AWS SCS-C03 · Updated 2026
Free AWS Security Specialty Practice Exam (SCS-C03)
Full-length SCS-C03 mock exams with the same number of questions and time as the real exam. Detection, incident response, infrastructure, IAM, data protection and governance scenarios, answers explained, and your score by domain.
1. Choose a set
2. Choose a mode
65 questions · 2 hours 50 min · same as the real exam
You have an unfinished attempt on this set.
Questions 1–10Page 1 of 7
🏆
Question 1Data Protection
Harbor Telecom exposes a public API through an Application Load Balancer. A new security standard requires that client connections use only TLS 1.2 or TLS 1.3, and that older protocol versions are refused. The team wants to keep TLS termination on the load balancer. Which solution BEST meets these requirements?
Correct answer: A. Set the HTTPS listener to a predefined security policy that allows only TLS 1.2 and TLS 1.3.
The listener security policy controls which TLS protocol versions and ciphers the load balancer negotiates, so a TLS 1.2 and 1.3 policy refuses older versions. Certificates are not tied to a TLS protocol version. WAF inspects HTTP requests after the TLS handshake and is not the right control for protocol versions.
The listener security policy controls which TLS protocol versions and ciphers the load balancer negotiates, so a TLS 1.2 and 1.3 policy refuses older versions. Certificates are not tied to a TLS protocol version. WAF inspects HTTP requests after the TLS handshake and is not the right control for protocol versions.
Question 2Detection
Ironleaf Capital must keep seven years of CloudTrail events from all organization accounts and run SQL queries on them during investigations. The team does not want to manage Athena tables, partitions, or ETL jobs. Which solution BEST meets these requirements?
Correct answer: C. Create an organization event data store in CloudTrail Lake with seven-year retention.
CloudTrail Lake stores events in an event data store that supports SQL queries and long retention, with no tables or ETL to manage. Athena on S3 works, but the team would have to maintain table definitions and partition settings.
CloudTrail Lake stores events in an event data store that supports SQL queries and long retention, with no tables or ETL to manage. Athena on S3 works, but the team would have to maintain table definitions and partition settings.
Question 3Identity & Access
Quarry Software deploys infrastructure from GitHub Actions workflows. The team stores an IAM user's access keys as repository secrets and wants to remove them. Only workflows running on the main branch of the payments repository may assume the deployment role. Which solution BEST meets these requirements?
Correct answer: D. Create a GitHub OIDC provider and restrict the trust policy sub claim to the payments repo and main branch.
An OIDC provider lets the workflow get temporary credentials, and a sub claim condition limits the role to the named repository and branch. Checking only the aud claim would let any GitHub workflow that targets AWS STS try to assume the role.
An OIDC provider lets the workflow get temporary credentials, and a sub claim condition limits the role to the named repository and branch. Checking only the aud claim would let any GitHub workflow that targets AWS STS try to assume the role.
Question 4Infrastructure Security
A ticketing website behind Amazon CloudFront is being scraped by automated clients. The clients rotate through thousands of residential IP addresses and imitate real browsers, so per-IP rate limits no longer help. The company already uses AWS WAF and wants a managed capability to detect these sophisticated bots without writing custom detection logic. Which solution BEST meets these requirements?
Correct answer: D. Add the AWS WAF Bot Control managed rule group at the targeted inspection level to the web ACL.
The targeted inspection level of Bot Control uses browser interrogation, fingerprinting, and behavior analysis to detect bots that do not identify themselves. The common level mainly detects self-identifying bots, so it would miss clients that imitate real browsers.
The targeted inspection level of Bot Control uses browser interrogation, fingerprinting, and behavior analysis to detect bots that do not identify themselves. The common level mainly detects self-identifying bots, so it would miss clients that imitate real browsers.
Question 5Data Protection
Summit Manufacturing connects its data center to AWS with a dedicated 100 Gbps AWS Direct Connect connection. Policy now requires encryption of all traffic on this link at near line rate. The team wants to avoid the throughput limits and tunnel management of IPsec. Which solution BEST meets these requirements?
Correct answer: B. Enable MACsec on the dedicated connection with a supported router and a configured CKN and CAK.
MACsec provides layer 2 encryption on supported dedicated Direct Connect connections at line rate without IPsec tunnels. Site-to-Site VPN over Direct Connect uses IPsec, which has per-tunnel throughput limits. MACsec is not available on hosted connections.
MACsec provides layer 2 encryption on supported dedicated Direct Connect connections at line rate without IPsec tunnels. Site-to-Site VPN over Direct Connect uses IPsec, which has per-tunnel throughput limits. MACsec is not available on hosted connections.
Question 6Detection
Harborview Credit wants the security team paged within minutes if anyone stops or deletes a CloudTrail trail in its production account. The team already uses an SNS topic for paging. It wants the simplest serverless solution. Which solution BEST meets these requirements?
Correct answer: B. Create an EventBridge rule for StopLogging and DeleteTrail API calls that targets SNS.
EventBridge receives CloudTrail management events and can match StopLogging and DeleteTrail calls within moments, then send them to SNS. A periodic Config rule or hourly Lambda check could miss the change for hours.
EventBridge receives CloudTrail management events and can match StopLogging and DeleteTrail calls within moments, then send them to SNS. A periodic Config rule or hourly Lambda check could miss the change for hours.
Question 7Identity & Access
Vantage Docs runs a multi-tenant API on Amazon ECS. The task role can read every tenant's prefix in a shared S3 bucket. For each request, the service assumes a second role and must limit the resulting credentials to the calling tenant's prefix only. The team does not want to create a role per tenant. Which solution BEST meets these requirements?
Correct answer: D. Pass a tenant-scoped session policy in the AssumeRole call to limit the resulting credentials.
A session policy passed during AssumeRole further limits the session, and effective permissions are the intersection of the role's policies and the session policy. Creating a role per tenant would also isolate data, but it breaks the requirement to avoid per-tenant roles.
A session policy passed during AssumeRole further limits the session, and effective permissions are the intersection of the role's policies and the session policy. Creating a role per tenant would also isolate data, but it breaks the requirement to avoid per-tenant roles.
Question 8Data Protection
At Juniper Health, a batch job in the same account needs permission to use a customer managed KMS key for a few hours each night. The security team wants to give this access programmatically and remove it when the job ends, without editing the key policy each time. Which solution BEST meets these requirements?
Correct answer: C. Create a KMS grant for the batch role with only the needed operations, then retire or revoke it after the job.
