CoStudy

HomeCertifications › AWS Certified Security — Specialty (SCS-C03)

AWS Certified Security — Specialty (SCS-C03) practice questions and exam guide

178 multiple-choice questions, 100 flashcards and 10 scenario simulations, organised into 6 chapters, written to the AWS Certified Security blueprint. Every question carries a full rationale.

Written and maintained by Nick Burton · last updated 2026-08-22 · how we write and review questions

Study AWS Certified Security — Specialty (SCS-C03) in CoStudy →

About the AWS Certified Security — Specialty (SCS-C03) exam

AWS Certified Security — Specialty (SCS-C03) Exam Guide (public, aws.amazon.com). Updated from SCS-C02 (SCS-C02 retired December 2025); AWS's stated focus for this update is expanded coverage of emerging technologies, with dedicated attention to generative AI and machine learning security. 6 content domains: 1) Detection (16%), 2) Incident Response (14% — now a standalone domain, previously combined with Detection under SCS-C02), 3) Infrastructure Security (18%), 4) Identity and Access Management (20% — now the single largest domain), 5) Data Protection (18%), 6) Security Foundations and Governance (14%). MCQs reference public AWS documentation and SCS-C03 exam objectives.

CoStudy's AWS Certified Security — Specialty (SCS-C03) bank holds 288 items organised into 6 chapters that follow the published blueprint. Every multiple-choice question carries a written rationale explaining why the correct answer is correct and why each distractor is tempting but wrong, and the bank includes 10 scenario-based simulations.

What the AWS Certified Security SCS-C03 bank covers

Each chapter follows a domain of the published exam outline. Practise one on its own:

Free AWS Certified Security — Specialty (SCS-C03) practice questions

A sample of 12 multiple-choice questions from the bank, with the full rationale shown.

Threat Detection and Incident Response

Which GuardDuty finding family indicates an EC2 instance is communicating with a known C2 or backdoor infrastructure?

  1. ElastiCache subnet group in public subnets
  2. VPC Flow Logs at ENI level
  3. Landing zone with mandatory and optional
  4. S3 SSE-C with customer-supplied key

Answer: C — Landing zone with mandatory and optional

Backdoor:EC2/C&CActivity.B!DNS specifically flags DNS lookups for known C2 domains. A is reconnaissance (scanning). C is mining. D is brute-force inbound SSH. Knowing finding family semantics is heavily tested.

AWS DETECTIVE:

  1. S3 server access logs to same bucket
  2. WAF regex pattern set for tuning
  3. Graph analysis of GuardDuty, VPC Flow Logs, and CloudTrail data to visualize entity relationships
  4. Network ACL with allow all outbound

Answer: C — Graph analysis of GuardDuty, VPC Flow Logs, and CloudTrail data to visualize entity relationships

Detective: investigation tool. Up to 12 months of data. Pre-built behavioral graphs. Answers: 'when did unauthorized access happen,' 'what other resources were accessed.' Complements other security services. Multi-account aggregation. SCS-C02 investigation.

Security Logging and Monitoring

AWS Config aggregator's PRIMARY use is to:

  1. Detective without GuardDuty enabled
  2. VPC endpoint policy restricting bucket access
  3. AWS Glue crawler without KMS-encrypted output
  4. Self-signed certificate stored in ACM

Answer: B — VPC endpoint policy restricting bucket access

Aggregator = multi-account/multi-Region view. The others are wrong.

AWS Security Hub provides:

  1. Detective without GuardDuty enabled
  2. Aggregates findings from GuardDuty, Inspector
  3. Public subnet with IGW route
  4. Envelope encryption via customer library

Answer: B — Aggregates findings from GuardDuty, Inspector

Security Hub: single pane of glass for security findings across AWS services and partner integrations. ASFF (AWS Security Finding Format). Continuous compliance checks. Cross-account aggregation. Critical SCS-C02 service.

Infrastructure Security

A team wants to expose an internal service from one VPC to another VPC owned by a different account WITHOUT VPC peering. The CORRECT design uses:

  1. IAM policy Deny without Condition block
  2. Asymmetric CMK for signing only
  3. AWS PrivateLink (a VPC endpoint service) fronted by a Network Load Balancer
  4. Secrets Manager with static value

Answer: C — AWS PrivateLink (a VPC endpoint service) fronted by a Network Load Balancer

PrivateLink (VPC Endpoint Service) is the SaaS-style private-to-private connection without CIDR coupling or peering. A is public exposure. C is hybrid connectivity. D is internet egress.

An AWS NETWORK FIREWALL is:

  1. Prevention agent to require MFA on API calls
  2. Third-party certificate imported to ACM
  3. SSM Parameter String plaintext value
  4. Symmetric CMK with default rotation

Answer: A — Prevention agent to require MFA on API calls

AWS Network Firewall: managed L3-L7 firewall, suricata-compatible IDS/IPS rules. Deep packet inspection. Centralized via Firewall Manager. Compared to Security Groups (stateful, instance-level) and NACLs (stateless, subnet-level), Network Firewall is more powerful for VPC perimeter.

Identity and Access Management

AWS IAM IDENTITY CENTER (formerly SSO):

  1. GuardDuty for data classification
  2. KMS alias without underlying key change
  3. Amazon Inspector for network scanning
  4. Federated SSO with permission sets across

Answer: D — Federated SSO with permission sets across

IAM Identity Center: enterprise SSO for AWS. Replaces multi-account IAM user provisioning. SAML 2.0 + SCIM for IdP integration. Permission Sets: pre-defined or custom roles assigned to accounts. AWS access portal for users. Best practice for org-wide identity. SCS-C02 identity at scale.

