BEST meets these requirements?
Correct answer: B. Enable GuardDuty Malware Protection for S3 on the bucket with object tagging turned on.
GuardDuty Malware Protection for S3 scans newly uploaded objects and can add a tag with the scan result. Macie looks for sensitive data such as PII, not malware, and Inspector does not scan S3 objects.
GuardDuty Malware Protection for S3 scans newly uploaded objects and can add a tag with the scan result. Macie looks for sensitive data such as PII, not malware, and Inspector does not scan S3 objects.
Question 17Data Protection
Ridgeway Bank must generate the key material for its AWS KMS keys in its own on-premises HSM. The bank also requires the ability to make data unreadable within minutes by removing the key material from AWS, then restore access later from its own backup. Operational overhead should stay low. Which solution BEST meets these requirements?
Correct answer: C. Create a symmetric KMS key with external key material origin and import the key material from the on-premises HSM.
Keys with imported key material let the bank generate material in its own HSM, delete it from KMS immediately, and import the same material again later. A CloudHSM custom key store generates key material inside AWS, not in the on-premises HSM. Scheduling deletion is not reversible after the waiting period and cannot be done on AWS managed keys.
Keys with imported key material let the bank generate material in its own HSM, delete it from KMS immediately, and import the same material again later. A CloudHSM custom key store generates key material inside AWS, not in the on-premises HSM. Scheduling deletion is not reversible after the waiting period and cannot be done on AWS managed keys.
Question 18Identity & Access
Ridgeway Manufacturing has 300 on-premises Linux servers that run batch jobs which write results to Amazon S3. The servers currently use long-term IAM access keys stored in config files. The company already issues X.509 certificates to every server from an internal certificate authority. The security team wants to remove all long-term keys with minimal changes to the servers. Which solution BEST meets these requirements?
Correct answer: A. Set up IAM Roles Anywhere with a trust anchor for the internal CA, a profile, and a role the servers assume using their certificates.
IAM Roles Anywhere lets workloads outside AWS exchange X.509 certificates from a trusted CA for temporary role credentials, which reuses the existing PKI. Rotating keys in Secrets Manager still leaves long-term access keys in use, which violates the requirement.
IAM Roles Anywhere lets workloads outside AWS exchange X.509 certificates from a trusted CA for temporary role credentials, which reuses the existing PKI. Rotating keys in Secrets Manager still leaves long-term access keys in use, which violates the requirement.
Question 19Detection
Sparrow Fintech has 25 accounts in AWS Organizations. It needs continuous vulnerability scanning of EC2 instances, container images in Amazon ECR, and Lambda functions. Results must be visible in one security account, and new accounts must be enrolled automatically. Which solution BEST meets these requirements?
Correct answer: D. Designate a delegated administrator for Amazon Inspector and auto-enable all scan types for members.
Amazon Inspector supports EC2, ECR, and Lambda scanning, and a delegated administrator can auto-enable it for new member accounts. ECR scanning alone covers only container images and leaves EC2 and Lambda unscanned.
Amazon Inspector supports EC2, ECR, and Lambda scanning, and a delegated administrator can auto-enable it for new member accounts. ECR scanning alone covers only container images and leaves EC2 and Lambda unscanned.
Question 20Infrastructure Security
A company uses AWS Organizations with 60 accounts and creates new accounts every month. The security team requires every Application Load Balancer and Amazon API Gateway stage in the organization to have a baseline set of AWS WAF managed rules. Application teams must still be able to add their own rules. The solution must have the least operational overhead. Which solution BEST meets these requirements?
Correct answer: A. Use AWS Firewall Manager with a WAF policy that adds the baseline rule groups first and auto-remediates resources.
Firewall Manager applies WAF policies across the organization, covers new accounts and resources automatically, and lets teams add their own rules between the first and last rule groups. A StackSet can create web ACLs, but it depends on teams to associate them, so new resources can be missed.
Firewall Manager applies WAF policies across the organization, covers new accounts and resources automatically, and lets teams add their own rules between the first and last rule groups. A StackSet can create web ACLs, but it depends on teams to associate them, so new resources can be missed.
Question 21Data Protection
Cobalt Retail uses SSE-KMS with a customer managed key on a bucket that receives millions of small object uploads each day. AWS KMS request charges have grown sharply, and the application is starting to see KMS throttling. The security team must keep SSE-KMS with the same customer managed key. Which change BEST meets these requirements?
Correct answer: C. Enable S3 Bucket Keys on the bucket default encryption configuration.
S3 Bucket Keys let S3 use a bucket-level key derived from the KMS key, which greatly reduces KMS requests, cost, and throttling while keeping the same customer managed key. Switching to SSE-S3 drops the customer managed key requirement. A quota increase may reduce throttling but does nothing about cost.
S3 Bucket Keys let S3 use a bucket-level key derived from the KMS key, which greatly reduces KMS requests, cost, and throttling while keeping the same customer managed key. Switching to SSE-S3 drops the customer managed key requirement. A quota increase may reduce throttling but does nothing about cost.
Question 22Detection
Northpine Energy uses Security Hub CSPM in 30 accounts across four Regions. Analysts currently sign in to each account and Region to review findings. The company wants one view of all findings from all accounts and Regions with minimal custom work. Which solution BEST meets these requirements?