KMS grants give specific, temporary permissions on a key and can be retired or revoked without changing the key policy. Editing the key policy each night adds risk and effort. An IAM policy has no effect if the key policy does not enable IAM policies for the account.
KMS grants give specific, temporary permissions on a key and can be retired or revoked without changing the key policy. Editing the key policy each night adds risk and effort. An IAM policy has no effect if the key policy does not enable IAM policies for the account.
Question 9Infrastructure Security
A company must send all traffic between the internet and its application VPCs through a fleet of next-generation firewall appliances from its current third-party vendor. The appliances must scale horizontally and stay transparent to the traffic flows. The company wants the appliance fleet in a dedicated security VPC. Which solution BEST meets these requirements?
Correct answer: B. Place the appliances behind a Gateway Load Balancer and route traffic through Gateway Load Balancer endpoints.
Gateway Load Balancer distributes traffic to third-party appliances transparently, keeps flows sticky to one appliance, and is reached through endpoints that can be route table targets. Moving to Network Firewall would drop the required vendor appliances.
Gateway Load Balancer distributes traffic to third-party appliances transparently, keeps flows sticky to one appliance, and is reached through endpoints that can be route table targets. Moving to Network Firewall would drop the required vendor appliances.
Question 10Detection
Sablewood Tech created a trail in us-east-1 a year ago. During an investigation, analysts found no CloudTrail log files for API activity in eu-west-1, where a suspicious instance was launched. Which change BEST closes this logging gap for all Regions?
Correct answer: C. Update the trail to apply to all Regions so it logs events from every Region.
A single-Region trail records only events in its own Region, so making it a multi-Region trail captures activity everywhere. Data events and Insights add event types but do not extend a trail to other Regions.
A single-Region trail records only events in its own Region, so making it a multi-Region trail captures activity everywhere. Data events and Insights add event types but do not extend a trail to other Regions.
Question 11Data Protection
Ironwood Capital must keep its encryption keys in single-tenant HSMs that it controls, validated at FIPS 140 Level 3. It still wants to use the native AWS KMS integration with S3, EBS, and RDS. Which solution BEST meets these requirements?
Correct answer: A. Create a KMS custom key store backed by an AWS CloudHSM cluster and use keys from it.
A CloudHSM custom key store keeps key material in single-tenant HSMs the customer controls while letting services use the key through KMS. Keys in the default KMS key store use multi-tenant HSMs managed by AWS. Client-side encryption with Secrets Manager loses the native service integration.
A CloudHSM custom key store keeps key material in single-tenant HSMs the customer controls while letting services use the key through KMS. Keys in the default KMS key store use multi-tenant HSMs managed by AWS. Client-side encryption with Secrets Manager loses the native service integration.
Question 12Detection
Juniper Robotics created a trail in a new member account that writes to a central S3 bucket in its log archive account. The trail shows an S3 delivery error and no files arrive. Other accounts deliver to the same bucket without issues. What is the MOST likely fix?
Correct answer: B. Update the bucket policy so CloudTrail can write under the AWSLogs prefix for the new account.
The bucket policy must allow the CloudTrail service principal to put objects under the AWSLogs path for each account, so a missing entry for the new account blocks delivery. CloudTrail writes as a service principal, so an IAM policy on an admin role has no effect.
The bucket policy must allow the CloudTrail service principal to put objects under the AWSLogs path for each account, so a missing entry for the new account blocks delivery. CloudTrail writes as a service principal, so an IAM policy on an admin role has no effect.
Question 13Identity & Access
Ironwood Energy attached an SCP to the organization root that denies ec2:RunInstances outside two approved Regions. A security audit finds that an IAM user in the management account launched instances in a third Region. The SCP is correctly written and attached. What is the BEST explanation and fix?
Correct answer: A. SCPs do not apply to the management account, so move workloads and users out of it.
Service control policies never restrict users or roles in the management account, which is why AWS recommends keeping workloads out of it. An identity policy such as AdministratorAccess cannot override an SCP deny in member accounts, so that explanation is wrong.
Service control policies never restrict users or roles in the management account, which is why AWS recommends keeping workloads out of it. An identity policy such as AdministratorAccess cannot override an SCP deny in member accounts, so that explanation is wrong.
Question 14Infrastructure Security
A company uses a transit gateway to send traffic between spoke VPCs through a central inspection VPC. The inspection VPC runs AWS Network Firewall endpoints in two Availability Zones. Some connections between spoke VPCs fail intermittently, and firewall logs show return packets reaching a different firewall endpoint than the original request. Route tables and firewall rules are correct. Which change BEST fixes the problem?
Correct answer: C. Enable appliance mode on the transit gateway attachment for the inspection VPC.
Appliance mode on the inspection VPC attachment makes the transit gateway keep both directions of a flow in the same Availability Zone, so the stateful firewall sees the whole session. Setting it on the spoke attachments does not control how traffic enters the inspection VPC, and a single zone would remove high availability.
Appliance mode on the inspection VPC attachment makes the transit gateway keep both directions of a flow in the same Availability Zone, so the stateful firewall sees the whole session. Setting it on the spoke attachments does not control how traffic enters the inspection VPC, and a single zone would remove high availability.
Question 15Data Protection
A regulator requires Aurelia Bank to keep the root key material for certain workloads outside AWS, in a key manager the bank operates in its own data center. AWS services that use AWS KMS must still be able to encrypt data with these keys. Which solution BEST meets these requirements?
Correct answer: D. Create KMS keys in an external key store connected to the on-premises key manager.
An external key store keeps key material in an external key manager outside AWS, and KMS sends requests to it for cryptographic operations. Imported key material is stored inside AWS KMS. CloudHSM clusters run in AWS, so the key material would still be inside AWS.
An external key store keeps key material in an external key manager outside AWS, and KMS sends requests to it for cryptographic operations. Imported key material is stored inside AWS KMS. CloudHSM clusters run in AWS, so the key material would still be inside AWS.
Question 16Detection
Thornbury Bank already uses GuardDuty in all accounts. The security team wants GuardDuty to link related signals, such as credential misuse followed by S3 data access, into one multistage finding. They want no custom correlation code. Which solution BEST meets these requirements?
Correct answer: D. Rely on GuardDuty Extended Threat Detection and enable S3 Protection for more coverage.
GuardDuty Extended Threat Detection is turned on by default and creates attack sequence findings that span multiple signals, and S3 Protection adds S3 data events to that analysis. Detective helps investigate findings, but it is not a detection and alerting service.
