Question bank
AWS Certified Security – Specialty
41 AWS Certified Security – Specialty questions with the correct answer and a written explanation, organised across 5 exam domains.
- 41 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Data Protection
9 questions in this domain
- Question 1Single Choice
Which AWS service provides fully managed key management and envelope encryption for data at rest?
- AAWS CloudHSM
- BAWS KMSCorrect answer
- CAWS Secrets Manager
- DAWS Certificate Manager
Why this is the answer
AWS KMS is the managed service for key management and envelope encryption.
- Question 2Multiple Select
Which two encryption options can be set as default encryption on an S3 bucket? (Choose two.)
- ASSE-S3Correct answer
- BSSE-C
- CSSE-KMSCorrect answer
- DSSE-D
Why this is the answer
S3 default encryption supports SSE-S3 and SSE-KMS, not SSE-C.
- Question 3Interactive
In the KMS policy snippet, which line grants the s3 service principal permission to use the key for GenerateDataKey?
- AThe Effect line specifying 'Allow'
- BThe Principal line specifying 's3.amazonaws.com'
- CThe Action line containing 'kms:GenerateDataKey'Correct answer
- DThe Resource line with '*'
Why this is the answer
The Action line specifies the permissions granted, including GenerateDataKey.
- Question 4Single Choice
What does TLS termination at an Application Load Balancer mean?
- AThe load balancer forwards traffic encrypted to the backend.
- BThe load balancer decrypts traffic and sends plaintext to the backend.Correct answer
- CThe backend encrypts all traffic.
- DThe client must provide a certificate.
Why this is the answer
TLS termination means the ALB decrypts incoming TLS and forwards plaintext.
- Question 5Multiple Select
Which two AWS services can automatically renew public TLS certificates? (Choose two.)
- AAWS Certificate ManagerCorrect answer
- BAWS CloudHSM
- CAWS Private Certificate AuthorityCorrect answer
- DACM with public CA
Why this is the answer
ACM automatically renews public certificates and ACM PCA renews private certificates.
- Question 6Interactive
Examine the VPN configuration: AWS tunnel endpoint IP and pre-shared key. Which protocol is used to establish the encrypted tunnel?
- ATLS
- BIPsecCorrect answer
- CSSH
- DDTLS
Why this is the answer
Site-to-Site VPN uses IPsec with IKEv2 for encrypted tunnels.
- Question 7Single Choice
Which AWS service provides automatic rotation of database passwords for RDS?
- AAWS Parameter Store
- BAWS Secrets ManagerCorrect answer
- CAWS KMS
- DAWS IAM
Why this is the answer
Secrets Manager natively rotates RDS passwords via integrated Lambda functions.
- Question 8Multiple Select
Which two features are only available in AWS Secrets Manager and not in Parameter Store? (Choose two.)
- AAutomatic rotationCorrect answer
- BSecureString parameter type
- CNative RDS integrationCorrect answer
- DHierarchical path naming
Why this is the answer
Secrets Manager offers automatic rotation and native RDS integration; Parameter Store does not.
- Question 9Interactive
In the IAM policy snippet, which two actions are required to retrieve a SecureString parameter? (Choose two.)
- Assm:GetParameterCorrect answer
- Bkms:DecryptCorrect answer
- Cssm:PutParameter
- Dkms:Encrypt
Why this is the answer
Both ssm:GetParameter and kms:Decrypt are needed to retrieve and decrypt a SecureString.
Identity and Access Management
8 questions in this domain
- Question 10Single Choice
Which AWS service provides short-lived credentials for IAM roles?
- AAWS Security Token Service (STS)Correct answer
- BAWS Identity and Access Management (IAM)
- CAmazon Cognito
- DAWS Key Management Service (KMS)
Why this is the answer
STS is the service that issues temporary, limited-privilege credentials for IAM roles or federated users.
- Question 11Multiple Select
Which two are benefits of using IAM roles instead of IAM users for EC2 instances?