Correct answer: D. Use a delegated administrator and set up cross-Region aggregation into one home Region.
A delegated administrator sees findings from all member accounts, and cross-Region aggregation brings findings from linked Regions into one home Region. Forwarding with EventBridge rules in every Region works but adds custom components to build and maintain.
A delegated administrator sees findings from all member accounts, and cross-Region aggregation brings findings from linked Regions into one home Region. Forwarding with EventBridge rules in every Region works but adds custom components to build and maintain.
Question 23Identity & Access
Pinebrook Fitness is building a mobile app where members sign up with email and password or with a social login. After sign-in, each member must upload workout photos directly to an S3 bucket, but only under a prefix that belongs to that member. The app must not embed any AWS keys. Which design BEST meets these requirements?
Correct answer: D. Use a Cognito user pool for sign-in and an identity pool for temporary credentials scoped per member.
The user pool handles sign-up and sign-in, and the identity pool exchanges the user pool token for temporary AWS credentials whose role policy can limit access to the member's own prefix. A user pool alone issues tokens, not AWS credentials, so it cannot authorize direct S3 uploads.
The user pool handles sign-up and sign-in, and the identity pool exchanges the user pool token for temporary AWS credentials whose role policy can limit access to the member's own prefix. A user pool alone issues tokens, not AWS credentials, so it cannot authorize direct S3 uploads.
Question 24Data Protection
Northwind Securities must keep trade records in Amazon S3 for seven years in a WORM state. Regulators require that no user, including the account root user, can delete or shorten the retention of a record before it expires. Which configuration BEST meets these requirements?
Correct answer: B. Enable S3 Object Lock in compliance mode with a seven-year default retention period.
Compliance mode prevents any user, including the root user, from deleting a locked version or shortening its retention. Governance mode can be bypassed by principals with the s3:BypassGovernanceRetention permission. A bucket policy can be edited or removed by an administrator, so it is not WORM.
Compliance mode prevents any user, including the root user, from deleting a locked version or shortening its retention. Governance mode can be bypassed by principals with the s3:BypassGovernanceRetention permission. A bucket policy can be edited or removed by an administrator, so it is not WORM.
Question 25Infrastructure Security
A healthcare company runs workloads in private subnets that reach the internet through NAT gateways. Compliance requires that outbound HTTP and HTTPS connections be allowed only to a short list of approved software update domains. The control must inspect the outbound connections themselves and drop all other web traffic. The company wants a managed service and does not want to run proxy servers. Which solution BEST meets these requirements?
Correct answer: C. Deploy AWS Network Firewall in the egress path with a stateful domain list rule group that allows the approved domains.
A Network Firewall domain list rule group inspects the TLS SNI and HTTP Host header of outbound connections and drops web traffic to domains that are not on the allow list. DNS Firewall only controls name resolution, so a workload that connects directly to an IP address would bypass it.
A Network Firewall domain list rule group inspects the TLS SNI and HTTP Host header of outbound connections and drops web traffic to domains that are not on the allow list. DNS Firewall only controls name resolution, so a workload that connects directly to an IP address would bypass it.
Question 26Detection
Glenmoor Pharma changed its CloudTrail trail to use SSE-KMS with a new customer managed key. Since the change, no new log files reach the S3 bucket. The bucket policy has not changed and already allows CloudTrail to write. What is the MOST likely fix?
Correct answer: D. Update the key policy to allow the CloudTrail service principal to use kms:GenerateDataKey*.
CloudTrail needs permission in the KMS key policy to generate data keys before it can encrypt and write log files. KMS permissions are not granted through an S3 bucket policy, so changing the bucket policy cannot fix the problem.
CloudTrail needs permission in the KMS key policy to generate data keys before it can encrypt and write log files. KMS permissions are not granted through an S3 bucket policy, so changing the bucket policy cannot fix the problem.
Question 27Data Protection
Pinecrest Insurance uses AWS Backup to protect EC2 and RDS workloads. After a ransomware drill, the security team requires that recovery points cannot be deleted early or have their retention reduced, even by an administrator with full permissions in the account. The settings must be locked permanently after a short testing period. Which solution BEST meets these requirements?
Correct answer: C. Apply an AWS Backup Vault Lock in compliance mode with a grace period before it becomes immutable.
Vault Lock in compliance mode becomes immutable after its grace period, so no one, including the root user, can delete recovery points early or change the lock. Governance mode can be removed by principals with sufficient IAM permissions. A vault access policy can be changed by an account administrator.
Vault Lock in compliance mode becomes immutable after its grace period, so no one, including the root user, can delete recovery points early or change the lock. Governance mode can be removed by principals with sufficient IAM permissions. A vault access policy can be changed by an account administrator.
Question 28Identity & Access
Coastal Credit Union has 40 member accounts in AWS Organizations. Each account still has its own root user password, and the team struggles to secure 40 sets of root credentials. Occasionally an administrator locks everyone out of an S3 bucket with a bad bucket policy and needs root to remove it. Which solution BEST reduces root credential risk while keeping that recovery ability?
Correct answer: B. Enable centralized root access, delete member root credentials, and use sts:AssumeRoot for root tasks.