GuardDuty Extended Threat Detection is turned on by default and creates attack sequence findings that span multiple signals, and S3 Protection adds S3 data events to that analysis. Detective helps investigate findings, but it is not a detection and alerting service.
Question 17Data Protection
Evergreen Defense stores classified project files in Amazon S3. A new contract requires two independent layers of server-side encryption on every object, using keys managed in AWS KMS. The team wants the simplest supported approach. Which solution BEST meets these requirements?
Correct answer: A. Set the bucket default encryption to dual-layer server-side encryption with KMS keys.
DSSE-KMS applies two layers of encryption to each object with keys from KMS, which matches the contract with a single setting. SSE-KMS with Bucket Keys provides one layer only. SSE-C and SSE-S3 do not combine on one object, and replication creates a second copy rather than a second layer.
DSSE-KMS applies two layers of encryption to each object with keys from KMS, which matches the contract with a single setting. SSE-KMS with Bucket Keys provides one layer only. SSE-C and SSE-S3 do not combine on one object, and replication creates a second copy rather than a second layer.
Question 18Identity & Access
A data engineer uses a role in account A that needs to read objects from a bucket in account B. Account B's bucket policy allows s3:GetObject for the role's ARN. The objects are owned by account B and use SSE-S3. The engineer still receives AccessDenied. What should the team do next?
Correct answer: B. Grant the role s3:GetObject on the bucket objects in an identity policy in account A.
Cross-account access requires an allow in both places: the resource policy in account B and an identity-based policy for the principal in account A. Changing the principal to the account root delegates trust to account A, but the role still lacks its own identity permission.
Cross-account access requires an allow in both places: the resource policy in account B and an identity-based policy for the principal in account A. Changing the principal to the account root delegates trust to account A, but the role still lacks its own identity permission.
Question 19Detection
Copperline Ads runs workloads on Amazon EKS. The security team needs to detect suspicious behavior inside running containers, such as unexpected process execution or crypto mining. The team does not want to deploy and update security agents by hand. Which solution BEST meets these requirements?
Correct answer: D. Enable GuardDuty Runtime Monitoring for EKS with automated agent management turned on.
Runtime Monitoring observes process, file, and network activity on nodes and containers, and automated agent management installs and updates the agent. EKS Protection reviews control plane audit logs, so it cannot see activity inside containers.
Runtime Monitoring observes process, file, and network activity on nodes and containers, and automated agent management installs and updates the agent. EKS Protection reviews control plane audit logs, so it cannot see activity inside containers.
Question 20Infrastructure Security
A SaaS provider runs an API behind a Network Load Balancer in its own VPC. It must give 200 customer VPCs in other AWS accounts private access to the API. Customer CIDR ranges overlap with each other and with the provider's VPC. Customers must not gain network access to any other provider resources. Which solution BEST meets these requirements?
Correct answer: C. Create a VPC endpoint service backed by the NLB, require acceptance, and allow the customer principals.
AWS PrivateLink exposes only the NLB-backed service through interface endpoints in each customer VPC, so overlapping CIDRs do not matter and no wider network path exists. VPC peering does not support overlapping CIDR ranges and would open routing between the networks.
AWS PrivateLink exposes only the NLB-backed service through interface endpoints in each customer VPC, so overlapping CIDRs do not matter and no wider network path exists. VPC peering does not support overlapping CIDR ranges and would open routing between the networks.
Question 21Data Protection
Lindale Archives keeps long-term records in an Amazon S3 Glacier vault. Compliance requires an immutable policy that denies deletes of archives younger than 10 years. The team wants a chance to confirm the policy works as intended before it can no longer be changed. Which approach BEST meets these requirements?
Correct answer: A. Initiate a Vault Lock with the policy, test it within the 24-hour window, and then complete the lock.
Initiating Vault Lock puts the policy in an in-progress state for 24 hours so it can be tested, and completing the lock makes it immutable. A vault access policy can be changed at any time. MFA delete is an S3 bucket versioning feature, not a Glacier vault control.
Initiating Vault Lock puts the policy in an in-progress state for 24 hours so it can be tested, and completing the lock makes it immutable. A vault access policy can be changed at any time. MFA delete is an S3 bucket versioning feature, not a Glacier vault control.
Question 22Detection
Marigold Payments runs Amazon Aurora PostgreSQL databases. The security team wants alerts on anomalous login behavior, such as successful logins from unusual sources after many failed attempts. They prefer a managed detection service over custom log analysis. Which solution BEST meets these requirements?
Correct answer: C. Enable GuardDuty RDS Protection for the accounts that run the Aurora databases.
GuardDuty RDS Protection profiles Aurora login activity and creates findings for anomalous logins with no custom rules. Metric filters can count failures, but they cannot judge whether a login is unusual compared to normal behavior.
GuardDuty RDS Protection profiles Aurora login activity and creates findings for anomalous logins with no custom rules. Metric filters can count failures, but they cannot judge whether a login is unusual compared to normal behavior.
Question 23Identity & Access
Summit Travel has a central S3 bucket of shared reference data. All current and future accounts in its organization must be able to read it. Accounts join and leave the organization often, and the team does not want to edit the bucket policy each time. Which bucket policy approach BEST meets this requirement?
Correct answer: A. Allow s3:GetObject for all principals with a condition that aws:PrincipalOrgID equals the org ID.
The aws:PrincipalOrgID condition allows any principal from an account in the organization, and membership changes apply automatically. A Lambda function that rewrites the account list also works, but it adds operational overhead the team wants to avoid.
The aws:PrincipalOrgID condition allows any principal from an account in the organization, and membership changes apply automatically. A Lambda function that rewrites the account list also works, but it adds operational overhead the team wants to avoid.
Question 24Data Protection
Fairbanks Legal uses a versioned S3 bucket for case files. The security team wants an extra safeguard so that permanently deleting an object version or suspending versioning requires a one-time code from an MFA device. Which action BEST meets this requirement?
Correct answer: B. Use the root user with its MFA device to enable MFA delete on the bucket through the CLI or API.
MFA delete can be enabled only by the bucket owner's root user, using the CLI or API with that user's MFA device. It cannot be enabled by an IAM user or from the console. A condition on s3:PutObject protects uploads, not version deletion or versioning changes.
MFA delete can be enabled only by the bucket owner's root user, using the CLI or API with that user's MFA device. It cannot be enabled by an IAM user or from the console. A condition on s3:PutObject protects uploads, not version deletion or versioning changes.
