// aws certified security - specialty scs-c02
SCS-C02
Prepare for the AWS Certified Security - Specialty exam with detailed questions and comprehensive study plans designed for security professionals.
307
questions
65
in exam
170m
duration
at a glance
What you get
PDF US$10.00Sub US$10/mopass 750 (scaled score)
Free practice questions are available without payment; anyone can start practicing at no cost.
access options
PDF bank or platform subscription?
Two separate purchases: a one-time PDF for SCS-C02, or a monthly subscription for online practice and simulators across the platform. A subscription does not include the PDF download.
option / 01 · pdf file
Full question bank PDF
US$10.00· one-time
- Full question bank as a print-ready PDF
- Lifetime access to this exam only
- Domain-tagged questions with explanations
- Separate from online practice — buy once
option / 02 · subscription
All exams · practice & simulator
US$10.00· per month
- Practice & exam simulator on every bank
- All current and future exams included
- Personal analytics and retention tools
- Cancel anytime — no per-exam upsells
sample · 1 of 307Shuffle
See what's in the bank.
Infrastructure Securitymedium
15 votes · last validated recently
A company needs to use HTTPS when connecting to its web applications to meet compliance requirements. These web applications run in Amazon VPC on Amazon EC2 instances behind an Application Load Balancer (ALB). A security engineer wants to ensure that the load balancer will only accept connections over port 443, even if the ALB is mistakenly configured with an HTTP listener.
Which configuration steps should the security engineer take to accomplish this task?
Which configuration steps should the security engineer take to accomplish this task?
A
Create a security group with a rule that denies inbound connections from 0.0.0.0/0 on port 80. Attach this security group to the ALB to overwrite more permissive rules from the ALB’s default security group.
0%
B
Create a network ACL that denies inbound connections from 0.0.0.0/0 on port 80. Associate the network ACL with the VPC’s internet gateway.
0%
C
Create a network ACL that allows outbound connections to the VPC IP range on port 443 only. Associate the network ACL with the VPC’s internet gateway.
0%
D
Create a security group with a single inbound rule that allows connections from 0.0.0.0/0 on port 443. Ensure this security group is the only one associated with the ALB.
100%
04 · coverage
Exam domains
Incident Response12%
26 q
Logging and Monitoring20%
75 q
Infrastructure Security26%
76 q
Identity and Access Management20%
72 q
Data Protection22%
58 q
community questionsview all →
Questions from the community
Top-voted approved contributions for this exam, reviewed before landing in the bank.
// top community questionsview all →
0.0 · 0 reviews
What candidates say
no reviews yet
related
You may also like
More exams based on your interests.
307 questions
PDF US$10.00 one-time·Sub US$10/mo
updated 7h ago·devco · cert
SCS-C02premiumamazon● updated 7h ago
AWS Certified Security - Specialty SCS-C02 SCS.
Prepare for the AWS Certified Security - Specialty exam with detailed questions and comprehensive study plans designed for security professionals.
// OFFICIAL EXAM LOGISTICS
source · amazon web services
// PASSING SCORE
750 / 1000· scaled
minimum to pass
75%of scale
// QUESTIONS
65official
// DURATION
170min
// EXAM FEE
300usd
// ITEM TYPES
multiple choice
multiple response
// questions
307in bank
// pass rate
92%self-reported
// last update
7h agoago
// add cadence · 12w
// downloadable pdf bank
Get the whole bank as a PDF
Every question tagged by domain, with a detailed explanation. Preview the first pages free — buy once for lifetime access to the full PDF.
307 questions
// what's inside
- 307 exam-style questions with verified answers
- Every question tagged by domain (5 domains covered)
- A detailed explanation / rationale for every question
// sample · 1 of 307
See what's in the bank.
#017dfab9-fd4b-456d-804b-59e0b1594fe2Infrastructure Securitymedium
↑ +47· 5 comments· seen 1,284×
A company needs to use HTTPS when connecting to its web applications to meet compliance requirements. These web applications run in Amazon VPC on Amazon EC2 instances behind an Application Load Balancer (ALB). A security engineer wants to ensure that the load balancer will only accept connections over port 443, even if the ALB is mistakenly configured with an HTTP listener.
Which configuration steps should the security engineer take to accomplish this task?
Which configuration steps should the security engineer take to accomplish this task?
A
Create a security group with a rule that denies inbound connections from 0.0.0.0/0 on port 80. Attach this security group to the ALB to overwrite more permissive rules from the ALB’s default security group.
0%B
Create a network ACL that denies inbound connections from 0.0.0.0/0 on port 80. Associate the network ACL with the VPC’s internet gateway.
0%C
Create a network ACL that allows outbound connections to the VPC IP range on port 443 only. Associate the network ACL with the VPC’s internet gateway.
0%D
Create a security group with a single inbound rule that allows connections from 0.0.0.0/0 on port 443. Ensure this security group is the only one associated with the ALB.
100%Community converges on D. Official key confirms.
15 votes · last validated recently
// explanation
D is correct because a security group is an allow-list, so associating only a group that permits inbound 443 ensures the ALB drops port 80 traffic even if an HTTP listener is mistakenly added.
contributed by
N1
@netdiver· revised by @cloud_chris// coverage · 5 domains
What this bank tests.
D112%
Incident Response26 q
D220%
Logging and Monitoring75 q
D326%
Infrastructure Security76 q
D420%
Identity and Access Management72 q
D522%
Data Protection58 q
// composition
By format & difficulty.
// by format
80%
20%
single · 245multi · 62
// by difficulty
easy
61· 20%
medium
217· 71%
hard
29· 9%
// contributors · 0 engineers
Built by people who took the exam.
Every question is contributed by someone who recently sat SCS-C02, then reviewed by an SME before landing in the bank. These are the most prolific contributors.
No contributors for this exam yet. Be the first to contribute a question.
// community questions
Questions from the community
Top-voted approved contributions for this exam, reviewed before landing in the bank.
// top community questionsview all →
// compare
One bank, or the whole platform?
this bank
$10.00· one-time
platform · subscribed
$10.00· per month
This bank
All other banks · 23+ exams
Lifetime access
All future updates included
Personal analytics + retention
Cancel anytime
—
// 0 reviews
0.0/ 5
5
0
4
0
3
0
2
0
1
0
No reviews yet. Be the first to share your experience with this question bank.
// faq
Things buyers ask before they buy.
Q.
Can I practice for free?
Free practice questions are available without payment; anyone can start practicing at no cost.
Q.
What do subscribers get?
Subscribers unlock the full practice question bank for each certification exam.
Q.
How much can I see without a subscription?
Approximately 1/2 of the question bank is accessible without a subscription.
Q.
What is the passing score?
The official passing mark for this exam is 750 (scaled score).
Q.
How long is the certification valid?
The certification is valid for 3 years. Renew by passing the current version of the exam or a higher-level certification within the same track.
Q.
What experience is recommended?
Candidates should have at least 5 years of IT security experience, with a minimum of 2 years hands-on experience securing AWS workloads.
// related
You may also like
Discover more exams based on your interests.
// ready when you are
307 questions. 92% pass rate. $10.00 once.
Lifetime access · all updates included · 30-day refund