CoStudyexam prep that shows its work
Open the study app

All certifications →Educational banks →

Home › Certifications › IT and cloud certification › AWS Certified Security — Specialty (SCS-C03)

AWS Certified Security SCS-C03 — AWS practice for the AWS Certified Security SCS-C03 credential

Last reviewed 2026-10-26 · CoStudy · how we write and review questions

AWS Certified Security SCS-C03 is the AWS Certified Security SCS-C03 credential. AWS writes the outline; a fail is another sitting fee and a delayed start, not a school-curve disappointment. Related CoStudy banks (aws_cloud_practitioner, aws_ai_practitioner, aws_solutions_architect_assoc, aws_developer_assoc) test different sittings — using one as a stand-in for AWS Certified Security SCS-C03 is how people fail the appointment they paid for.

CoStudy’s AWS Certified Security — Specialty (SCS-C03) bank holds 178 multiple-choice questions, 100 flashcards and 10 scenario simulations. Chapters in this bank follow that outline: Threat Detection and Incident Response; Security Logging and Monitoring; Infrastructure Security; Identity and Access Management; Data Protection; Management and Security Governance. The published material this bank is written against begins: AWS Certified Security — Specialty (SCS-C03) Exam Guide (public, aws.amazon.com). Updated from SCS-C02 (SCS-C02 retired December 2025); AWS's stated focus for this update is expanded coverage of emerging technologies, with dedicated attention to generative AI and machine… Every multiple-choice item on this page shows the full rationale in the HTML. CoStudy is not AWS. We do not have live items, and we do not guarantee a result.

  • 288 total items
  • 178 multiple choice
  • 100 flashcards
  • 10 simulations
  • 6 chapters

Study AWS Certified Security — Specialty (SCS-C03) in CoStudy →

Exam facts

Copied from the cited official page on the date shown. Rows marked unverified were not confirmed on that pass — check the certifying body before you pay or schedule. CoStudy is not the exam owner.

FactDetailSource
What it isAWS Certified Security — Specialty (SCS-C03) is administered under AWS. CoStudy is independent practice, not the exam owner.the AWS Certification exam guides · as of 2026-10
Published outlineAWS Certified Security — Specialty (SCS-C03) Exam Guide (public, aws.amazon.com). Updated from SCS-C02 (SCS-C02 retired December 2025); AWS's stated focus for this update is expanded coverage of emerging technologies, with dedicated attention to generative AI and machine learning security. 6 content domains: 1) Detection (16%), 2) Incident Response (14% — now a standalone domain, previously combined with Detection…the AWS Certification exam guides · as of 2026-10
Domain weights (from the outline blurb)Detection 16%; Incident Response 14%; Infrastructure Security 18%; Identity and Access Management 20%; Data Protection 18%; Security Foundations and Governance 14%the AWS Certification exam guides · as of 2026-10
Passing score / pass rateOnly the certifying body publishes a cut score or pass rate. This page does not invent one. (unverified)the AWS Certification exam guides · as of 2026-10
Fees and eligibilityApplication, sitting, and retake rules live on AWS’s site and can change. Confirm there before you pay.the AWS Certification exam guides · as of 2026-10

Exam format, sections and weights

Published domain weights from the cited official outline. Re-check the certifying body before you sit — weights move.

SectionPublished weight
Detection16%
Incident Response14%
Infrastructure Security18%
Identity and Access Management20%
Data Protection18%
Security Foundations and Governance14%

AWS Certified Security SCS-C03 bank mix (this question bank)

Chapter counts below are CoStudy’s mix so you can see where practice time goes. They are not a claim that the live exam uses these item counts.