Question 25Infrastructure Security
A company wants contractors to reach three internal web applications that run behind internal Application Load Balancers. Contractors must not use the corporate VPN. Each request must be evaluated against the contractor's identity in IAM Identity Center and device posture from a supported device management provider. Which solution BEST meets these requirements?
Correct answer: A. Use AWS Verified Access with identity and device trust providers and a Cedar access policy for each group.
Verified Access provides VPN-less access to internal applications and evaluates Cedar policies on every request using identity and device trust data. Client VPN is still a VPN and does not evaluate device posture on each request.
Verified Access provides VPN-less access to internal applications and evaluates Cedar policies on every request using identity and device trust data. Client VPN is still a VPN and does not evaluate device posture on each request.
Question 26Detection
Evergreen Telecom wants to centralize CloudTrail, VPC Flow Logs, Route 53 Resolver logs, and Security Hub CSPM findings from all accounts in one place. The data must use an open standard schema so the third-party SIEM can query it. Which solution BEST meets these requirements?
Correct answer: C. Enable Amazon Security Lake with a delegated administrator and add the SIEM as a subscriber.
Security Lake collects AWS log sources and findings across accounts, normalizes them to OCSF, and gives subscribers like a SIEM access to the data. Security Hub CSPM handles findings only, so it would not bring in the raw flow and DNS logs.
Security Lake collects AWS log sources and findings across accounts, normalizes them to OCSF, and gives subscribers like a SIEM access to the data. Security Hub CSPM handles findings only, so it would not bring in the raw flow and DNS logs.
Question 27Data Protection
Ellsworth Bank's mobile app must let customers download their monthly statements from a private S3 bucket. The bucket must stay private, each download link must work for only 15 minutes, and the app backend already authenticates users. What should the backend do?
Correct answer: B. Generate a presigned URL for the object that expires in 15 minutes
A presigned URL grants time-limited access to one object using the backend's credentials, so the bucket stays private and the link expires automatically. Creating IAM users for customers does not scale and is not meant for end-user access.
A presigned URL grants time-limited access to one object using the backend's credentials, so the bucket stays private and the link expires automatically. Creating IAM users for customers does not scale and is not meant for end-user access.
Question 28Identity & Access
Garnet Retail wants least-privilege policies for a new data processing role, but developers do not know exactly which API actions the application calls. The role has run with broad permissions in a test account for two weeks with CloudTrail enabled. What is the MOST efficient way to build a least-privilege policy?
Correct answer: D. Use IAM Access Analyzer to generate a policy from the role's CloudTrail activity
IAM Access Analyzer policy generation reviews CloudTrail logs for the role and drafts a policy containing only the actions and services actually used, which can then be refined. A managed read-only policy plus guessed write actions is both too broad and likely incomplete.
IAM Access Analyzer policy generation reviews CloudTrail logs for the role and drafts a policy containing only the actions and services actually used, which can then be refined. A managed read-only policy plus guessed write actions is both too broad and likely incomplete.
Question 29Detection
Ashford Systems runs an in-house configuration scanner. The security team wants its results shown next to other findings in Security Hub CSPM so analysts can use one triage workflow. The team will change the scanner as needed. Which solution BEST meets this requirement?
Correct answer: A. Format the results in ASFF and send them with the BatchImportFindings API operation.
Security Hub CSPM accepts custom findings through BatchImportFindings when they use the AWS Security Finding Format. It does not poll S3 buckets or read events from EventBridge to create findings.
Security Hub CSPM accepts custom findings through BatchImportFindings when they use the AWS Security Finding Format. It does not poll S3 buckets or read events from EventBridge to create findings.
Question 30Data Protection
A secret in AWS Secrets Manager in Account A at Westbrook Media stores an API key. A Lambda function in Account B must read the secret. The secret is currently encrypted with the AWS managed key aws/secretsmanager. Which set of changes BEST enables secure cross-account access?
Correct answer: B. Use a customer managed key, allow Account B in the secret policy and key policy, and grant the role IAM access.
Cross-account secret access needs a customer managed key, because the key policy of an AWS managed key cannot be changed to allow another account. The secret resource policy, key policy, and an IAM policy in Account B must all allow the access. Secrets Manager replication copies secrets to other Regions, not other accounts.
Cross-account secret access needs a customer managed key, because the key policy of an AWS managed key cannot be changed to allow another account. The secret resource policy, key policy, and an IAM policy in Account B must all allow the access. Secrets Manager replication copies secrets to other Regions, not other accounts.
Question 31Infrastructure Security
A three-tier app at Corliss Health runs web servers in an Auto Scaling group whose private IP addresses change often. The database security group currently allows the web subnet's CIDR range, which also contains unrelated test instances. How should the engineer restrict database access to only the web servers?
Correct answer: A. Allow the web tier's security group ID as the source in the database security group
Referencing the web tier's security group as the source lets any instance in that group connect, no matter how its IP changes, and excludes everything else in the subnet. NACL deny rules by IP break as soon as instances are replaced.
Referencing the web tier's security group as the source lets any instance in that group connect, no matter how its IP changes, and excludes everything else in the subnet. NACL deny rules by IP break as soon as instances are replaced.
Question 32Identity & Access
Kestrel Bank wants to stop employees from copying data out to S3 buckets in personal or third-party AWS accounts. Identities in its organization should only be able to access resources owned by accounts in the organization. Access to AWS-owned resources that services need must still work. Which control BEST meets this requirement?
Correct answer: D. An SCP denying S3 actions when aws:ResourceOrgID differs, with exceptions for AWS-owned resources.
An SCP with aws:ResourceOrgID creates an identity perimeter that stops company principals from reaching buckets outside the organization. An RCP or bucket policy controls who can reach company resources, not which outside resources company principals can write to.
An SCP with aws:ResourceOrgID creates an identity perimeter that stops company principals from reaching buckets outside the organization. An RCP or bucket policy controls who can reach company resources, not which outside resources company principals can write to.
Question 33Data Protection
Maple Street Apps needs to store about 200 configuration values for its services, including a few database connection strings that must be encrypted. The values change rarely and do not need automatic rotation. The team wants the lowest cost option with native IAM access control. Which solution BEST meets these requirements?
Correct answer: A. Use Parameter Store, with standard-tier SecureString parameters for the sensitive values.
Standard-tier Parameter Store parameters have no storage charge, and SecureString encrypts sensitive values with KMS while IAM controls access per parameter. Secrets Manager charges per secret per month, which is costly for values that do not need rotation. A single S3 object gives coarse access control over all values at once.
