Free AWS Certified Security - Specialty SCS-C02 Exam Questions and Answers

Last updated: September 12, 2026

Exam code

SCS-C02

Provider

Amazon

Questions in our bank

1000+

Free to read

First 10, with answers

Official page

Official Exam website

Our test mode duration & pass mark

130 mins · 70%

Recommended: Switch to Test Mode to start a practice test that simulates the real exam experience.

1. Question #1

   - (Exam Topic 1) A company had one of its Amazon EC2 key pairs compromised. A Security Engineer must identify which current Linux EC2 instances were deployed and used the compromised key pair. How can this task be accomplished?

   • A. Obtain the list of instances by directly querying Amazon EC2 using: IAM ec2 describe-instances--fi1ters "Name=key-name,Values=KEYNAMEHERE".
   • B. Obtain the fingerprint for the key pair from the IAM Management Console, then search for the fingerprint in the Amazon Inspector logs.
   • C. Obtain the output from the EC2 instance metadata using: curl http://169.254.169.254/latest/meta-data/public- keys/0/.
   • D. Obtain the fingerprint for the key pair from the IAM Management Console, then search for thefingerprint in Amazon CloudWatch Logs using: IAM logs filter-log-
   Reveal Answer

2. Question #2

   - (Exam Topic 1) A company has several critical applications running on a large fleet of Amazon EC2 instances. As part of a security operations review, the company needs to apply a critical operating system patch to EC2 instances within 24 hours of the patch becoming available from the operating system vendor. The company does not have a patching solution deployed on IAM, but does have IAM Systems Manager configured. The solution must also minimize administrative overhead. What should a security engineer recommend to meet these requirements?

   • A. Create an IAM Config rule defining the patch as a required configuration for EC2 instances.
   • B. Use the IAM Systems Manager Run Command to patch affected instances.
   • C. Use an IAM Systems Manager Patch Manager predefined baseline to patch affected instances.
   • D. Use IAM Systems Manager Session Manager to log in to each affected instance and apply the patch.
   Reveal Answer

3. Question #3

   - (Exam Topic 1) A company is designing the securely architecture (or a global latency-sensitive web application it plans to deploy to IAM. A Security Engineer needs to configure a highly available and secure two-tier architecture. The security design must include controls to prevent common attacks such as DDoS, cross-site scripting, and SQL injection. Which solution meets these requirements?

   • A. Create an Application Load Balancer (ALB) that uses public subnets across multiple Availability Zones within a single Regio
   • B. Point the ALB to an Auto Scaling group with Amazon EC2 instances in private subnets across multiple Availability Zones within the same Regio
   • C. Create an AmazonCloudFront distribution that uses the ALB as its origi
   • D. Create appropriate IAM WAF ACLs and enable them on the CloudFront distribution.
   Reveal Answer

4. Question #4

   - (Exam Topic 1) A security engineer has been tasked with implementing a solution that allows the company's development team to have interactive command line access to Amazon EC2 Linux instances using the IAM Management Console. Which steps should the security engineer take to satisfy this requirement while maintaining least privilege?

   • A. Enable IAM Systems Manager in the IAM Management Console and configure for access to EC2 instances using the default AmazonEC2RoleforSSM rol
   • B. Install the Systems Manager Agent on all EC2 Linux instances that need interactive acces
   • C. Configure IAM user policies to allow development team access to the Systems Manager Session Manager and attach to the team's IAM users.
   • D. Enable console SSH access in the EC2 consol
   Reveal Answer

5. Question #5

   - (Exam Topic 1) A company has several workloads running on IAM. Employees are required to authenticate using on-premises ADFS and SSO to access the IAM Management Console. Developers migrated an existing legacy web application to an Amazon EC2 instance. Employees need to access this application from anywhere on the internet, but currently, there is no authentication system built into the application. How should the Security Engineer implement employee-only access to this system without changing the application?