ChapterItems in this bank
Threat Detection and Incident Response28 (16%)
Security Logging and Monitoring24 (13%)
Infrastructure Security37 (21%)
Identity and Access Management33 (19%)
Data Protection36 (20%)
Management and Security Governance20 (11%)

How this bank is different

  • AWS Certified Security SCS-C03 is one AWS exam code. A Cloud Practitioner stem is not an Architect stem.
  • The credited answer is the service that meets the constraint (RPO, encryption, cost, ops), not the logo you used at work.
  • Recertification and exam versions are AWS’s. Pin the code on your voucher before you drill.

Exam format and blueprint

AWS Certified Security — Specialty (SCS-C03) Exam Guide (public, aws.amazon.com). Updated from SCS-C02 (SCS-C02 retired December 2025); AWS's stated focus for this update is expanded coverage of emerging technologies, with dedicated attention to generative AI and machine learning security. 6 content domains: 1) Detection (16%), 2) Incident Response (14% — now a standalone domain, previously combined with Detection under SCS-C02), 3) Infrastructure Security (18%), 4) Identity and Access Management (20% — now the single largest domain), 5) Data Protection (18%), 6) Security Foundations and Governance (14%). MCQs reference public AWS documentation and SCS-C03 exam objectives.

What the AWS Certified Security SCS-C03 bank covers

Each chapter follows a domain of the published exam outline. Practise one on its own (chapter URLs are in the app and on this page for navigation; they are not sitemap targets):

Study timeline

Pin the exam code first. Then spend the largest block of time on detection (16% in the published blurb). Pair every miss with a diagram or a console click.

Six-week AWS Certified Security SCS-C03 block — 10–14 hours/week

Weeks 1–4: walk the chapters in outline order, with a mixed set twice a week. Week 5: only the two weakest chapters. Week 6: two timed sittings in the shape the certifying body describes, then stop adding new outline. AWS Certified Security — Specialty (SCS-C03) samples on this page are for judging rationale quality, not for a full mock.

Twelve-week working-hours plan — 6–8 hours/week

Two or three evenings and one weekend block. Keep a written error log keyed to chapters, not to “I was tired.” The last fourteen days are timing and weak-chapter repair only. If you are also sitting a related exam (aws_cloud_practitioner), do not merge the decks.

Free AWS Certified Security — Specialty (SCS-C03) practice questions

A sample of 12 multiple-choice questions from the bank, with the full rationale shown.

Threat Detection and Incident Response

Which GuardDuty finding family indicates an EC2 instance is communicating with a known C2 or backdoor infrastructure?

  1. ElastiCache subnet group in public subnets
  2. VPC Flow Logs at ENI level
  3. Landing zone with mandatory and optional
  4. S3 SSE-C with customer-supplied key

Answer: C — Landing zone with mandatory and optional

Backdoor:EC2/C&CActivity.B!DNS specifically flags DNS lookups for known C2 domains. A is reconnaissance (scanning). C is mining. D is brute-force inbound SSH. Knowing finding family semantics is heavily tested.

AWS DETECTIVE:

  1. S3 server access logs to same bucket
  2. WAF regex pattern set for tuning
  3. Graph analysis of GuardDuty, VPC Flow Logs, and CloudTrail data to visualize entity relationships
  4. Network ACL with allow all outbound

Answer: C — Graph analysis of GuardDuty, VPC Flow Logs, and CloudTrail data to visualize entity relationships

Detective: investigation tool. Up to 12 months of data. Pre-built behavioral graphs. Answers: 'when did unauthorized access happen,' 'what other resources were accessed.' Complements other security services. Multi-account aggregation. SCS-C02 investigation.

Security Logging and Monitoring

AWS Config aggregator's PRIMARY use is to:

  1. Detective without GuardDuty enabled
  2. VPC endpoint policy restricting bucket access
  3. AWS Glue crawler without KMS-encrypted output
  4. Self-signed certificate stored in ACM

Answer: B — VPC endpoint policy restricting bucket access

Aggregator = multi-account/multi-Region view. The others are wrong.

