Question 1

Delivery of organization-wide AWS CloudTrail logs to a central Amazon S3 bucket has unexpectedly stopped. The organization trail seems correctly configured, but an analysis of the destination bucket's policy reveals the statements below. What is the MOST likely cause of this delivery failure?

{
    "Sid": "AWSCloudTrailAclCheck",
    "Effect": "Allow",
    "Principal": {
        "Service": "cloudtrail.amazonaws.com"
    },
    "Action": "s3:GetBucketAcl",
    "Resource": "arn:aws:s3:::my-central-log-bucket"
},
{
    "Sid": "AWSCloudTrailWrite",
    "Effect": "Allow",
    "Principal": {
        "Service": "cloudtrail.amazonaws.com"
    },
    "Action": "s3:PutObject",
    "Resource": "arn:aws:s3:::my-central-log-bucket/AWSLogs/o-xxxxxxxxxx/*",
    "Condition": {
        "StringEquals": {
            "s3:x-amz-acl": "bucket-owner-full-control"
        }
    }
}

Accepted Answer

The `Principal` element should specify the management account's ARN instead of the CloudTrail service principal., The policy is missing a `Resource` ARN allowing `s3:PutObject` for the management account's log files., The `Resource` ARN for `s3:PutObject` should not include the organization ID prefix., The bucket policy is missing the `aws:SourceArn` condition key, which is required for organization trails.

Question 2

A security team has received an Amazon GuardDuty finding indicating an EC2 instance is communicating with a known command-and-control server. To understand the full scope of this incident, the team needs to efficiently investigate all related API calls made by IAM roles on the instance, VPC network flows, and other associated GuardDuty findings leading up to and during the event. Which AWS service is specifically designed to automatically correlate these disparate data sources into a unified, interactive graph for streamlined investigation?

Accepted Answer

Amazon CloudWatch Logs Insights, Amazon Athena, AWS Security Hub, Amazon Detective

Question 3

During an active incident investigation, a security analyst confirms that a virtual machine hosting a critical application is communicating with a malicious command-and-control server. To prevent lateral movement and contain the threat while preserving the instance for live forensic analysis, which isolation method should be implemented immediately?

Accepted Answer

Remove the instance's public IP address and detach it from its application load balancer., Log into the instance and disable the primary network interface from within the operating system., Place the instance in a quarantine security group that denies all traffic except from a designated forensic analysis network., Create a snapshot of the instance's attached storage volumes and then terminate the instance.

Question 4

A company's e-commerce platform, served by Amazon CloudFront and an Application Load Balancer (ALB), is experiencing a surge of malicious requests identified as SQL injection (SQLi) attacks. The security team must block these attacks at the edge immediately without modifying application code. Which solution will most effectively meet this requirement?

Accepted Answer

Modify the network ACLs associated with the ALB's subnets to deny traffic from the attacking IP addresses., Configure the ALB's security group to include a deny rule for the source IPs of the malicious requests., Create an AWS WAF web ACL, associate it with the CloudFront distribution, and add the `AWSManagedRulesSQLiRuleSet` managed rule group., Enable AWS Shield Advanced on the CloudFront distribution to block the SQLi attacks.

Question 5

During an incident response investigation, a security team needs to capture the full packet payloads of network traffic from a specific Amazon EC2 instance suspected of communicating with a malicious command-and-control server. The team needs to send this captured traffic to a separate EC2 instance running a third-party forensic analysis tool. The solution must not require any agent installation on the source instance. Which AWS feature should the team use to meet these requirements?

Accepted Answer

An AWS Network Firewall rule group configured to log all packets with their full payload., VPC Traffic Mirroring with the compromised instance's ENI as the source and the forensic tool's ENI as the target., VPC Flow Logs configured with a custom log format to capture payload data., Amazon GuardDuty with S3 Protection enabled to automatically capture suspicious traffic.

Question 6

A healthcare provider needs to implement automated data retention policies for multiple AWS services to comply with data governance standards. Specifically, they need to ensure that Amazon RDS database snapshots are retained for 365 days and that logs stored in Amazon CloudWatch Logs log groups are retained for 90 days before being deleted. Which combination of actions will meet these requirements? (Select TWO)

Accepted Answer

Configure an S3 Lifecycle policy on the bucket where CloudWatch Logs are exported to delete logs after 90 days., Create a backup plan in AWS Backup with a lifecycle rule to transition RDS snapshots to cold storage after 90 days and expire them after 365 days., Create an Amazon Data Lifecycle Manager (DLM) policy to manage the retention of the RDS snapshots., Set up an Amazon EventBridge rule to trigger an AWS Lambda function daily that deletes old RDS snapshots and CloudWatch Logs log streams., Use the `put-retention-policy` AWS CLI command or the AWS Management Console to set the retention period for each CloudWatch Logs log group.

