Try 12 AWS SCS-C03 sample questions, review AWS security specialty scope across identity, detection, infrastructure protection, data protection, incident response, and governance, and request an IT Mastery practice update.
SCS-C03 is AWS Certified Security - Specialty. It validates deep AWS security knowledge across detection, incident response, infrastructure security, identity and access management, data protection, governance, and secure production operations.
Full app-backed IT Mastery practice for SCS-C03 is still being prioritized. Use this page to review the exam snapshot, topic coverage, and related live security and AWS practice options.
SCS-C03 questions usually reward the option that protects AWS workloads with least privilege, reliable detection, secure data handling, clear incident response, and governance controls that fit the operating environment.
| Domain | Weight |
|---|---|
| Detection | 16% |
| Incident Response | 14% |
| Infrastructure Security | 18% |
| Identity and Access Management | 20% |
| Data Protection | 18% |
| Security Foundations and Governance | 14% |
Try these 12 original sample questions for AWS SCS-C03. They are designed for self-assessment and are not official exam questions.
What this tests: threat detection signal selection
A security team wants managed detection for suspicious API calls, unusual data access, and known malicious IP activity across AWS accounts. Which service is the best starting point?
Best answer: D
Explanation: GuardDuty analyzes sources such as CloudTrail management events, VPC Flow Logs, DNS logs, and selected data events to identify suspicious activity. It is a managed threat-detection service. EFS, Budgets, and CodeBuild do not provide this detection function.
What this tests: CloudTrail coverage
An auditor asks for a record of management API activity across all Regions in an AWS account. Which configuration is most appropriate?
Best answer: B
Explanation: CloudTrail records AWS API activity. A multi-Region trail helps capture management events across Regions, and a protected S3 bucket supports retention and review. VPC Flow Logs and application logs do not replace CloudTrail API audit evidence.
What this tests: least privilege IAM
A Lambda function needs read access to one DynamoDB table. Which permission design is most secure?
Best answer: C
Explanation: Least privilege means granting only the actions and resources required for the workload. A scoped Lambda execution role is the correct pattern. Broad managed policies, shared broad permissions, and long-lived access keys increase blast radius.
What this tests: service control policy purpose
An organization wants to prevent member accounts from disabling CloudTrail or leaving the organization, even if local administrators have broad account permissions. Which control is most relevant?
Best answer: A
Explanation: Service control policies set permission guardrails across AWS Organizations accounts. They can deny high-risk actions even when account-level IAM would otherwise allow them. Security groups, lifecycle rules, and concurrency controls do not create organization-level permission boundaries.
What this tests: KMS access control
An application role has an IAM policy allowing kms:Decrypt, but decrypt calls still fail for a customer managed KMS key. What should the security engineer check?
Best answer: D
Explanation: KMS authorization depends on the key policy and, when allowed by that policy, IAM policies or grants. An IAM allow alone is not enough if the key policy does not permit the principal or delegate access. S3 versioning, NAT routes, and CloudFront caching do not explain KMS authorization failure.
What this tests: S3 public access prevention
A company stores sensitive documents in S3 and wants account-level protection against accidental public bucket policies or ACLs. Which control should be enabled?
Best answer: B
Explanation: S3 Block Public Access can prevent public ACLs and policies at the account or bucket level. It is a key guardrail for sensitive data. Transfer Acceleration and website hosting do not prevent public exposure, and CloudFront field-level encryption does not secure S3 bucket policy mistakes by itself.
What this tests: sensitive data discovery
A security team needs to discover whether S3 buckets contain personally identifiable information and prioritize findings for review. Which AWS service is designed for this?
Best answer: C
Explanation: Macie uses managed data discovery to identify sensitive data such as PII in S3 and produce findings. Batch, Route 53, and Cloud9 do not classify S3 data for sensitive-content risk.
What this tests: incident containment
An EC2 instance is suspected of compromise. The team wants to preserve evidence while immediately limiting network communication. What is the best first containment step?
Best answer: A
Explanation: Isolation through a restrictive security group can contain network activity while preserving the instance and volumes for investigation. Immediate termination or evidence deletion can destroy forensic data. Public exposure and disabled logging make the incident response worse.
What this tests: private access to AWS APIs
Instances in private subnets must call AWS Systems Manager APIs without using a NAT gateway or internet gateway. Which feature should be used?
Best answer: D
Explanation: Interface VPC endpoints let private resources reach supported AWS APIs over private connectivity. Systems Manager typically requires endpoints such as ssm, ssmmessages, and ec2messages for private managed-instance operation. Public IPs, public DNS, and ALBs do not provide private API access.
What this tests: unused external access analysis
A security engineer wants to identify resource policies that allow access from outside the account or organization, such as S3 bucket policies and IAM role trust policies. Which service should be used?
Best answer: C
Explanation: IAM Access Analyzer evaluates policies and reports external access findings for supported resources. It is directly aligned with detecting unintended cross-account or public access. Lightsail, Backup, and Elastic Beanstalk do not analyze policy exposure.
What this tests: secrets rotation
A database password used by an application must be stored securely and rotated on a schedule with minimal custom code. Which service is the best fit?
Best answer: A
Explanation: Secrets Manager supports secure storage and managed rotation workflows for secrets such as database credentials. Plaintext variables, source-code storage, and email-based rotation create exposure and operational risk.
What this tests: centralized security posture
A security team uses GuardDuty, Inspector, Macie, IAM Access Analyzer, and AWS Config across accounts. They want one place to aggregate and prioritize findings against security standards. Which service is most appropriate?
Best answer: B
Explanation: Security Hub aggregates findings from AWS security services and partners, maps findings to standards, and supports centralized security posture management. Queues, desktop services, and application hosting do not provide security finding aggregation.
flowchart LR
A["Asset and threat"] --> B["Identity boundary"]
B --> C["Network and workload control"]
C --> D["Data protection"]
D --> E["Detection and response"]
E --> F["Governance evidence"]
Use this map when a Security Specialty scenario asks where to apply a control. Strong answers identify the asset, choose the right identity and network boundary, protect data, and preserve monitoring evidence.
| Topic | Strong answer pattern | Common trap |
|---|---|---|
| IAM | Use least privilege, conditions, roles, permission boundaries, and access analysis | Attaching broad managed policies to solve one denial |
| Data protection | Encrypt appropriately, manage keys, restrict access, and monitor use | Encrypting data while leaving broad identity access |
| Network security | Use security groups, NACLs, endpoints, routing, inspection, and logs | Assuming private subnet placement is sufficient |
| Detection | Use CloudTrail, Config, GuardDuty, Security Hub, and meaningful alerting | Collecting logs without response ownership |
| Incident response | Isolate, preserve evidence, rotate credentials, and remediate root cause | Deleting compromised resources before capturing evidence |
| Governance | Apply organization guardrails, audit evidence, and exception ownership | Treating compliance as a one-time checklist |
Use this page to review sample questions, request an update for this route, and compare related IT Mastery pages.
| If you need to practice… | Best page | Why |
|---|---|---|
| baseline cybersecurity | Security+ SY0-701 | Best live route for core security architecture, operations, and governance. |
| AWS architecture controls | SAA-C03 | Useful for AWS-native security, resiliency, networking, and access-boundary decisions. |
| AWS operations and monitoring | SOA-C03 | Reinforces logging, monitoring, remediation, backup, and operational security signals. |