Standard-tier Parameter Store parameters have no storage charge, and SecureString encrypts sensitive values with KMS while IAM controls access per parameter. Secrets Manager charges per secret per month, which is costly for values that do not need rotation. A single S3 object gives coarse access control over all values at once.
Question 34Detection
Calder Energy receives a daily feed of known malicious IP addresses from its industry information sharing group. The security team wants Amazon GuardDuty to raise findings whenever any workload communicates with one of those addresses, with minimal custom code. What should the team configure?
Correct answer: C. A GuardDuty threat list loaded from the feed in Amazon S3
GuardDuty threat lists let you upload your own malicious IP lists from S3, and GuardDuty then generates findings for any traffic involving them. A WAF IP set only blocks inbound web requests at load balancers and does not detect outbound connections from workloads.
GuardDuty threat lists let you upload your own malicious IP lists from S3, and GuardDuty then generates findings for any traffic involving them. A WAF IP set only blocks inbound web requests at load balancers and does not detect outbound connections from workloads.
Question 35Infrastructure Security
A company runs 1,500 EC2 instances with Windows Server and Amazon Linux across 12 accounts in AWS Organizations. The security team must install critical and security patches within 7 days of release, patch only during approved windows, and see compliance status centrally. The solution must have the least operational overhead. Which solution BEST meets these requirements?
Correct answer: A. Use a Quick Setup patch policy with custom patch baselines and a scheduled patching window.
A Systems Manager Quick Setup patch policy applies Patch Manager baselines and schedules across accounts in the organization and reports patch compliance centrally. A monthly AMI rebuild cannot meet the 7-day requirement and adds instance replacement work.
A Systems Manager Quick Setup patch policy applies Patch Manager baselines and schedules across accounts in the organization and reports patch compliance centrally. A monthly AMI rebuild cannot meet the 7-day requirement and adds instance replacement work.
Question 36Data Protection
Copperfield Retail uses a customer managed KMS key to encrypt order data. A new policy requires the key material to rotate every 180 days. Existing ciphertext must remain decryptable without re-encrypting it, and the team wants no custom code. Which solution BEST meets these requirements?
Correct answer: D. Enable automatic key rotation on the key and set the rotation period to 180 days.
Automatic rotation supports a custom period between 90 and 2,560 days, and KMS keeps older key material so existing ciphertext still decrypts. Creating new keys and moving the alias works but needs manual or scripted effort every cycle. AWS managed keys rotate yearly and cannot be set to 180 days.
Automatic rotation supports a custom period between 90 and 2,560 days, and KMS keeps older key material so existing ciphertext still decrypts. Creating new keys and moving the alias works but needs manual or scripted effort every cycle. AWS managed keys rotate yearly and cannot be set to 180 days.
Question 37Incident Response
Wrenfield Corp wants an automated response to high-severity GuardDuty findings on EC2. The workflow must tag the instance, snapshot volumes in parallel, isolate it, and notify the team. It needs built-in retries and a visual record of each run. Which solution BEST meets these requirements?
Correct answer: B. An EventBridge rule on high-severity findings that starts a Step Functions state machine.
Step Functions supports parallel branches, retries, and a visual history of each execution, and EventBridge can start it when a finding matches. A single Lambda function has no built-in visual audit trail and is limited to 15 minutes.
Step Functions supports parallel branches, retries, and a visual history of each execution, and EventBridge can start it when a finding matches. A single Lambda function has no built-in visual audit trail and is limited to 15 minutes.
Question 38Identity & Access
Falcon Media has 80 accounts in AWS Organizations. The security team must get findings whenever an S3 bucket, KMS key, IAM role trust policy, or Lambda function allows access from outside the organization. Sharing between accounts in the organization is expected and should not create findings. Which solution BEST meets this requirement?
Correct answer: C. Create an organization-level external access analyzer with the organization as the zone of trust.
With the organization as the zone of trust, IAM Access Analyzer reports only resources shared with principals outside the organization. Per-account analyzers treat other accounts in the organization as external, which creates findings for expected internal sharing.
With the organization as the zone of trust, IAM Access Analyzer reports only resources shared with principals outside the organization. Per-account analyzers treat other accounts in the organization as external, which creates findings for expected internal sharing.
Question 39Governance
Delmar Foods uses AWS Organizations. Teams tag EC2 instances with a CostCenter key, but values such as 'finance', 'Finance', and 'FIN' break reporting. The security team wants to define allowed values centrally and block noncompliant tagging operations on EC2 instances. Which solution BEST meets these requirements?
Correct answer: B. Create a tag policy with the allowed CostCenter values and enforce it for EC2 instances.
Tag policies standardize tag keys and values across accounts, and enforcement for a resource type blocks noncompliant tagging operations. A Config rule only detects problems after the fact. An SCP that requires any CostCenter tag does not standardize the allowed values.
Tag policies standardize tag keys and values across accounts, and enforcement for a resource type blocks noncompliant tagging operations. A Config rule only detects problems after the fact. An SCP that requires any CostCenter tag does not standardize the allowed values.
Question 40Incident Response
A compromised EC2 instance at Hollis Freight is part of an Auto Scaling group behind an Application Load Balancer. The team will isolate it with a restrictive security group for forensic work. The instance must not be terminated during the investigation. Which action BEST meets this requirement?
Correct answer: D. Detach the instance from the Auto Scaling group and deregister it from the target group.
Detaching the instance removes it from Auto Scaling control, and deregistering it stops it from receiving load balancer traffic. Termination protection does not stop Auto Scaling from terminating an instance that fails health checks.
Detaching the instance removes it from Auto Scaling control, and deregistering it stops it from receiving load balancer traffic. Termination protection does not stop Auto Scaling from terminating an instance that fails health checks.
Question 41Infrastructure Security
A company requires all EC2 workloads to launch from AMIs hardened to CIS benchmark guidance. The AMIs must be rebuilt automatically when the base image is updated and tested before they are distributed to 15 accounts. The team does not want to maintain its own build servers. Which solution BEST meets these requirements?
Correct answer: B. Create an EC2 Image Builder pipeline with hardening and test components that distributes to the accounts.
EC2 Image Builder is managed, can run when base image updates are available, applies hardening and test components, and distributes AMIs across accounts. A Jenkins and Packer setup can produce similar images but requires the self-managed build servers the team wants to avoid.
EC2 Image Builder is managed, can run when base image updates are available, applies hardening and test components, and distributes AMIs across accounts. A Jenkins and Packer setup can produce similar images but requires the self-managed build servers the team wants to avoid.
