Amazon SCS-C02 Free Sample Exam Questions 2026

Here you can get the actual Amazon SCS-C02 exam questions and answers in PDF for free and for all questions premium file. These best AWS Certified Security - Specialty Exam SCS-C02 PDF questions are for every Amazon users. Real SCS-C02 exam dumps that will assist you to crack the %certification% certification exam in the PDF format. For Advance preparation premium PDF files available for perfect exam preparation on reilable price option.

UNLOCK FULL
SCS-C02 Exam Features

In Just $35 You can Access

• All Official Question Types
• Interactive Web-Based Practice Test Software
• No Installation or 3rd Party Software Required
• Customize your practice sessions (Free Demo)
• 24/7 Customer Support

Get Full Access

Page: 1 / 66
Total Questions: 327

Questions & Answers PDF

• Question 1

  

  A business requires a forensic logging solution for hundreds of Docker-based apps running on Amazon EC2. The solution must analyze logs in real time, provide message replay, and persist logs.Which Amazon Web Offerings (IAM) services should be employed to satisfy these requirements? (Select two.)

  • Amazon Athena
  • Amazon Kinesis
  • Amazon SQS
  • Amazon Elasticsearch
  • Amazon EMR

  Reveal Answer Answer: B, D Next Question

• Question 2

  

  A website currently runs on Amazon EC2, wan mostly statics content on the site. Recently the site was subjected to a DDoS attack a security engineer was (asked was redesigning the edge security to helpMitigate this risk in the future.What are some ways the engineer could achieve this (Select THREE)?

  • Use IAM X-Ray to inspect the trafc going to the EC2 instances.
  • Move the static content to Amazon S3, and front this with an Amazon Cloud Front distribution.
  • Change the security group conguration to block the source of the attack trafc
  • Use IAM WAF security rules to inspect the inbound trafc.
  • Use Amazon Inspector assessment templates to inspect the inbound traffic.
  • Use Amazon Route 53 to distribute trafc.

  Reveal Answer Answer: B, D, F Next Question

• Question 3

  

  A company uses AWS Organizations. The company wants to implement short-term cre-dentials for third-party AWS accounts to use to access accounts within the com-pany's organization. Access is for the AWS Management Console and third-party software-as-a-service (SaaS) applications. Trust must be enhanced to prevent two external accounts from using the same credentials. The solution must require the least possible operational effort.Which solution will meet these requirements?

  • Use a bearer token authentication with OAuth or SAML to manage and share a central Amazon Cognito user pool across multiple Amazon API Gateway APIs.
  • Implement AWS IAM Identity Center (AWS Single Sign-On), and use an identi-ty source of choice. Grant access to users and groups from other accounts by using permission sets that are assigned by account.
  • Create a unique IAM role for each external account. Create a trust policy. Use AWS Secrets Manager to create a random external key.
  • Create a unique IAM role for each external account. Create a trust policy that includes a condition that uses the sts:Externalld condition key.

  Reveal Answer Answer: D Next Question

• Question 4

  

  An international company has established a new business entity in South Korea. The company also has established a new AWS account to contain the workload for the South Korean region. The company has set up the workload in the new account in the ap-northeast-2 Region. The workload consists of three Auto Scaling groups of Amazon EC2 instances. All workloads that operate in this Region must keep system logs and application logs for 7 years.A security engineer must implement a solution to ensure that no logging data is lost for each instance during scaling activities. The solution also must keep the logs for only the required period of 7 years.Which combination of steps should the security engineer take to meet these requirements? (Choose three.)

  • Ensure that the Amazon CloudWatch agent is installed on all the EC2 instances that the Auto Scaling groups launch. Generate a CloudWatch agent configuration file to forward the required logs to Amazon CloudWatch Logs.
  • Set the log retention for desired log groups to 7 years.
  • Attach an IAM role to the launch configuration or launch template that the Auto Scaling groups use. Configure the role to provide the necessary permissions to forward logs to Amazon CloudWatch Logs.
  • Attach an IAM role to the launch configuration or launch template that the Auto Scaling groups use. Configure the role to provide the necessary permissions to forward logs to Amazon S3.
  • Ensure that a log forwarding application is installed on all the EC2 instances that the Auto Scaling groups launch. Configure the log forwarding application to periodically bundle the logs and forward the logs to Amazon S3.
  • Configure an Amazon S3 Lifecycle policy on the target S3 bucket to expire objects after 7 years.

  Reveal Answer Answer: A, B, C Next Question

• Question 5

  

  A company needs a solution to protect critical data from being permanently deleted. The data is stored in Amazon S3 buckets.The company needs to replicate the S3 objects from the company's primary AWS Region to a secondary Region to meet disaster recovery requirements. The company must also ensure that users who have administrator access cannot permanently delete the data in the secondary Region.Which solution will meet these requirements?

