Important Amazon SCS-C02 Exam Questions

CertPrep • Amazon • SCS-C02 Exam Questions

Select Certification Providers

Select Certification Exam

Get Full Version

Amazon AWS Certified Security - Specialty (old) SCS-C02 Exam

Attempt the Amazon Specialty practice test and solve real exam-like SCS-C02 questions to prepare efficiently and increase your chances of success. Our Amazon SCS-C02 practice questions match the actual AWS Certified Security - Specialty (old) exam format, helping you enhance confidence and improve performance. With our SCS-C02 practice exam software, you can analyze your performance, identify weak areas, and work on them effectively to boost your final Amazon Specialty exam score.

Vendor:	Amazon
Exam Name:	AWS Certified Security - Specialty (old)
Registration Code:	SCS-C02
Related Certification:	Amazon Specialty Certification
Exam Audience:	AWS Amazon Security Engineers and Security Architects,

Total Questions

467

Last Updated

04-07-2026

Exam Duration

170 MINUTES

Upgrade to Premium

GET FULL PDF

Question: 1

[Identity and Access Management]

A security engineer is implementing a solution to allow users to seamlessly encrypt Amazon S3 objects without having to touch the keys directly. The solution must be highlyscalable without requiring continual management. Additionally, the organization must be able to immediately delete the encryption keys.

Which solution meets these requirements?

AUse AWS KMS with AWS managed keys and the ScheduleKeyDeletion API with a PendingWindowInDays set to 0 to remove the keys if necessary.

BUse KMS with AWS imported key material and then use the DeletelmportedKeyMaterial API to remove the key material if necessary.

CUse AWS CloudHSM to store the keys and then use the CloudHSM API or the PKCS11 library to delete the keys if necessary.

DUse the Systems Manager Parameter Store to store the keys and then use the service API operations to delete the keys if necessary.

Answer: A

Explanation:

For seamless encryption of Amazon S3 objects without direct key management, AWS Key Management Service (KMS) with AWS managed keys offers a highly scalable and manageable solution. TheScheduleKeyDeletionAPI withPendingWindowInDaysset to 0 allows for immediate deletion of the keys, meeting the requirement for immediate key removal. This approach leverages the managed infrastructure of KMS, reducing the overhead of key management while ensuring scalability and security. The integration of KMS with S3 and the ability to schedule key deletion provides a balance between ease of use and security control.

Question: 2

[Infrastructure Security]

A company that uses AWS Organizations wants to see AWS Security Hub findings for many AWS accounts and AWS Regions. Some of the accounts are in the company's organization, and some accounts are in organizations that the company manages for customers. Although the company can see findings in the Security Hub administrator account for accounts in the company's organization, there are no findings from accounts in other organizations.

Which combination of steps should the company take to see findings from accounts that are outside the organization that includes the Security Hub administrator account? (Select TWO.)

AUse a designated administration account to automatically set up member accounts.

BCreate the AWS Service Role ForSecurrty Hub service-linked rote for Security Hub.

CSend an administration request from the member accounts.

DEnable Security Hub for all member accounts.

ESend invitations to accounts that are outside the company's organization from the Security Hub administrator account.

Answer: C, E

Explanation:

To see Security Hub findings for accounts that are outside the organization that includes the Security Hub administrator account, the following steps are required:

Send invitations to accounts that are outside the company's organization from the Security Hub administrator account. This will allow the administrator account to view and manage findings from those accounts. The administrator account can send invitations by using the Security Hub console, API, or CLI.For more information, see Sending invitations to member accounts.

Send an administration request from the member accounts. This will allow the member accounts to accept the invitation from the administrator account and establish a relationship with it. The member accounts can send administration requests by using the Security Hub console, API, or CLI.For more information, see Sending administration requests.

This solution will enable the company to see Security Hub findings for many AWS accounts and AWS Regions, including accounts that are outside its own organization.

The other options are incorrect because they either do not establish a relationship between the administrator and member accounts (A, B), do not enable Security Hub for all member accounts (D), or do not use a valid service for Security Hub (F).