Question 42Governance
Prism Health must apply the same set of AWS Config rules and remediation actions to all 70 accounts in its organization, and manage them as one unit with a single compliance score. The work must be done from a delegated administrator account. Which solution BEST meets these requirements?
Correct answer: C. Deploy an organization conformance pack from the Config delegated administrator account.
An organization conformance pack packages Config rules and remediation actions as one unit and deploys them to all accounts from the delegated administrator. Manual templates in each account add overhead and drift risk. Separate organization rules lack the grouped compliance view, and this plan would use the management account.
An organization conformance pack packages Config rules and remediation actions as one unit and deploys them to all accounts from the delegated administrator. Manual templates in each account add overhead and drift risk. Separate organization rules lack the grouped compliance view, and this plan would use the management account.
Question 43Identity & Access
Juniper Labs has a legacy reporting role with AdministratorAccess. The team wants to replace it with a least-privilege policy based on what the role actually did over the last 60 days. A CloudTrail trail already logs management events for the account. Which approach requires the least effort?
Correct answer: A. Use IAM Access Analyzer policy generation on the role with the existing trail and a 60-day range.
Access Analyzer policy generation reads CloudTrail activity for the chosen period and drafts a policy with the actions the role used. Querying logs with Athena gives the same data but takes much more manual work, and policy validation only checks grammar and best practices.
Access Analyzer policy generation reads CloudTrail activity for the chosen period and drafts a policy with the actions the role used. Querying logs with Athena gives the same data but takes much more manual work, and policy validation only checks grammar and best practices.
Question 44Incident Response
A pod in Thistle Media's Amazon EKS cluster shows signs of compromise. The team must stop the pod's network traffic, keep it running for evidence collection, and stop new pods from being placed on the same node. Which actions BEST meet these requirements?
Correct answer: D. Apply a deny-all network policy to the pod and cordon the worker node it runs on.
A deny-all network policy cuts the pod's traffic while it keeps running, and cordoning stops new pods from being scheduled on the node. Deleting the pod removes the evidence that responders need to collect.
A deny-all network policy cuts the pod's traffic while it keeps running, and cordoning stops new pods from being scheduled on the node. Deleting the pod removes the evidence that responders need to collect.
Question 45Governance
Ravenwood Payments prepares for an annual PCI DSS audit. Auditors want evidence mapped to PCI DSS requirements, collected continuously from AWS Config, CloudTrail, and Security Hub. The compliance team wants to cut the manual work of gathering screenshots. Which solution BEST meets these requirements?
Correct answer: A. Create an AWS Audit Manager assessment from the prebuilt PCI DSS framework.
Audit Manager continuously collects evidence from AWS sources and maps it to controls in prebuilt frameworks such as PCI DSS. The AWS Attestation of Compliance covers AWS infrastructure, not the company's own environment. Security Hub findings and Athena reports still need manual mapping to requirements.
Audit Manager continuously collects evidence from AWS sources and maps it to controls in prebuilt frameworks such as PCI DSS. The AWS Attestation of Compliance covers AWS infrastructure, not the company's own environment. Security Hub findings and Athena reports still need manual mapping to requirements.
Question 46Infrastructure Security
A company runs many microservices on one Amazon EKS cluster. All pods currently use the node IAM role, which can access every S3 bucket the services need. The security team wants each service to receive only its own permissions. The platform team wants to avoid creating and managing an IAM OIDC provider for each cluster. Which solution BEST meets these requirements?
Correct answer: C. Install the EKS Pod Identity Agent and create a pod identity association for each service account.
EKS Pod Identity gives each service account its own IAM role through pod identity associations and does not need an OIDC provider per cluster. IAM roles for service accounts also scopes permissions per service, but it requires the OIDC provider the team wants to avoid.
EKS Pod Identity gives each service account its own IAM role through pod identity associations and does not need an OIDC provider per cluster. IAM roles for service accounts also scopes permissions per service, but it requires the OIDC provider the team wants to avoid.
Question 47Incident Response
Bramble Health has a small security team and uses GuardDuty and Security Hub CSPM across its organization. It wants AWS to help triage findings and give 24/7 access to AWS incident responders during active events, with case tracking built in. Which solution BEST meets these requirements?
Correct answer: D. Subscribe to AWS Security Incident Response for the organization's member accounts.
AWS Security Incident Response triages GuardDuty and Security Hub CSPM findings, manages cases, and provides around-the-clock access to the AWS Customer Incident Response Team. The Shield Response Team focuses on DDoS events, not general security incidents.
AWS Security Incident Response triages GuardDuty and Security Hub CSPM findings, manages cases, and provides around-the-clock access to the AWS Customer Incident Response Team. The Shield Response Team focuses on DDoS events, not general security incidents.
Question 48Identity & Access
Cobalt Insurance deploys IAM policies through a CI/CD pipeline. The security team wants the pipeline to fail automatically when a pull request changes a policy so that it grants any access beyond an approved reference policy. Reviewers should not need to read every policy by hand. Which solution BEST meets this requirement?
Correct answer: D. Add a step that runs the Access Analyzer CheckNoNewAccess check against the reference policy.
The CheckNoNewAccess custom policy check compares a new policy with a reference policy and fails if the new one grants more access. ValidatePolicy finds syntax and best practice issues, but it does not compare permissions with an approved baseline.
The CheckNoNewAccess custom policy check compares a new policy with a reference policy and fails if the new one grants more access. ValidatePolicy finds syntax and best practice issues, but it does not compare permissions with an approved baseline.
Question 49Governance
Northgate University wants every account in its Research OU to have a standard IAM role for security audits and a baseline set of security resources. New accounts added to the OU must receive the baseline automatically, with no manual steps. Which solution BEST meets these requirements?
Correct answer: B. Use CloudFormation StackSets with service-managed permissions and automatic deployment to the Research OU.
StackSets with service-managed permissions can target an OU and automatically deploy to accounts that join it later. Self-managed permissions require creating execution roles and listing accounts manually. A daily Lambda function is custom code and leaves gaps between runs.
StackSets with service-managed permissions can target an OU and automatically deploy to accounts that join it later. Self-managed permissions require creating execution roles and listing accounts manually. A daily Lambda function is custom code and leaves gaps between runs.
Question 50Incident Response
At Calloway Energy, many engineers sign in through an external IdP and assume the same IAM role. During a past incident, CloudTrail could not show which engineer made a harmful change. The company wants future CloudTrail events to identify the person, even after role chaining. Which solution BEST meets this requirement?