   • A. Place the application behind an Application Load Balancer (ALB). Use Amazon Cognito as authentication for the AL
   • B. Define a SAML-based Amazon Cognito user pool and connect it to ADFS.
   • C. Implement IAM SSO in the master account and link it to ADFS as an identity provide
   • D. Define the EC2 instance as a managed resource, then apply an IAM policy on the resource.
   Reveal Answer

6. Question #6

   - (Exam Topic 1) A company has a VPC with an IPv6 address range and a public subnet with an IPv6 address block. The VPC currently hosts some public Amazon EC2 instances but a Security Engineer needs to migrate a second application into the VPC that also requires IPv6 connectivity. This new application will occasionally make API requests to an external, internet-accessible endpoint to receive updates However, the Security team does not want the application's EC2 instance exposed directly to the internet The Security Engineer intends to create a private subnet with a custom route table and to associate the route table with the private subnet What else does the Security Engineer need to do to ensure the application will not be exposed directly to the internet, but can still communicate as required''

   • A. Launch a NAT instance in the public subnet Update the custom route table with a new route to the NAT instance
   • B. Remove the internet gateway, and add IAM PrivateLink to the VPC Then update the custom route table with a new route to IAM PrivateLink
   • C. Add a managed NAT gateway to the VPC Update the custom route table with a new route to the gateway
   • D. Add an egress-only internet gateway to the VP
   Reveal Answer

7. Question #7

   - (Exam Topic 2) You have an S3 bucket hosted in IAM. This is used to host promotional videos uploaded by yourself. You need to provide access to users for a limited duration of time. How can this be achieved? Please select:

   • A. Use versioning and enable a timestamp for each version
   • B. Use Pre-signed URL's
   • C. Use IAM Roles with a timestamp to limit the access
   • D. Use IAM policies with a timestamp to limit the access
   Reveal Answer

8. Question #8

   - (Exam Topic 2) The Accounting department at Example Corp. has made a decision to hire a third-party firm, AnyCompany, to monitor Example Corp.'s IAM account to help optimize costs. The Security Engineer for Example Corp. has been tasked with providing AnyCompany with access to the required Example Corp. IAM resources. The Engineer has created an IAM role and granted permission to AnyCompany's IAM account to assume this role. When customers contact AnyCompany, they provide their role ARN for validation. The Engineer is concerned that one of AnyCompany's other customers might deduce Example Corp.'s role ARN and potentially compromise the company's account. What steps should the Engineer perform to prevent this outcome?

   • A. Create an IAM user and generate a set of long-term credential
   • B. Provide the credentials to AnyCompany.Monitor access in IAM access advisor and plan to rotate credentials on a recurring basis.
   • C. Request an external ID from AnyCompany and add a condition with sts:Externald to the role's trust policy.
   • D. Require two-factor authentication by adding a condition to the role's trust policy with IAM:MultiFactorAuthPresent.
   Reveal Answer

9. Question #9

   - (Exam Topic 2) Which of the following minimizes the potential attack surface for applications?

   • A. Use security groups to provide stateful firewalls for Amazon EC2 instances at the hypervisor level.
   • B. Use network ACLs to provide stateful firewalls at the VPC level to prevent access to any specific IAM resource.
   • C. Use IAM Direct Connect for secure trusted connections between EC2 instances within private subnets.
   • D. Design network security in a single layer within the perimeter network (also known as DMZ, demilitarized zone, and screened subnet) to facilitate quicker
   Reveal Answer

10. Question #10

    - (Exam Topic 2) A company maintains sensitive data in an Amazon S3 bucket that must be protected using an IAM KMS CMK. The company requires that keys be rotated automatically every year. How should the bucket be configured?

    • A. Select server-side encryption with Amazon S3-managed keys (SSE-S3) and select an IAM-managed CMK.
    • B. Select Amazon S3-IAM KMS managed encryption keys (S3-KMS) and select a customer-managed CMK with key rotation enabled.
    • C. Select server-side encryption with Amazon S3-managed keys (SSE-S3) and select a customer-managed CMK that has imported key material.
    • D. Select server-side encryption with IAM KMS-managed keys (SSE-KMS) and select an alias to an IAM-managed CMK.
    Reveal Answer