Sample Questions from AWS Certified Security – Specialty (SCS-C02)

Preview a few questions below — answers are revealed when you take the exam.

  1. A company is migrating its on-premises applications to AWS and needs to ensure secure communication between its VPC and on-premises data center. The security team mandates the use of a VPN solution that supports dynamic routing. Which approach should the team take to meet these requirements while ensuring the highest level of security and minimal operational overhead?

    • Deploy an AWS Site-to-Site VPN with static routing and use AWS Direct Connect for dynamic routing.
    • Implement an AWS Site-to-Site VPN with dynamic routing using BGP and integrate it with AWS Direct Connect for enhanced security and bandwidth.
    • Use AWS Client VPN for secure access and deploy an additional VPN solution for dynamic routing between the VPC and the on-premises data center.
    • Configure an AWS Global Accelerator to handle dynamic routing and use AWS Site-to-Site VPN for secure communication between the VPC and the on-premises data center.

  2. An organization is using AWS Config to maintain a configuration baseline for its EC2 instances. The security team wants to ensure that all instances comply with the baseline and receive alerts for any deviations. What strategy should be applied to achieve this goal efficiently?

    • Configure AWS Config rules to evaluate instance compliance against the baseline and set up Amazon EventBridge to trigger notifications for non-compliant instances.
    • Manually review AWS Config compliance reports daily and use AWS Lambda to send alerts for non-compliant instances.
    • Use AWS Systems Manager Automation to regularly check instance compliance and AWS Step Functions to orchestrate the alert process.
    • Deploy a custom solution using AWS Lambda to periodically assess instance compliance and Amazon SNS to send alerts for non-compliant instances.

  3. Identify the AWS service that allows you to create fine-grained permissions for accessing AWS resources and APIs.

    • AWS Identity and Access Management (IAM)
    • AWS Key Management Service (KMS)
    • AWS Directory Service
    • AWS Certificate Manager (ACM)

  4. A financial services company is implementing a multi-account strategy on AWS to segregate different business units. They need to centralize logging and monitoring across all accounts. Which architecture supports the requirements of centralized logging and compliance reporting?

    • Use AWS CloudTrail in each account to log events and AWS Config to maintain configuration baselines. Aggregate logs using Amazon S3 and analyze them with Amazon Athena for compliance reporting.
    • Deploy AWS GuardDuty in each account for threat detection and use AWS Security Hub to aggregate findings. Utilize Amazon EventBridge to centralize logs and Amazon QuickSight for reporting.
    • Implement AWS CloudWatch Logs in each account for logging and use AWS Lambda to forward logs to a centralized Amazon S3 bucket. Employ Amazon Macie for data sensitivity analysis and Amazon QuickSight for visualization.
    • Configure AWS Config rules in each account to capture configuration changes and use AWS Step Functions to orchestrate log aggregation in Amazon S3. Utilize Amazon Athena for querying and Amazon QuickSight for reporting.

  5. What is the best troubleshooting action when an AWS Lambda function fails to execute due to insufficient permissions?

    • Check the AWS Lambda function's execution role and ensure it has the necessary permissions to access the required AWS services.
    • Increase the memory allocation for the Lambda function to ensure it has enough resources to execute.
    • Modify the VPC configuration of the Lambda function to ensure it can communicate with the necessary resources.
    • Review the Lambda function's code for any syntax errors or logical issues that might be causing the failure.