Correct answer: C. Have the IdP set SourceIdentity and require the sts:SourceIdentity key in the role trust policy.
SourceIdentity is set when the role is assumed, cannot be changed by the user, persists through role chaining, and appears in CloudTrail events. Session names are chosen by the caller and do not carry over reliably when roles are chained.
SourceIdentity is set when the role is assumed, cannot be changed by the user, persists through role chaining, and appears in CloudTrail events. Session names are chosen by the caller and do not carry over reliably when roles are chained.
Question 51Governance
At Coastline Logistics, many teams deploy AWS CloudFormation stacks from pipelines, the console, and local machines. Security must block any stack operation that would create an RDS DB instance without storage encryption, no matter how the stack is deployed. Which solution BEST meets these requirements?
Correct answer: D. Activate a CloudFormation Hook in each account that fails stack operations with unencrypted RDS.
CloudFormation Hooks run inside the CloudFormation service before resources are provisioned, so they apply to every stack operation regardless of where it starts. A Guard check in one pipeline misses console and local deployments. Config rules and drift detection act only after resources exist.
CloudFormation Hooks run inside the CloudFormation service before resources are provisioned, so they apply to every stack operation regardless of where it starts. A Guard check in one pipeline misses console and local deployments. Config rules and drift detection act only after resources exist.
Question 52Infrastructure Security
A company runs an Amazon EKS cluster on EC2 nodes that use the Amazon VPC CNI plugin. An Amazon RDS database must accept connections only from the payments pods. Other pods run on the same nodes and must not be able to reach the database. Which solution BEST meets these requirements?
Correct answer: C. Enable security groups for pods and attach a dedicated security group to the payments pods.
Security groups for pods assign a dedicated security group to selected pods through a SecurityGroupPolicy, so the RDS security group can trust only that group. Allowing the node security group would let every pod on those nodes reach the database.
Security groups for pods assign a dedicated security group to selected pods through a SecurityGroupPolicy, so the RDS security group can trust only that group. Allowing the node security group would let every pod on those nodes reach the database.
Question 53Identity & Access
An operator at Aspen Robotics receives an UnauthorizedOperation error when calling ec2:RunInstances. The error includes a long encoded authorization message. The operator needs to see which statement and condition caused the denial before asking for a policy change. What should the operator do?
Correct answer: B. Call sts:DecodeAuthorizationMessage with a principal that has permission to decode the message.
The STS DecodeAuthorizationMessage API returns the decoded details, including the matched statements and context, to a principal allowed to call it. CloudTrail records the error code but does not include the full policy text or the decoded evaluation details.
The STS DecodeAuthorizationMessage API returns the decoded details, including the matched statements and context, to a principal allowed to call it. CloudTrail records the error code but does not include the full policy text or the decoded evaluation details.
Question 54Incident Response
Ransomware corrupted tables in Nettlefield Retail's Amazon RDS for MySQL database at 14:05. The database is protected by AWS Backup with continuous backups enabled. The team must restore data to just before the attack with as little data loss as possible. Which solution BEST meets this requirement?
Correct answer: C. Use AWS Backup point-in-time restore to 14:04 into a new database instance.
Continuous backups allow a point-in-time restore to a moment just before the attack, and the restore creates a new DB instance. A daily snapshot would lose all changes since it was taken, and RDS does not restore in place over a running instance.
Continuous backups allow a point-in-time restore to a moment just before the attack, and the restore creates a new DB instance. A daily snapshot would lose all changes since it was taken, and RDS does not restore in place over a running instance.
Question 55Governance
A product team at Quillon Software is designing a new serverless payments feature. Leadership wants security risks identified and prioritized before any code is written, with clear mitigations that become security requirements. Which approach BEST meets these requirements?
Correct answer: A. Threat model the design with a framework such as STRIDE and track mitigations as requirements.
Threat modeling during design finds and ranks risks early and turns mitigations into requirements before code exists. Penetration tests and Inspector scans happen after code is written and deployed, which is later than required. GuardDuty detects threats in running workloads, not design risks.
Threat modeling during design finds and ranks risks early and turns mitigations into requirements before code exists. Penetration tests and Inspector scans happen after code is written and deployed, which is later than required. GuardDuty detects threats in running workloads, not design risks.
Question 56Incident Response
During an investigation at Pennant Media, responders find that an attacker added a Lambda function URL with auth type NONE to an internal function, exposing it to the internet. The function's execution role can read a customer database. What should the responders do FIRST?
Correct answer: B. Remove the function URL and review the role's recent activity in CloudTrail
Removing the public function URL contains the exposure immediately, and CloudTrail shows what the role accessed and who changed the configuration. Deleting the log group destroys evidence that the investigation needs.
Removing the public function URL contains the exposure immediately, and CloudTrail shows what the role accessed and who changed the configuration. Deleting the log group destroys evidence that the investigation needs.
Question 57Infrastructure Security
An AWS Lambda function must query an Amazon RDS database in private subnets and read the database password from AWS Secrets Manager. The VPC has no NAT gateway or internet gateway, and the company will not add one. The function's execution role must follow least privilege. Which solution BEST meets these requirements?
Correct answer: A. Attach the function to the private subnets, add a Secrets Manager interface endpoint, and scope the role to the one secret.
A Secrets Manager interface endpoint gives the VPC-attached function a private path to the service, and allowing GetSecretValue on only that secret meets least privilege. Adding a NAT gateway would also work technically, but it breaks the stated constraint.
A Secrets Manager interface endpoint gives the VPC-attached function a private path to the service, and allowing GetSecretValue on only that secret meets least privilege. Adding a NAT gateway would also work technically, but it breaks the stated constraint.
Question 58Governance
Bramble Networks must keep VPC Flow Logs from all VPCs for one year to support investigations. Sending them to CloudWatch Logs has become too expensive, and analysts only run occasional queries. The team wants to reduce cost while keeping the logs queryable. Which solution BEST meets these requirements?
Correct answer: C. Publish the flow logs to Amazon S3 in Parquet format and query them with Amazon Athena.
Delivering flow logs to S3 costs less than CloudWatch Logs ingestion, Parquet reduces storage and query cost, and Athena handles occasional queries. Shortening retention breaks the one-year requirement. GuardDuty findings are not a replacement for raw flow log records during investigations.
Delivering flow logs to S3 costs less than CloudWatch Logs ingestion, Parquet reduces storage and query cost, and Athena handles occasional queries. Shortening retention breaks the one-year requirement. GuardDuty findings are not a replacement for raw flow log records during investigations.