AWS Security Hub provides:

  1. Detective without GuardDuty enabled
  2. Aggregates findings from GuardDuty, Inspector
  3. Public subnet with IGW route
  4. Envelope encryption via customer library

Answer: B — Aggregates findings from GuardDuty, Inspector

Security Hub: single pane of glass for security findings across AWS services and partner integrations. ASFF (AWS Security Finding Format). Continuous compliance checks. Cross-account aggregation. Critical SCS-C02 service.

Infrastructure Security

A team wants to expose an internal service from one VPC to another VPC owned by a different account WITHOUT VPC peering. The CORRECT design uses:

  1. IAM policy Deny without Condition block
  2. Asymmetric CMK for signing only
  3. AWS PrivateLink (a VPC endpoint service) fronted by a Network Load Balancer
  4. Secrets Manager with static value

Answer: C — AWS PrivateLink (a VPC endpoint service) fronted by a Network Load Balancer

PrivateLink (VPC Endpoint Service) is the SaaS-style private-to-private connection without CIDR coupling or peering. A is public exposure. C is hybrid connectivity. D is internet egress.

An AWS NETWORK FIREWALL is:

  1. Prevention agent to require MFA on API calls
  2. Third-party certificate imported to ACM
  3. SSM Parameter String plaintext value
  4. Symmetric CMK with default rotation

Answer: A — Prevention agent to require MFA on API calls

AWS Network Firewall: managed L3-L7 firewall, suricata-compatible IDS/IPS rules. Deep packet inspection. Centralized via Firewall Manager. Compared to Security Groups (stateful, instance-level) and NACLs (stateless, subnet-level), Network Firewall is more powerful for VPC perimeter.

Identity and Access Management

AWS IAM IDENTITY CENTER (formerly SSO):

  1. GuardDuty for data classification
  2. KMS alias without underlying key change
  3. Amazon Inspector for network scanning
  4. Federated SSO with permission sets across

Answer: D — Federated SSO with permission sets across

IAM Identity Center: enterprise SSO for AWS. Replaces multi-account IAM user provisioning. SAML 2.0 + SCIM for IdP integration. Permission Sets: pre-defined or custom roles assigned to accounts. AWS access portal for users. Best practice for org-wide identity. SCS-C02 identity at scale.

A permission boundary is BEST described as:

  1. CloudTrail management events only
  2. Amazon Comprehend without VPC endpoint
  3. Private subnet with NAT gateway
  4. CloudWatch Logs metric filter with alarm

Answer: D — CloudWatch Logs metric filter with alarm

Permission boundary = max permissions for an IAM principal (user/role). It does not grant; it caps. A reverses purpose. C confuses with org-level SCPs. D is wrong concept.

Data Protection

Amazon Macie is BEST used for:

  1. Client-side encryption before upload
  2. Discovering and classifying sensitive data in S3 buckets
  3. S3 server access logs to same bucket
  4. Network ACL with allow all outbound

Answer: B — Discovering and classifying sensitive data in S3 buckets

Macie: managed data security service for S3. Auto-discovers and classifies PII (SSN, credit cards, health data). Alerts on public buckets containing sensitive data. SCS-C02 data protection domain.

AWS Secrets Manager differs from Parameter Store in:

  1. Private CA issuing internal certificates
  2. Encrypted at rest and in transit by default
  3. Cross-region KMS key replication
  4. WAF for backend database queries

Answer: B — Encrypted at rest and in transit by default

Choose based on rotation needs: Secrets Manager for credentials needing automated rotation (RDS, etc.). Parameter Store for config/secrets without rotation requirements. Both KMS-integrated. SCS-C02 tests this distinction.

Management and Security Governance

AWS Organizations Service Control Policies (SCPs) provide:

  1. Session policy scoped to single request
  2. Route 53 for identity federation
  3. IAM policy Allow with wildcard Resource
  4. Deny-list ceiling on max permissions across

Answer: D — Deny-list ceiling on max permissions across

SCPs: account boundary. Restrict (not grant) what IAM users/roles can do in member accounts. Common: prevent disabling CloudTrail, restrict regions, prevent root API usage. Critical for multi-account governance.

