AWS Certified Security - Specialty Questions and Answers
300 questions organized by topic with detailed explanations
AWS
SCS-C03
300 questions
6 topics
Updated Jul 2026A team wants broad, continuous visibility into where sensitive data might exist across its Amazon S3 estate before decid...A company needs a searchable, downloadable, and immutable record of the last 90 days of management events in a single AW...A security team enables Amazon GuardDuty in an AWS account for the first time. Which data sources does GuardDuty start a...
Incident Response
42 questions12 easy18 medium12 hard~14% of exam
A team wants a vulnerability management service that automatically discovers and continuously rescans eligible resources...An Amazon Inspector finding is based on a vulnerability that is exploitable over the network, but the affected EC2 insta...A company wants administrators to connect to EC2 instances for incident response without opening inbound SSH or RDP port...
Infrastructure Security
54 questions12 easy27 medium15 hard~18% of exam
A company must identify unintended network access paths relative to its security requirements and demonstrate compliance...Which statement accurately describes the protection scope of AWS Shield Standard and AWS Shield Advanced?A company wants to verify that all network paths between certain resources and internet gateways include expected contro...
Identity and Access Management
60 questions18 easy29 medium13 hard~20% of exam
What is the primary purpose of a permissions boundary for an IAM user or role?A company enabled an external access analyzer in one AWS Region and expects it to monitor all supported resources in eve...A company wants CloudTrail logs to reflect the actual workforce user who accessed downstream AWS managed applications th...
Data Protection
54 questions12 easy27 medium15 hard~18% of exam
A security architect wants full control over KMS key lifecycle and usage permissions for an encryption key used by appli...An object version in Amazon S3 is protected by Object Lock in compliance mode until a future date. An administrator want...A company uses S3 Cross-Region Replication for objects encrypted with a multi-Region KMS key and expects replication to ...
Security Foundations and Governance
42 questions12 easy24 medium6 hard~14% of exam
A platform team wants a configurable account template that standardizes the provisioning of new AWS accounts with pre-ap...A team wants a single CloudFormation template to deploy baseline security resources consistently across multiple AWS acc...A compliance team wants a service that uses prebuilt frameworks, automatically collects evidence for in-scope AWS accoun...
All Questions
| # | Question | Topic | Difficulty |
|---|---|---|---|
| 1 | What is the primary purpose of a permissions boundary for an IAM user or role? | Identity and Access Management | easy |
| 2 | A company must identify unintended network access paths relative to its security requirements and de... | Infrastructure Security | medium |
| 3 | Which statement accurately describes the protection scope of AWS Shield Standard and AWS Shield Adva... | Infrastructure Security | hard |
| 4 | A company wants to verify that all network paths between certain resources and internet gateways inc... | Infrastructure Security | hard |
| 5 | A platform team wants a configurable account template that standardizes the provisioning of new AWS ... | Security Foundations and Governance | medium |
Sign in to see all 300 questions
Create a free account to browse the questions included with the free plan.
Ready to test your knowledge?
Take a full AWS Certified Security - Specialty practice test with timed exam simulation.
Start Practice Test