Amazon SCS-C02 practice materials Questions Answers

Exam Code:
SCS-C02
Exam Name:
AWS Certified Security – Specialty Exam
Last Update:
Jun 01,2026

450 Questions Answers Verified by Experts!


PDF + Testing Engine
$50.00
$144.00

Testing Engine (only)
$35.00
$79.00

PDF (only)
$30.00
$65.00

Amazon SCS-C02 Last Week Results!

871
Customers Passed
Amazon SCS-C02
95%
Average Score In Real
Exam At Testing Centre
87%
Questions are designed to align with exam objectives

Amazon SCS-C02 Questions for Amazon Specialty Certification Exam 2026

Here’s you can get most updated Amazon SCS-C02 AWS Certified Security – Specialty Exam updated practice questions and explanations in PDF and web-based practice test software. These verified AWS Certified Security – Specialty Exam SCS-C02 questions are enough to practice and prepare for your certification exam. These Amazon SCS-C02 practice questions that will undoubtedly assist you to prepare for the actual Amazon Specialty Certification exam. Optionally, you can get premium files for extra help for the exam, besides a huge number of practice questions in the free Amazon SCS-C02 PDF files.

Get a Perfect Exam Score with Actual Amazon SCS-C02 practice questions

You can showcase your skills in the present information technology field with the Amazon Specialty Certification SCS-C02 certification. Success in the SCS-C02 exam expands your portfolio to get well-paid jobs. CertsDrive offers real CompTIA Network+ Certification SCS-C02 studyguide to help you earn your desired Amazon certification. Hundreds of IT aspirants have verified their skill set with these Amazon Specialty Certification SCS-C02 updated practice questions. Practice exams and PDF questions are formats of our product. You can practice in the actual AWS Certified Security – Specialty Exam SCS-C02 exam environment with our desktop practice test software and web-based practice exam.
 

The Amazon Specialty Certification SCS-C02 PDF format is ideal for preparing quickly from any place via smartphones, laptops, and tablets. CertsDrive has been helping SCS-C02 exam applicants for many years. You can also authenticate your skills with the Amazon Certification SCS-C02 exam certificate if you prepare from our exam-aligned study guide. Furthermore, there is a refund policy for users who fail after using AWS Certified Security – Specialty Exam SCS-C02 exam practice questions.

AWS Certified Security – Specialty Exam SCS-C02 practice questions with explanations

 

CertsDrive is the leading website that offers actual Amazon SCS-C02 practice questions PDF for easy preparation. Try free AWS Certified Security – Specialty Exam SCS-C02 practice questions demo before purchasing.
 

UNLOCK FULL
SCS-C02 Exam Features

In Just $11 You can Access

• All Official Question Types
• Interactive Web-Based Practice Test Software
• No Installation or 3rd Party Software Required
• Customize your practice sessions (Free Demo)
• 24/7 Customer Support

Get Full Access

Page: 1 / 66
Total Questions: 327

Questions & Answers PDF

• Question 1

  

  A company has developed a new Amazon RDS database application. The company must secure the ROS database credentials for encryption in transit and encryption at rest. The company also must rotate the credentials automatically on a regular basis.Which solution meets these requirements?

  • Use IAM Systems Manager Parameter Store to store the database credentiais. Configure automatic rotation of the credentials.
  • Use IAM Secrets Manager to store the database credentials. Configure automat* rotation of the credentials
  • Store the database credentials in an Amazon S3 bucket that is configured with server-side encryption with S3 managed encryption keys (SSE-S3) Rotate the credentials with IAM database authentication.
  • Store the database credentials m Amazon S3 Glacier, and use S3 Glacier Vault Lock Configure an IAM Lambda function to rotate the credentials on a scheduled basts

  Reveal Answer Answer: A Next Question

• Question 2

  

  A security engineer is creating an AWS Lambda function. The Lambda function needs to use a role that is named LambdaAuditRole to assume a role that is named AcmeAuditFactoryRole in a different AWS account.When the code is processed, the following error message appears: 'An error oc-curred (AccessDenied) when calling the AssumeRole operation.'Which combination of steps should the security engineer take to resolve this er-ror? (Select TWO.)

