AWS SCS-C03: Security Specialty Practice Exam

What the AWS SCS-C03 exam covers

• Detection165 questions
• Incident Response151 questions
• Infrastructure Security185 questions
• Identity and Access Management171 questions
• Data Protection177 questions
• Security Foundations and Governance93 questions

Free AWS SCS-C03 practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 942.

1. Question 1Incident Response

   Which AWS service uses ML and threat intelligence to detect malicious activity from CloudTrail, VPC Flow Logs, and DNS logs?

   • AAmazon Macie
   • BAmazon GuardDutyCorrect
   • CAmazon Inspector
   • DAWS Security Hub
   ✓ Correct answer: B

   Amazon GuardDuty continuously analyzes CloudTrail management events, VPC Flow Logs, and Route 53 DNS query logs, applying machine learning and AWS threat intelligence to surface findings like credential exfiltration or command-and-control traffic, all agentlessly with no sensors to deploy.

   Why the other options are wrong

   • AAmazon Macie uses ML to discover sensitive data in S3, but it does not analyze CloudTrail, VPC Flow Logs, or DNS logs for threats.
   • CAmazon Inspector scans EC2, containers, and Lambda for software vulnerabilities and CVEs; it is not a log-based threat detector.
   • DAWS Security Hub aggregates and prioritizes findings from services like GuardDuty; it does not perform the ML detection itself.
2. Question 2Infrastructure Security

   Administrators need shell access to EC2 instances in private subnets without opening inbound SSH, managing bastion hosts, or distributing SSH keys. What is the recommended approach?

   • ADeploy a public bastion host with a shared key pair distributed to all administrators
   • BOpen inbound port 22 to the corporate CIDR range on every private instance's security group
   • CAttach Elastic IPs to the instances and allow inbound SSH from 0.0.0.0/0 with keys
   • DUse AWS Systems Manager Session Manager with the SSM agent and least-privilege IAMCorrect
   ✓ Correct answer: D

   AWS Systems Manager Session Manager establishes an encrypted interactive shell session through the SSM agent running on the EC2 instance, using outbound HTTPS (port 443) to the SSM service endpoint - no inbound port rules are required on security groups or NACLs. Session access is controlled entirely through IAM policies, all session activity is logged to CloudTrail and optionally to S3 or CloudWatch Logs, and no SSH keys or bastion hosts need to be managed, significantly reducing operational complexity and attack surface.

   Why the other options are wrong

   • AA bastion with a shared key still requires managing a host and SSH keys, exactly what the requirement forbids.
   • BOpening port 22 to the corporate CIDR still requires inbound SSH access, which the scenario prohibits.
   • CAssigning Elastic IPs and allowing SSH from anywhere is a severe exposure and still relies on open inbound ports and keys.
3. Question 3Security Foundations and Governance

   Which CLI command attaches a Service Control Policy to an Organizations OU?

   • Aaws organizations create-account --policy-id p-abc123 --target-id ou-1111-22223333
   • Baws organizations enable-policy-type --root-id r-abcd --policy-type SERVICE_CONTROL_POLICY
   • Caws iam attach-role-policy --role-name OU --policy-arn arn:aws:iam::aws:policy/p-abc123
   • Daws organizations attach-policy --policy-id p-abc123 --target-id ou-1111-22223333Correct
   ✓ Correct answer: D

   aws organizations attach-policy attaches a policy (here an SCP, p-abc123) to a target such as an OU (--target-id ou-1111-22223333), a root, or an account, enforcing the guardrail on everything beneath it. SCPs are attached this way, not created with account or IAM role commands.

   Why the other options are wrong

   • Acreate-account provisions a new member account; it has no --policy-id or --target-id and does not attach an SCP to an OU.
   • Benable-policy-type only turns on a policy type such as SERVICE_CONTROL_POLICY for an Organizations root; it does not attach a specific SCP to an OU.
   • Ciam attach-role-policy attaches an IAM managed policy to a role, not a Service Control Policy to an Organizations OU.
4. Question 4Data ProtectionSelect all that apply

   A regulated workload requires cryptographic operations backed by FIPS 140-2 Level 3 validated, single-tenant hardware with full customer control of keys. Which TWO options meet this? (Choose TWO)

   • AA KMS custom key store backed by CloudHSM so KMS keys are stored in your HSM clusterCorrect
   • BAWS KMS with an AWS managed key backed by the default multi-tenant KMS HSMs
   • CAWS CloudHSM for dedicated, single-tenant HSMs under customer controlCorrect
   • DAmazon S3 default encryption using SSE-KMS with an AWS managed key
   ✓ Correct answer: A, C

   AWS CloudHSM provides dedicated, single-tenant HSMs that are FIPS 140-2 Level 3 validated and fully under customer control. A KMS custom key store backed by CloudHSM keeps KMS key material inside your own HSM cluster, pairing KMS APIs with single-tenant hardware.

