AWS SCS-C03: Security Specialty Practice Exam

What the AWS SCS-C03 exam covers

• Detection161 questions
• Incident Response147 questions
• Infrastructure Security180 questions
• Identity and Access Management166 questions
• Data Protection172 questions
• Security Foundations and Governance91 questions

Free AWS SCS-C03 sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 917.

1. Question 1Incident Response

   Which AWS service uses ML and threat intelligence to detect malicious activity from CloudTrail, VPC Flow Logs, and DNS logs?

   • AAWS CodeBuild
   • BAmazon GuardDutyCorrect
   • CAmazon SQS
   • DAmazon Athena
   ✓ Correct answer: B

   Amazon GuardDuty uses machine learning and AWS threat intelligence to automatically detect malicious activity by analyzing CloudTrail management events, VPC Flow Logs, and Route 53 DNS query logs. This agentless detection service identifies threats such as credential exfiltration, unauthorized API calls, and instances communicating with malicious IPs. GuardDuty provides actionable findings that integrate with Security Hub for centralized visibility and automated response workflows. By leveraging behavioral analysis and threat intelligence, GuardDuty detects threats with minimal operational overhead.

   Why the other options are wrong

   • AAWS CodeBuild is incorrect because AWS CodeBuild is a CI/CD build service, not a threat detection service
   • CAmazon SQS is incorrect because Amazon SQS is a message queue service, not a threat detection service
   • DAmazon Athena is incorrect because Amazon Athena is a query service, not a real-time threat detection service
2. Question 2Infrastructure Security

   A SaaS provider wants customers to privately consume the provider's application from the customers' own VPCs without VPC peering or exposing the service to the internet. Which service supports this design?

   • AAWS Transit Gateway shared publicly with all customers
   • BAWS PrivateLink with a VPC endpoint service backed by a Network Load BalancerCorrect
   • CVPC peering between the provider and every customer VPC
   • DA public Application Load Balancer with security group restrictions
   ✓ Correct answer: B

   AWS PrivateLink lets a SaaS provider expose a service through a VPC endpoint service, which is fronted by a Network Load Balancer in the provider's VPC. Customers create an Interface VPC endpoint in their own VPC that points to the provider's endpoint service. Traffic flows entirely over the AWS private network - no VPC peering is required, the provider's VPC CIDR is never exposed, and the service is never accessible from the public internet, making it the recommended pattern for private multi-tenant SaaS connectivity.

   Why the other options are wrong

   • AAWS Transit Gateway shared publicly with all customers would require full network connectivity between provider and customer VPCs, expose routing to all connected parties, and create a complex routing topology that defeats the privacy goal.
   • CVPC peering between the provider and every customer VPC requires managing a mesh of peering connections that does not scale to many customers, exposes full VPC CIDR blocks on both sides, and may hit VPC peering limits.
   • DA public Application Load Balancer with security group restrictions still places the service on the public internet, requiring the provider to manage IP allow-lists and exposing the endpoint to internet-based threats.
3. Question 3Security Foundations and Governance

   Which service continuously evaluates resource configs against rules for compliance?

   • AAWS CodeBuild
   • BAmazon CloudFront
   • CAWS ConfigCorrect
   • DAmazon SQS
   ✓ Correct answer: C

   This security service provides essential capabilities for protecting sensitive data in AWS environments. The solution involves multiple layers of controls including encryption, access management, and monitoring. Proper implementation requires understanding both the technical capabilities and the compliance requirements driving the design. The service integrates with other AWS security services to provide comprehensive protection. Organizations should evaluate their specific compliance requirements and threat model when selecting between available options.

   Why the other options are wrong

   • AAWS CodeBuild is incorrect because it does not provide the specific technical capability required to solve this security scenario.
   • BAmazon CloudFront is incorrect because it does not provide the specific technical capability required to solve this security scenario.
   • DAmazon SQS is incorrect because it does not provide the specific technical capability required to solve this security scenario.
4. Question 4Incident ResponseSelect all that apply

   An incident responder must capture forensic evidence from a suspected-compromised EC2 instance while preserving chain of custody. Which TWO actions are appropriate? (Choose TWO)

   • ADetach the volumes and immediately reformat them
   • BAcquire a memory dump before stopping the instance, since stopping clears volatile RAMCorrect
   • CReboot the instance several times to reproduce the issue
   • DCreate EBS snapshots of the volumes and copy them to an isolated forensics account with restricted accessCorrect
   ✓ Correct answer: B, D

   Create EBS snapshots of the volumes and copy them to an isolated forensics account with restricted access. This security service provides essential capabilities for protecting sensitive data in AWS environments. The solution involves multiple layers of controls including encryption, access management, and monitoring. Proper implementation requires understanding both the technical capabilities and the compliance requirements driving the design. The service integrates with other AWS security services to provide comprehensive protection. Organizations should evaluate their specific compliance requirements and threat model when selecting between available options.