  • Ensure that LambdaAuditRole has the sts:AssumeRole permission for Ac-meAuditFactoryRole.
  • Ensure that LambdaAuditRole has the AWSLambdaBasicExecutionRole managed policy attached.
  • Ensure that the trust policy for AcmeAuditFactoryRole allows the sts:AssumeRole action from LambdaAuditRole.
  • Ensure that the trust policy for LambdaAuditRole allows the sts:AssumeRole action from the lambda.amazonaws.com service.
  • Ensure that the sts:AssumeRole API call is being issued to the us-east-I Region endpoint.

  Reveal Answer Answer: A, C Next Question

• Question 3

  

  A company is building a data processing application that uses AWS Lambda functions The application's Lambda functions need to communicate with an Amazon RDS OB instance that is deployed within a VPC in the same AWS accountWhich solution meets these requirements in the MOST secure way?

  • Configure the DB instance to allow public access Update the DB instance security group to allow access from the Lambda public address space for the AWS Region
  • Deploy the Lambda functions inside the VPC Attach a network ACL to the Lambda subnet Provide outbound rule access to the VPC CIDR range only Update the DB instance security group to allow traffic from 0 0 0 0/0
  • Deploy the Lambda functions inside the VPC Attach a security group to the Lambda functions Provide outbound rule access to the VPC CIDR range only Update the DB instance security group to allow traffic from the Lambda security group
  • Peer the Lambda default VPC with the VPC that hosts the DB instance to allow direct network access without the need for security groups

  Reveal Answer Answer: C Next Question

• Question 4

  

  A company is running an application on Amazon EC2 instances in an Auto Scaling group. The application stores logs locally. A security engineer noticed that logs were lost after a scale-in event. The security engineer needs to recommend a solution to ensure the durability and availability of log data All logs must be kept for a minimum of 1 year for auditing purposes. What should the security engineer recommend?

  • Within the Auto Scaling lifecycle, add a hook to create and attach an Amazon Elastic Block Store (Amazon EBS) log volume each time an EC2 instance is created. When the instance is terminated, the EBS volume can be reattached to another instance for log review.
  • Create an Amazon Elastic File System (Amazon EFS) file system and add a command in the user data section of the Auto Scaling launch template to mount the EFS file system during EC2 instance creation. Configure a process on the instance to copy the logs once a day from an instance Amazon Elastic Block Store (Amazon EBS) volume to a directory in the EFS file system.
  • Add an Amazon CloudWatch agent into the AMI used in the Auto Scaling group. Configure the CloudWatch agent to send the logs to Amazon CloudWatch Logs for review,
  • Within the Auto Scaling lifecycle, add a lifecycle hook at the terminating state transition and alert the engineering team by using a lifecycle notification to Amazon Simple Notification Service (Amazon SNS). Configure the hook to remain in the Terminating:Wait state for 1 hour to allow manual review of the security logs prior to instance termination.

  Reveal Answer Answer: C Next Question

• Question 5

  

  A company wants to configure DNS Security Extensions (DNSSEC) for the company's primary domain. The company registers the domain with Amazon Route 53. The company hosts the domain on Amazon EC2 instances by using BIND.What is the MOST operationally efficient solution that meets this requirement?

  • Set the dnssec-enable option to yes in the BIND configuration. Create a zone-signing key (ZSK) and a key-signing key (KSK) Restart the BIND service.
  • Migrate the zone to Route 53 with DNSSEC signing enabled. Create a zone-signing key (ZSK) and a key-signing key (KSK) that are based on an AWS. Key Management Service (AWS KMS) customer managed key.
  • Set the dnssec-enable option to yes in the BIND configuration. Create a zone-signing key (ZSK) and a key-signing key (KSK). Run the dnssec-signzone command to generate a delegation signer (DS) record Use AWS. Key Management Service (AWS KMS) to secure the keys.
  • Migrate the zone to Route 53 with DNSSEC signing enabled. Create a key-signing key (KSK) that is based on an AWS Key Management Service (AWS KMS) customer managed key. Add a delegation signer (DS) record to the parent zone.