An organization needs to ensure new accounts created in the Organization automatically have CloudTrail, Config, GuardDuty, and a baseline IAM setup. The MOST appropriate solution is:

  1. KMS alias without underlying key change
  2. Amazon Managed Blockchain without private channel
  3. Hardcoded credential in Lambda environment
  4. SCP denying cloudtrail:StopLogging at org root

Answer: D — SCP denying cloudtrail:StopLogging at org root

Control Tower Account Factory (and Customizations for Control Tower / AFT) is the canonical provisioning pattern. The others don't scale. D is the wrong service.

AWS Certified Security — Specialty (SCS-C03) flashcards

6 sample cards from the 100 in the bank.

KMS key rotation?

AWS-managed: yearly, automatic. Customer-managed: optional yearly.

IAM policy types?

Identity-based, resource-based, permissions boundary, organization SCPs, ACLs, session policies.

AWS Systems Manager Incident Manager?

Detect, respond. Runbooks, escalation, post-mortems.

AWS Audit Manager?

Continuous compliance evidence collection. Maps controls to frameworks.

Encryption in transit?

TLS for API calls. ALB/CloudFront TLS termination. RDS SSL connections.

AWS CloudTrail?

Logs API calls. Audit trail. Required for security investigations.

Practise the full AWS Certified Security — Specialty (SCS-C03) bank

These samples are a small slice. The full bank runs flashcards, multiple choice and timed mock exams with per-chapter progress tracking, on the web and in the iOS app.

Open AWS Certified Security — Specialty (SCS-C03) →

Frequently asked

What is the AWS Certified Security SCS-C03 exam?

AWS Certified Security — Specialty (SCS-C03) Exam Guide (public, aws.amazon.com). Updated from SCS-C02 (SCS-C02 retired December 2025); AWS's stated focus for this update is expanded coverage of emerging technologies, with dedicated attention to generative AI and machine learning security. 6 content domains: 1) Detection (16%), 2) Incident Response (14% — now a standalone domain, previously combined with Detection under SCS-C02), 3) Infrastructure Security (18%), 4) Identity and Access Management (20% — now the single largest domain), 5) Data Protection (18%), 6) Security Foundations and Governance (14%). MCQs reference public AWS documentation and SCS-C03 exam objectives.

How is CoStudy’s AWS Certified Security SCS-C03 bank organised?

It holds 288 items across 6 chapters: Threat Detection and Incident Response; Security Logging and Monitoring; Infrastructure Security; Identity and Access Management; Data Protection; Management and Security Governance. Free samples on this page include the full rationale, with no account. Chapter counts in the bank are our mix; they are not a promise that the live exam uses the same item counts.

Should I study AWS Certified Security SCS-C03 and aws cloud practitioner as one pile?

No. AWS Certified Security SCS-C03 is its own sitting. Related banks on CoStudy (aws_cloud_practitioner, aws_ai_practitioner, aws_solutions_architect_assoc, aws_developer_assoc, aws_sysops_assoc) exist because candidates confuse neighbouring credentials. Use the outline for the exam on your voucher.

Where do AWS Certified Security SCS-C03 fees, cut scores, and pass rates live?

On AWS’s published pages — start at the AWS Certification exam guides. This page quotes a number only when we retrieved it from an official URL, and otherwise says unverified. Prep blogs that tabulate every exam’s price are often stale.

Are these real AWS Certified Security SCS-C03 exam questions?

No. CoStudy does not have live items. The samples below are original practice written to the published outline, with rationales. Anyone selling “real exam dumps” is describing something you should not buy.

Primary source

This bank is written against AWS's published exam material. Check the AWS Certification exam guides for the current outline, fees and eligibility rules — those change, and the certifying body is the only authority on them. CoStudy is not affiliated with AWS.

Related study guides

Related certifications

Browse professional certification banks →