   Why the other options are wrong

   • BAWS KMS with an AWS managed key relies on multi-tenant, AWS-controlled HSMs, so it does not give you single-tenant hardware or full customer key control.
   • DAmazon S3 default encryption with SSE-KMS using an AWS managed key uses shared, AWS-controlled infrastructure, not dedicated single-tenant HSMs you control.
5. Question 5Infrastructure Security

   A security engineer needs to audit all changes made to security groups and Network ACLs across an AWS account over the last 90 days. Which service and approach provides the most complete record?

   • AQuery AWS CloudTrail for AuthorizeSecurityGroupIngress, RevokeSecurityGroupIngress, CreateNetworkAclEntry, and DeleteNetworkAclEntry API calls in the management event historyCorrect
   • BReview VPC Flow Logs for new traffic patterns that suggest security group or NACL rules were added, inferring the changes from newly observed allowed connections
   • CUse Amazon Inspector to scan every security group and NACL and generate a compliance report covering all rule changes made across the account in the past 90 days
   • DEnable AWS Config and rely on the configuration timeline for security groups and NACLs to reveal which IAM principal made each rule change over the past 90 days
   ✓ Correct answer: A

   CloudTrail records every API call as a management event, including AuthorizeSecurityGroupIngress/Egress, the Revoke calls, and NACL mutations such as CreateNetworkAclEntry and DeleteNetworkAclEntry, each with caller identity, source IP, and time. Event History retains 90 days of management events at no extra cost, making it the authoritative audit trail.

   Why the other options are wrong

   • BFlow Logs show traffic flows, not configuration changes; you cannot tell from them which rule was added or who added it, only that traffic was allowed or denied.
   • CAmazon Inspector scans the current state for vulnerabilities and misconfigurations; it does not provide a historical audit of rule changes over time.
   • DAWS Config timelines show how a resource's configuration changed, but they do not record the IAM principal or API call behind each change; CloudTrail supplies that caller identity.
6. Question 6Detection

   A security engineer needs CloudTrail to detect changes to its own configuration, such as someone calling StopLogging or UpdateTrail, and store proof that the log files were not altered. Which CloudTrail feature provides cryptographic assurance that delivered log files are intact?

   • ACloudTrail log file integrity validation, which produces signed digest filesCorrect
   • BS3 bucket versioning on the destination bucket, retaining prior copies of each object
   • CSSE-S3 server-side encryption applied to the objects in the destination log bucket
   • DCloudTrail Insights events, which surface unusual API call rate activity
   ✓ Correct answer: A

   When integrity validation is enabled, CloudTrail delivers hourly digest files containing SHA-256 hashes of each log file plus a digital signature using a private key, so any tampering can be detected with the validate-logs command. This is the purpose-built mechanism for proving log file integrity.

   Why the other options are wrong

   • BVersioning preserves previous object copies but provides no cryptographic proof that a delivered log file was not altered after delivery.
   • CSSE-S3 encrypts objects at rest but does not produce any signed evidence that log files remain unmodified over time.
   • DInsights detects unusual API activity patterns and does not validate the integrity of the delivered log files.
7. Question 7Identity and Access ManagementSelect all that apply

   A security engineer wants to detect and remediate IAM access keys that have been publicly exposed and overly permissive policies. Which TWO AWS capabilities directly help? (Choose TWO)

   • AIAM Access Analyzer unused access findings to flag stale credentials and permissionsCorrect
   • BAWS automatically applying the AWSCompromisedKeyQuarantine policy when a key is found exposed publiclyCorrect
   • CAmazon Macie automatically scanning IAM policy JSON documents to flag wildcard Action statements
   • DAWS Shield Advanced continuously inspecting sts:AssumeRole API call traffic for behavioral anomalies
   ✓ Correct answer: A, B

   IAM Access Analyzer's unused-access analyzer surfaces stale access keys, unused roles, and excess permissions so you can right-size overly permissive identities. Separately, when AWS finds an access key exposed publicly it automatically attaches the AWSCompromisedKeyQuarantine policy to cap the blast radius while you rotate it.

   Why the other options are wrong

   • CAmazon Macie discovers and classifies sensitive data in S3; it does not parse IAM policy JSON for wildcard actions.
   • DAWS Shield Advanced defends against DDoS attacks and does not inspect sts:AssumeRole calls for anomalies.
8. Question 8Security Foundations and Governance

   A security architect wants to apply a permission guardrail that blocks all member accounts in an OU from deleting or modifying a specific set of CloudWatch alarms used for compliance monitoring, while still allowing normal operations. Which mechanism fits best?