  Reveal Answer Answer: D Next Question

• Question 6

  

  A company's IAM account consists of approximately 300 IAM users. Now there is a mandate that an access change is required for 100 IAM users to have unlimited privileges to S3.As a system administrator, how can you implement this effectively so that there is no need to apply the policy at the individual user level?Please select:

  • Create a new role and add each user to the IAM role
  • Use the IAM groups and add users, based upon their role, to different groups and apply the policy to group
  • Create a policy and apply it to multiple users using a JSON script
  • Create an S3 bucket policy with unlimited access which includes each user's IAM account ID

  Reveal Answer Answer: B Next Question

• Question 7

  

  A company's security team needs to receive a notification whenever an AWS access key has not been rotated in 90 or more days. A security engineer must develop a solution that provides these notifications automatically.Which solution will meet these requirements with the LEAST amount of effort?

  • Deploy an AWS Config managed rule to run on a periodic basis of 24 hours. Select the access-keys-rotated managed rule, and set the maxAccessKeyAge parameter to 90 days. Create an Amazon EventBridge (Amazon CloudWatch Events) rule with an event pattern that matches the compliance type of NON_COMPLIANT from AWS Config for the managed rule. Configure EventBridge (CloudWatch Events) to send an Amazon Simple Notification Service (Amazon SNS) notification to the security team.
  • Create a script to export a .csv file from the AWS Trusted Advisor check for IAM access key rotation. Load the script into an AWS Lambda function that will upload the .csv file to an Amazon S3 bucket. Create an Amazon Athena table query that runs when the .csv file is uploaded to the S3 bucket. Publish the results for any keys older than 90 days by using an invocation of an Amazon Simple Notification Service (Amazon SNS) notification to the security team.
  • Create a script to download the IAM credentials report on a periodic basis. Load the script into an AWS Lambda function that will run on a schedule through Amazon EventBridge (Amazon CloudWatch Events). Configure the Lambda script to load the report into memory and to filter the report for records in which the key was last rotated at least 90 days ago. If any records are detected, send an Amazon Simple Notification Service (Amazon SNS) notification to the security team.
  • Create an AWS Lambda function that queries the IAM API to list all the users. Iterate through the users by using the ListAccessKeys operation. Verify that the value in the CreateDate field is not at least 90 days old. Send an Amazon Simple Notification Service (Amazon SNS) notification to the security team if the value is at least 90 days old. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to schedule the Lambda function to run each day.

  Reveal Answer Answer: A Next Question

• Question 8

  

  A security engineer needs to develop a process to investigate and respond to po-tential security events on a company's Amazon EC2 instances. All the EC2 in-stances are backed by Amazon Elastic Block Store (Amazon EBS). The company uses AWS Systems Manager to manage all the EC2 instances and has installed Systems Manager Agent (SSM Agent) on all the EC2 instances.The process that the security engineer is developing must comply with AWS secu-rity best practices and must meet the following requirements:* A compromised EC2 instance's volatile memory and non-volatile memory must be preserved for forensic purposes.* A compromised EC2 instance's metadata must be updated with corresponding inci-dent ticket information.* A compromised EC2 instance must remain online during the investigation but must be isolated to prevent the spread of malware.* Any investigative activity during the collection of volatile data must be cap-tured as part of the process.Which combination of steps should the security engineer take to meet these re-quirements with the LEAST operational overhead? (Select THREE.)

  • Gather any relevant metadata for the compromised EC2 instance. Enable ter-mination protection. Isolate the instance by updating the instance's secu-rity groups to restrict access. Detach the instance from any Auto Scaling groups that the instance is a member of. Deregister the instance from any Elastic Load Balancing (ELB) resources.
  • Gather any relevant metadata for the compromised EC2 instance. Enable ter-mination protection. Move the instance to an isolation subnet that denies all source and destination traffic. Associate the instance with the subnet to restrict access. Detach the instance from any Auto Scaling groups that the instance is a member of. Deregister the instance from any Elastic Load Balancing (ELB) resources.
  • Use Systems Manager Run Command to invoke scripts that collect volatile data.
  • Establish a Linux SSH or Windows Remote Desktop Protocol (RDP) session to the compromised EC2 instance to invoke scripts that collect volatile data.
  • Create a snapshot of the compromised EC2 instance's EBS volume for follow-up investigations. Tag the instance with any relevant metadata and inci-dent ticket information.
  • Create a Systems Manager State Manager association to generate an EBS vol-ume snapshot of the compromised EC2 instance. Tag the instance with any relevant metadata and incident ticket information.