Verified References:

https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-member-accounts.html

Question: 3

[Logging and Monitoring]

A security engineer is implementing a logging solution for a company's AWS environment. The security engineer has configured an AWS CloudTrail trail in the company's AWS account. The logs are stored in an Amazon S3 bucket for a third-party service provider to monitor. The service provider has a designated 1AM role to access the S3 bucket.

The company requires all logs to be encrypted at rest with a customer managed key. The security engineer uses AWS Key Management Service (AWS KMS) lo create the customer managed key and key policy. The security engineer also configures CloudTrail to use the key to encrypt the trail.

When the security engineer implements this configuration, the service provider no longer can read the logs.

What should the security engineer do to allow the service provider to read the logs?

AEnsure that the S3 bucket policy allows access to the service provider's role to decrypt objects.

BAdd a statement to the key policy to allow the service provider's role the kms: Decrypt action (or the key.

CAdd the AWSKeyManagementServicePowerUser AWS managed policy to the service provider's role.

DMigrate the key to AWS Certificate Manager (ACM) to create a shared endpoint for access to the key.

Answer: B

Question: 4

[Data Protection]

A company has multiple Amazon S3 buckets encrypted with customer-managed CMKs Due to regulatory requirements the keys must be rotated every year. The company's Security Engineer has enabled automatic key rotation for the CMKs; however the company wants to verity that the rotation has occurred.

What should the Security Engineer do to accomplish this?

AFilter IAM CloudTrail logs for KeyRotaton events

BMonitor Amazon CloudWatcn Events for any IAM KMS CMK rotation events

CUsing the IAM CLI. run the IAM kms gel-key-relation-status operation with the --key-id parameter to check the CMK rotation date

DUse Amazon Athena to query IAM CloudTrail logs saved in an S3 bucket to filter Generate New Key events

Answer: C

Explanation:

theaws kms get-key-rotation-statuscommand returns a boolean value that indicates whetherautomatic rotation of the customer master key (CMK) is enabled1.This commandalsoshowsthe date and time when the CMK was last rotated2. The other options are not valid ways to check the CMK rotation status.

Question: 5

[Identity and Access Management]

A company is evaluating the use of AWS Systems Manager Session Manager to gam access to the company's Amazon EC2 instances. However, until the company implements the change, the company must protect the key file for the EC2 instances from read and write operations by any other users.

When a security administrator tries to connect to a critical EC2 Linux instance during an emergency, the security administrator receives the following error. "Error Unprotected private key file - Permissions for' ssh/my_private_key pern' are too open".

Which command should the security administrator use to modify the private key Me permissions to resolve this error?

Achmod 0040 ssh/my_private_key pern

Bchmod 0400 ssh/my_private_key pern

Cchmod 0004 ssh/my_private_key pern

Dchmod 0777 ssh/my_private_key pern

Answer: B

Explanation:

The error message indicates that the private key file permissions are too open, meaning that other users can read or write to the file. This is a security risk, as the private key should be accessible only by the owner of the file. To fix this error, the security administrator should use the chmod command to change the permissions of the private key file to 0400, which means that only the owner can read the file and no one else can read or write to it.

The chmod command takes a numeric argument that represents the permissions for the owner, group, and others in octal notation. Each digit corresponds to a set of permissions: read (4), write (2), and execute (1). The digits are added together to get the final permissions for each category. For example, 0400 means that the owner has read permission (4) and no other permissions (0), and the group and others have no permissions at all (0).

The other options are incorrect because they either do not change the permissions at all (D), or they give too much or too little permissions to the owner, group, or others (A, C).

Verified References:

https://superuser.com/questions/215504/permissions-on-private-key-in-ssh-folder

https://www.baeldung.com/linux/ssh-key-permissions

SAVE TIME & QUICKLY PREPARE WITH REAL QUESTIONS

GET FULL ACCESS

Other Amazon Certification Exams

SAP-C02 Exam

AWS Certified Solutions Architect - Professional Exam

AIF-C01 Exam

AWS Certified AI Practitioner

AIP-C01 Exam

AWS Certified Generative AI Developer - Professional

SAA-C03 Exam

AWS Certified Solutions Architect - Associate

SCS-C03 Exam

AWS Certified Security - Specialty

DOP-C02 Exam

AWS Certified DevOps Engineer - Professional Exam