- AAutomatic credential rotationCorrect answer
- BReduced management overheadCorrect answer
- CAbility to assign a static public IP
- DBetter integration with CloudWatch logs
Why this is the answer
Roles provide automatic, short-lived credentials and eliminate the need to manage and rotate access keys.
- Question 12Interactive
What does the following IAM trust policy allow?
- AA specific IAM user (John) can assume this role.Correct answer
- BAny IAM user in the account can assume this role.
- CThe role can be assumed by any AWS service.
- DJohn can create a new role with the same permissions.
Why this is the answer
The trust policy's Principal is an IAM user ARN, and Action is sts:AssumeRole, so only that user can assume the role.
- Question 13Single Choice
Which IAM feature sets a maximum permissions ceiling for an IAM role?
- APermission boundaryCorrect answer
- BService control policy (SCP)
- CTrust policy
- DIdentity-based policy
Why this is the answer
A permission boundary is a managed policy that defines the maximum permissions an IAM entity can have.
- Question 14Multiple Select
Which two identity protocols are supported for federation with AWS IAM?
- ASAML 2.0Correct answer
- BOpenID Connect (OIDC)Correct answer
- CLDAP
- DRADIUS
Why this is the answer
AWS IAM supports SAML 2.0 and OIDC as identity federation protocols to grant temporary access.
- Question 15Interactive
What type of access control is demonstrated by this IAM policy?
- AAttribute-based access control (ABAC)Correct answer
- BRole-based access control (RBAC)
- CDiscretionary access control (DAC)
- DMandatory access control (MAC)
Why this is the answer
The policy uses a condition on resource tags (Environment=dev), which is characteristic of ABAC.
- Question 16Single Choice
Which AWS service is used to centrally manage permissions across multiple AWS accounts?
- AAWS OrganizationsCorrect answer
- BAWS IAM
- CAWS Config
- DAWS CloudFormation
Why this is the answer
AWS Organizations uses Service Control Policies (SCPs) to centrally manage permissions across accounts.
- Question 17Multiple Select
Which two are valid use cases for Amazon Cognito user pools?
- AUser sign-in for a mobile applicationCorrect answer
- BStoring user profile informationCorrect answer
- CFederating corporate Active Directory users
- DProviding temporary AWS credentials directly
Why this is the answer
User pools handle authentication and user storage; identity pools provide AWS credentials.
Infrastructure Security
11 questions in this domain
- Question 18Single Choice
Which AWS service acts as a stateful virtual firewall for an EC2 instance?
- ASecurity GroupCorrect answer
- BNetwork ACL
- CAWS WAF
- DAWS Shield
Why this is the answer
Security Groups are stateful and act as a virtual firewall for EC2 instances, only allowing inbound and outbound traffic based on rules.
- Question 19Multiple Select
Which two statements about Network ACLs (NACLs) are correct? (Select two.)
- AThey are stateless and require explicit inbound and outbound rules.Correct answer
- BThey are stateful and automatically allow return traffic.
- CThey support both allow and deny rules evaluated in numeric order.Correct answer
- DThey can be attached directly to an EC2 instance.
Why this is the answer
NACLs are stateless, operate at the subnet level, and support both allow and deny rules evaluated in numerical order (lowest first).
- Question 20Interactive
Review the security group inbound rule below. What access does it permit?
- ASSH access from any IP addressCorrect answer
- BHTTP access from any IP address
- CHTTPS access from any IP address
- DRDP access from any IP address
Why this is the answer
The rule allows TCP port 22 from 0.0.0.0/0, which corresponds to SSH access from any IP.
- Question 21Single Choice
Which AWS service is used to automatically patch EC2 instances with security updates?
- AAWS Systems Manager Patch ManagerCorrect answer
- BAmazon Inspector
- CAWS Config
- DAmazon GuardDuty
Why this is the answer
AWS Systems Manager Patch Manager automates the process of patching managed nodes with security and other updates.
- Question 22Multiple Select
Which two resources can Amazon Inspector scan for vulnerabilities? (Select two.)
- AEC2 instancesCorrect answer
- BContainer images in ECRCorrect answer
- CRDS databases
- DS3 buckets
Why this is the answer
Amazon Inspector can scan EC2 instances for OS vulnerabilities and container images in ECR for software vulnerabilities.
