CertArea
All AWS exams

Free SCS-C03 practice test: 30 questions with answers

30 original questions for AWS Certified Security - Specialty, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
100 questions
Real exam
65 questions, 170 min

SCS-C03 exam guide: topics, cost and format

All 30 SCS-C03 questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Data protection (5 questions)

  1. Question 1

    Which two measures limit how a principal in another account can use a customer managed KMS key? (Choose two.)

    1. AGrant kms:* to the root user in the key policy only
    2. BEnable automatic key rotation so that access expires
    3. CUse KMS grants with narrow operations for specific principals
    4. DPublish the key ARN so that partners can request access
    5. ERestrict the key policy to named principals and add conditions such as aws:PrincipalOrgID
    Show answer and explanation
    Correct answer: C, E

    Key policy conditions and principal lists define who may use the key, and grants give narrow, revocable permissions for specific operations. Automatic rotation does not revoke access, and root-level grants or publishing ARNs widen exposure.

  2. Question 2

    A company wants to ensure that no S3 bucket in any account can be made public, even if a bucket policy is later changed. Which control should it use?

    1. AEnable S3 versioning on every bucket so that earlier object versions remain recoverable if content is publicly exposed
    2. BEnforce S3 Block Public Access at the account level and use an SCP to prevent changes to that setting
    3. CAdd a comment to each bucket's description field noting that it is private and restricted to internal use by the team
    4. DRely on object ACLs with read-only permissions granted to specific canonical user IDs for the reporting application
    Show answer and explanation
    Correct answer: B

    Account-level Block Public Access overrides bucket policies and ACLs, and an SCP prevents local changes to it. Comments, ACLs, and versioning do not stop public access.

  3. Question 3

    A company needs to find personal data, such as names and card numbers, stored in S3 buckets across several accounts. Which service is designed for this?

    1. AAWS Trusted Advisor
    2. BAmazon Inspector
    3. CAmazon Route 53
    4. DAmazon Macie
    Show answer and explanation
    Correct answer: D

    Amazon Macie discovers and classifies sensitive data in S3 at scale. Inspector finds software vulnerabilities, and Trusted Advisor and Route 53 do not analyze stored content.

  4. Question 4

    A service must decrypt data encrypted with a customer managed key for a short-lived task. Which KMS mechanism grants limited, temporary permission without changing the key policy?

    1. ASharing the key material with the service team through an encrypted export
    2. BDisabling automatic key rotation on the customer managed key in production
    3. CA KMS grant issued to the principal for specific operations
    4. DChanging the key policy to allow the principal permanently
    Show answer and explanation
    Correct answer: C

    Grants give scoped, revocable permissions for specified operations and do not require editing the key policy. Permanent policy changes are broader than needed, and key material is never shared in KMS.

  5. Question 5

    An application needs database credentials that rotate automatically every 30 days. Which service should store them?

    1. AA plaintext config file in an S3 bucket
    2. BCloudFormation template parameters marked NoEcho
    3. CEnvironment variables baked into an AMI
    4. DAWS Secrets Manager with automatic rotation
    Show answer and explanation
    Correct answer: D

    Secrets Manager stores secrets encrypted and rotates supported credentials on a schedule without redeployment. Baked-in variables, plaintext files, and NoEcho parameters do not provide managed rotation.

Identity and access management (5 questions)

  1. Question 6

    A security team must prevent every account in an AWS Organization from disabling CloudTrail, regardless of local IAM policies. Which control should it use?

    1. AAn IAM account password policy that enforces minimum length, rotation intervals, and reuse prevention for console users, applied to each IAM user
    2. BA service control policy at the organization root or an OU that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail
    3. CAn IAM permission boundary attached to one developer role that limits the maximum permissions it can grant
    4. DA resource-based policy attached to one S3 bucket, scoped to that bucket's objects and their access
    Show answer and explanation
    Correct answer: B

    Service control policies set the maximum permissions for accounts in the organization, so a deny there applies even to account administrators. Permission boundaries and bucket policies apply to narrower scopes and do not stop CloudTrail API calls.

  2. Question 7

    A third-party vendor must assume a role in a customer account. Which configuration reduces the confused deputy risk?

    1. ARequire an external ID condition in the role's trust policy that the vendor must supply
    2. BGrant the vendor's root account AdministratorAccess through a managed IAM policy
    3. CUse a wildcard Principal in the trust policy, letting other accounts assume the role without an external ID
    4. DShare long-term IAM access keys with the vendor's support team for 90 days
    Show answer and explanation
    Correct answer: A

    An external ID ensures the vendor can only assume the role when it presents the expected value, which blocks confused deputy attacks. Sharing long-term keys or broad trust relationships give the vendor or others unnecessary power.