Question 7

An organization's security policy requires that all infrastructure configurations in its AWS environment must strictly match the state defined in their version-controlled AWS CloudFormation templates. A security engineer needs to implement an automated mechanism to identify any resources within a CloudFormation stack that have been altered manually outside of CloudFormation. The solution must provide a detailed report of the differences between the template's expected configuration and the actual resource configuration.

Accepted Answer

Enable termination protection on the CloudFormation stack to prevent any out-of-band changes to the stack's resources., Execute drift detection on the CloudFormation stack and review the detailed results for any resources with a 'MODIFIED' status., Create an Amazon EventBridge rule that triggers an AWS Lambda function to parse AWS CloudTrail logs for any configuration change API calls., Configure AWS Config rules to evaluate the resources and trigger an Amazon SNS notification upon detecting a non-compliant resource.

Question 8

A central security team needs to identify potential data security risks, such as sensitive data residing in Amazon S3 buckets, across all member accounts within an AWS Organization. The team must manage this process from a designated security tooling account, using the delegated administrator feature, rather than the management account. Which AWS service fulfills this requirement?

Accepted Answer

Amazon Macie, AWS Secrets Manager, AWS Certificate Manager, AWS Trusted Advisor

Question 9

A security engineer is troubleshooting a connection timeout issue for an application hosted on an Amazon EC2 instance. The instance's security group allows outbound traffic on TCP port 443. The subnet's network ACL (NACL) has an outbound rule allowing traffic to destination port 443 and an inbound rule allowing traffic from source port 443. However, connections consistently fail. Analysis of VPC Flow Logs shows outbound packets are allowed, but no return packets are received. What is the most likely cause of this issue?

Accepted Answer

The route table for the subnet does not have a route to an internet gateway., The security group needs an explicit inbound rule for the ephemeral port range., The NACL is missing an inbound rule to allow traffic destined for the ephemeral port range., The NACL is stateful and is automatically blocking the return traffic.

Question 10

A security policy for an S3 bucket containing sensitive logs mandates two conditions. All new objects must be uploaded with server-side encryption using a specific customer-managed AWS KMS key. Furthermore, all access to the bucket must originate exclusively from a designated VPC endpoint. Which approach correctly implements these controls?

Accepted Answer

Create a bucket policy with two `Deny` statements. The first denies the `s3:PutObject` action if the `s3:x-amz-server-side-encryption` header is not `aws:kms` OR the `s3:x-amz-server-side-encryption-aws-kms-key-id` does not match the specific key ARN. The second denies all S3 actions if the `aws:sourceVpce` does not match the endpoint ID., Enable default encryption on the S3 bucket using the specified KMS key. Create a bucket policy with an `Allow` statement for principals that has a condition requiring the `aws:SourceVpc` to match the VPC ID., Create a bucket policy with a single `Deny` statement for the `s3:PutObject` action. The condition should check if `s3:x-amz-server-side-encryption` is not equal to `aws:kms` or if `s3:x-amz-server-side-encryption-aws-kms-key-id` does not match the specific key ARN. Create a separate IAM policy to restrict access to the VPC endpoint., Create a bucket policy with two statements. The first uses `Effect: Allow` for `s3:PutObject` with a condition that `s3:x-amz-server-side-encryption` equals `aws:kms`. The second uses `Effect: Allow` for all S3 actions with a condition that `aws:sourceVpce` matches the endpoint ID.

Question 11

Clients are reporting intermittent 'SSL_ERROR_NO_CYPHER_OVERLAP' errors when connecting to a new web application distributed by Amazon CloudFront. The CloudFront distribution uses a custom domain name and an AWS Certificate Manager (ACM) certificate. A security policy is also configured on the distribution. Which of the following are the most likely causes for this specific error? (Select TWO)

Accepted Answer

The ACM certificate does not include the custom domain name in its Subject Alternative Name (SAN) list., The client browser does not support Server Name Indication (SNI)., The CloudFront security policy is set to a restrictive level, such as TLSv1.2_2021, and the client browser is outdated., The Origin Protocol Policy in CloudFront is set to 'HTTP Only'., The CloudFront distribution is not associated with an AWS WAF web ACL.

Question 12

A security team needs to proactively identify unusual API activity within their AWS accounts that might indicate compromised credentials. They are specifically concerned about an abnormally high rate of IAM policy changes or EC2 instance terminations originating from a new geographic location. The team wants a managed solution that uses machine learning to automatically detect these deviations from normal operational patterns without manual threshold configuration. Which AWS service should be implemented to meet this requirement?