- Question 23Interactive
Given the SSM document command below, what operation will be performed on the target instances?
- AIt will only report missing patches (Scan mode).Correct answer
- BIt will apply all missing patches (Install mode).
- CIt will reboot the instances after patching.
- DIt will remove non-compliant patches.
Why this is the answer
The command uses 'operation': 'Scan', which instructs Patch Manager to report compliance without applying patches.
- Question 24Single Choice
Which AWS service provides a content delivery network with integrated security features like WAF and Shield?
- AAmazon CloudFrontCorrect answer
- BAWS Global Accelerator
- CAmazon Route 53
- DAWS WAF
Why this is the answer
Amazon CloudFront is a global content delivery network that integrates with AWS WAF and Shield for edge security.
- Question 25Multiple Select
Which two benefits does Origin Access Control (OAC) provide when used with CloudFront and S3? (Select two.)
- AIt allows CloudFront to securely access S3 without making the bucket public.Correct answer
- BIt uses signed requests to authenticate CloudFront to S3.Correct answer
- CIt enables static website hosting on S3.
- DIt provides automatic SSL/TLS termination at the edge.
Why this is the answer
OAC allows CloudFront to authenticate using a signed header, so the S3 bucket can remain private while still being accessed by CloudFront.
- Question 26Interactive
Examine the Route 53 routing policy snippet. What does this configuration accomplish?
- AIt distributes traffic across multiple resources based on weights.Correct answer
- BIt routes users to the resource with the lowest latency.
- CIt fails over to a secondary resource if the primary is unhealthy.
- DIt blocks traffic from specific geographic regions.
Why this is the answer
The snippet shows a weighted routing policy with two records having different weights, distributing traffic proportionally.
- Question 27Single Choice
Which AWS service is used to centrally manage multiple accounts and apply service control policies?
- AAWS OrganizationsCorrect answer
- BAWS Control Tower
- CAWS IAM
- DAWS Config
Why this is the answer
AWS Organizations is the service that provides central management of multiple accounts and allows Service Control Policies (SCPs) to be applied.
- Question 28Multiple Select
Which two statements about Service Control Policies (SCPs) are true? (Select two.)
- ASCPs can be used to deny actions across an entire AWS account.Correct answer
- BSCPs grant permissions to IAM users and roles.
- CSCPs define a permission boundary that IAM policies cannot exceed.Correct answer
- DSCPs apply to the management account of an organization.
Why this is the answer
SCPs filter permissions at the account level, they can deny actions, and they act as a boundary; they do not grant permissions and do not affect the management account.
Security Logging and Monitoring
8 questions in this domain
- Question 29Single Choice
Which AWS service provides centralized log storage and real-time metric extraction from log streams?
- AAWS CloudTrail
- BAmazon CloudWatch LogsCorrect answer
- CAmazon GuardDuty
- DAWS Config
Why this is the answer
Amazon CloudWatch Logs centralizes log data and uses metric filters to extract patterns and trigger CloudWatch alarms.
- Question 30Multiple Select
Which two AWS services are directly integrated with AWS Security Hub as finding sources?
- AAmazon GuardDutyCorrect answer
- BAWS CloudTrail
- CAmazon InspectorCorrect answer
- DAmazon VPC Flow Logs
Why this is the answer
GuardDuty and Inspector generate findings that are ingested by Security Hub; CloudTrail and VPC Flow Logs are data sources for GuardDuty, not direct providers.
- Question 31Interactive
What CloudWatch Logs Insights query extracts ERROR messages and counts them per log stream?
- Afields @timestamp, @message | filter @message like /ERROR/ | stats count() by @logStreamCorrect answer
- Bfields @timestamp, @message | filter @message = 'ERROR' | stats count() by @logStream
- Cfields @timestamp, @message | stats count() by @logStream | filter @message like /ERROR/
- Dfields @timestamp, @message | filter @message != /ERROR/ | stats count() by @logStream
Why this is the answer
The correct syntax uses 'like /ERROR/' for pattern matching and groups by @logStream. The other options have incorrect order or pattern syntax.
