[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-317383-105":3,"detail-sidebar-cat-0-en-105":80,"doc-detail-317383-en":130},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":73,"head_meta":75,"extra_data":77,"updated_unix":79},105,"en","aws-certified-security-specialty-scs-c01-sample-exam-questions","AWS Certified Security – Specialty (SCS-C01) Sample Exam Questions","","AWS Certified Security – Specialty (SCS-C01) sample exam questions covering common cloud security engineering scenarios. Topics include enforcing private-only service access between VPC and KMS, meeting log segregation requirements with minimal risk, defining secure security group rules for a three-tier architecture, integrating SAML-based authentication into an AWS-hosted web application using Cognito, correcting an S3 bucket policy to allow object-level reads, and troubleshooting VPC peering connectivity issues for application-to-database communication.",{"@graph":14,"@context":72},[15,34,55],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/document/","Document",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/document/exam/","Exam",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/document/aws-certified-security-specialty-scs-c01-sample-exam-questions/317383/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/aws-certified-security-specialty-scs-c01-sample-exam-questions/317383.png","ImageObject",300,407,{"name":42,"@type":43},"Caleb Sterling","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-09-21","2026-09-20",true,{"@type":52,"interactionType":53,"userInteractionCount":26},"InteractionCounter",{"@type":54},"ViewAction",{"@type":56,"mainEntity":57},"FAQPage",[58,64,68],{"name":59,"@type":60,"acceptedAnswer":61},"How can you ensure VPC-to-KMS communication stays entirely within AWS without public endpoints?","Question",{"text":62,"@type":63},"Use private VPC endpoints for KMS with private DNS enabled and enforce the requirement via the KMS key policy using the source VPC endpoint condition. Options involving direct public routing or importing keys over a VPN increase risk and do not meet the constraint as stated.","Answer",{"name":65,"@type":60,"acceptedAnswer":66},"What is the least-risk approach to store two applications' logs in different places when one contains sensitive data?",{"text":67,"@type":63},"Use Amazon CloudWatch Logs with two separate log groups—one per application—and apply an AWS IAM policy to control access to each log group. This cleanly isolates sensitive logs with minimal changes to the application.",{"name":69,"@type":60,"acceptedAnswer":70},"What should you change in an S3 bucket policy to fix the error when granting public read access?",{"text":71,"@type":63},"Update the Resource to include the object path wildcard, such as arn:aws:s3:::appbucket/*, because s3:GetObject applies to objects rather than the bucket root ARN.","https://schema.org",{"og:url":32,"og:type":74,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":76,"canonical":32},"index,follow",{"doc_id":78,"site_id":7},317383,1789999996,{"code":4,"msg":81,"data":82},"success",[83,87,91,94,99,104,109,114,119,122,126],{"id":22,"doc_module":4,"doc_module_name":25,"category_name":84,"show_sort_weight":85,"slug":86},"Story & Novel",90,"story-novel",{"id":26,"doc_module":4,"doc_module_name":25,"category_name":88,"show_sort_weight":89,"slug":90},"Literature",80,"literature",{"id":33,"doc_module":4,"doc_module_name":25,"category_name":29,"show_sort_weight":92,"slug":93},70,"exam",{"id":95,"doc_module":4,"doc_module_name":25,"category_name":96,"show_sort_weight":97,"slug":98},5,"Comic",60,"comic",{"id":100,"doc_module":4,"doc_module_name":25,"category_name":101,"show_sort_weight":102,"slug":103},6,"Technology",50,"technology",{"id":105,"doc_module":4,"doc_module_name":25,"category_name":106,"show_sort_weight":107,"slug":108},7,"Healthcare",40,"healthcare",{"id":110,"doc_module":4,"doc_module_name":25,"category_name":111,"show_sort_weight":112,"slug":113},8,"Research & Report",30,"research-report",{"id":115,"doc_module":4,"doc_module_name":25,"category_name":116,"show_sort_weight":117,"slug":118},9,"Religion & Spirituality",20,"religion-spirituality",{"id":117,"doc_module":4,"doc_module_name":25,"category_name":120,"show_sort_weight":117,"slug":121},"World Cup","world-cup",{"id":123,"doc_module":4,"doc_module_name":25,"category_name":124,"show_sort_weight":123,"slug":125},10,"Lifestyle","lifestyle",{"id":127,"doc_module":4,"doc_module_name":25,"category_name":128,"show_sort_weight":95,"slug":129},19,"General","general",{"code":4,"msg":81,"data":131},{"doc_id":78,"user_id":132,"nickname":42,"user_avatar":133,"doc_module":4,"category_id":33,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":26,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":100,"language":139,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":140,"faqs":141,"seo_title":142,"seo_description":12,"update_tm":143,"read_time":144},962084925290,"https://ap-avatar.wpscdn.com/davatar_085a072bc5b1113ac321206ff7593b45","AWS Certified Security – Specialty (SCS-C01) Sample Exam Questions  \n1) A corporate cloud security policy states that communication between the company's VPC and KMS must travel entirely within the AWS network and not use the public service endpoints.  \nWhat combination of the following actions satisfies that requirement? (Select TWO.)  \nA) Add the aws:sourceVpce condition to the KMS key policy referencing the company's Amazon VPC endpoint ID.  \nB) Remove the VPC internet gateway from the VPC and add a virtual private gateway to the VPC to prevent direct, public internet connectivity.  \nC) Create a VPC endpoint for AWS KMS with private DNS enabled.  \nD) Use the KMS Import Key feature to securely transfer the AWS KMS key over a VPN.  \nE) Add the following condition to the AWS KMS key policy: \"aws:SourceIp\": \" [10.0.0.0/16\".](10.0.0.0/16\".)  \n2) An application team is designing a solution with two applications. The security team wants the applications' logs to be captured in two different places, because one of the applications produces logs with sensitive data.  \nWhat solution meets the requirement with the LEAST risk and effort?  \nA) Use Amazon CloudWatch logs to capture all logs, write an AWS Lambda function that parses the log file, and move sensitive data to a different log.  \nB) Use Amazon CloudWatch logs with two log groups, one for each application, and use an AWS IAM policy to control access to the log groups as required.  \nC) Aggregate logs into one file, then use Amazon CloudWatch Logs, and then design two CloudWatch metric filters to filter sensitive data from the logs.  \nD) Add logic to the application that saves sensitive data logs on the Amazon EC2 instances' local storage, and write a batch script that logs into the EC2 instances and moves sensitive logs to a secure location.  \n3) A Security Engineer must set up security group rules for a three-tier application:  \nPresentation Tier-Accessed by users over the web, protected by the security group,  \npresentation-sg  \nLogic Tier-RESTful API accessed from the Presentation Tier via [https](https), protected by the security group, logic-sg  \nData Tier-SQL Server database accessed over port 1433 from the Logic Tier, protected by the security group, data-sg  \nWhat combination of the following security group rules will allow the application to be secure and functional? (Select THREE.)  \nA) presentation-sg: Allow ports 80 and 443 from [0.0.0.0/0](0.0.0.0/0)  \nB) data-sg: Allow port 1433 from presentation-sg  \nC) data-sg: Allow port 1433 from logic-sg  \nD) presentation-sg: Allow port 1433 from data-sg  \nE) logic-sg: Allow port 443 from presentation-sg  \nF) logic-sg: Allow port 443 from [0.0.0.0/0](0.0.0.0/0)  \n© 2018, Amazon Web Services, Inc. or its affiliates. All rights [reserved | aws.amazon.com](reserved | aws.amazon.com) 1  \nAWS Certified Security – Specialty (SCS-C01) Sample Exam Questions  \n4) A Security Engineer is working with a product team building a web application on AWS. The application uses Amazon S3 to host HTML pages and other static content, API Gateway and AWS Lambda to provide RESTful services, and Amazon DynamoDB to store state and other data. The users already exist in a directory that is exposed via a SAML identity provider (IDP).  \nWhat should the Security Engineer do to enable users to be authenticated into the web application and call APIs? (Select THREE) .  \nA) Create a custom authorization service using AWS Lambda.  \nB) Configure a SAML Identity Provider in Amazon Cognito to map attributes to the Cognito User Pool attributes.  \nC) Configure the identity provider to add the Amazon Cognito User Pool as a relying party.  \nD) Configure an Amazon Cognito Identity Pool to integrate with social login providers.  \nE) Update DynamoDB to store the user email addresses and passwords.  \nF) Update API Gateway to use an Amazon Cognito User Pools authorizer.  \n5) An organization is hosting a web application on AWS and is using an S3 bucket to store images. Use","cbCaiqpOHEq7QsoN","https://ap.wps.com/l/cbCaiqpOHEq7QsoN","pdf",197192,"English","# AWS Certified Security – Specialty (SCS-C01) Sample Exam Questions\n## Network and service access controls\n## Logging and sensitive data segregation\n## Security group design for tiered apps\n## Authentication for web apps with Cognito\n## S3 bucket policy troubleshooting\n## VPC peering network troubleshooting","[{\"question\":\"How can you ensure VPC-to-KMS communication stays entirely within AWS without public endpoints?\",\"answer\":\"Use private VPC endpoints for KMS with private DNS enabled and enforce the requirement via the KMS key policy using the source VPC endpoint condition. Options involving direct public routing or importing keys over a VPN increase risk and do not meet the constraint as stated.\"},{\"question\":\"What is the least-risk approach to store two applications' logs in different places when one contains sensitive data?\",\"answer\":\"Use Amazon CloudWatch Logs with two separate log groups—one per application—and apply an AWS IAM policy to control access to each log group. This cleanly isolates sensitive logs with minimal changes to the application.\"},{\"question\":\"What should you change in an S3 bucket policy to fix the error when granting public read access?\",\"answer\":\"Update the Resource to include the object path wildcard, such as arn:aws:s3:::appbucket/*, because s3:GetObject applies to objects rather than the bucket root ARN.\"}]","AWS Certified Security – Specialty (SCS-C01) Sample Exam Questions | PDF",1789932497,15]