How many Select Two (Multi-Select) Questions questions are on this page?

This page has 20 Select Two (Multi-Select) Questions scenario questions for the SCS-C02 exam, each with detailed explanations and wrong-answer analysis.

How should I approach SCS-C02 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to AWS Certified Security Specialty SCS-C02 questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise AWS Certified Security Specialty SCS-C02 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

SCS-C02

exam code

Amazon Web Services

vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmulti select

Full question →

A company is migrating a legacy application to AWS. The application requires two-way communication between the web servers and the database servers using TCP port 3306. The security team wants to follow the principle of least privilege. Which TWO actions should be taken to secure the traffic?

A
Create a security group for the web servers that allows outbound traffic on port 3306 to the database security group.
Security groups are stateful and will allow return traffic automatically.
B
Create a security group for the database servers that allows inbound traffic on port 3306 from the web subnet CIDR.
Why wrong: Using the web security group ID as source is more dynamic and secure than IP CIDR.
C
Place the database servers in a public subnet for easier connectivity.
Why wrong: Databases should be in private subnets, not exposed to the internet.
D
Configure the network ACL for the database subnet to allow inbound traffic on port 3306 from the web subnet CIDR.
Why wrong: NACLs are stateless and require explicit outbound rules; security groups are simpler and stateful.
E
Create a security group for the database servers that allows inbound traffic on port 3306 from the web security group ID.
This ensures only instances in the web security group can connect.

Select Two (Multi-Select) Questions

How to approach select two (multi-select) questions

Quick answer

Related SCS-C02 topic practice pages

Threat Detection and Incident Response practice questions

Security Logging and Monitoring practice questions

Identity and Access Management practice questions

Management and Security Governance practice questions

Infrastructure Security practice questions

Data Protection practice questions

SCS-C02 fundamentals practice questions

SCS-C02 scenario practice questions

SCS-C02 troubleshooting practice questions

Practice scenarios

A company is migrating a legacy application to AWS. The application requires two-way communication between the web servers and the database servers using TCP port 3306. The security team wants to follow the principle of least privilege. Which TWO actions should be taken to secure the traffic?

A security administrator is designing a cross-account access strategy. The administrator needs to allow users in Account A to assume an IAM role in Account B to access an S3 bucket. Which TWO of the following statements are true regarding this configuration?

Which TWO of the following are valid methods to centrally manage security policies and enforce compliance across multiple AWS accounts? (Choose two.)

A company uses AWS Config to record resources. Which TWO actions can be taken to automatically remediate non-compliant resources detected by AWS Config rules?

A company wants to implement least privilege access for a data analytics team that uses Amazon Athena to query data in S3. Which THREE steps should be taken?

A security engineer is designing a VPC with public and private subnets. The application servers in the private subnets need to access the internet for software updates, but must not be directly reachable from the internet. Which TWO actions satisfy these requirements?

A company wants to enforce encryption in transit for all data transferred between its Amazon EC2 instances and an Application Load Balancer (ALB). The company uses AWS Certificate Manager (ACM) to provision TLS certificates. Which TWO actions should the company take? (Choose TWO.)

Which TWO actions can be performed using AWS IAM? (Choose two.)

Which TWO steps should a security engineer take when responding to a confirmed security incident involving a compromised EC2 instance? (Choose 2.)

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all API calls in the organization are logged and retained for at least one year. Which AWS services or features should be used to meet these requirements? (Choose TWO.)

A security engineer is investigating a potential data exfiltration incident. The engineer notices large volumes of data being transferred from an Amazon S3 bucket to an external IP address. Which AWS services can be used to detect and alert on such behavior? (Choose THREE.)

A company uses AWS Systems Manager Patch Manager to patch EC2 instances. During a security incident, the security team needs to quickly patch a critical vulnerability across all Windows instances in a specific AWS region. Which steps should the team take? (Choose TWO.)

A company wants to use AWS CloudTrail to monitor data events for all S3 buckets. Which THREE steps are necessary? (Choose THREE.)

Which TWO AWS services provide native integration with Amazon CloudWatch Logs for real-time monitoring of application logs? (Choose TWO.)

A security engineer needs to capture all network traffic between EC2 instances in a VPC for forensic analysis. Which TWO services should be used together? (Choose TWO.)

A security engineer needs to monitor cross-account access to resources. Which THREE AWS services can be used to log or detect such access? (Choose THREE.)

Which THREE factors should be considered when designing IAM policies for cross-account access? (Choose three.)