Centralized root access management lets the management account or a delegated administrator remove member root credentials and still run scoped privileged tasks, such as deleting a misconfigured bucket policy, through short-term root sessions. Vaulting or adding MFA still leaves 40 long-term root credentials to protect.
Centralized root access management lets the management account or a delegated administrator remove member root credentials and still run scoped privileged tasks, such as deleting a misconfigured bucket policy, through short-term root sessions. Vaulting or adding MFA still leaves 40 long-term root credentials to protect.
Question 29Detection
Auditors at Cobalt Bank ask the security team to prove that CloudTrail log files in S3 were not changed or deleted after CloudTrail delivered them. The team needs a native method that can be run on demand for any time range. Which solution BEST meets this requirement?
Correct answer: C. Enable log file integrity validation and check the logs against the digest files.
Log file integrity validation creates signed, hashed digest files that let you confirm whether any log file was modified or deleted after delivery. Versioning keeps prior versions, but it does not give cryptographic proof that a file is unchanged.
Log file integrity validation creates signed, hashed digest files that let you confirm whether any log file was modified or deleted after delivery. Versioning keeps prior versions, but it does not give cryptographic proof that a file is unchanged.
Question 30Data Protection
Silverline Travel stores Amazon Aurora MySQL credentials in AWS Secrets Manager and must rotate them every 30 days. The application runs continuously, and the team must avoid any window where existing connections fail because the password changed. Which rotation approach BEST meets these requirements?
Correct answer: A. Use the alternating users rotation strategy with a separate secret for a user that can update both users.
The alternating users strategy switches between two database users, so the current credentials keep working while the other user is updated. Single user rotation changes the only password, which can cause brief failures for clients holding the old value. A custom Lambda with Parameter Store adds overhead and still uses one password.
The alternating users strategy switches between two database users, so the current credentials keep working while the other user is updated. Single user rotation changes the only password, which can cause brief failures for clients holding the old value. A custom Lambda with Parameter Store adds overhead and still uses one password.
Question 31Infrastructure Security
A financial services company has a VPC with no internet gateway. EC2 instances in the VPC reach Amazon S3 through a gateway VPC endpoint. The security team must stop the instances from writing data to any S3 bucket outside the company's organization in AWS Organizations. This must hold even if someone places credentials for an external account on an instance. Which solution BEST meets these requirements?
Correct answer: B. Attach an endpoint policy that allows S3 actions only when aws:ResourceOrgID equals the company's organization ID.
The endpoint policy is evaluated for every request that passes through the endpoint, regardless of which account's credentials are used, so it can limit traffic to buckets owned by the organization. An SCP only applies to principals in the company's own accounts, so external credentials would not be affected.
The endpoint policy is evaluated for every request that passes through the endpoint, regardless of which account's credentials are used, so it can limit traffic to buckets owned by the organization. An SCP only applies to principals in the company's own accounts, so external credentials would not be affected.
Question 32Identity & Access
A developer at Bluefin Media has an identity-based policy that allows s3:* on all resources. The account's SCPs allow all actions. The developer can read objects in a bucket but receives AccessDenied when uploading an object. The bucket has no bucket policy, and there are no session policies. What is the MOST likely cause?
Correct answer: A. A permissions boundary on the developer's user allows s3:GetObject but not s3:PutObject.
A permissions boundary sets the maximum permissions for an IAM entity, so an action must be allowed by both the identity policy and the boundary. Same-account access does not need a bucket policy when the identity policy allows the action, so that option is incorrect.
A permissions boundary sets the maximum permissions for an IAM entity, so an action must be allowed by both the identity policy and the boundary. Same-account access does not need a bucket policy when the identity policy allows the action, so that option is incorrect.
Question 33Data Protection
Tidewater Group has 60 AWS accounts in AWS Organizations, with thousands of S3 buckets. The security team must find buckets that likely contain personally identifiable information and see the results in one place. It wants continuous coverage without creating and scheduling jobs bucket by bucket. Which solution BEST meets these requirements?
Correct answer: C. Designate a Macie delegated administrator for the organization and enable automated sensitive data discovery.
A Macie delegated administrator manages all member accounts centrally, and automated sensitive data discovery continuously samples objects across buckets without per-bucket jobs. Creating jobs in each account adds the overhead the team wants to avoid. GuardDuty S3 Protection detects suspicious access, not sensitive data.
A Macie delegated administrator manages all member accounts centrally, and automated sensitive data discovery continuously samples objects across buckets without per-bucket jobs. Creating jobs in each account adds the overhead the team wants to avoid. GuardDuty S3 Protection detects suspicious access, not sensitive data.
Question 34Detection
Aldridge Health hires an approved penetration testing firm that scans its AWS workloads every month from a fixed set of public IP addresses. Each test floods the security team with Amazon GuardDuty findings, which hides real threats. The team wants GuardDuty to stop generating findings for that firm's addresses only. What should the team do?
Correct answer: D. Add the firm's IP addresses to a GuardDuty trusted IP list
A trusted IP list tells GuardDuty not to generate findings for traffic from those addresses, which removes the noise without losing coverage for everything else. Disabling GuardDuty leaves the whole environment unmonitored during the test window.