  3. Question 8

    A company wants engineers to receive temporary administrator access to production accounts, with session activity recorded. Which approach is best?

    1. AIAM Identity Center permission sets assigned per account, with session duration limits and CloudTrail logging
    2. BA permanent IAM user per engineer with AdministratorAccess and long-lived access keys in each account
    3. CA root account login credential shared by the engineering team for console access and API calls
    4. DA shared administrator password stored in a team wiki page with edit access for the whole group
    Show answer and explanation
    Correct answer: A

    Permission sets issue temporary, role-based sessions that are logged and can be revoked centrally. Shared passwords, permanent admin users, and root logins provide no session accountability.

  4. Question 9

    Which two practices reduce the risk of credential exposure in CI/CD pipelines? (Choose two.)

    1. APrint secrets in build logs to help debugging
    2. BShare one deploy user across all repositories
    3. CUse OIDC federation so pipelines receive short-lived role sessions
    4. DStore long-term access keys as pipeline variables
    5. EScan repositories for committed secrets
    Show answer and explanation
    Correct answer: C, E

    Federated short-lived sessions remove stored long-term keys, and secret scanning catches credentials committed to code. Stored keys, printed secrets, and shared users all increase exposure.

  5. Question 10

    Administrators want a team to create IAM roles for its own applications without being able to grant more permissions than a defined ceiling. Which feature provides this?

    1. AA resource-based policy on each S3 bucket that grants the team s3:PutObject on its shared prefix
    2. BA shared root account password stored in a team wiki and reused for console sign-in by the delivery engineers
    3. CA public access block on the account that rejects public bucket policies and public ACLs on objects
    4. DA permission boundary attached to the roles the team creates, enforced by an IAM policy that restricts role creation
    Show answer and explanation
    Correct answer: D

    Permission boundaries set the maximum permissions an identity can receive, and a policy can require that boundary on any role the team creates. Root passwords, bucket policies, and public access blocks do not delegate IAM administration.

Threat detection and incident response (5 questions)

  1. Question 11

    A security team sees Amazon GuardDuty findings showing an EC2 instance communicating with a known cryptocurrency mining pool. What is the best first containment step?

    1. ATerminate the affected instance immediately without preserving memory, volumes, or logs for review
    2. BReplace the instance's security group with one that denies all traffic, after snapshotting its volumes for forensics
    3. CIgnore the finding because GuardDuty findings are informational in nature and need no action on the resource
    4. DDisable GuardDuty detectors in the affected account to stop further finding alerts from being generated
    Show answer and explanation
    Correct answer: B

    Isolating the instance stops the outbound traffic while preserving volumes for investigation. Terminating first destroys evidence, and disabling GuardDuty removes detection rather than responding to the threat.

  2. Question 12

    A responder confirms that an IAM access key has been used by an attacker. What should be done first to contain the threat?

    1. AWait 24 hours while monitoring CloudTrail to see whether the key's API calls continue before deciding
    2. BRotate the access key on the developer's laptop by creating a new key on that machine
    3. CDeactivate the access key and attach a deny policy to the affected principal after preserving the relevant evidence
    4. DDelete the CloudTrail logs permanently from the trail bucket so the attacker cannot be traced later
    Show answer and explanation
    Correct answer: C

    Deactivating the key and denying the principal stops further use, and evidence should be captured in the same step. Deleting logs destroys the investigation record, and waiting or partial rotation leaves the attacker active.

  3. Question 13

    Which two actions preserve evidence and contain a compromised EC2 instance? (Choose two.)

    1. ATag the instance with the investigation ID and move it to an isolated security group
    2. BRestart the instance so that malware loses its state
    3. CSnapshot attached EBS volumes before changing the instance
    4. DTerminate the instance to stop the attacker
    5. EDelete the CloudTrail entries that reference the instance
    Show answer and explanation
    Correct answer: A, C

    Snapshots preserve disk evidence, and an isolation group with a tracking tag contains the instance while keeping it available for analysis. Termination, deleting logs, and restarting destroy evidence or change the state the investigation needs.

  4. Question 14

    Which service continuously scans EC2 instances and container images for software vulnerabilities and network exposure?

    1. AAmazon Inspector
    2. BAWS Config Rules
    3. CAmazon CloudHSM
    4. DAmazon Cognito
    Show answer and explanation
    Correct answer: A

    Inspector performs continuous vulnerability assessment of instances and images. Config tracks configuration, CloudHSM manages hardware keys, and Cognito handles user sign-in.

  5. Question 15

    A company wants GuardDuty to detect unusual access patterns to its S3 buckets, such as data exfiltration attempts. Which feature should be enabled?

    1. AGuardDuty S3 Protection
    2. BAmazon Inspector container scanning
    3. CAWS Shield Advanced
    4. DAWS Config conformance packs
    Show answer and explanation
    Correct answer: A

    GuardDuty S3 Protection analyzes S3 data events for suspicious access and exfiltration indicators. Shield, Inspector, and Config address different risks.

