SCS-C02PRACTICE QUESTIONS

SCS-C02 practice questions with answers

6 example questions from the AWS Certified Security - Specialty question bank, grouped by exam domain. Pick an answer and check it to see the explanation.

Threat Detection and Incident Response

The Threat Detection and Incident Response domain focuses on identifying, mitigating, and managing security threats. It involves detecting suspicious activities, analyzing security incidents, and implementing effective response strategies.

Question 1Select 1

Task 1.1 Design and implement an incident response plan

A company with multiple AWS accounts is using AWS Organizations to manage these accounts. The security team wants to enhance threat detection and incident response across the organization. They plan to implement a centralized logging solution using Amazon CloudWatch Logs and to create custom metric filters that match the patterns of known incidents. When a threat is detected, they want to automate the response by triggering AWS Lambda functions to remediate the issue. To ensure that threat detection events are managed centrally and that appropriate responses are automatically initiated, the team decides to use Amazon EventBridge. Which of the following steps should the security team take to configure integration and incident response using Amazon EventBridge, without adding unnecessary complexity or permissions?

A. Create an EventBridge event bus in the management account, enable EventBridge to receive events across the associated accounts in AWS Organizations, and create rules in the central event bus to trigger Lambda functions in response to specific threat detection patterns.

B. Create an individual EventBridge event bus in each account and set up cross-account resource sharing for each event bus to send and receive threat detection events.

C. Avoid using EventBridge and manually assess and respond to threat detection patterns by assigning dedicated security personnel to monitor CloudWatch Logs in each AWS account.

D. Develop a custom third-party service outside AWS to collect CloudWatch Logs from all accounts and trigger AWS Lambda functions in each account upon threat detection.

Security Logging and Monitoring

The Security Logging and Monitoring domain covers the implementation and management of logging and monitoring systems. It focuses on collecting, analyzing, and responding to security-related data to ensure compliance and enhance security posture.

Question 1Select 1

Task 2.5 Design a log analysis solution

A company is using AWS for their production environment, where they have multiple EC2 instances, S3 buckets and RDS databases in use. They want to aggregate all logs into a central repository for analysis to improve security through better visibility. To automate the process of normalizing, parsing, and correlating these logs for consistent formatting and simplified analysis, they are planning on leveraging AWS services. Which of the following approaches using AWS Lambda is most appropriate for meeting their need to analyze security logs in a cost-effective and scalable way?

A. Use AWS Lambda functions triggered by S3 event notifications whenever new logs are delivered to the S3 bucket. The Lambda function can parse, normalize, and then push the transformed logs to Amazon Elasticsearch Service for correlation and analysis.

B. Invoke AWS Lambda functions on a fixed schedule using Amazon CloudWatch Events to pull logs from each EC2 instance, S3 bucket, and RDS instance, for manual normalization, parsing, and correlation before storage in an Amazon RDS database.

C. Deploy AWS Lambda functions to each EC2 instance to locally normalize and parse logs before directly forwarding them to a third-party SIEM (Security Information and Event Management) solution over the Internet.

D. Configure AWS Lambda to continuously stream data from Amazon Kinesis Data Firehose to execute in-memory log normalization and parsing, and subsequently discard the logs to prevent overstorage.

Infrastructure Security

Infrastructure Security domain focuses on securing cloud infrastructure. It covers best practices for network security, host-based security, and securing data in transit and at rest, leveraging AWS services to protect against threats and vulnerabilities.

Question 1Select 1

Task 3.4 Troubleshoot network security

A company has deployed its critical application across multiple EC2 instances within a VPC. Recently, there have been reports of atypical network behavior and potential security issues affecting the application's performance. As a security specialist tasked with investigating this issue, you decide to use AWS services to capture and analyze the traffic to and from the affected EC2 instances without impacting their performance or network throughput. Which AWS feature would you use to accomplish this task?