Question 59Identity & Access
Willow Clinics uses IAM Identity Center with its built-in Identity Center directory and no external identity provider. Compliance requires every user to use MFA at each sign-in. Users who have not registered a device yet must be forced to register one before they can continue. Which configuration BEST meets these requirements?
Correct answer: D. Set Identity Center MFA to prompt every sign-in and require users without a device to register at sign-in.
Identity Center MFA settings can prompt at every sign-in and force users without a device to register one, which meets both requirements. Context-aware mode only prompts when the sign-in context changes, so it does not meet the every sign-in rule.
Identity Center MFA settings can prompt at every sign-in and force users without a device to register one, which meets both requirements. Context-aware mode only prompts when the sign-in context changes, so it does not meet the every sign-in rule.
Question 60Incident Response
Detective at Oakridge Media shows many GuardDuty findings across several accounts that involve the same external IP address and two IAM roles. An analyst needs to understand the full scope of this one incident in a single view, not review each finding alone. Which Detective feature BEST meets this need?
Correct answer: D. Finding groups, which link related findings and entities into one investigation view.
Detective finding groups connect related findings and the entities they share, such as IP addresses and roles, so analysts can scope a whole incident at once. An account profile shows activity for one account and does not tie findings across accounts together.
Detective finding groups connect related findings and the entities they share, such as IP addresses and roles, so analysts can scope a whole incident at once. An account profile shows activity for one account and does not tie findings across accounts together.
Question 61Governance
Fieldstone Health has Business Support on its AWS accounts. The security team wants an automatic email whenever an AWS Trusted Advisor security check changes to a red status, without polling the API. Which solution BEST meets these requirements?
Correct answer: A. Create an EventBridge rule in us-east-1 that matches Trusted Advisor check status events and targets an SNS topic.
Trusted Advisor publishes check status change events to EventBridge in the US East (N. Virginia) Region, so a rule there can notify an SNS topic. Rules in other Regions would not receive these events. A scheduled Lambda function is polling, which the team wants to avoid.
Trusted Advisor publishes check status change events to EventBridge in the US East (N. Virginia) Region, so a rule there can notify an SNS topic. Rules in other Regions would not receive these events. A scheduled Lambda function is polling, which the team wants to avoid.
Question 62Infrastructure Security
A company has EC2 instances in 40 accounts in AWS Organizations. Some instances cannot run the SSM Agent because of a vendor support policy. The security team needs continuous vulnerability findings for all instances, managed from one account, with new accounts enrolled automatically. Which solution BEST meets these requirements?
Correct answer: B. Delegate Inspector administration, auto-enable EC2 scanning, and use hybrid scan mode for agentless coverage.
An Inspector delegated administrator can auto-enable EC2 scanning for new member accounts, and hybrid scan mode uses agentless snapshot scanning for instances without the SSM Agent. Agent-based scanning alone would leave the instances without the agent uncovered.
An Inspector delegated administrator can auto-enable EC2 scanning for new member accounts, and hybrid scan mode uses agentless snapshot scanning for instances without the SSM Agent. Agent-based scanning alone would leave the instances without the agent uncovered.
Question 63Identity & Access
Quarry Lane Media gives 500 contractors IAM access to one shared S3 bucket. Each contractor must be able to read and write only objects under a prefix matching their own user name, and the team wants a single policy rather than 500. What should the security engineer use?
Correct answer: D. An IAM policy using the ${aws:username} policy variable in the resource ARN
Policy variables such as ${aws:username} are filled in at evaluation time, so one policy restricts each user to their own prefix. Writing a statement per contractor works but becomes unmanageable and runs into bucket policy size limits.
Policy variables such as ${aws:username} are filled in at evaluation time, so one policy restricts each user to their own prefix. Writing a statement per contractor works but becomes unmanageable and runs into bucket policy size limits.
Question 64Incident Response
Responders at Valemont Inc must run commands on an isolated EC2 instance during an investigation. The isolation security group allows no inbound rules, and the SSH key may be compromised. All commands must be logged. The subnet has no internet access. Which solution BEST meets these requirements?
Correct answer: C. Use Session Manager with VPC interface endpoints and allow only outbound HTTPS to them.
Session Manager needs no inbound ports or SSH keys, can log every session, and works without internet access through VPC interface endpoints. EC2 Instance Connect Endpoint still requires an inbound SSH rule, which breaks the isolation requirement.
Session Manager needs no inbound ports or SSH keys, can log every session, and works without internet access through VPC interface endpoints. EC2 Instance Connect Endpoint still requires an inbound SSH rule, which breaks the isolation requirement.
Question 65Governance
Larchmont Media finds that developers sometimes make S3 buckets publicly readable. The security team wants any such bucket detected and fixed automatically within minutes, with no custom code to maintain. Which solution BEST meets these requirements?
Correct answer: B. Use an AWS Config managed rule with automatic remediation through a Systems Manager Automation runbook.
A Config managed rule detects publicly readable buckets, and automatic remediation runs an AWS-provided Systems Manager Automation runbook to fix them without custom code. A custom Lambda scanner is code the team must maintain and runs only hourly. Macie and Trusted Advisor report the issue but do not fix it.
A Config managed rule detects publicly readable buckets, and automatic remediation runs an AWS-provided Systems Manager Automation runbook to fix them without custom code. A custom Lambda scanner is code the team must maintain and runs only hourly. Macie and Trusted Advisor report the issue but do not fix it.
The real AWS Security Specialty exam at a glance
65questions
2h 50mtime limit
MCQmultiple choice
75%+aim for here
Score 75% or more on two different sets before you book the real exam. Need a plan for your weak topics? See how we help you pass, or get a full refund.
More free AWS practice tests
AWS Cloud Practitioner Practice Test65 questions · CLF-C02AWS AI Practitioner Practice Test65 questions · AIF-C01AWS Solutions Architect Associate Practice Test65 questions · SAA-C03AWS Solutions Architect Professional Practice Test75 questions · SAP-C03AWS DevOps Engineer Professional Practice Test75 questions · DOP-C02AWS Data Engineer Associate Practice Test65 questions · DEA-C01
See all 36 free practice tests →
Original practice questions written by CertOcean in the style of the AWS Security Specialty exam. They are not real exam questions. AWS Security Specialty and Amazon Web Services are trademarks of their owners. Real exam format: 65 questions (50 scored, 15 unscored) · 170 minutes · passing score 750 on a 100-1000 scale.