Home › Certifications › AWS Certified Security — Specialty (SCS-C03)
178 multiple-choice questions, 100 flashcards and 10 scenario simulations, organised into 6 chapters, written to the AWS Certified Security blueprint. Every question carries a full rationale.
Study AWS Certified Security — Specialty (SCS-C03) in CoStudy →
AWS Certified Security — Specialty (SCS-C03) Exam Guide (public, aws.amazon.com). Updated from SCS-C02 (SCS-C02 retired December 2025); AWS's stated focus for this update is expanded coverage of emerging technologies, with dedicated attention to generative AI and machine learning security. 6 content domains: 1) Detection (16%), 2) Incident Response (14% — now a standalone domain, previously combined with Detection under SCS-C02), 3) Infrastructure Security (18%), 4) Identity and Access Management (20% — now the single largest domain), 5) Data Protection (18%), 6) Security Foundations and Governance (14%). MCQs reference public AWS documentation and SCS-C03 exam objectives.
CoStudy's AWS Certified Security — Specialty (SCS-C03) bank holds 288 items organised into 6 chapters that follow the published blueprint. Every multiple-choice question carries a written rationale explaining why the correct answer is correct and why each distractor is tempting but wrong, and the bank includes 10 scenario-based simulations.
Each chapter follows a domain of the published exam outline. Practise one on its own:
A sample of 12 multiple-choice questions from the bank, with the full rationale shown.
Which GuardDuty finding family indicates an EC2 instance is communicating with a known C2 or backdoor infrastructure?
Answer: C — Landing zone with mandatory and optional
Backdoor:EC2/C&CActivity.B!DNS specifically flags DNS lookups for known C2 domains. A is reconnaissance (scanning). C is mining. D is brute-force inbound SSH. Knowing finding family semantics is heavily tested.
AWS DETECTIVE:
Answer: C — Graph analysis of GuardDuty, VPC Flow Logs, and CloudTrail data to visualize entity relationships
Detective: investigation tool. Up to 12 months of data. Pre-built behavioral graphs. Answers: 'when did unauthorized access happen,' 'what other resources were accessed.' Complements other security services. Multi-account aggregation. SCS-C02 investigation.
AWS Config aggregator's PRIMARY use is to:
Answer: B — VPC endpoint policy restricting bucket access
Aggregator = multi-account/multi-Region view. The others are wrong.
AWS Security Hub provides:
Answer: B — Aggregates findings from GuardDuty, Inspector
Security Hub: single pane of glass for security findings across AWS services and partner integrations. ASFF (AWS Security Finding Format). Continuous compliance checks. Cross-account aggregation. Critical SCS-C02 service.
A team wants to expose an internal service from one VPC to another VPC owned by a different account WITHOUT VPC peering. The CORRECT design uses:
Answer: C — AWS PrivateLink (a VPC endpoint service) fronted by a Network Load Balancer
PrivateLink (VPC Endpoint Service) is the SaaS-style private-to-private connection without CIDR coupling or peering. A is public exposure. C is hybrid connectivity. D is internet egress.
An AWS NETWORK FIREWALL is:
Answer: A — Prevention agent to require MFA on API calls
AWS Network Firewall: managed L3-L7 firewall, suricata-compatible IDS/IPS rules. Deep packet inspection. Centralized via Firewall Manager. Compared to Security Groups (stateful, instance-level) and NACLs (stateless, subnet-level), Network Firewall is more powerful for VPC perimeter.
AWS IAM IDENTITY CENTER (formerly SSO):
Answer: D — Federated SSO with permission sets across
IAM Identity Center: enterprise SSO for AWS. Replaces multi-account IAM user provisioning. SAML 2.0 + SCIM for IdP integration. Permission Sets: pre-defined or custom roles assigned to accounts. AWS access portal for users. Best practice for org-wide identity. SCS-C02 identity at scale.
A permission boundary is BEST described as:
Answer: D — CloudWatch Logs metric filter with alarm
Permission boundary = max permissions for an IAM principal (user/role). It does not grant; it caps. A reverses purpose. C confuses with org-level SCPs. D is wrong concept.