A trusted IP list tells GuardDuty not to generate findings for traffic from those addresses, which removes the noise without losing coverage for everything else. Disabling GuardDuty leaves the whole environment unmonitored during the test window.
Question 35Infrastructure Security
A company runs eight VPCs in a single AWS account. It wants to stop EC2 instances in those VPCs from resolving domains that are known to host malware or botnet command servers. The instances use the default Route 53 Resolver. The security team does not want to research or maintain the threat domain lists itself. Which solution BEST meets these requirements?
Correct answer: D. Create a DNS Firewall rule group that blocks AWS managed domain lists and associate it with each VPC.
Route 53 Resolver DNS Firewall includes AWS managed domain lists for malware and botnet command and control domains, and AWS keeps those lists current. GuardDuty detects DNS activity to malicious domains, but it does not block resolution.
Route 53 Resolver DNS Firewall includes AWS managed domain lists for malware and botnet command and control domains, and AWS keeps those lists current. GuardDuty detects DNS activity to malicious domains, but it does not block resolution.
Question 36Data Protection
Ashford Labs runs workloads in us-east-1 and us-west-2 from a single AWS account. Auto Scaling groups and developers create new EBS volumes every day. The security team must ensure that every new EBS volume and snapshot copy in both Regions is encrypted, with the least operational effort. Which solution BEST meets these requirements?
Correct answer: A. Enable EBS encryption by default separately in us-east-1 and in us-west-2.
EBS encryption by default is a Regional setting, so it must be enabled in each Region used, and then every new volume is encrypted automatically. Treating it as a single account-wide setting would leave the second Region unprotected. Launch template changes depend on people and miss volumes created in other ways.
EBS encryption by default is a Regional setting, so it must be enabled in each Region used, and then every new volume is encrypted automatically. Treating it as a single account-wide setting would leave the second Region unprotected. Launch template changes depend on people and miss volumes created in other ways.
Question 37Incident Response
A responder at Ridgeway Labs replaced the security group of a compromised EC2 instance with one that has no rules. An attacker's existing SSH session stayed open. The instance shares a subnet with production servers that must keep running. Which action BEST stops the existing session?
Correct answer: B. Attach a group that allows all traffic so flows become untracked, then apply the no-rules group.
Security group changes do not interrupt tracked connections, but untracked flows are cut when the rules change, so moving through an allow-all group first ends the session. A subnet-wide network ACL deny would also cut traffic to the production servers that share the subnet.
Security group changes do not interrupt tracked connections, but untracked flows are cut when the rules change, so moving through an allow-all group first ends the session. A subnet-wide network ACL deny would also cut traffic to the production servers that share the subnet.
Question 38Identity & Access
Granite Health has 120 accounts in AWS Organizations. Teams sometimes write S3 bucket policies that accidentally grant access to principals outside the company. The security team needs a central control that blocks any principal outside the organization from accessing S3 buckets in member accounts, even if a bucket policy allows it. AWS services acting on the company's behalf must keep working. Which solution BEST meets this requirement?
Correct answer: D. Attach an RCP that denies s3:* when aws:PrincipalOrgID does not match, excepting AWS service principals.
Resource control policies restrict what any principal can do to resources in member accounts, including principals outside the organization, so they enforce a central resource perimeter. SCPs only limit principals inside the organization, so they cannot stop an external account from using a permissive bucket policy.
Resource control policies restrict what any principal can do to resources in member accounts, including principals outside the organization, so they enforce a central resource perimeter. SCPs only limit principals inside the organization, so they cannot stop an external account from using a permissive bucket policy.
Question 39Governance
Meridian Energy uses AWS Organizations with all features enabled. The security team must prevent anyone in member accounts, including the root user of those accounts, from stopping or deleting the organization CloudTrail trail. Which solution BEST meets these requirements?
Correct answer: C. Attach an SCP to the root of the organization that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.
An SCP is a preventive control that limits all principals in member accounts, including their root users. IAM policies cannot restrict the root user and must be attached to every principal. A Config rule only detects the change after it happens.
An SCP is a preventive control that limits all principals in member accounts, including their root users. IAM policies cannot restrict the root user and must be attached to every principal. A Config rule only detects the change after it happens.
Question 40Incident Response
Bluefern Software found that temporary credentials for its CI/CD role were leaked and are being used from an unknown IP address. Each pipeline job assumes the role for a fresh session. The pipeline must keep working, and the leaked credentials must stop working now. Which action BEST meets these requirements?
Correct answer: B. Use the IAM option to revoke active sessions, which denies tokens issued before now.
Revoking active sessions adds a deny policy based on aws:TokenIssueTime, so older sessions fail while new pipeline sessions work. Changing the trust policy only blocks new AssumeRole calls and does not invalidate credentials that were already issued.
Revoking active sessions adds a deny policy based on aws:TokenIssueTime, so older sessions fail while new pipeline sessions work. Changing the trust policy only blocks new AssumeRole calls and does not invalidate credentials that were already issued.
Question 41Infrastructure Security
A company with AWS Organizations must ensure that every new EC2 instance in its member accounts requires IMDSv2. Developers launch instances through the console, the AWS CLI, and several infrastructure as code tools. The control must be preventive and must not depend on developers choosing the right settings. Which solution BEST meets these requirements?