   • AA Service Control Policy denying the specific CloudWatch alarm-modification actions, conditioned on the protected resourcesCorrect
   • BAn IAM permissions boundary attached to the management account root user to block alarm-modification actions org-wide
   • CA resource-based policy applied to the CloudWatch service that denies deletion of the compliance-monitoring alarms
   • DAn AWS Config remediation action that automatically recreates any compliance alarm after it is deleted or modified
   ✓ Correct answer: A

   SCPs set the maximum available permissions for accounts in an OU. A targeted Deny on actions like cloudwatch:DeleteAlarms (optionally scoped by condition to the protected alarms) prevents any principal in those accounts from removing the compliance alarms while leaving other operations intact.

   Why the other options are wrong

   • BPermissions boundaries cannot be attached to the root user and do not apply org-wide, so they cannot enforce this guardrail across the OU.
   • CCloudWatch alarms do not support resource-based policies, so this control cannot be applied to protect them.
   • DA Config remediation only reacts after a change occurs rather than preventively blocking the alarm-modification actions as required.
9. Question 9Infrastructure Security

   A company wants all VPCs in its organization to send DNS queries through a centralized inspection point so DNS Firewall rules and query logging are enforced consistently, and they want to manage the rule groups from a single account. Which approach is the BEST fit?

   • ACreate Route 53 Resolver DNS Firewall rule groups once and share them across accounts with AWS Resource Access Manager (RAM), associating them with each VPC.Correct
   • BPush /etc/hosts entries to every instance pointing to a central DNS appliance VPC, and update the file everywhere when rules change centrally.
   • CRoute all DNS traffic through a shared NAT gateway subnet so a single choke point can enforce the organization's DNS Firewall rule groups.
   • DDisable VPC DNS resolution across all accounts and require applications to connect to services by static IP address to avoid DNS lookups.
   ✓ Correct answer: A

   Sharing rule groups through RAM lets one account author and maintain domain rule groups, while member accounts associate them with their VPCs. Combined with Resolver query logging, this gives organization-wide, centrally managed DNS filtering without per-account rule duplication.

   Why the other options are wrong

   • BManaging per-instance host files does not use DNS Firewall or query logging and is unmanageable at organization scale.
   • CA NAT gateway routes IP traffic and cannot enforce DNS Firewall rule groups, which operate on Resolver queries, not routing.
   • DDisabling DNS resolution breaks name-based services and forfeits DNS Firewall inspection and logging entirely.
10. Question 10Data ProtectionSelect all that apply

    A platform team is implementing envelope encryption and weighing GenerateDataKey versus GenerateDataKeyWithoutPlaintext. Which statements are correct? (Choose two.)

    • AGenerateDataKey returns both a plaintext data key (for immediate local encryption) and an encrypted copy of that data keyCorrect
    • BGenerateDataKeyWithoutPlaintext returns only the encrypted data key, so the plaintext is obtained later via Decrypt only when encryption is actually performedCorrect
    • CGenerateDataKeyWithoutPlaintext eliminates any future need to call Decrypt because the returned key can be used to decrypt data directly
    • DGenerateDataKey is the only data-key operation that works with customer-managed keys, since the WithoutPlaintext variant supports AWS managed keys only
    ✓ Correct answer: A, B

    GenerateDataKey returns a plaintext data key for immediate local encryption plus an encrypted copy to store. GenerateDataKeyWithoutPlaintext returns only the encrypted form for systems that provision keys ahead of use; the plaintext is recovered later via Decrypt. Both operations work with customer-managed keys.

    Why the other options are wrong

    • CDecrypt is still required later to turn the encrypted data key back into usable plaintext.
    • DBoth data-key operations work with customer-managed keys, so GenerateDataKey is not the only option.

Who this AWS SCS-C03 practice exam is for

This practice set is for anyone preparing for the AWS SCS-C03: Security Specialty exam at the advanced level - from first-time candidates building a foundation to experienced AWS practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this AWS SCS-C03 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real AWS SCS-C03 exam.

Related AWS resources

• AWS SCS-C03 study guideKey concepts
• AWS practice examsAll AWS
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• AWS Certified AI Practitioner (AIF-C01) practice examRelated
• AWS Certified CloudOps Engineer - Associate (SOA-C03) practice examRelated
• AWS Certified Data Engineer - Associate (DEA-C01) practice examRelated

AWS SCS-C03 practice exam FAQ