Infrastructure security (5 questions)

  1. Question 16

    Which statement about security groups and network ACLs is correct?

    1. ASecurity groups are stateful, so return traffic for an allowed flow is permitted automatically, while network ACLs are stateless and need rules in both directions
    2. BBoth security groups and network ACLs are stateful, so explicit return-traffic rules are not required in either control because the response to every permitted connection is tracked automatically
    3. CNetwork ACLs are stateful, tracking connection state so that return traffic is admitted automatically, and security groups are stateless, so every inbound and outbound rule must be defined explicitly
    4. DBoth controls filter traffic that crosses an internet gateway, so instances in private subnets are unaffected by their rules
    Show answer and explanation
    Correct answer: A

    Security groups track connections and allow return traffic automatically, whereas network ACLs evaluate inbound and outbound rules separately. The other statements reverse the behavior or misplace the controls.

  2. Question 17

    Which AWS service provides automatic protection against network and transport-layer DDoS attacks for all customers at no additional cost?

    1. AAWS WAF managed rules only
    2. BAmazon Macie
    3. CAWS Config
    4. DAWS Shield Standard
    Show answer and explanation
    Correct answer: D

    AWS Shield Standard is enabled automatically for all AWS customers and mitigates common infrastructure-layer attacks. WAF rules operate at the application layer, and Macie and Config serve different purposes.

  3. Question 18

    Which two controls enforce IMDSv2 use on EC2 instances and reduce the risk of credential theft through SSRF? (Choose two.)

    1. ADisable Systems Manager agent updates
    2. BSet HttpTokens to required in the instance metadata options
    3. CAssign a public IP address to every instance
    4. DSet the metadata hop limit to 64 on all instances
    5. EUse an AWS Config rule or SCP to block launches that do not require IMDSv2
    Show answer and explanation
    Correct answer: B, E

    Requiring session-token-based metadata access blocks simple SSRF requests, and a Config rule or SCP keeps new instances compliant. A public IP address and a high hop limit increase exposure, and agent updates are unrelated.

  4. Question 19

    A company must inspect and filter outbound traffic from its VPCs based on domain names. Which service fits?

    1. AAWS Snowball Edge compute devices
    2. BAWS Global Accelerator with anycast IP endpoints
    3. CAWS Network Firewall with domain list rules
    4. DAmazon Connect cloud contact center routing flows
    Show answer and explanation
    Correct answer: C

    AWS Network Firewall supports stateful domain list rules for egress filtering. Global Accelerator routes traffic for performance, and Connect and Snowball serve other purposes.

  5. Question 20

    A Lambda function must reach an RDS database in a private subnet. Which network configuration is required?

    1. AAttach the function to the internet gateway of the VPC and add a default outbound route for database access
    2. BAssign the function a public IP address through an Elastic IP address in the VPC
    3. CAttach the function to the VPC subnets and a security group that allows the database port
    4. DPlace the RDS database in a public subnet open to 0.0.0.0/0 on its database port
    Show answer and explanation
    Correct answer: C

    A VPC-attached function uses the subnets and security group to reach private resources, with the database security group allowing that traffic. Public addresses and open databases add exposure without solving the connectivity requirement.

Management and security governance (5 questions)

  1. Question 21

    A security team wants to continuously evaluate whether EC2 instances use approved AMIs and whether S3 buckets are encrypted, with conformance reporting. Which service fits?

    1. AAmazon Athena with federated query connectors
    2. BAWS Snowball Edge storage optimized devices
    3. CAWS Config rules and conformance packs
    4. DAWS Backup vault lock policies
    Show answer and explanation
    Correct answer: C

    AWS Config evaluates resource configurations against rules and packages them as conformance packs with compliance reporting. Backup, Athena, and Snowball do not evaluate configuration compliance.

  2. Question 22

    A multi-account environment must prevent workloads from being created in unapproved regions. Which control is most direct?

    1. AAsking developers through written guidance to avoid other regions
    2. BA preventive region-deny guardrail implemented with service control policies
    3. CTagging resources with region names and cost allocation tags for reporting
    4. DSetting a cost budget alert for each region with AWS Budgets
    Show answer and explanation
    Correct answer: B

    A preventive guardrail uses SCPs to block actions outside approved regions across accounts. Tags, requests to developers, and budget alerts do not prevent resource creation.

  3. Question 23

    A security lead wants findings from all accounts in one place with standardized severity and compliance scores. Which service should aggregate them?