Correct answer: C. Apply an SCP that denies ec2:RunInstances when ec2:MetadataHttpTokens is not set to required.
An SCP that checks the ec2:MetadataHttpTokens condition key blocks any launch that does not require IMDSv2, no matter which tool makes the call. An account-level metadata default is only a default, and a launch request can override it.
An SCP that checks the ec2:MetadataHttpTokens condition key blocks any launch that does not require IMDSv2, no matter which tool makes the call. An account-level metadata default is only a default, and a launch request can override it.
Question 42Governance
Starboard Fintech is moving from one AWS account to a multi-account setup. It needs a dedicated log archive account, a security audit account, guardrails applied to new accounts, and a standard way to create accounts. The team has little AWS experience and wants the least operational effort. Which solution BEST meets these requirements?
Correct answer: A. Set up an AWS Control Tower landing zone and use Account Factory to create new accounts.
Control Tower sets up a landing zone with log archive and audit accounts, applies managed controls, and provides Account Factory for standard account creation. Custom scripts with the Organizations API can achieve similar results but with much more effort. StackSets deploy resources, but they do not create the account structure and controls on their own.
Control Tower sets up a landing zone with log archive and audit accounts, applies managed controls, and provides Account Factory for standard account creation. Custom scripts with the Organizations API can achieve similar results but with much more effort. StackSets deploy resources, but they do not create the account structure and controls on their own.
Question 43Identity & Access
Lumen Insights offers a SaaS cost reporting tool. Each customer creates an IAM role in its own account that the Lumen production account assumes to read billing data. Lumen's security team worries that one customer could give Lumen another customer's role ARN and get that customer's data. Which control BEST prevents this?
Correct answer: B. Require a unique sts:ExternalId per customer in each role trust policy, generated and assigned by Lumen.
A unique external ID per customer, checked in each role's trust policy and supplied by Lumen, prevents the confused deputy problem because Lumen will only pass the ID it assigned to that customer. Trusting a specific Lumen role still lets that role assume any customer role it is tricked into using.
A unique external ID per customer, checked in each role's trust policy and supplied by Lumen, prevents the confused deputy problem because Lumen will only pass the ID it assigned to that customer. Trusting a specific Lumen role still lets that role assume any customer role it is tricked into using.
Question 44Incident Response
A developer at Larkspur Games pushed an IAM user access key to a public code repository an hour ago. The key belongs to a service user that a batch job uses. The security team must contain the exposure and keep evidence for the investigation. What should the team do FIRST?
Correct answer: A. Deactivate the exposed key, then review CloudTrail for any actions taken with it.
Deactivating the key stops its use right away while keeping the user and key ID for CloudTrail analysis, and the key can be rotated afterward. Cleaning the repository does not help because a public key may already have been copied.
Deactivating the key stops its use right away while keeping the user and key ID for CloudTrail analysis, and the key can be rotated afterward. Cleaning the repository does not help because a public key may already have been copied.
Question 45Governance
Granite Partners has 40 accounts in AWS Organizations across four Regions. Auditors want a single view of AWS Config rule compliance for all accounts and Regions, managed from the security tooling account rather than the management account. Which solution BEST meets these requirements?
Correct answer: C. Register the security account as a Config delegated administrator and create an organization aggregator there.
A Config delegated administrator can create an organization-wide aggregator that collects compliance data from all accounts and Regions into one view. An aggregator in the management account conflicts with the requirement to manage from the security account. Exporting reports per Region creates manual work and no unified view.
A Config delegated administrator can create an organization-wide aggregator that collects compliance data from all accounts and Regions into one view. An aggregator in the management account conflicts with the requirement to manage from the security account. Exporting reports per Region creates manual work and no unified view.
Question 46Infrastructure Security
A company manages 400 Linux EC2 instances in private subnets through two SSH bastion hosts. Auditors require that every interactive session be logged, including the commands and their output. The security team wants to close inbound port 22 on all instances. The VPCs have no NAT gateways. Which solution BEST meets these requirements?
Correct answer: B. Use Session Manager through the required VPC endpoints and enable session logging to S3 or CloudWatch Logs.
Session Manager needs no inbound ports, works without internet access through VPC endpoints, and can log full session output to S3 or CloudWatch Logs. An EC2 Instance Connect Endpoint still requires instances to accept SSH on port 22, and shell history is not a reliable record of output.
Session Manager needs no inbound ports, works without internet access through VPC endpoints, and can log full session output to S3 or CloudWatch Logs. An EC2 Instance Connect Endpoint still requires instances to accept SSH on port 22, and shell history is not a reliable record of output.
Question 47Incident Response
Halcyon Travel must move evidence from a compromised EC2 instance to a separate forensic account. The instance's EBS volume is encrypted with the AWS managed key aws/ebs. The team took a snapshot, but cannot share it with the forensic account. Which solution BEST meets this requirement?
Correct answer: D. Copy the snapshot using a customer managed key that the forensic account can use, then share it.
Snapshots encrypted with an AWS managed key cannot be shared, so the snapshot must be copied with a customer managed key whose policy allows the forensic account. The key policy of an AWS managed key cannot be edited, and an encrypted snapshot cannot be copied to an unencrypted one.