   Why the other options are wrong

   • ADetach the volumes and immediately reformat them is incorrect because it does not provide the specific technical capability required to solve this security scenario.
   • CReboot the instance several times to reproduce the issue is incorrect because it does not provide the specific technical capability required to solve this security scenario.
5. Question 5Infrastructure Security

   A Network ACL rule 100 allows inbound TCP on port 443 from 0.0.0.0/0. Rule 200 denies inbound TCP on port 443 from 198.51.100.50/32. Which of the following correctly describes the result for a request from 198.51.100.50?

   • AThe request is allowed because rule 100 (lower number) matches first and NACLs process rules in ascending orderCorrect
   • BThe request is denied because the more specific rule 200 takes precedence over the broader rule 100
   • CThe request is allowed because ALLOW rules always override DENY rules in NACLs
   • DThe result depends on whether the security group also allows the traffic
   ✓ Correct answer: A

   Network ACLs evaluate rules in ascending numeric order and stop at the first matching rule. Rule 100 (ALLOW) matches traffic from 198.51.100.50 on port 443 before rule 200 is ever evaluated. The deny in rule 200 is never reached. To block a specific IP you must place the DENY rule at a lower number than the broader ALLOW - for example, rule 90 DENY for 198.51.100.50/32, then rule 100 ALLOW for 0.0.0.0/0.

   Why the other options are wrong

   • BNACLs do not use specificity to determine precedence - they use rule number order. More specific rules do not automatically take priority; rule numbering determines evaluation order.
   • CNACLs do not have an 'ALLOW overrides DENY' behavior - the first matching rule wins regardless of whether it is an ALLOW or DENY.
   • DSecurity groups are evaluated only after a NACL allows the traffic - but in this case the NACL itself allows the request at rule 100, so security groups would then apply; however, the question asks about the NACL result, which is ALLOW.
6. Question 6Incident Response

   A GuardDuty finding of type PenTest:IAMUser/KaliLinux is generated. What does this finding indicate, and what is an appropriate first response?

   • AAPI calls were made using credentials from a host running Kali Linux; verify whether sanctioned testing is occurring before treating it as maliciousCorrect
   • BAn EC2 instance in the account is running the Kali Linux distribution and must be terminated immediately to remove the threat
   • CGuardDuty detected malware on an attached EBS volume and automatically quarantined the affected instance for you
   • DAn S3 bucket policy was modified to allow public access from a penetration-testing tool and should be reverted at once
   ✓ Correct answer: A

   This finding indicates AWS API activity originating from a host identified as Kali Linux, a common penetration-testing distribution. Because authorized red-team testing can trigger it, the right first step is to verify with the testing team and, if approved, suppress via a filter or trusted-IP list rather than assuming compromise.

   Why the other options are wrong

   • BThe finding is about API calls from a Kali Linux host, not about an EC2 instance running Kali, so terminating an instance is not the indicated response.
   • CThis is a penetration-testing indicator based on the calling host, not an EBS malware detection or quarantine event.
   • DThe finding relates to API calls from a pen-testing distribution, not to an S3 bucket policy change granting public access.
7. Question 7Infrastructure Security

   An EC2 instance in a public subnet must serve a website on TCP 443 to the internet, but the security team wants to ensure it cannot initiate any outbound connections except DNS and HTTPS to a specific update repository. Because security groups are stateful, which configuration meets this requirement?

   • AAdd explicit outbound (egress) rules to the security group allowing only TCP 443 to the repository CIDR and TCP/UDP 53 to the DNS resolver, and remove the default allow-all egress ruleCorrect
   • BRely solely on the inbound rule that allows TCP 443, assuming that stateful return traffic will by itself satisfy every outbound connection need the instance has
   • CAdd a Network ACL outbound DENY rule covering all ports and expect the stateful security group to keep permitting only the required outbound allows
   • DEnable IMDSv2 on the instance, expecting the metadata token requirement to constrain the instance's outbound traffic to only the approved destinations
   ✓ Correct answer: A

   By default a security group permits all outbound traffic; to restrict instance-initiated connections you must remove that rule and add narrowly scoped egress rules. Statefulness only auto-allows return traffic for connections that match inbound rules, so deliberate outbound (instance-initiated) flows still require explicit egress rules.

