AWS Certified Security - Specialty (SCS-C03) Practice Exam
Advance your career in cloud security with the AWS Certified Security - Specialty (SCS-C03) Exam Simulator. Realistic, scenario-based practice exams mirror the official exam, with detailed explanations to close your knowledge gaps.
Exam domains
The SCS-C03 questions are grouped into 6 domains divided into 16 tasks.
SCS-C03 example questions
One example question per domain from the SCS-C03 question bank, with the correct answer and its explanation. Sign in to the simulator to answer them with all answer options.
A company uses the unified CloudWatch agent on Amazon EC2 instances to collect operating system security logs. After a least-privilege IAM policy update, agent metrics continue to arrive, but newly launched instances do not deliver logs to the existing /security/linux log group. The agent reports AccessDeniedException for logs:CreateLogStream. The agent uses the instance profile role. The role's only statement granting logs:CreateLogStream and logs:PutLogEvents allows both actions with this Resource value: arn:aws:logs:us-east-1:111122223333:log-group:/security/linux The configured log group and Region are correct. Network connectivity and local file permissions have been verified, and no other policies restrict these actions. Which change will restore log delivery while maintaining least privilege?
Show answer
CORRECT ANSWERChange the Resource for both actions to arn:aws:logs:us-east-1:111122223333:log-group:/security/linux:log-stream:* in the instance profile role's policy.
CreateLogStream and PutLogEvents authorize access to log-stream resources. The existing ARN identifies only the log group and does not match its log streams. The replacement ARN permits both operations on streams within the intended group without granting access to other groups.
An incident response team stores original system and application log archives in a versioned Amazon S3 evidence bucket. Each object version has a 90-day S3 Object Lock compliance-mode retention period. Lifecycle rules expire current objects and permanently delete eligible noncurrent versions after the approved retention period. Legal counsel identifies specific object version IDs that must be preserved for litigation. Their retention periods expire tomorrow, but the litigation has no known end date. Unrelated evidence must continue through normal disposal. After counsel authorizes release, the selected versions must become eligible for normal disposal without an additional fixed retention period. Automated cleanup roles can delete object versions but cannot change Object Lock retention settings or legal holds. Which action meets these requirements?
Show answer
CORRECT ANSWERApply an S3 Object Lock legal hold to each identified object version. Leave the lifecycle rules unchanged, and remove the holds only after counsel authorizes release.
A legal hold protects an individual object version from permanent deletion without requiring an expiration date. Lifecycle processing and cleanup roles cannot permanently delete held versions. Unrelated versions remain subject to normal disposal. Once the holds are removed and the original retention periods have expired, the selected versions become eligible for normal disposal.
A manufacturer uses an Amazon SageMaker AI real-time endpoint to summarize confidential engineering documents. The model must receive the complete documents to produce useful summaries. The endpoint has data capture enabled for requests and responses, and the application also writes request and response bodies to diagnostic logs. A security review finds confidential document text in both telemetry destinations. Company policy permits processing this text during inference but prohibits storing it in inference-monitoring data or diagnostic logs. Operations engineers must retain request correlation IDs, latency measurements, response status codes, and token counts. They do not require document text or generated summaries. Which change meets these requirements?
Show answer
CORRECT ANSWERDisable endpoint request and response data capture. Replace application body logging with an allowlist-based telemetry record containing only the required operational fields, and ensure error-handling paths do not log payloads.
This prevents confidential payloads from being persisted through either identified telemetry path while preserving the operational information engineers need. The complete documents can still be sent to the model for inference. Applying the same restriction to error paths prevents exceptions or debugging logic from bypassing the control.
A company uses one shared IAM role for application operators. Each operator session has trusted Project and Environment principal tags that operators cannot change. EC2 instances have corresponding resource tags maintained by a provisioning service. Some legacy instances are missing one or both tags. Operators must be able to reboot an instance only when BOTH instance tag values match the corresponding principal tag values. Instances missing either tag must remain inaccessible. Operators cannot modify instance tags, assume other roles, or change IAM policies. The role currently has no EC2 permissions, and no other policies grant or restrict the requested access. A security engineer will scope all new statements to EC2 instance ARNs in the approved account and Region. Which policy configuration meets these requirements?