Snapshots encrypted with an AWS managed key cannot be shared, so the snapshot must be copied with a customer managed key whose policy allows the forensic account. The key policy of an AWS managed key cannot be edited, and an encrypted snapshot cannot be copied to an unencrypted one.
Question 48Identity & Access
Sterling Games has 25 project teams that share one AWS account and federate through IAM Identity Center. Each team must start, stop, and reboot only the EC2 instances that belong to its project. New projects are added every month, and the security team does not want to update policies each time. Which solution BEST meets these requirements?
Correct answer: A. Pass a project session tag and allow actions when aws:ResourceTag/project equals aws:PrincipalTag/project.
Attribute-based access control compares the user's project tag with the instance's project tag, so one policy covers all current and future projects. Per-project permission sets with instance IDs must be edited every time a project or instance changes.
Attribute-based access control compares the user's project tag with the instance's project tag, so one policy covers all current and future projects. Per-project permission sets with instance IDs must be edited every time a project or instance changes.
Question 49Governance
A prospective customer of Larkspur Software asks for proof that the AWS infrastructure behind its SaaS product has been independently audited for security controls. The customer specifically requests the AWS SOC 2 report. Which action BEST meets this request?
Correct answer: B. Download the AWS SOC 2 report from AWS Artifact and share it under its terms.
AWS Artifact provides on-demand access to AWS compliance reports such as SOC 2, subject to their terms. Audit Manager collects evidence about the customer's own use of AWS, not the third-party audit of AWS infrastructure. Security Hub summaries show account configuration, not an independent audit report.
AWS Artifact provides on-demand access to AWS compliance reports such as SOC 2, subject to their terms. Audit Manager collects evidence about the customer's own use of AWS, not the third-party audit of AWS infrastructure. Security Hub summaries show account configuration, not an independent audit report.
Question 50Incident Response
Fairhaven Logistics wants a standard response when GuardDuty reports a high-severity EC2 finding. The response must snapshot volumes, apply an isolation security group, and pause for a security lead to approve isolation. The team prefers managed runbooks over custom code. Which solution BEST meets these requirements?
Correct answer: D. A Systems Manager Automation runbook with an approval step, started by an EventBridge rule.
Systems Manager Automation runbooks include an approval step and can be started directly by an EventBridge rule. A Lambda function would need custom code to wait for and track approval, and it is limited to 15 minutes of run time.
Systems Manager Automation runbooks include an approval step and can be started directly by an EventBridge rule. A Lambda function would need custom code to wait for and track approval, and it is limited to 15 minutes of run time.
Question 51Governance
The platform team at Bluepeak Games writes AWS CloudFormation templates and deploys them through a CI pipeline. Security wants templates rejected during the build stage if they define S3 buckets without encryption or security groups open to 0.0.0.0/0 on port 22. Rules must be written as code and run before any resources exist. Which solution BEST meets these requirements?
Correct answer: D. Add an AWS CloudFormation Guard validation step to the CI pipeline with policy rules for these checks.
CloudFormation Guard evaluates templates against policy-as-code rules, so the pipeline can fail the build before anything is deployed. Config rules evaluate resources only after they exist. Drift detection compares live resources to templates and does not check policy compliance.
CloudFormation Guard evaluates templates against policy-as-code rules, so the pipeline can fail the build before anything is deployed. Config rules evaluate resources only after they exist. Drift detection compares live resources to templates and does not check policy compliance.
Question 52Infrastructure Security
A company stores container images in Amazon ECR and runs some of them on Amazon ECS for months at a time. The security team needs vulnerability findings for both operating system packages and programming language packages. Images must be re-evaluated automatically when new CVEs are published, not only when they are pushed. Which solution BEST meets these requirements?
Correct answer: A. Turn on ECR enhanced scanning with Amazon Inspector and set the repositories to continuous scanning.
Enhanced scanning uses Amazon Inspector to find both operating system and language package vulnerabilities, and continuous mode rescans images when new CVEs appear. Basic scanning covers operating system packages only and does not rescan images continuously.
Enhanced scanning uses Amazon Inspector to find both operating system and language package vulnerabilities, and continuous mode rescans images when new CVEs appear. Basic scanning covers operating system packages only and does not rescan images continuously.
Question 53Identity & Access
Orchid Pharma stores clinical files in an S3 bucket. All access must come through one specific gateway VPC endpoint in the research VPC. Requests from the internet or from other VPC endpoints must be denied, even for administrators with s3:* permissions. Which bucket policy statement BEST meets this requirement?
Correct answer: C. Deny s3:* when aws:SourceVpce does not equal the ID of the research VPC gateway endpoint.
A Deny with aws:SourceVpce not equal to the endpoint ID blocks every request that does not arrive through that endpoint, and an explicit deny overrides any administrator allow. The aws:SourceIp key does not carry private VPC addresses for traffic through a VPC endpoint, so that condition would not work as intended.
A Deny with aws:SourceVpce not equal to the endpoint ID blocks every request that does not arrive through that endpoint, and an explicit deny overrides any administrator allow. The aws:SourceIp key does not carry private VPC addresses for traffic through a VPC endpoint, so that condition would not work as intended.