Accepted Answer

Amazon GuardDuty, AWS CloudTrail Insights, Amazon CloudWatch Logs Insights, AWS Security Hub insights

Question 13

A company is deploying a new critical payment processing application on Amazon EC2. The security team requires sufficient log detail to investigate security incidents and failed transactions, but the operations team is concerned about the performance impact and storage costs of excessive logging. What is the MOST appropriate logging level to configure for this production application to balance security visibility with operational efficiency?

Accepted Answer

TRACE level, to provide the most granular detail possible, including method entry and exit points., WARN level, to capture potential issues and unexpected events that are not yet errors., DEBUG level, to capture all application state changes for comprehensive analysis., INFO level, to log routine processing steps and significant state changes.

Question 14

To enforce strict non-repudiation and integrity for software artifacts stored in a central repository, a security architect must select an appropriate cryptographic control. The control must ensure that the identity of the engineer who committed the artifact is cryptographically bound to the artifact itself, preventing them from later denying their action. Which of the following is the most suitable control for this specific requirement?

Accepted Answer

Hashing the artifact with SHA-512 and storing the hash value separately., Generating a digital signature for the artifact using the engineer's private key., Creating a Hash-based Message Authentication Code (HMAC) using a shared secret., Encrypting the artifact using AES-256 in GCM mode with a pre-shared key.

Question 15

A financial services firm must ensure that proprietary client identification numbers, which follow a specific alphanumeric pattern, are not being stored in any of its Amazon S3 buckets. The security team has enabled Amazon Macie but has found that the default managed data identifiers do not detect this proprietary format. The team needs to implement a solution to scan all existing and new S3 objects for this specific data type.

Accepted Answer

Use Amazon S3 Storage Lens to create a custom metric that tracks the occurrence of the specific alphanumeric pattern., Create a custom AWS Config rule with an AWS Lambda function that uses regular expressions to scan S3 objects upon creation., Develop a custom data identifier in Amazon Macie using a regular expression that matches the proprietary format and run a sensitive data discovery job., Configure Amazon GuardDuty S3 Protection to monitor for the proprietary data pattern in S3 data events.

Question 16

An e-commerce platform, built on a standard three-tier architecture, is protected by an edge WAF using managed rulesets against common threats. A security review identifies a high-risk vulnerability where authenticated users can submit syntactically valid API requests to manipulate business logic in the application tier. Which security enhancement at the edge is the most effective measure to prevent this type of exploit?

Accepted Answer

Deploying an API gateway at the edge to enforce a positive security model based on a defined API schema., Configuring the origin web servers to only accept traffic from the WAF's IP ranges., Implementing strict rate-limiting policies on the vulnerable API endpoints., Enriching WAF logs with application-level transaction data and forwarding them to a SIEM for correlation.

Question 17

A company requires an IAM policy for a developer role that allows all Amazon DynamoDB actions. However, to prevent accidental data loss, the policy must explicitly forbid the deletion of any DynamoDB table under all circumstances. Furthermore, for all other allowed actions, the request must include a tag with the key `Project` and a value of `Confidential`.

Accepted Answer

An `Allow` statement with `Action: "dynamodb:*"` and `Resource: "*"`, conditioned on `aws:RequestTag/Project` being "Confidential"., A `Deny` statement with `Action: "dynamodb:DeleteTable"` and `Resource: "*"`., A `Deny` statement with `Action: "dynamodb:DeleteTable"` and `Resource: "*"`, conditioned on `aws:RequestTag/Project` NOT being "Confidential"., An `Allow` statement for `dynamodb:*` and a separate `Deny` statement for `dynamodb:DeleteTable` that only applies if the `Project` tag is missing., An `Allow` statement with `Action: "dynamodb:*"` and `Resource: "*"`, conditioned on `aws:ResourceTag/Project` being "Confidential".

Question 18

To investigate an unexplained spike in S3 data transfer costs, a security team must create detailed visualizations from 30 days of S3 server access logs. The analysis requires correlating high-volume `GetObject` requests with the requester's IAM principal and source IP address. Which approach provides the most flexible and powerful capabilities for this type of ad-hoc query and visualization?

Accepted Answer

Use Amazon Athena to query the log files directly in their S3 bucket and use Amazon QuickSight to create the visualizations., Ingest the logs into Amazon CloudWatch Logs and use CloudWatch Logs Insights to query the data and create CloudWatch Dashboards., Review Amazon GuardDuty S3 Protection findings and use Amazon Detective to explore the relationships between the resources., Configure a subscription filter on the S3 log bucket to stream data to Amazon OpenSearch Service and use OpenSearch Dashboards for analysis.

