Practice questions · Cybersecurity
AWS Certified Security - Specialty (SCS-C03): Practice Questions
Original, syllabus-based practice questions for AWS Certified Security - Specialty (SCS-C03). Each answer is explained, including why the other options are wrong. Filter by domain or difficulty. These are concept and scenario checks written to test understanding - not reproductions of live exam content.
Answered 0 · Correct 0
-
An IAM user's identity-based policy allows s3:GetObject on a bucket, but the bucket policy contains an explicit deny for that user. What is the result?
Correct answer: B. An explicit deny in any applicable policy always wins over every allow, no matter where the allow is stated. Identity-based policies have no precedence over resource-based policies, policy attachment order is irrelevant to evaluation, and time-of-day conditions apply only if a policy actually defines them. -
What does a service control policy (SCP) in AWS Organizations actually do?
Correct answer: D. An SCP is a guardrail: it bounds what identities in member accounts can ever do, but it never grants access by itself - an IAM policy must still allow the action. It does not replace IAM policies, it grants nothing to administrators, and it has nothing to do with traffic encryption. -
A security team wants to cap the permissions a specific IAM role can ever have, without changing AWS Organizations settings. Which feature fits?
Correct answer: A. A permissions boundary caps the maximum permissions an identity can have: effective access is the intersection of the boundary and the role's policies. An SCP operates at the account or OU level through Organizations, a session policy only narrows one temporary session rather than capping the role itself, and resource-based policies control individual resources, not the identity's ceiling. -
A third-party vendor needs to assume a role in your account. Which element protects against the confused deputy problem in this cross-account setup?
Correct answer: C. An external ID is a shared secret the vendor must present when assuming the role, ensuring requests genuinely originate from your customer relationship and cannot be relayed on behalf of another party. Password policies and root MFA protect different credentials entirely, and a longer session duration increases rather than reduces exposure. -
An application on an EC2 instance needs to read from an S3 bucket. What is the recommended way to give it access?
Correct answer: B. An instance role delivers automatically rotated temporary credentials through the instance profile, so no long-lived secrets ever sit on the machine. Hard-coded IAM user keys are static credentials that can be stolen, root keys should never exist for workloads, and a public bucket with an obscure name is not access control at all. -
Your organization wants an S3 bucket to be readable only by principals from accounts inside its AWS Organization. Which condition key achieves this cleanly?
Correct answer: A. The aws:PrincipalOrgID condition key matches the organization ID of the calling principal, so a single bucket-policy statement covers every current and future account in the organization. aws:SourceIp restricts by network origin and breaks as networks change, aws:RequestedRegion constrains call destinations, and the server-side-encryption key governs object encryption, not who may read. -
An administrator's identity-based policy allows ec2:TerminateInstances, but the SCP on the account's OU does not include that action in any Allow statement. What happens when they try?
Correct answer: D. Effective permissions are the intersection of the SCP and IAM policies: if the SCP's allow-list omits an action, no identity in that account can use it, whatever their IAM policies say. Identity policies never override SCPs, there is no approval queue in IAM evaluation, and Security Hub reports findings rather than intercepting API calls. -
A company with many AWS accounts wants employees to sign in once with short-lived credentials to access all of them. Which service is built for this?
Correct answer: C. IAM Identity Center provides workforce single sign-on across a multi-account organization, issuing short-lived credentials mapped to permission sets. Cognito user pools authenticate customers of your own applications, AWS Artifact serves compliance reports, and Systems Manager Inventory catalogs installed software - none of them signs your workforce into accounts. -
A company wants engineers to log in to AWS with their existing corporate identity provider and stop creating IAM users entirely. What is the standard pattern?
Correct answer: B. Federation trusts the corporate IdP: users authenticate there and receive temporary role credentials in AWS, so no IAM users or long-term secrets exist per engineer. Password syncing recreates the credential-sprawl problem, a shared IAM user destroys accountability, and vaulted long-term keys remain long-term keys with all their exposure risk. -
Which statement correctly contrasts security groups and network ACLs?
Correct answer: A. Security groups attach at the instance level, keep connection state so return traffic is automatically allowed, and only express allow rules. Network ACLs sit at subnet boundaries, are stateless with numbered allow and deny rules, and must permit both directions. The other options invert the levels or the rule capabilities. -
You must block traffic from one specific IPv4 address to every instance in a subnet. Which control does this directly?
Correct answer: C. Network ACLs support explicit deny rules and apply to everything in the subnet, so a single numbered deny entry blocks the address. Security groups cannot express deny rules at all, VPC Flow Logs only record traffic metadata rather than blocking anything, and an S3 bucket policy governs bucket access, not subnet traffic. -
A team wants interactive shell access to EC2 instances with no inbound ports open, no bastion host, and full session auditing. Which approach delivers this?