Question 54Incident Response
An EC2 instance at Stonegate Retail may be running malware that exists only in memory. The responders have isolated the instance on the network. They must preserve volatile evidence before they take any action that could change it. Which step BEST meets this requirement?
Correct answer: A. Use Systems Manager Run Command to run a memory capture tool and save it to S3.
A memory capture tool run through Run Command collects RAM contents while the instance is still running. Creating an AMI with default settings reboots the instance, and stopping it also erases memory, so volatile evidence is lost.
A memory capture tool run through Run Command collects RAM contents while the instance is still running. Creating an AMI with default settings reboots the instance, and stopping it also erases memory, so volatile evidence is lost.
Question 55Governance
Cedar Ridge Corp runs 25 accounts in AWS Organizations. The security team wants Amazon GuardDuty enabled in every current and future account, with all findings managed from the security account. The team wants to avoid using the management account for daily security work. Which solution BEST meets these requirements?
Correct answer: B. Designate the security account as the GuardDuty delegated administrator and turn on auto-enable for the organization.
A GuardDuty delegated administrator manages all organization accounts, and auto-enable turns on GuardDuty for new accounts automatically. Invitations from the management account use the account the team wants to keep out of daily work. Standalone detectors from StackSets would not give central finding management.
A GuardDuty delegated administrator manages all organization accounts, and auto-enable turns on GuardDuty for new accounts automatically. Invitations from the management account use the account the team wants to keep out of daily work. Standalone detectors from StackSets would not give central finding management.
Question 56Incident Response
Quillon Analytics finds that a Lambda function was modified to send data to an external host. The function is triggered by an SQS queue. The team must stop all invocations right away and keep the code and configuration for forensic review. Which action BEST meets these requirements?
Correct answer: B. Set reserved concurrency to zero and download the deployment package for review.
Setting reserved concurrency to zero throttles every invocation while keeping the function, its code, and its settings intact for analysis. Deleting the function stops it but destroys evidence that the investigation needs.
Setting reserved concurrency to zero throttles every invocation while keeping the function, its code, and its settings intact for analysis. Deleting the function stops it but destroys evidence that the investigation needs.
Question 57Infrastructure Security
A company runs production workloads on Amazon EKS and pulls images from Amazon ECR. A new policy says that only images signed by the company's release pipeline may run in production clusters. The company wants AWS to manage the signing keys and their lifecycle. Which solution BEST meets these requirements?
Correct answer: C. Sign images with AWS Signer and Notation in the pipeline and verify signatures with a cluster admission controller.
AWS Signer manages signing profiles and keys, Notation attaches the signature to the image in ECR, and an admission controller rejects unsigned images at deploy time. A push-restricted repository limits who can upload images, but nothing verifies a signature when the image is deployed.
AWS Signer manages signing profiles and keys, Notation attaches the signature to the image in ECR, and an admission controller rejects unsigned images at deploy time. A push-restricted repository limits who can upload images, but nothing verifies a signature when the image is deployed.
Question 58Governance
An auditor asks Willow Creek Clinics to list security tasks that are its own responsibility for a workload running on Amazon EC2 instances with an Amazon RDS for MySQL database. Which task belongs to Willow Creek Clinics under the AWS shared responsibility model?
Correct answer: B. Patching the guest operating system on the EC2 instances.
For EC2, the customer manages the guest operating system, including patches. AWS patches the hypervisor and the underlying hosts for managed services such as RDS. Physical data center security is always an AWS responsibility.
For EC2, the customer manages the guest operating system, including patches. AWS patches the hypervisor and the underlying hosts for managed services such as RDS. Physical data center security is always an AWS responsibility.
Question 59Identity & Access
Maple Retail has 200 accounts in AWS Organizations, and a security account is the delegated administrator for IAM Access Analyzer. Auditors ask the team to find IAM roles that have not been used in 90 days and permissions that roles have but never use. The team wants continuous findings across all accounts with the least effort. What should the team do?
Correct answer: D. Create an organization-level unused access analyzer in the security account with a 90-day tracking period.
An organization-level unused access analyzer continuously reports unused roles, access keys, passwords, and unused permissions across member accounts. An external access analyzer only reports resources shared outside the zone of trust, so it does not find unused permissions.
An organization-level unused access analyzer continuously reports unused roles, access keys, passwords, and unused permissions across member accounts. An external access analyzer only reports resources shared outside the zone of trust, so it does not find unused permissions.
Question 60Incident Response
GuardDuty at Embervale Corp reports unusual API calls by an IAM role. Detective is enabled for the organization. An analyst must quickly see which IP addresses used the role, where they were located, and how the activity compares to the prior weeks. Which approach requires the LEAST effort?
Correct answer: A. Open the finding in Detective and review the role's profile and its activity timeline.
Detective builds a behavior graph from CloudTrail, VPC Flow Logs, and GuardDuty data, and its role profile shows IP addresses, geolocation, and baseline comparisons. Athena can answer the same questions but requires writing and tuning queries by hand.
Detective builds a behavior graph from CloudTrail, VPC Flow Logs, and GuardDuty data, and its role profile shows IP addresses, geolocation, and baseline comparisons. Athena can answer the same questions but requires writing and tuning queries by hand.