    1. AAWS Glue ETL jobs and crawlers for normalizing findings into a data catalog
    2. BAWS Shield Advanced with 24/7 DDoS response team and cost protection
    3. CAmazon QuickSight dashboards for visualizing findings and trends
    4. DAWS Security Hub with a delegated administrator and cross-region aggregation
    Show answer and explanation
    Correct answer: D

    Security Hub aggregates findings from many services and accounts and normalizes them to a common format with compliance checks. QuickSight visualizes data, Shield protects against DDoS, and Glue transforms data.

  4. Question 24

    Which two statements about service control policies are correct? (Choose two.)

    1. ASCPs apply to the principals of the management account
    2. BSCPs can grant access to resources in other accounts
    3. CSCPs replace IAM identity policies entirely
    4. DSCPs do not grant permissions by themselves
    5. ESCPs set the maximum permissions available to principals in member accounts
    Show answer and explanation
    Correct answer: D, E

    SCPs define the maximum available permissions for member accounts and do not grant access, so identities still need IAM allows. SCPs do not restrict the management account and do not replace identity policies.

  5. Question 25

    An AWS Config rule detects an S3 bucket without default encryption. The team wants the correction to run automatically under an approved runbook that records each action. Which feature fits?

    1. ADisabling the Config rule
    2. BManually editing the bucket in the console after a monthly review
    3. CConfig automatic remediation that runs an SSM Automation document
    4. DDeleting the bucket each time the rule fires
    Show answer and explanation
    Correct answer: C

    Automatic remediation with an SSM Automation runbook applies a controlled fix and records execution. Manual monthly review is slow, deleting data is destructive, and disabling the rule removes the control.

Security logging and monitoring (5 questions)

  1. Question 26

    A company needs an audit trail of API activity across 40 accounts that account administrators cannot alter or delete. Which configuration meets this need?

    1. AAn organization trail that delivers logs to a central S3 bucket in a log archive account, with log file integrity validation enabled
    2. BCloudWatch dashboards and metric widgets that display aggregated API call counts per account and region, refreshed each minute to support operational monitoring
    3. CVPC Flow Logs enabled at the subnet level for every subnet in each VPC, capturing accepted and rejected IP traffic metadata records for network troubleshooting
    4. DPer-account trails stored in each account's dedicated S3 bucket with delete permissions for account administrators
    Show answer and explanation
    Correct answer: A

    An organization trail with central, separately owned storage and log file validation keeps records outside administrators' reach and detects tampering. Local buckets with delete rights and dashboards do not meet the tamper-resistance requirement.

  2. Question 27

    Which data source best shows whether traffic to an EC2 instance on a specific port was accepted or rejected during an incident?

    1. ARoute 53 hosted zone settings and record sets
    2. BCloudWatch CPU utilization and memory metrics
    3. CS3 server access logs stored for the audit bucket
    4. DVPC Flow Logs with accept and reject records
    Show answer and explanation
    Correct answer: D

    VPC Flow Logs record accepted and rejected connection metadata at the network interface, subnet, or VPC level. CPU metrics and S3 access logs do not capture network connection decisions.

  3. Question 28

    A security analyst must query six months of CloudTrail logs stored in S3 for failed console sign-ins. Which tool is most efficient?

    1. AAmazon Athena with a table over the CloudTrail bucket, partitioned by date
    2. BAmazon Rekognition custom label models for image and video analysis
    3. CAmazon Polly neural text-to-speech voice synthesis for narration
    4. DManually downloading each log file to a laptop for offline review
    Show answer and explanation
    Correct answer: A

    Athena queries logs in place with SQL, and partitioning limits the data scanned. Manual downloads are slow, and Rekognition and Polly do not query log data.

  4. Question 29

    A security team wants matching log events from a CloudWatch Logs group delivered in near real time to a function that starts a custom response. Which feature provides this?

    1. AManual searches of the log group in the console each hour by an analyst for events
    2. BA subscription filter that delivers matching events to a Lambda function or Kinesis stream
    3. CA weekly CSV summary report emailed to the security distribution list for team review
    4. DA monthly export of the log group to S3 Glacier Deep Archive for long-term retention
    Show answer and explanation
    Correct answer: B

    Subscription filters stream matching events to Lambda, Kinesis, or Firehose for near-real-time processing. Exports, manual searches, and weekly reports are too slow for automated response.

  5. Question 30

    A company needs to record S3 object-level read and write activity for a specific bucket in CloudTrail. What should it configure?

    1. ACloudWatch request metrics for the bucket, showing aggregate request counts per day
    2. BCloudTrail data events for the bucket, in addition to management events
    3. CS3 server access logs enabled on the bucket, with no CloudTrail trail configured
    4. DA bucket lifecycle expiration rule that writes a server access log entry for deletions
    Show answer and explanation
    Correct answer: B

    Object-level activity is recorded as CloudTrail data events, which must be enabled explicitly for the bucket. Lifecycle rules and metrics do not record who accessed individual objects.