AWS SCS-C03: AWS Certified Security - Specialty

Last checked October 22, 2026 against the official AWS exam page.

1. Question 1Data protection

   Which two measures limit how a principal in another account can use a customer managed KMS key? (Choose two.)

   1. AGrant kms:* to the root user in the key policy only
   2. BEnable automatic key rotation so that access expires
   3. CUse KMS grants with narrow operations for specific principals
   4. DPublish the key ARN so that partners can request access
   5. ERestrict the key policy to named principals and add conditions such as aws:PrincipalOrgID
   Show answer and explanationHide answer

   Correct answer: C, E

   Key policy conditions and principal lists define who may use the key, and grants give narrow, revocable permissions for specific operations. Automatic rotation does not revoke access, and root-level grants or publishing ARNs widen exposure.

2. Question 2Identity and access management

   A security team must prevent every account in an AWS Organization from disabling CloudTrail, regardless of local IAM policies. Which control should it use?

   1. AAn IAM account password policy that enforces minimum length, rotation intervals, and reuse prevention for console users, applied to each IAM user
   2. BA service control policy at the organization root or an OU that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail
   3. CAn IAM permission boundary attached to one developer role that limits the maximum permissions it can grant
   4. DA resource-based policy attached to one S3 bucket, scoped to that bucket's objects and their access
   Show answer and explanationHide answer

   Correct answer: B

   Service control policies set the maximum permissions for accounts in the organization, so a deny there applies even to account administrators. Permission boundaries and bucket policies apply to narrower scopes and do not stop CloudTrail API calls.

3. Question 3Threat detection and incident response

   A security team sees Amazon GuardDuty findings showing an EC2 instance communicating with a known cryptocurrency mining pool. What is the best first containment step?

   1. ATerminate the affected instance immediately without preserving memory, volumes, or logs for review
   2. BReplace the instance's security group with one that denies all traffic, after snapshotting its volumes for forensics
   3. CIgnore the finding because GuardDuty findings are informational in nature and need no action on the resource
   4. DDisable GuardDuty detectors in the affected account to stop further finding alerts from being generated
   Show answer and explanationHide answer

   Correct answer: B

   Isolating the instance stops the outbound traffic while preserving volumes for investigation. Terminating first destroys evidence, and disabling GuardDuty removes detection rather than responding to the threat.

4. Question 4Infrastructure security

   Which statement about security groups and network ACLs is correct?

   1. ASecurity groups are stateful, so return traffic for an allowed flow is permitted automatically, while network ACLs are stateless and need rules in both directions
   2. BBoth security groups and network ACLs are stateful, so explicit return-traffic rules are not required in either control because the response to every permitted connection is tracked automatically
   3. CNetwork ACLs are stateful, tracking connection state so that return traffic is admitted automatically, and security groups are stateless, so every inbound and outbound rule must be defined explicitly
   4. DBoth controls filter traffic that crosses an internet gateway, so instances in private subnets are unaffected by their rules
   Show answer and explanationHide answer

   Correct answer: A

   Security groups track connections and allow return traffic automatically, whereas network ACLs evaluate inbound and outbound rules separately. The other statements reverse the behavior or misplace the controls.

5. Question 5Management and security governance

   A security team wants to continuously evaluate whether EC2 instances use approved AMIs and whether S3 buckets are encrypted, with conformance reporting. Which service fits?

   1. AAmazon Athena with federated query connectors
   2. BAWS Snowball Edge storage optimized devices
   3. CAWS Config rules and conformance packs
   4. DAWS Backup vault lock policies
   Show answer and explanationHide answer

   Correct answer: C

   AWS Config evaluates resource configurations against rules and packages them as conformance packs with compliance reporting. Backup, Athena, and Snowball do not evaluate configuration compliance.