Correct answer: D. Session Manager tunnels shell sessions through the SSM agent over outbound HTTPS, so no inbound port, bastion host, or SSH key is needed, and sessions can be logged for audit. A bastion or an open port 22 still means inbound SSH exposure, and a VPN with local SSH keys on laptops keeps unaudited key sprawl alive. -
Which measure prevents a server-side request forgery in a web app from harvesting the EC2 instance's role credentials via the metadata service?
Correct answer: B. IMDSv2 requires a session token that typical request-forgery payloads relayed through a web application cannot obtain, which protects the credentials endpoint. Termination protection, EBS encryption and dedicated tenancy are unrelated to metadata access - they address accidental deletion, data at rest and hardware isolation. -
Private-subnet workloads must reach S3 without their traffic leaving the AWS network, and access must be restricted to specific buckets. What fits?
Correct answer: A. A gateway endpoint routes S3 traffic privately inside the AWS network, and its endpoint policy can limit which buckets and actions are reachable. A NAT gateway sends traffic out through the public internet path, public IPs expose the instances themselves, and a VPN to the corporate site does not create a private path to S3. -
A security team needs centralized egress filtering for many VPCs, including blocking outbound traffic by domain name and applying intrusion-prevention signatures. Which service matches?
Correct answer: C. AWS Network Firewall provides managed stateful inspection with domain-based filtering and IPS-style signatures, and a central inspection VPC lets many VPCs share it. Security groups and network ACLs match only IPs, ports and protocols with no domain or signature awareness, and Shield Advanced defends against DDoS rather than filtering egress. -
Which layer of traffic does AWS WAF inspect, and for what kind of threats?
Correct answer: B. AWS WAF evaluates web requests at the application layer, applying rules that match injection patterns, bad bots, rate abuse and similar request-level threats. Volumetric layer 3 and 4 floods are Shield's territory, and AWS exposes no customer controls at layer 2 or the physical layer. -
What does AWS Shield Advanced add beyond the protection every AWS customer already receives?
Correct answer: D. Shield Standard already gives everyone baseline defense against common network-level DDoS events; Advanced layers on financial safeguards for attack-driven scaling, richer visibility and the Shield Response Team. It does not replace security groups, vulnerability scanning is Inspector's job, and traffic encryption is unrelated to DDoS protection. -
In envelope encryption, what is the role of the KMS key?
Correct answer: C. Envelope encryption performs bulk encryption locally with a data key, then protects that data key by encrypting it under the KMS key - combining fast symmetric crypto with centralized key control. The KMS key does not encrypt data blocks directly at scale, data keys are essential rather than replaced, and signing is a separate capability. -
A compliance team must see exactly which principal used the encryption key for each S3 object access. Which encryption mode supports this?
Correct answer: A. With SSE-KMS every decrypt uses the KMS key and is recorded in CloudTrail with the calling principal, giving the audit trail compliance wants; a customer managed key adds a controllable key policy. SSE-S3 leaves no per-principal key-usage trail because AWS manages its keys invisibly, SSE-C pushes key handling onto every caller with no central audit point, and dropping encryption fails the requirement outright. -
Which statement about KMS key policies is accurate?
Correct answer: B. Every KMS key has exactly one key policy, and it is the root of authorization for that key: unless the key policy grants access or delegates to IAM, identity policies cannot open the key up. Key policies are mandatory rather than optional, identity policies work only in combination with that delegation, and the policy governs its own key wherever the caller sits. -
An application must let a service use a specific KMS key temporarily and programmatically, without editing the key policy or IAM policies. Which mechanism is designed for this?
Correct answer: D. Grants are the programmatic delegation mechanism in KMS: they confer specific operations on a key to a grantee principal and are retired when no longer needed, exactly for workflows where policies are too static. Key material never leaves KMS unencrypted, permanent administrator access is the opposite of temporary, and rotation settings have nothing to do with authorization. -
Data encrypted in one Region must be decryptable in a second Region for disaster recovery, without exporting key material. What supports this?
Correct answer: A. Multi-Region keys are purpose-built for this: the primary and replica share interoperable material managed inside KMS, so ciphertext created in one Region decrypts in the other. AWS managed keys are Region-bound rather than global, a key ID grants nothing by itself, and bulk decrypt-and-re-encrypt pipelines add cost, risk and delay that replication avoids. -
Why might an organization import its own key material into KMS instead of letting KMS generate it?
Correct answer: C. Importing key material keeps its origin with the organization: they can set expiry, delete the material immediately, and satisfy policies that demand externally generated keys. It changes governance rather than performance, KMS-generated symmetric keys do support rotation, and imported material is more restricted across Regions, not automatically shared. -
A team needs database credentials stored encrypted, with automatic rotation handled by the storing service itself. Which choice is the direct fit?