A permission boundary is BEST described as:

  1. CloudTrail management events only
  2. Amazon Comprehend without VPC endpoint
  3. Private subnet with NAT gateway
  4. CloudWatch Logs metric filter with alarm

Answer: D — CloudWatch Logs metric filter with alarm

Permission boundary = max permissions for an IAM principal (user/role). It does not grant; it caps. A reverses purpose. C confuses with org-level SCPs. D is wrong concept.

Data Protection

Amazon Macie is BEST used for:

  1. Client-side encryption before upload
  2. Discovering and classifying sensitive data in S3 buckets
  3. S3 server access logs to same bucket
  4. Network ACL with allow all outbound

Answer: B — Discovering and classifying sensitive data in S3 buckets

Macie: managed data security service for S3. Auto-discovers and classifies PII (SSN, credit cards, health data). Alerts on public buckets containing sensitive data. SCS-C02 data protection domain.

AWS Secrets Manager differs from Parameter Store in:

  1. Private CA issuing internal certificates
  2. Encrypted at rest and in transit by default
  3. Cross-region KMS key replication
  4. WAF for backend database queries

Answer: B — Encrypted at rest and in transit by default

Choose based on rotation needs: Secrets Manager for credentials needing automated rotation (RDS, etc.). Parameter Store for config/secrets without rotation requirements. Both KMS-integrated. SCS-C02 tests this distinction.

Management and Security Governance

AWS Organizations Service Control Policies (SCPs) provide:

  1. Session policy scoped to single request
  2. Route 53 for identity federation
  3. IAM policy Allow with wildcard Resource
  4. Deny-list ceiling on max permissions across

Answer: D — Deny-list ceiling on max permissions across

SCPs: account boundary. Restrict (not grant) what IAM users/roles can do in member accounts. Common: prevent disabling CloudTrail, restrict regions, prevent root API usage. Critical for multi-account governance.

An organization needs to ensure new accounts created in the Organization automatically have CloudTrail, Config, GuardDuty, and a baseline IAM setup. The MOST appropriate solution is:

  1. KMS alias without underlying key change
  2. Amazon Managed Blockchain without private channel
  3. Hardcoded credential in Lambda environment
  4. SCP denying cloudtrail:StopLogging at org root

Answer: D — SCP denying cloudtrail:StopLogging at org root

Control Tower Account Factory (and Customizations for Control Tower / AFT) is the canonical provisioning pattern. The others don't scale. D is the wrong service.

AWS Certified Security — Specialty (SCS-C03) flashcards

6 sample cards from the 100 in the bank.

KMS key rotation?

AWS-managed: yearly, automatic. Customer-managed: optional yearly.

IAM policy types?

Identity-based, resource-based, permissions boundary, organization SCPs, ACLs, session policies.

AWS Systems Manager Incident Manager?

Detect, respond. Runbooks, escalation, post-mortems.

AWS Audit Manager?

Continuous compliance evidence collection. Maps controls to frameworks.

Encryption in transit?

TLS for API calls. ALB/CloudFront TLS termination. RDS SSL connections.

AWS CloudTrail?

Logs API calls. Audit trail. Required for security investigations.

Practise the full AWS Certified Security — Specialty (SCS-C03) bank

These samples are a small slice. The full bank runs flashcards, multiple choice and timed mock exams with per-chapter progress tracking, on the web and in the iOS app.

Open AWS Certified Security — Specialty (SCS-C03) →

AWS Certified Security SCS-C03 — frequently asked

How many AWS Certified Security SCS-C03 practice questions does CoStudy have?

The AWS Certified Security — Specialty (SCS-C03) bank holds 288 items: 178 multiple-choice questions, 100 flashcards and 10 scenario-based simulations. 18 of them are on this page to read free, with no signup.

Do the AWS Certified Security SCS-C03 questions come with explanations?

Yes. Every multiple-choice item carries a written rationale that states the controlling principle behind the correct answer and then addresses each wrong option in turn — why it tempts and precisely where it fails. Knowing why the plausible answer was wrong is worth more than knowing which letter was right.

What topics does the AWS Certified Security SCS-C03 bank cover?

It is organised into 6 chapters that follow the published exam blueprint: Threat Detection and Incident Response; Security Logging and Monitoring; Infrastructure Security; Identity and Access Management; Data Protection; Management and Security Governance. The number of questions in each chapter is proportional to that domain's published weight, so working through the bank exposes you to roughly the mix the real exam uses.

What is on the AWS Certified Security SCS-C03 exam?

AWS Certified Security — Specialty (SCS-C03) Exam Guide (public, aws.amazon.com). Updated from SCS-C02 (SCS-C02 retired December 2025); AWS's stated focus for this update is expanded coverage of emerging technologies, with dedicated attention to generative AI and machine learning security. 6 content domains: 1) Detection (16%), 2) Incident Response (14% — now a standalone domain, previously combined with Detection under SCS-C02), 3) Infrastructure Security (18%), 4) Identity and Access Management (20% — now the single largest domain), 5) Data…

Are the AWS Certified Security SCS-C03 practice questions free?

The samples on this page are free to read in full, rationales included, with no account. The complete 288-item bank, the timed mock exams and per-chapter progress tracking are part of CoStudy on the web and in the iOS app.

How current is the AWS Certified Security SCS-C03 content?

Last reviewed 2026-08-22. Banks are written against the certifying body's published exam outline and re-checked when that outline changes — exams get renumbered, retired and reweighted, and a bank written to a superseded outline teaches the wrong proportions. Figures that are re-indexed annually are deliberately not asserted as rules; the questions test the governing principle instead.

Primary source

This bank is written against AWS's published exam material. Check the AWS Certification exam guides for the current outline, fees and eligibility rules — those change, and the certifying body is the only authority on them. CoStudy is not affiliated with AWS.

Related study guides

Related certifications

Browse all 222 study banks →