Question 19

An organization has implemented a centralized model for secrets management where all secrets are stored in a dedicated 'Security' AWS account. An application running on an Amazon EC2 instance in a 'Production' account needs to retrieve a database password from Secrets Manager in the 'Security' account. Which combination of configurations is required to grant this cross-account access securely? (Select TWO)

Accepted Answer

A VPC peering connection between the VPCs in the 'Security' and 'Production' accounts to allow network traffic for the API call., A resource-based policy attached to the secret in the 'Security' account that allows the `secretsmanager:GetSecretValue` action from the EC2 instance's IAM role ARN., A Service Control Policy (SCP) in AWS Organizations that explicitly allows `secretsmanager:GetSecretValue` between the two accounts., A resource-based policy attached to the secret in the 'Security' account that allows the `sts:AssumeRole` action from the 'Production' account's root user., An identity-based policy attached to the EC2 instance's IAM role in the 'Production' account that allows the `secretsmanager:GetSecretValue` action on the secret's ARN.

Question 20

During a new application deployment, a Lambda function with an attached IAM execution role is consistently failing. CloudWatch Logs for the function show a generic `AccessDeniedException` when it attempts to write an object to a specific S3 bucket. The function's role policy explicitly allows `s3:PutObject` on the target bucket ARN. A security engineer needs to determine the precise cause of the denial, which could be a conflicting policy or a missing condition. What is the most direct method to obtain a detailed authorization decision message for the failed API call?

Accepted Answer

Query AWS CloudTrail event history for the failed `PutObject` events and inspect the `errorMessage` field in the event record., Review the IAM Access Advisor report for the Lambda execution role to check the last accessed timestamp for the `s3:PutObject` permission., Generate a finding using IAM Access Analyzer for the S3 bucket to identify policies that grant external access., Simulate the `s3:PutObject` action for the Lambda execution role and the target S3 bucket ARN in the IAM policy simulator.

AWS Certified Security Specialty Practice Exams (2025) for DevelopersData ScientistsData AnalystsData EngineersAnyoneDevelopers

Master the AWS Certified Security Specialty Exam

Practice Exam Domains Covered - Latest 2025 certification alignment

2025 Practice Exam Details

Cutting Edge Exam Prep with AI Enhanced Learning

AI Enhanced Learning With Premium Certification Practice Exams

Real-time AI Learning:

Unparalleled Understanding:

Advanced Learning with AI:

Exam Prep Powered by our Certification Practice System

Fast-Track Your Preparation Path

Realistic Exam Experience and Comprehensive Preparation

Fully Crafted and Supported by Experts in the USA

Proven Quality and Trust for Real Success

In-depth Explanations for Complete Mastery

Chosen and Trusted by Professionals Worldwide

Marvin Watson

Edward Martinez

Peter Chen

Daniel Garcia

Brandon Hill

Ava Thompson

Ali Karim

Sophia Padilla

Jiwon Thomas

Ella Sanders

Marvin Watson

Edward Martinez

Peter Chen

Daniel Garcia

Brandon Hill

Ava Thompson

Ali Karim

Sophia Padilla

Jiwon Thomas

Ella Sanders

Marvin Watson

Edward Martinez

Peter Chen

Daniel Garcia

Brandon Hill

Ava Thompson

AWS Certified Security Specialty Certification Preparation Path

Focus on Passing on the First Attempt

Practice with Realistic Exams for Real Success

Build a Deep and Solid Foundation

Invest in Your Future

Why Choose Our AWS Practice Exams?

Built on Trust, Quality, and Proven Success

Expertise Backed by Professionals

Customer Focused, Always

AWS Certified Security Specialty Certification PreparationChoose Your Path to Success

Starter Practice Exam1 Exam

Pro Practice Pack3 Exam Bundle

Ultimate Practice Pack6 Exam Bundle

Prepare for Success with AWS Certified Security Specialty Exam Practice

AWS Certified Security Specialty Certification Preparation

The Goal of our Certification Preparation

Who Should Pursue this Certification Preparation?

ConsiderationsWhen Choosing Practice Exams

Beware of Outdated Content

Quality Matters in Exam Prep

Avoid Non-Expert Materials

Anytime, Anywhere Access

Unlimited Attempts

Cross-Device Sync

Frequently Asked Questions

How closely do your practice questions resemble the actual exam?▼

How up-to-date are your practice exams?▼

How long do I have access to the practice exams?▼

Are your practice exams available on mobile devices?▼

Do you provide explanations for the answers?▼

Take the Next Step Towards AWS Certification Prep

AWS Certified Security Specialty Practice Exams (2025) for
Developers
Data Scientists
Data Analysts
Data Engineers
Anyone
Developers

AWS Certified Security Specialty Certification Preparation
Choose Your Path to Success

Starter Practice Exam
1 Exam

Pro Practice Pack
3 Exam Bundle

Ultimate Practice Pack
6 Exam Bundle

Considerations
When Choosing Practice Exams