Question 61Governance
Hollis Design is a small company with one AWS account on the Basic Support plan. The owner wants a quick check for a few common security risks, such as whether the root user has MFA and whether security groups allow unrestricted access on sensitive ports. The check must not add cost or require enabling new services. Which solution BEST meets these requirements?
Correct answer: C. Review the core security checks in AWS Trusted Advisor.
Trusted Advisor core security checks, including root MFA and specific ports unrestricted, are available on every support plan at no extra cost. Security Hub CSPM and Config conformance packs require enabling services that add charges. Amazon Inspector scans for software vulnerabilities, not these account settings.
Trusted Advisor core security checks, including root MFA and specific ports unrestricted, are available on every support plan at no extra cost. Security Hub CSPM and Config conformance packs require enabling services that add charges. Amazon Inspector scans for software vulnerabilities, not these account settings.
Question 62Infrastructure Security
An application server in a private subnet calls a third-party HTTPS API through a NAT gateway in a public subnet. The server's security group allows all outbound traffic. A new custom network ACL on the private subnet allows outbound TCP 443 to 0.0.0.0/0 and inbound TCP 443 from 0.0.0.0/0. Since the change, all API calls time out. Which change BEST fixes the problem while keeping the network ACL restrictive?
Correct answer: A. Add an inbound network ACL rule that allows TCP 1024-65535 from 0.0.0.0/0.
Network ACLs are stateless, so response traffic returning to the server's ephemeral ports needs its own inbound rule. Security groups are stateful and already allow the return traffic, so adding a security group rule does not fix the problem.
Network ACLs are stateless, so response traffic returning to the server's ephemeral ports needs its own inbound rule. Security groups are stateful and already allow the return traffic, so adding a security group rule does not fix the problem.
Question 63Identity & Access
Tidewater Legal is building a document portal for its own clients. Authorization rules are complex, such as allowing a paralegal to view a case file only if the paralegal is assigned to that case. Developers want these rules kept outside the application code so they can be reviewed and changed without redeploying. Which AWS approach BEST meets this requirement?
Correct answer: D. Define Cedar policies in an Amazon Verified Permissions policy store and call it from the portal for each decision.
Amazon Verified Permissions stores fine-grained application authorization rules as Cedar policies and returns allow or deny decisions through its API, so rules change without code changes. Building custom evaluation logic in Lambda keeps the authorization engine inside code the team must maintain.
Amazon Verified Permissions stores fine-grained application authorization rules as Cedar policies and returns allow or deny decisions through its API, so rules change without code changes. Building custom evaluation logic in Lambda keeps the authorization engine inside code the team must maintain.
Question 64Incident Response
Ransomware encrypted data in Pinecrest Media's production account. Its backups are in an AWS Backup logically air-gapped vault owned by a separate account. The team wants to restore into a new, clean recovery account quickly, without trusting production. Which solution BEST meets these requirements?
Correct answer: A. Share the logically air-gapped vault with the recovery account by using AWS RAM.
A logically air-gapped vault can be shared with another account through AWS RAM, and that account can restore from it directly. Copying the backups into the production account would place clean data back in an environment that may still be compromised.
A logically air-gapped vault can be shared with another account through AWS RAM, and that account can restore from it directly. Copying the backups into the production account would place clean data back in an environment that may still be compromised.
Question 65Governance
Quarry Point Media wants CloudTrail data events for S3 to investigate access to two buckets that hold contract files. The account has hundreds of other buckets with heavy traffic, and logging all S3 data events would be very expensive. The team must capture the needed activity at the lowest cost. Which solution BEST meets these requirements?
Correct answer: C. Use advanced event selectors on the trail to log S3 data events only for the two bucket ARNs.
Advanced event selectors can limit data events to specific bucket ARNs, so the trail records only the needed activity and avoids cost for other buckets. Logging all buckets still incurs event charges even if logs are deleted later. Management events do not include object-level reads and writes.
Advanced event selectors can limit data events to specific bucket ARNs, so the trail records only the needed activity and avoids cost for other buckets. Logging all buckets still incurs event charges even if logs are deleted later. Management events do not include object-level reads and writes.
The real AWS Security Specialty exam at a glance
65questions
2h 50mtime limit
MCQmultiple choice
75%+aim for here
Score 75% or more on two different sets before you book the real exam. Need a plan for your weak topics? See how we help you pass, or get a full refund.
More free AWS practice tests
AWS Cloud Practitioner Practice Test65 questions · CLF-C02AWS AI Practitioner Practice Test65 questions · AIF-C01AWS Solutions Architect Associate Practice Test65 questions · SAA-C03AWS Solutions Architect Professional Practice Test75 questions · SAP-C03AWS DevOps Engineer Professional Practice Test75 questions · DOP-C02AWS Data Engineer Associate Practice Test65 questions · DEA-C01
See all 36 free practice tests →
Original practice questions written by CertOcean in the style of the AWS Security Specialty exam. They are not real exam questions. AWS Security Specialty and Amazon Web Services are trademarks of their owners. Real exam format: 65 questions (50 scored, 15 unscored) · 170 minutes · passing score 750 on a 100-1000 scale.