1500 Questions | AWS Certified Security – Specialty 2026

Detailed Exam Domain CoverageBefore diving into the course details, here is the exact breakdown of the AWS Certified Security – Specialty exam blueprint that this question bank covers:Domain 1: Design Secure Apply Implementation Plans (20%)Implementing access controls using IAM roles, policies, and conditions.Validating access to AWS resources using CloudTrail and AWS CloudWatch.Analyzing security data using AWS Security Hub.Domain 2: Implement Secure Data Storage (22%)S3 bucket configuration and permissions management.AWS Key Management Service (KMS) and AWS S3 key management.Storage data in Amazon EBS volumes that are encrypted using AWS CloudHSM.Domain 3: Architect Secure Application and Resource Configurations (23%)Security configurations for AWS Lambda functions.Security considerations for AWS API Gateway REST APIs and HTTP APIs.Validating access to AWS Lambda functions using CloudTrail and AWS CloudWatch.Domain 4: Identify and Mitigate Security Threats (19%)Identifying, analyzing, and mitigating threats using AWS Security Hub and AWS Inspector.Monitoring and analyzing security-related data using AWS CloudWatch and AWS CloudTrail.Validating AWS CloudWatch and AWS CloudTrail logs for security data.Domain 5: Respond to Security Incident and Compromised Systems (16%)Analyzing and responding to security incidents using AWS Security Hub and AWS Inspector.Monitoring and analyzing security-related data using AWS CloudWatch and AWS CloudTrail.Validating AWS CloudWatch and AWS CloudTrail logs for security data.Course DescriptionPassing the AWS Certified Security - Specialty exam requires more than just memorizing AWS documentation. It demands a deep, practical understanding of how to secure complex cloud architectures, analyze granular log data, and mitigate active threats across the AWS ecosystem. I created this practice test course to bridge the gap between theoretical knowledge and exam-day reality.When I was studying for advanced AWS certifications, I found that taking highly contextual, scenario-based practice exams was the single most effective way to identify knowledge gaps. I designed this extensive bank of 1,500 original practice questions to mirror the difficulty, format, and trickery of the actual exam. Every single question comes with a comprehensive explanation that breaks down exactly why the correct answer is right, and critically, why every other option is incorrect.This course will thoroughly test your ability to configure resource-based policies, navigate KMS key architectures, secure Lambda environments, and automate incident response via Security Hub and CloudWatch. By practicing with this volume of high-quality questions, you will build the stamina and analytical skills needed to evaluate complex technical scenarios quickly and accurately.Practice Questions PreviewHere is a sample of what you will find inside the course:Question 1: You are tasked with ensuring that all Amazon EBS volumes created by your team are encrypted at rest using a specific AWS KMS Customer Managed Key (CMK). You need to enforce this with the least amount of operational overhead. Which solution is best?Options:A) Create a custom IAM policy that denies the ec2:CreateVolume action unless the ec2:Encrypted condition is true.B) Enable EBS Default Encryption at the account level for the required AWS Region and select the specific KMS CMK from the dropdown menu.C) Deploy an AWS Config managed rule to evaluate EBS volumes and trigger an AWS Systems Manager Automation document to encrypt non-compliant volumes.D) Create an AWS Lambda function triggered by AWS CloudTrail events to identify unencrypted volumes and delete them immediately.E) Modify the default AWS managed key (aws/ebs) policy to enforce strict usage by specific IAM roles.F) Store all data in Amazon S3 instead and use CloudHSM to enforce Server-Side Encryption with Customer-Provided Keys (SSE-C).Correct Answer: BOverall Explanation: The most efficient way to enforce EBS encryption across an entire account and region without managing complex IAM policies or custom automation is to enable Account-Level Default EBS Encryption.A - Incorrect: While IAM policies can enforce encryption, applying and maintaining this policy across all users and roles requires ongoing operational overhead, making it less efficient than account-level default encryption.B - Correct: Enabling EBS Default Encryption at the account level ensures every newly created volume is automatically encrypted using the specified KMS CMK, requiring zero ongoing maintenance.C - Incorrect: AWS Config is a reactive control. The volume would still be created in an unencrypted state initially before the remediation triggers, which violates strict compliance requirements.D - Incorrect: Deleting unencrypted volumes via Lambda and CloudTrail is highly disruptive, reactive, and operationally heavy compared to simply preventing their creation via default encryption.E - Incorrect: You cannot modify the key policy of an AWS managed key (aws/ebs).F - Incorrect: The requirement explicitly asks to secure Amazon EBS volumes, not to change the storage architecture entirely to S3 and CloudHSM.Question 2: An application uses AWS Lambda to process sensitive financial data. You need to ensure that the Lambda function can only access a specific Amazon S3 bucket and that this access is tightly monitored for security audits. Which combination of actions should you take?Options:A) Embed long-term IAM access keys securely inside the Lambda function's environment variables to authenticate with S3.B) Create an IAM execution role for the Lambda function with an inline policy granting s3:GetObject solely for the target bucket's ARN.C) Enable AWS CloudTrail data events specifically for the target S3 bucket to monitor object-level API activity.D) Make the S3 bucket public but restrict access using an S3 bucket policy that specifies the Lambda function's IP address.E) Both B and C.F) Both A and D.Correct Answer: EOverall Explanation: Securing Lambda access to S3 requires a combination of least-privilege IAM execution roles and enabling object-level logging through CloudTrail to satisfy strict audit requirements.A - Incorrect: You should never use long-term IAM access keys with Lambda. Lambda securely assumes an execution role to obtain temporary credentials.B - Correct (Part of E): Applying an IAM execution role to Lambda with least-privilege access restricted to the specific S3 bucket ARN is the correct way to authorize access securely.C - Correct (Part of E): CloudTrail management events do not log S3 object-level actions (like GetObject) by default. You must explicitly enable data events for the specific bucket to fulfill the security audit requirement.D - Incorrect: Lambda functions do not have static IP addresses by default unless routed through a NAT Gateway in a VPC. Making a bucket public is a severe security risk.E - Correct: This option correctly combines the secure IAM execution role (B) with the necessary CloudTrail data event logging (C).F - Incorrect: Both A and D represent poor security practices and violate AWS well-architected framework principles.Question 3: A security team is investigating a potential breach where an unauthorized IAM user was created. They need to analyze historical API calls to find out exactly who created the user and from which IP address. Which AWS service is primarily used for this task?Options:A) Amazon MacieB) AWS Secrets ManagerC) AWS CloudTrailD) AWS WAF (Web Application Firewall)E) AWS Shield AdvancedF) Amazon InspectorCorrect Answer: COverall Explanation: AWS CloudTrail is the foundational governance and auditing service in AWS, recording all control plane API calls, making it the correct tool for investigating IAM user creation.A - Incorrect: Amazon Macie is a data security service that uses machine learning to discover and protect sensitive data (like PII) in Amazon S3. It does not audit IAM API calls.B - Incorrect: AWS Secrets Manager is used to securely store, rotate, and retrieve database credentials and API keys.C - Correct: CloudTrail logs every API call made within an AWS account, including CreateUser actions in IAM, and captures the identity of the caller, the time, and the source IP address.D - Incorrect: AWS WAF protects web applications from common web exploits (like SQL injection or cross-site scripting) at the application layer. It does not track internal AWS control plane changes.E - Incorrect: AWS Shield Advanced provides managed DDoS protection for applications running on AWS.F - Incorrect: Amazon Inspector is an automated vulnerability management service that scans EC2 instances and container images for software flaws, not API activity logs.Welcome to the Mock Exams Practice Tests Academy to help you prepare for your AWS Certified Security – Specialty exam.You can retake the exams as many times as you want.This is a huge original question bank.You get support from instructors if you have questions.Each question has a detailed explanation.Mobile-compatible with the Udemy app.I hope that by now you're convinced! And there are a lot more questions inside the course.