Amazon Macie is BEST used for:
Answer: B — Discovering and classifying sensitive data in S3 buckets
Macie: managed data security service for S3. Auto-discovers and classifies PII (SSN, credit cards, health data). Alerts on public buckets containing sensitive data. SCS-C02 data protection domain.
AWS Secrets Manager differs from Parameter Store in:
Answer: B — Encrypted at rest and in transit by default
Choose based on rotation needs: Secrets Manager for credentials needing automated rotation (RDS, etc.). Parameter Store for config/secrets without rotation requirements. Both KMS-integrated. SCS-C02 tests this distinction.
AWS Organizations Service Control Policies (SCPs) provide:
Answer: D — Deny-list ceiling on max permissions across
SCPs: account boundary. Restrict (not grant) what IAM users/roles can do in member accounts. Common: prevent disabling CloudTrail, restrict regions, prevent root API usage. Critical for multi-account governance.
An organization needs to ensure new accounts created in the Organization automatically have CloudTrail, Config, GuardDuty, and a baseline IAM setup. The MOST appropriate solution is:
Answer: D — SCP denying cloudtrail:StopLogging at org root
Control Tower Account Factory (and Customizations for Control Tower / AFT) is the canonical provisioning pattern. The others don't scale. D is the wrong service.
6 sample cards from the 100 in the bank.
KMS key rotation?
AWS-managed: yearly, automatic. Customer-managed: optional yearly.
IAM policy types?
Identity-based, resource-based, permissions boundary, organization SCPs, ACLs, session policies.
AWS Systems Manager Incident Manager?
Detect, respond. Runbooks, escalation, post-mortems.
AWS Audit Manager?
Continuous compliance evidence collection. Maps controls to frameworks.
Encryption in transit?
TLS for API calls. ALB/CloudFront TLS termination. RDS SSL connections.
AWS CloudTrail?
Logs API calls. Audit trail. Required for security investigations.
These samples are a small slice. The full bank runs flashcards, multiple choice and timed mock exams with per-chapter progress tracking, on the web and in the iOS app.
Open AWS Certified Security — Specialty (SCS-C03) →
The AWS Certified Security — Specialty (SCS-C03) bank holds 288 items: 178 multiple-choice questions, 100 flashcards and 10 scenario-based simulations. 18 of them are on this page to read free, with no signup.
Yes. Every multiple-choice item carries a written rationale that states the controlling principle behind the correct answer and then addresses each wrong option in turn — why it tempts and precisely where it fails. Knowing why the plausible answer was wrong is worth more than knowing which letter was right.
It is organised into 6 chapters that follow the published exam blueprint: Threat Detection and Incident Response; Security Logging and Monitoring; Infrastructure Security; Identity and Access Management; Data Protection; Management and Security Governance. The number of questions in each chapter is proportional to that domain's published weight, so working through the bank exposes you to roughly the mix the real exam uses.
AWS Certified Security — Specialty (SCS-C03) Exam Guide (public, aws.amazon.com). Updated from SCS-C02 (SCS-C02 retired December 2025); AWS's stated focus for this update is expanded coverage of emerging technologies, with dedicated attention to generative AI and machine learning security. 6 content domains: 1) Detection (16%), 2) Incident Response (14% — now a standalone domain, previously combined with Detection under SCS-C02), 3) Infrastructure Security (18%), 4) Identity and Access Management (20% — now the single largest domain), 5) Data…
The samples on this page are free to read in full, rationales included, with no account. The complete 288-item bank, the timed mock exams and per-chapter progress tracking are part of CoStudy on the web and in the iOS app.
Last reviewed 2026-08-22. Banks are written against the certifying body's published exam outline and re-checked when that outline changes — exams get renumbered, retired and reweighted, and a bank written to a superseded outline teaches the wrong proportions. Figures that are re-indexed annually are deliberately not asserted as rules; the questions test the governing principle instead.
This bank is written against AWS's published exam material. Check the AWS Certification exam guides for the current outline, fees and eligibility rules — those change, and the certifying body is the only authority on them. CoStudy is not affiliated with AWS.