Correct answer: B. Secrets Manager stores secrets encrypted and natively rotates credentials for supported databases on a schedule. Parameter Store SecureString encrypts values but has no built-in rotation engine, an S3 spreadsheet is storage with none of the secret lifecycle, and baking credentials into the AMI freezes them into every instance launched from it. -
Which service discovers and classifies sensitive data such as personal information stored in S3 buckets?
Correct answer: D. Macie applies machine learning and pattern matching to find and classify sensitive data such as PII across S3, and reports where it is exposed. Inspector scans compute resources for software vulnerabilities, Config records resource configuration history against rules, and Shield defends against DDoS - none of them examines object contents for sensitive data. -
Which service continuously analyzes sources like CloudTrail events, VPC Flow Logs and DNS query logs to flag malicious activity in an account?
Correct answer: A. GuardDuty is the managed threat-detection service: it ingests CloudTrail, VPC Flow Logs, DNS logs and other sources, and raises findings for suspicious behavior such as credential misuse or unusual API activity. Certificate Manager issues TLS certificates, CloudFront is a content delivery network, and Batch schedules compute jobs. -
A security lead wants findings from multiple AWS services and partner tools in one place, checked against common security standards. Which service does this?
Correct answer: C. Security Hub aggregates findings from GuardDuty, Inspector, Macie and partner products, normalizes them, and scores accounts against security standards. Detective investigates root causes rather than aggregating, CloudTrail records API activity, and EventBridge routes events between services without any security scoring of its own. -
After a GuardDuty finding, an analyst needs to walk back through weeks of activity to understand the root cause and scope. Which service is purpose-built for that investigation?
Correct answer: D. Detective builds a behavior graph from CloudTrail, VPC Flow Logs and GuardDuty data so analysts can pivot across entities and time to establish root cause and scope. Trusted Advisor offers best-practice checks, X-Ray traces application requests for performance debugging, and Firewall Manager centrally manages firewall rules rather than investigating incidents. -
Which service performs automated vulnerability scanning of EC2 instances, container images in ECR, and Lambda functions?
Correct answer: B. Inspector continuously scans EC2 instances, ECR container images and Lambda functions for known software vulnerabilities and risky network exposure. Macie classifies sensitive data in S3, Artifact is a portal for AWS compliance documents, and Secrets Manager stores and rotates secrets - none of them scans workloads for CVE-class weaknesses. -
CloudTrail is enabled with default settings, but object-level reads on a sensitive S3 bucket are not appearing in the logs. Why?
Correct answer: A. CloudTrail records management events by default; object-level activity such as GetObject is a data event that must be switched on explicitly and is billed separately. CloudTrail does cover S3 when configured, no single bucket owner can disable logging for every account, and versioning affects object history rather than API logging. -
During an audit you must demonstrate that delivered CloudTrail log files have not been modified or deleted since delivery. Which capability provides this?
Correct answer: C. Integrity validation writes signed digest files that chain each delivered log file, so auditors can cryptographically verify nothing was altered or removed after delivery. Versioning keeps old copies but proves nothing about tampering, repeating an Athena query only rereads whatever is there, and encryption protects confidentiality rather than demonstrating integrity. -
A security team wants findings from AWS and third-party tools normalized into one open schema their SIEM can consume. Which standard is designed for this?
Correct answer: D. OCSF defines a vendor-neutral schema for security findings, so events from AWS services and third-party tools can be normalized and consumed by analytics platforms without custom translation. Well-Architected is a design-review framework, the shared responsibility model describes the AWS-customer duty split, and the OSI model describes network layering. -
An IAM user's access key has been posted publicly. What should the response team do first?
Correct answer: B. Deactivating the exposed key immediately removes the attacker's access, and CloudTrail review then establishes what the key did so follow-up containment can be scoped. Waiting invites abuse of a live credential, deleting the whole account is destructive overkill that also destroys evidence, and the root password is a different credential entirely. -
An EC2 instance is behaving as if compromised. Which immediate action best preserves evidence while containing the threat?
Correct answer: C. Swapping the instance into an isolation security group cuts the attacker's connectivity while keeping it intact, and volume snapshots preserve disk state for forensics. Termination and reboot both destroy volatile evidence and can trigger auto-scaling replacements, and deleting logs erases the very record the investigation needs. -
Before performing disk forensics on a compromised instance's EBS volume, what is the recommended handling of the volume data?
