Free AWS Certified Security - Specialty Practice Questions

Sample Practice Questions

Try these 10 sample questions from the AWS Certified Security - Specialty practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A team receives an alert whenever either of two related CloudWatch metric alarms enters ALARM. It wants a notification only when both alarms meet their conditions. Which alarm design meets this requirement?

   1. A. Create a composite alarm whose rule requires both metric alarms to be in ALARM.
   2. B. Create a metric alarm for each metric and notify on each alarm directly.
   3. C. Create a composite alarm whose rule requires either metric alarm to be in ALARM.
   4. D. Create a metric alarm that watches the state of one of the existing alarms.

   Answer: A

   Explanation: AWS says, "A composite alarm includes a rule expression that takes into account the alarm states of other alarms that you have created." It also states, "The composite alarm goes into ALARM state only if all conditions of the rule are met." A rule combining both alarms meets the stated notification condition; individual or either-alarm alerts do not.

   Reference: Using Amazon CloudWatch alarms — Composite alarms

2. 2A response plan needs a central place for engineers to view, investigate, and resolve operational work items tied to AWS resources. Which Systems Manager capability fits?

   1. A. OpsCenter
   2. B. State Manager
   3. C. Patch Manager
   4. D. Parameter Store

   Answer: A

   Explanation: AWS says, "OpsCenter provides a central location where operations engineers and IT professionals can view, investigate, and resolve operational work items (OpsItems) related to AWS resources." That is the requested response workspace.

   Reference: AWS Systems Manager OpsCenter — AWS Systems Manager OpsCenter / Introduction

3. 3A public web endpoint receives bursts of requests from individual clients. The team wants AWS WAF to count requests by a chosen aggregation key and apply an action after a rate limit is breached. Which rule type fits?

   1. A. Rate-based rule
   2. B. Geo match rule
   3. C. Label match rule
   4. D. Managed rule group reference

   Answer: A

   Explanation: AWS says, "A rate-based rule counts incoming requests and rate limits requests when they are coming at too fast a rate." Its aggregation criteria and evaluation window address the stated per-group burst behavior.

   Reference: Using rate-based rule statements in AWS WAF — Rate-based rule / Introduction

4. 4An enterprise wants workforce sign-in to AWS accounts and managed applications through one identity service. Which AWS service serves this purpose?

   1. A. Amazon Cognito identity pools
   2. B. AWS IAM Identity Center
   3. C. AWS STS
   4. D. IAM Roles Anywhere

   Answer: B

   Explanation: AWS states, "AWS IAM Identity Center is the AWS solution for connecting your workforce users to AWS managed applications such as Kiro and Amazon Quick, and other AWS resources." The listed IAM Identity Center use cases include access to AWS accounts and applications for workforce users.

   Reference: What is IAM Identity Center? — What is IAM Identity Center?

5. 5An Application Load Balancer must terminate client TLS connections. What must be configured on its HTTPS listener?

   1. A. A server certificate and a security policy
   2. B. Only a target-group health check
   3. C. Only a network ACL
   4. D. A VPC endpoint policy

   Answer: A

   Explanation: AWS states, "To create an HTTPS listener, you must deploy at least one SSL server certificate on your load balancer. The load balancer uses a server certificate to terminate the front-end connection and then decrypt requests from clients before sending them to the targets. You must also specify a security policy, which is used to negotiate secure connections between clients and the load balancer." Both the server certificate and security policy are required for the HTTPS listener.

   Reference: Create an HTTPS listener for your Application Load Balancer — Create an HTTPS listener for your Application Load Balancer

6. 6A new AWS organization must use service control policies across its member accounts. Which feature set should the management account select?

   1. A. Consolidated billing only
   2. B. All features
   3. C. A single organizational unit only
   4. D. A delegated administrator only

   Answer: B

   Explanation: "SCPs are available only in an organization that has all features enabled." Consolidated billing alone does not support SCPs; OU and administrator choices do not replace the feature set.

   Reference: Service control policies (SCPs) — Service control policies / availability

7. 7An operations team wants CloudWatch to evaluate aggregated results of a scheduled CloudWatch Logs Insights query and alarm when a threshold is breached. Which alarm type directly supports this without a metric filter?

   1. A. A metric alarm based on a metric filter
   2. B. A composite alarm based on two metric alarms
   3. C. A log alarm based on the scheduled query
   4. D. An anomaly alarm on an EC2 metric

   Answer: C

   Explanation: AWS states, "A log alarm monitors the results of a CloudWatch Logs Insights query that runs on a schedule." It further says to use log alarms "to detect patterns, errors, or threshold breaches directly in your log data without creating metric filters." The requested query result and no-filter condition identify a log alarm.

   Reference: Using Amazon CloudWatch alarms — Log alarms

8. 8A team wants an OpsItem to be created when an EventBridge rule processes a security event from an AWS service. Which integration should the response design use?

   1. A. EventBridge to OpsCenter
   2. B. AWS Config aggregator to OpsCenter
   3. C. CloudTrail Lake to State Manager
   4. D. VPC Flow Logs to Patch Manager

   Answer: A

   Explanation: AWS says OpsCenter can automatically create an OpsItem "when EventBridge processes an event from any AWS service that publishes events." This is the direct event-to-work-item integration.

   Reference: AWS Systems Manager OpsCenter — OpsCenter / EventBridge integration

9. 9An AWS WAF rate-based rule should count only requests for the login path, even though the web ACL protects other paths. Which rule feature narrows what the rate rule tracks?

   1. A. Scope-down statement
   2. B. Custom aggregation key
   3. C. Rate limit setting
   4. D. Evaluation window setting

   Answer: A

   Explanation: AWS says a rate-based rule can take a "scope-down statement, to narrow the scope of the requests that the rule tracks and rate limits." A login-path match in that statement limits the counted requests.

   Reference: Using rate-based rule statements in AWS WAF — Rate-based rule / Scope-down statement

10. 10An IAM Identity Center deployment must manage workforce access to AWS accounts across an organization. Which instance type is required for that capability?

    1. A. An account instance in a member account
    2. B. An account instance in the management account
    3. C. An organization instance in the management account
    4. D. An account instance in a delegated administrator account

    Answer: C

    Explanation: AWS states, "An organization instance is the best practice. It's the only instance that enables you to manage access to AWS accounts and it is recommended for all production use of applications." The instance must be an organization instance; moving an account instance among account roles does not give it organization-wide account access.

    Reference: What is IAM Identity Center? — Two instance types