  • Configure AWS Backup to perform cross-Region S3 backups. Select a backup vault in the secondary Region. Enable AWS Backup Vault Lock in governance mode for the backups in the secondary Region
  • Implement S3 Object Lock in compliance mode in the primary Region. Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region.
  • Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region. Create an S3 bucket policy to deny the s3:ReplicateDelete action on the S3 bucket in the secondary Region
  • Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region. Configure S3 object versioning on the S3 bucket in the secondary Region.

  Reveal Answer Answer: B Next Question

• Question 6

  

  A company is developing a highly resilient application to be hosted on multiple Amazon EC2 instances . The application will store highly sensitive user data in Amazon RDS tablesThe application must* Include migration to a different IAM Region in the application disaster recovery plan.* Provide a full audit trail of encryption key administration events* Allow only company administrators to administer keys.* Protect data at rest using application layer encryptionA Security Engineer is evaluating options for encryption key managementWhy should the Security Engineer choose IAM CloudHSM over IAM KMS for encryption key management in this situation?

  • The key administration event logging generated by CloudHSM is significantly more extensive than IAM KMS.
  • CloudHSM ensures that only company support staff can administer encryption keys, whereas IAM KMS allows IAM staff to administer keys
  • The ciphertext produced by CloudHSM provides more robust protection against brute force decryption attacks than the ciphertext produced by IAM KMS
  • CloudHSM provides the ability to copy keys to a different Region, whereas IAM KMS does not

  Reveal Answer Answer: B Next Question

• Question 7

  

  A company uses HTTP Live Streaming (HL'S) to stream live video content to paying subscribers by using Amazon CloudFront. HLS splits the video content into chunks so that the user can request the right chunk based on different conditions. Because the video events last for several hours, the total video is made up of thousands of chunks.The origin URL is not disclosed, and every user is forced to access the CloudFront URL. The company has a web application that authenticates the paying users against an internal repository and a CloudFront key pair that is already issued.What is the simplest and MOST effective way to protect the content?

  • Develop the application to use the CloudFront key pair to create signed URLs that users will use to access the content.
  • Develop the application to use the CloudFront key pair to set the signed cookies that users will use to access the content.
  • Develop the application to issue a security token that Lambda@Edge will receive to authenticate and authorize access to the content
  • Keep the CloudFront URL encrypted inside the application, and use AWS KMS to resolve the URL on-the-fly after the user is authenticated.

  Reveal Answer Answer: B Next Question

• Question 8

  

  A security engineer wants to forward custom application-security logs from an Amazon EC2 instance to Amazon CloudWatch. The security engineer installsthe CloudWatch agent on the EC2 instance and adds the path of the logs to the CloudWatch configuration file.However, CloudWatch does not receive the logs. The security engineer verifies that the awslogs service is running on the EC2 instance.What should the security engineer do next to resolve the issue?

  • Add AWS CloudTrail to the trust policy of the EC2 instance. Send the custom logs to CloudTrail instead of CloudWatch.
  • Add Amazon S3 to the trust policy of the EC2 instance. Configure the application to write the custom logs to an S3 bucket that CloudWatch can use to ingest the logs.
  • Add Amazon Inspector to the trust policy of the EC2 instance. Use Amazon Inspector instead of the CloudWatch agent to collect the custom logs.
  • Attach the CloudWatchAgentServerPolicy AWS managed policy to the EC2 instance role.

  Reveal Answer Answer: D Next Question

• Question 9

  

  A security engineer recently rotated all IAM access keys in an AWS account. The security engineer then configured AWS Config and enabled the following AWSConfig managed rules; mfa-enabled-for-iam-console-access, iam-user-mfa-enabled, access-key-rotated, and iam-user-unused-credentials-check.The security engineer notices that all resources are displaying as noncompliant after the IAM GenerateCredentialReport API operation is invoked.What could be the reason for the noncompliant status?

  • The IAM credential report was generated within the past 4 hours.
  • The security engineer does not have the GenerateCredentialReport permission.
  • The security engineer does not have the GetCredentialReport permission.
  • The AWS Config rules have a MaximumExecutionFrequency value of 24 hours.

  Reveal Answer Answer: D Next Question

• Question 10

  

  You have an S3 bucket defined in IAM. You want to ensure that you encrypt the data before sending it across the wire. What is the best way to achieve this.Please select:

  • Enable server side encryption for the S3 bucket. This request will ensure that the data is encrypted first.
  • Use the IAM Encryption CLI to encrypt the data first
  • Use a Lambda function to encrypt the data before sending it to the S3 bucket.
  • Enable client encryption for the bucket

  Reveal Answer Answer: B Next Question

Page: 1 / 66
Total Questions: 327

Previous Page Next Page