Correct answer: A. Snapshotting captures the disk state and lets analysts work on a restored copy inside an isolated environment, keeping the original evidence pristine. Working directly on the live volume alters timestamps and risks disrupting production, formatting destroys the evidence outright, and broad live sharing multiplies both contamination and exposure. -
The team wants compromised instances quarantined within seconds of specific GuardDuty findings, without waiting for a human. What is the standard pattern?
Correct answer: D. GuardDuty findings flow through EventBridge, where a rule can match specific finding types and trigger a Lambda that isolates the instance automatically - containment in seconds. Meetings, email queues and change boards all leave a live compromise waiting on human latency, which is exactly what the requirement rules out. -
Suspicious console activity suggests the account's root user credentials may be compromised. Which response is appropriate?
Correct answer: B. Root compromise requires immediately re-securing the credential set: new password, removal of any root access keys, MFA verification, then a CloudTrail audit of what happened. Waiting on a support case leaves the account exposed, an AWS account cannot have a second root user, and locking out IAM users punishes responders without touching root access. -
After containing an incident, the team documents what happened and updates runbooks and controls. Which incident-response phase is this?
Correct answer: A. The post-incident phase turns a breach into institutional learning: documentation, root-cause records, and updates to runbooks, controls and training close the loop back to preparation. Detection is when the event is first noticed, containment stops the spread, and triage is the early prioritization step - all earlier in the lifecycle. -
Under the shared responsibility model, who patches the guest operating system on an EC2 instance?
Correct answer: C. EC2 sits on the infrastructure side of the model: AWS secures the hardware, hypervisor and facilities, while everything inside the instance, including guest OS patching, belongs to the customer. Neither AWS nor AWS Support patches customer instances, and no operating system maintains itself without a patch process the customer sets up. -
How does the customer's security responsibility change when moving a workload from EC2 to a managed service such as Lambda?
Correct answer: D. The responsibility line shifts with the service model: for Lambda, AWS runs the servers, OS and runtime, but the customer still secures function code, data, permissions and configuration. Responsibility never vanishes, it clearly is not identical across service types, and managed services reduce rather than increase the customer's infrastructure burden. -
A company runs dozens of AWS accounts and wants central guardrails, consolidated billing, and grouped account management. Which service is the foundation for this?
Correct answer: B. Organizations is the multi-account backbone: organizational units, service control policy guardrails, and consolidated billing across every member account. Certificate Manager issues TLS certificates, WorkSpaces provides virtual desktops, and Snowball is a data-transfer appliance - none of them manages an account hierarchy. -
Which service sets up and governs a secure multi-account environment using an opinionated landing zone with preventive and detective controls?
Correct answer: A. Control Tower automates the landing-zone pattern on top of Organizations, provisioning accounts with guardrails that prevent risky actions and detect drift. Elastic Beanstalk deploys individual applications, App Runner runs containerized web apps, and Connect is a contact-center service - none of them governs multi-account structure. -
An auditor asks for AWS's own compliance certifications, such as SOC and ISO reports. Where does the customer retrieve these?
Correct answer: D. Artifact is the self-service portal for AWS compliance reports and agreements, so customers download SOC, ISO and PCI evidence directly. No support ticket or email exchange is needed for standard reports, and Marketplace sells third-party software rather than AWS's own audit documents. -
Security wants every account's CloudTrail activity collected in one place that workload teams cannot alter. What is the standard multi-account pattern?
Correct answer: C. An organization trail captures every member account automatically and delivers to a dedicated log-archive account, where restrictive policies keep workload teams out - tamper resistance by architecture. Per-team promises are not controls, part-time logging leaves blind windows an attacker can use, and manual weekly copies are slow, lossy and unenforceable. -
Which practice best expresses defense in depth for a web workload on AWS?
Correct answer: A. Defense in depth stacks independent controls - WAF at the edge, security groups and segmentation, least-privilege IAM, encryption, and monitoring - so one failure does not expose the workload. A single security group or encryption alone is one layer, and blocking everything permanently is denial of service to your own users, not a defense strategy.
Practice questions FAQ
- Are these real SCS-C03 exam questions?
- No. These are original study questions written to test understanding. They are not real exam questions, exam dumps, or copied from any provider.
- How should I use these practice questions?
- Answer each one, read the explanation (including why the wrong options are wrong), and use the per-domain score below to focus your revision on weak areas. Revisit before exam day.
- How many questions should I do before the exam?
- Enough to score consistently across every domain, alongside full-length practice from official or reputable providers. Understanding why each answer is right matters more than raw volume.
- What score means I am ready?
- A good signal is consistently scoring around 80% or higher across all domains on questions you have not seen before, and being able to explain why the wrong options are wrong.
- Should I use exam dumps?
- No. Dumps (real or leaked questions) breach provider policy, can void your certification, and do not build the understanding the exam actually tests.