- Question 32Single Choice
What VPC Flow Logs aggregation interval provides near-real-time visibility?
- A1 minuteCorrect answer
- B5 minutes
- C10 minutes
- D15 minutes
Why this is the answer
VPC Flow Logs support a 1-minute aggregation interval (max) for near-real-time data; default is 10 minutes.
- Question 33Multiple Select
Which two AWS services are essential for centralized logging across multiple accounts using AWS Organizations?
- AAWS CloudTrailCorrect answer
- BAmazon Security Hub
- CAWS Config
- DAWS OrganizationsCorrect answer
Why this is the answer
CloudTrail delivers logs to S3; AWS Organizations provides the mechanism to create an organization trail that covers all accounts.
- Question 34Interactive
What Athena file format minimizes query cost and improves performance?
- AJSON
- BCSV
- CParquetCorrect answer
- DAvro
Why this is the answer
Parquet is a columnar format that compresses data and reduces the amount scanned per query, lowering cost and speeding up performance.
- Question 35Single Choice
Which AWS service provides a single pane of glass for compliance standards like CIS and PCI DSS?
- AAmazon GuardDuty
- BAWS Security HubCorrect answer
- CAWS Config
- DAmazon Inspector
Why this is the answer
Security Hub consolidates findings and runs compliance checks against standards like CIS and PCI DSS, providing a unified security posture view.
- Question 36Multiple Select
Which two actions are necessary to enable AWS Security Hub compliance checks across all accounts?
- AEnable AWS Config in all accounts and RegionsCorrect answer
- BEnable Amazon GuardDuty
- CDesignate a Security Hub administrator accountCorrect answer
- DCreate an S3 bucket for findings
Why this is the answer
Security Hub requires AWS Config for resource recording and a delegated administrator to manage multi-account findings and settings.
Threat Detection and Incident Response
5 questions in this domain
- Question 37Single Choice
Which CloudTrail event type captures object-level API operations like S3 GetObject?
- AManagement events
- BData eventsCorrect answer
- CInsight events
- DControl events
Why this is the answer
Data events must be explicitly enabled in CloudTrail to capture object-level API calls such as S3 GetObject and PutObject.
- Question 38Multiple Select
Which three AWS services are primarily used for threat detection and analysis, excluding CloudTrail?
- AAmazon GuardDutyCorrect answer
- BAWS Security HubCorrect answer
- CAmazon DetectiveCorrect answer
- DAWS CloudTrail
Why this is the answer
GuardDuty, Security Hub, and Detective are detection and investigation services; CloudTrail provides audit logging.
- Question 39Interactive
Based on the GuardDuty finding snippet provided, which finding type is detected?
- AUnauthorizedAccess:EC2/SSHBruteForceCorrect answer
- BBackdoor:EC2/C&CActivity.B!DNS
- CRecon:EC2/PortProbeUnprotected
- DPersistence:IAMUser/UserPermissions
Why this is the answer
The finding type is explicitly stated in the 'type' field of the JSON as UnauthorizedAccess:EC2/SSHBruteForce.
- Question 40Single Choice
What is the initial step in cloud incident response upon suspecting a breach?
- AIsolate the compromised instance
- BPreserve evidence by taking snapshotsCorrect answer
- CNotify the incident response team
- DTerminate the affected resource
Why this is the answer
Preserving evidence (e.g., EBS snapshots) is critical to avoid losing volatile data before containment actions.
- Question 41Multiple Select
Which two actions are appropriate for containing a compromised EC2 instance?
- AUpdate the security group to block all unnecessary trafficCorrect answer
- BRemove IAM policies from the instance's roleCorrect answer
- CCreate an EBS snapshot
- DTerminate the instance via the console
Why this is the answer
Updating security groups and removing IAM policies are containment actions that do not destroy evidence; snapshots are for preservation.
Frequently asked questions
Everything about the AWS Certified Security – Specialty question bank and how to use it.