Free AWS Certified Security - Specialty Exam Questions and Answers

Last updated: September 8, 2026

Provider

Amazon

Questions in our bank

1000+

Free to read

First 10, with answers

Official page

Official Exam website

Our test mode duration & pass mark

130 mins · 70%

Verified answers

Reviewed weekly

Recommended: Switch to Test Mode to start a practice test that simulates the real exam experience.

1. Question #1

   A company wants to have an Intrusion detection system available for their VPC in AWS. They want to have complete control over the system. Which of the following would be ideal to implement? Please select:

   • A. Use AWS WAF to catch all intrusions occurring on the systems in the VPC
   • B. Use a custom solution available in the AWS Marketplace
   • C. Use VPC Flow logs to detect the issues and flag them accordingly.
   • D. Use AWS Cloudwatch to monitor all traffic
   Reveal Answer

2. Question #2

   A security team must present a daily briefing to the CISO that includes a report of which of the company's thousands of EC2 instances and on-premises servers are missing the latest security patches. All instances/servers must be brought into compliance within 24 hours so they do not show up on the next day's report. How can the security team fulfill these requirements? Please select:

   • A. Use Amazon QuickSight and Cloud Trail to generate the report of out of compliance instances/server
   • B. Redeploy all out of compliance instances/servers using an AMI with the latest patches.
   • C. Use Systems Manger Patch Manger to generate the report of out of compliance instances/ server
   • D. Use Systems Manager Patch Manger to install the missing patches.
   Reveal Answer

3. Question #3

   Your company makes use of S3 buckets for storing dat

   • A. There is a company policy that all services should have logging enable
   • B. How can you ensure thatlogging is always enabled for created S3 buckets in the AWS Account? Please select:
   • C. Use AWS Inspector to inspect all S3 buckets and enable logging for those where it is not enabled
   • D. Use AWS Config Rules to check whether logging is enabled for buckets
   Reveal Answer

4. Question #4

   Which technique can be used to integrate AWS 1AM (Identity and Access Management) with an on Questions & Answers PDF P-63 premise LDAP (Lightweight Directory Access Protocol) directory service? Please select:

   • A. Use an 1AM policy that references the LDAP account identifiers and the AWS credentials.
   • B. Use SAML (Security Assertion Markup Language) to enable single sign-on between AWS and LDAP.
   • C. Use AWS Security Token Service from an identity broker to issue short-lived AWS credentials.
   • D. Use 1AM roles to automatically rotate the 1AM credentials when LDAP credentials are update
   Reveal Answer

5. Question #5

   Your application currently uses customer keys which are generated via AWS KMS in the US east region. You now want to use the same set of keys from the EU- Central region. How can this be accomplished? Please select:

   • A. Export the key from the US east region and import them into the EU-Central region
   • B. Use key rotation and rotate the existing keys to the EU-Central region
   • C. Use the backing key from the US east region and use it in the EU-Central region
   • D. This is not possible since keys from KMS are region specific
   Reveal Answer

6. Question #6

   A company has hired a third-party security auditor, and the auditor needs read-only access to all AWS resources and logs of all VPC records and events that have occurred on AWS. How can the company meet the auditor's requirements without comprising security in the AWS environment? Choose the correct answer from the options below Please select:

   • A. Create a role that has the required permissions for the auditor.
   • B. Create an SNS notification that sends the CloudTrail log files to the auditor's email when CIoudTrail delivers the logs to S3, but do not allow the auditor access
   • C. The company should contact AWS as part of the shared responsibility model, and AWS will grant required access to th^ third-party auditor.
   • D. Enable CloudTrail logging and create an 1AM user who has read-only permissions to the required AWS resources, including the bucket containing the
   Reveal Answer

7. Question #7

   Your company has an external web site. This web site needs to access the objects in an S3 bucket. Which of the following would allow the web site to access the objects in the most secure manner? Please select:

   • A. Grant public access for the bucket via the bucket policy
   • B. Use the aws:Referer key in the condition clause for the bucket policy
   • C. Use the aws:sites key in the condition clause for the bucket policy
   • D. Grant a role that can be assumed by the web site
   Reveal Answer

8. Question #8

   You are creating a Lambda function which will be triggered by a Cloudwatch Event. The data from these events needs to be stored in a DynamoDB table. How should the Lambda function be given access to the DynamoDB table? Please select:

   • A. Put the AWS Access keys in the Lambda function since the Lambda function by default is secure
   • B. Use an 1AM role which has permissions to the DynamoDB table and attach it to the Lambda function.
   • C. Use the AWS Access keys which has access to DynamoDB and then place it in an S3 bucket.
   • D. Create a VPC endpoint for the DynamoDB tabl
   Reveal Answer

9. Question #9

   Your company has just set up a new central server in a VPC. There is a requirement for other teams who have their servers located in different VPC's in the same region to connect to the central server. Which of the below options is best suited to achieve this requirement. Please select:

   • A. Set up VPC peering between the central server VPC and each of the teams VPCs.
   • B. Set up AWS DirectConnect between the central server VPC and each of the teams VPCs.
   • C. Set up an IPSec Tunnel between the central server VPC and each of the teams VPCs.
   • D. None of the above options will work.
   Reveal Answer

10. Question #10

    You are hosting a web site via website hosting on an S3 bucket - http://demo.s3-website-us-east-l .amazonaws.com. You have some web pages that use Javascript that access resources in another bucket which has web site hosting also enabled. But when users access the web pages , they are getting a blocked Javascript error. How can you rectify this? Please select:

    • A. Enable CORS for the bucket
    • B. Enable versioning for the bucket
    • C. Enable MFA for the bucket
    • D. Enable CRR for the bucket
    Reveal Answer