Show answer
CORRECT ANSWERAdd one Allow statement for ec2:RebootInstances with this condition: {"StringEquals":{"ec2:ResourceTag/Project":"${aws:PrincipalTag/Project}","ec2:ResourceTag/Environment":"${aws:PrincipalTag/Environment}"}}.
Both condition keys must evaluate to true within the same statement. Each resource tag must therefore match its corresponding trusted principal tag. If either resource tag is absent, its StringEquals comparison does not match, and the statement does not grant access.
A company stores sensitive daily exports in an S3 bucket and uses S3 Cross-Region Replication to copy them to a disaster recovery bucket. Both buckets have versioning enabled. Each export uses a unique key and is never overwritten. All replication operations complete successfully before the exports reach their retention limits. Neither bucket uses Object Lock. The approved retention schedule makes current objects eligible for expiration 365 days after creation and their noncurrent versions eligible for permanent deletion 1 day after becoming noncurrent. The source bucket already has S3 Lifecycle rules implementing this schedule and cleaning up expired object delete markers. The destination bucket has no Lifecycle rules, and an audit finds that old replicas remain there after their source versions have been permanently deleted. Which change will apply the approved automatic disposal schedule to both existing and future replicas with the least operational overhead?
Show answer
CORRECT ANSWERConfigure destination bucket Lifecycle rules to expire current objects after 365 days, permanently delete noncurrent versions after 1 day, and remove expired object delete markers.
Lifecycle configurations are independent for source and destination buckets. Destination rules apply to existing and future matching replicas. Replicas retain the original objects' creation times for age-based Lifecycle processing. Current-version expiration, noncurrent-version expiration, and expired delete marker cleanup together implement the approved disposal schedule.
A company uses an AWS Control Tower landing zone to govern its AWS accounts. The security team has developed a CloudFormation template that deploys a company-specific AWS Config rule and its supporting resources without modifying Control Tower-managed resources. Platform operators must be able to select this approved security customization and its version when creating workload accounts through the Control Tower console. The customization must be deployed as part of the account provisioning workflow. The company does not want to modify the Control Tower-managed Account Factory product or maintain a separate post-provisioning automation pipeline. Which solution meets these requirements?
Show answer
CORRECT ANSWERPublish the template as a versioned AWS Service Catalog product in a blueprint hub account. Configure Account Factory Customization and select the product's blueprint and version when provisioning each workload account.
Account Factory Customization integrates Service Catalog blueprint products into Control Tower account provisioning. A blueprint can deploy custom security resources from a CloudFormation template. Operators can select the approved blueprint and version during account creation without modifying the Control Tower-managed Account Factory product or maintaining a separate deployment pipeline.
Exam mode and practice mode
| Exam mode | Practice mode | |
|---|---|---|
| Questions count | 65 | 1 - 65 |
| Time limit | 170 minutes | Optional, 10 - 200 minutes |
| Exam scope | 6 domains with the official questions ratio | Selected domains with the official questions ratio |
| Correct answers | After exam submission | After exam submission or after each answer |
| Question types | Mix of single and multiple correct answers | Single, multiple or both |
| Question hints | Never | Optional |
| Question domain | Revealed after exam submission | Revealed after submission or during the exam |
| Scoring | 15 of 65 questions do not count towards the result | Official AWS method or mathematical mean |
See all simulator features on the AWS Exam Simulator page.
Technologies and concepts
Infrastructure as code (IaC)
IaC turns infrastructure definitions into repeatable deployment processes that can be reviewed, tested, and automated. It helps engineers create consistent environments, reduce manual errors, and apply security standards across accounts while maintaining a traceable history of changes.
Secure remote access
Secure remote access combines identity verification, authorization, protected transport, and monitoring to make resources accessible without granting unnecessary network exposure. In cloud environments, it applies to employee application access, administrative sessions, private service access, and connectivity between on-premises networks and cloud workloads.
Certificate management
It covers certificate issuance, validation, deployment, renewal, revocation, and retirement, together with protection of the keys and trust chains that make certificates useful. In cloud environments, effective certificate management prevents outages from expired certificates and supports authenticated, encrypted communication across public endpoints, internal services, accounts, and Regions.
Services on the exam
All 26 AWS services that can appear on the SCS-C03 exam.