  Reveal Answer Answer: A, C, E Next Question

• Question 9

  

  A developer 15 building a serverless application hosted on IAM that uses Amazon Redshift in a data store. The application has separate modules for read/write and read-only functionality. The modules need their own database users tor compliance reasons.Which combination of steps should a security engineer implement to grant appropriate access' (Select TWO )

  • Configure cluster security groups for each application module to control access to database users that are required for read-only and read/write.
  • Configure a VPC endpoint for Amazon Redshift Configure an endpoint policy that maps database users to each application module, and allow access to the tables that are required for read-only and read/write
  • Configure an IAM poky for each module Specify the ARN of an Amazon Redshift database user that allows the GetClusterCredentials API call
  • Create focal database users for each module
  • Configure an IAM policy for each module Specify the ARN of an IAM user that allows the GetClusterCredentials API call

  Reveal Answer Answer: C, D Next Question

• Question 10

  

  A company has retail stores The company is designing a solution to store scanned copies of customer receipts on Amazon S3 Files will be between 100 KB and 5 MB in PDF format Each retail store must have a unique encryption key Each object must be encrypted with a unique keyWhich solution will meet these requirements?

  • Create a dedicated AWS Key Management Service (AWS KMS) customer managed key for each retail store Use the S3 Put operation to upload the objects to Amazon S3 Specify server-side encryption with AWS KMS keys (SSE-KMS) and the key ID of the store's key
  • Create a new AWS Key Management Service (AWS KMS) customer managed key every day for each retail store Use the KMS Encrypt operation to encrypt objects Then upload the objects to Amazon S3
  • Run the AWS Key Management Service (AWS KMS) GenerateDataKey operation every day for each retail store Use the data key and client-side encryption to encrypt the objects Then upload the objects to Amazon S3
  • Use the AWS Key Management Service (AWS KMS) ImportKeyMaterial operation to import new key material to AWS KMS every day for each retail store Use a customer managed key and the KMS Encrypt operation to encrypt the objects Then upload the objects to Amazon S3

  Reveal Answer Answer: A Next Question

Page: 1 / 66
Total Questions: 327

Previous Page Next Page

Types of Questions Support

Both SCS-C02 PDF and Testing Engine have all the practice questions including Multiple Choice, Simulation and Drag Drop Questions.

?
?
??

Free 3 Months Amazon SCS-C02 Exam practice questions with explanations Update

We provide you 3 Months Free Amazon SCS-C02 Exam Updates at no cost.

?
?
??

100% Amazon SCS-C02 refund policy and support policy

We provide you SCS-C02 practice material with policy-based support With refund policy.

?
?
??

Fully SSL Secure System of Purchase for Amazon SCS-C02 Exam

Purchase Amazon SCS-C02 Exam Product with fully SSL Secure system and available in your PrepFiles Account.

?
?
???

We Respect Privacy Policy

We respect full Privacy of our customers and would not share information with any third party.

?
?
??

Fully Exam Environment

Experience official exam objectives Environment with our testing engine.

?
?
??

2 Modes of SCS-C02 Practice Exam in Testing Engine

Testing Mode and Practice Mode.

?
?
??

Exam Score History

Our SCS-C02 Testing Engine will Save your SCS-C02 Exam Score so you can Review it later to improve your results.

?
?
??

Question Selection in Test engine

PrepFiles Test engine Provides Option to choose randomize and non-randomize Questions Set.

?
?
??

Saving Your Exam Notes

Our SCS-C02 Testing Engine provides option to save your exam Notes.

?
?