A. Enable VPC Traffic Mirroring on the affected EC2 instances to capture and analyze their network traffic.

B. Use AWS Shield Advanced to monitor and protect the network traffic to the EC2 instances.

C. Implement an additional Elastic Load Balancer (ELB) to log and analyze the traffic going to the EC2 instances.

D. Deploy AWS WAF in front of the EC2 instances to inspect and capture incoming traffic.

Identity and Access Management

Identity and Access Management domain focuses on managing access to AWS resources. It involves implementing and maintaining AWS IAM policies, roles, and permissions to ensure secure access control, user authentication, and compliance with best practices.

Question 1Select 1

Task 4.2 Design, implement, and troubleshoot authorization for AWS Resources

A developer at a company attempted to deploy an application on AWS using an IAM user account. The application needed to write logs to an Amazon S3 bucket; however, the deployment failed with an 'Access Denied' error when trying to write to the bucket. After reviewing the IAM policy attached to the user, the developer discovered that the policy provided the necessary 's3:PutObject' permission for the bucket. Upon further investigation, the developer found no explicit deny in the IAM policy that could have caused the error. Which of the following could be the MOST likely reason for the observed 'Access Denied' error?

A. The S3 bucket had a bucket policy that explicitly denied write access to the IAM user.

B. The IAM user did not have the 's3:ListBucket' permission for the S3 bucket.

C. The S3 bucket was located in a different AWS region than the IAM user's default region.

D. The 's3:PutObject' permission was mistyped as 'S3:putobject' in the IAM policy.

Data Protection

Data Protection domain focuses on safeguarding data within AWS. It includes encryption, key management, data masking, and secure storage solutions to protect data at rest and in transit, ensuring privacy and compliance with regulations.

Question 1Select 1

Task 5.2 Design and implement controls that provide confidentiality and integrity for data at rest

A financial services company is migrating its relational database workloads to AWS and has chosen Amazon Aurora as their database service because of its high performance and availability. The company's chief information security officer (CISO) has emphasized the importance of securing sensitive customer data at rest to comply with stringent financial industry regulations. The CISO is considering various encryption options to ensure data confidentiality and integrity. Which encryption technique should be used to meet the company's business requirements for encrypting data at rest in Amazon Aurora?

A. Encrypt the Amazon Aurora database using AWS Key Management Service (AWS KMS) customer managed keys.

B. Encrypt the Amazon Aurora database using SSL/TLS for data in transit.

C. Use Amazon Aurora's built-in Transparent Data Encryption with a default master key.

D. Implement database encryption using a tokenization service.

Management and Security Governance

Management and Security Governance domain emphasizes establishing and maintaining security policies and procedures. It involves ensuring compliance, risk management, and implementing governance frameworks.

Question 1Select 1

Task 6.2 Implement a secure and consistent deployment strategy for cloud resources

Your company is utilizing AWS for their critical web application and relies heavily on the AWS network infrastructure for protection against DDoS attacks. You, as a security specialist, have been tasked to ensure that all the AWS accounts under organizational units (OUs) comply with the company's strict security policies, which include DDoS protection for all resources. You need to deploy a solution that automates the application of DDoS protection policies and integrates with AWS Shield Advanced for additional protection. Which AWS service should you implement to meet this requirement while adhering to the security governance domain and ensuring a secure and consistent deployment strategy for cloud resources?

A. Deploy AWS Firewall Manager with AWS Shield Advanced integration to automatically apply the necessary DDoS protection policies to the accounts in the OUs.

B. Set up Amazon Inspector to automatically assess applications for exposure to DDoS attacks and enforce the necessary protection policies.

C. Use AWS Config rules to assess, audit, and evaluate the configurations of your AWS resources for compliance with DDoS protection policies.

D. Implement AWS Direct Connect to link your internal network to AWS and manage DDoS protection policies.

PRACTICE EXAMSCS-C02 exam simulator

5439 questions covering every domain and task, full-length exams, explanations for every answer and a pass probability indicator.

Open the simulator →