   Why the other options are wrong

   • BStateful return traffic only covers responses to inbound connections and does not permit the instance to initiate new outbound connections for updates.
   • CA NACL outbound deny-all would block the return traffic for the inbound HTTPS server too, and it does not selectively allow the required egress.
   • DIMDSv2 hardens access to instance metadata and has no effect on which external destinations the instance may connect to.
8. Question 8Data ProtectionSelect all that apply

   A security team is hardening encryption in transit across multiple AWS services. Which TWO actions correctly enforce or verify TLS for the named services? (Choose TWO)

   • AConfigure an Application Load Balancer HTTPS listener with a modern TLS security policy and an ACM certificateCorrect
   • BMount Amazon EFS with the TLS option using the EFS mount helper to encrypt traffic to the file systemCorrect
   • CEnable S3 default encryption to encrypt data while it travels over the network
   • DTurn on EBS encryption to protect data sent between the client and an S3 bucket
   ✓ Correct answer: A, B

   An ALB HTTPS listener terminates TLS using an ACM certificate and a chosen security policy, protecting client-to-load-balancer traffic. The EFS mount helper with the tls option establishes a stunnel-based TLS tunnel so NFS traffic between clients and EFS is encrypted in transit.

   Why the other options are wrong

   • CS3 default encryption protects data at rest, not data in transit; transit is protected by HTTPS/TLS to the endpoint.
   • DEBS encryption protects volume data at rest and has nothing to do with client-to-S3 network traffic.
9. Question 9Infrastructure Security

   A company exposes an internal SaaS application to specific customer VPCs using AWS PrivateLink. A security review asks how to ensure that only approved customer AWS accounts can create interface endpoints to the service and that customers cannot discover the provider's underlying private IP addresses. Which combination of controls is correct?

   • AAdd the approved account principals to the endpoint service allow list (and require acceptance), and rely on PrivateLink so consumers only see ENIs in their own VPC, never the provider's IPs.Correct
   • BPeer the provider VPC with each approved customer VPC and use route tables to limit reachability, exposing only the service subnet's private IP range to consumers.
   • CPublish the service through an internet-facing Application Load Balancer protected by a security group that references each approved customer's public CIDR ranges.
   • DShare the provider's service subnets with the approved customers using AWS Resource Access Manager so only those accounts can create endpoints into them.
   ✓ Correct answer: A

   Configuring allowed principals on the endpoint service plus requiring manual acceptance ensures only approved accounts can connect. With PrivateLink, the consumer's traffic enters through an interface endpoint ENI in the consumer VPC and is NATed to the provider's NLB, so customers never see provider private IPs and there is no route-level coupling between VPCs.

   Why the other options are wrong

   • BVPC peering exposes the provider's private IP space to consumers and does not enforce an account allow list, failing both requirements.
   • CAn internet-facing ALB places the service on the public internet and reveals its endpoint, which contradicts keeping the provider's IPs hidden.
   • DSharing subnets via RAM lets consumers place resources into the provider's subnets rather than privately consuming the service, which is not the PrivateLink model.
10. Question 10Data Protection

    An application in Account A must call kms:Decrypt on a customer-managed KMS key that lives in Account B. The key policy in Account B already contains a statement allowing the root principal of Account A. Despite this, the application's IAM role in Account A receives an AccessDenied error. Assuming no SCP or VPC endpoint policy is involved, what is the MOST likely cause?

    • AThe IAM role in Account A has no IAM policy that allows kms:Decrypt on the Account B key ARNCorrect
    • BCross-account KMS access additionally requires a grant created by Account A
    • CThe key policy must name the specific IAM role ARN; allowing the Account A root principal is ignored for cross-account access
    • DCross-account decryption is only possible if the key is a multi-Region key
    ✓ Correct answer: A

    When a key policy delegates to the root of another account, that delegation only enables IAM in that other account to grant access; it does not by itself authorize any principal. The role in Account A must still have an identity-based policy permitting kms:Decrypt on the key's ARN. Both sides must allow the call.

    Why the other options are wrong

    • BGrants are an optional authorization mechanism, not a mandatory requirement for cross-account use.
    • CAllowing the account root principal in the key policy is a valid and common pattern; it does not require naming the exact role.
    • DSingle-Region customer-managed keys support cross-account use; multi-Region is unrelated to this requirement.

Related AWS resources

• AWS SCS-C03 study guideKey concepts
• AWS practice examsAll AWS
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• AWS Certified AI Practitioner (AIF-C01) practice examRelated
• AWS CLF-C02 practice examRelated
• AWS Certified Data Engineer - Associate (DEA-C01) practice examRelated

AWS SCS-C03 practice exam FAQ