Yes. All questions and features are available at no cost. You only need to create an account.

Are the questions identical to the real exam?

Our questions simulate the format and difficulty of official exams, but they are not leaked actual questions.

Can I practice without a time limit?

Yes. Practice mode has no timer and shows the correct answer instantly.

Are my results saved?

Yes. All your attempts are saved to your profile with detailed statistics.

AWSSpecialty100% Free

AWS Certified Security – Specialty

SCS-C02

Advanced security, encryption, identity management, and incident response on AWS.

—

Exam questions

—

Time limit

—

Passing score

Specialty

Level

Exam Instructions

•Each question can have one or multiple correct answers. Multi-answer questions will indicate this clearly.
•In exam mode, you have X minutes to complete all questions. The timer starts automatically.
•In practice mode, there is no time limit and you can view the explanation for each answer.
•In marathon mode, all questions in the bank are used, with no time limit and explanations for every question.
•You can flag questions for review and navigate freely between them.

Exam topics & domains

Threat detection & incident response (GuardDuty, Detective)
Security logging & monitoring (CloudTrail, Security Hub)
Infrastructure security (VPC, WAF, Shield)
Identity & access management (IAM, SCP, SSO)

🎧 Audio FlashcardsAI Neural Voice

Exam Audio Pills (SCS-C02)

2-minute high-yield audio summaries reviewing classic exam traps and golden rules for AWS Certified Security – Specialty.

Full Audio Prep Library →

Cryptographic Key Authorization & Access

KMS Key Policies vs. IAM Policies & Root Delegation

Master the cryptographic permission hierarchy between KMS Key Policies, root delegation, and cross-account authorization.

0:000:00

💡

Exam Golden Rule:

Key Policy is MANDATORY on KMS keys. IAM policies alone have ZERO effect unless the Key Policy contains a statement delegating authority to the account root ('Principal': {'AWS': 'arn:aws:iam::<acct>:root'}). For cross-account access, BOTH the Key Policy and the external IAM policy must grant permissions.