SCS-C03AWS Certified Security – Specialty
What the exam covers
- Threat detection and monitoring 62 practice questions 16%
- Incident response 35 practice questions 14%
- Infrastructure security 57 practice questions 18%
- Identity and access management 54 practice questions 20%
- Data protection 69 practice questions 18%
- Security foundations and governance 53 practice questions 14%
Study guide
From AWS
About SCS-C03
The current version of the AWS security specialty. It goes deep on detection with GuardDuty, Security Hub and Detective, logging architecture, incident response and forensics, edge and network protection, KMS and encryption, and IAM policy evaluation across accounts.
Who it's for. Security engineers and architects responsible for AWS environments.
How to prepare
- Be able to evaluate IAM policies by hand: explicit deny, SCPs, permission boundaries, resource policies and session policies.
- KMS key policies, grants and cross-account key use are a common place to slip.
- For incident response, know the order: isolate, preserve evidence (snapshots, memory), then investigate.
Sample SCS-C03 questions
Try these with the answers on the page, then practise the full bank.
- A container platform team notices a shell process spawned inside a running pod that opened an outbound connection to an unknown host, which is typical of an attacker gaining interactive access. Which threat detection capability watches process and file behavior inside running workloads to catch this? Threat detection and monitoring
- Responders need a playbook for a compromised workload. It must pause for an analyst's approval before revoking the instance role's active sessions and isolating the host, and it must record each step for audit. Which combination best models this? Incident response
- A development VPC needs flow records only for denied traffic, stored as cheaply as possible, and the team will query them occasionally with SQL. Which delivery configuration is most economical? Threat detection and monitoring
- A media company streams video from a private S3 bucket through a CloudFront distribution. The bucket uses KMS encryption. The team wants direct requests to the bucket endpoint to fail unless they come from that distribution, signed with SigV4. Which setup achieves this? Infrastructure security
- A company runs several microservices on an Amazon EKS cluster. Each microservice needs read access to one S3 prefix, and no service should inherit access that belongs to another. The team also wants no static keys stored anywhere in the cluster or the images. Which design meets these goals? Infrastructure security
- A partner's integration generates a presigned download link using its own IAM role. The partner downloads over plain HTTP and receives AccessDenied. The link has not expired, and the role holds s3:GetObject permission. What explains the denial? Identity and access management
- A company in Account A encrypts its analytics reports with a customer managed KMS key. A data science team in Account B must decrypt those reports, and Account B can already read the bucket that holds them. What must be in place for Account B's decryption calls to succeed? Data protection
- An analytics pipeline writes millions of small objects per hour to a bucket encrypted with a customer managed KMS key. KMS request charges and throttling are rising. Which bucket setting cuts the number of KMS requests while keeping the same customer key? Data protection
- All 50 sample questions
Questions people ask
Is this SCS-C03 practice exam free?
Yes. All 330 questions, the timed mock exam and the explanations are free, and there's no account to create.
Are these real exam questions?
No. Real exam questions are confidential under the AWS candidate agreement. These are practice questions written to cover the same domains in the same scenario style, each with an explanation of why the answer is right.
How is the SCS-C03 mock exam scored?
Questions are drawn from every domain in proportion to the exam guide, and you get a raw percentage with a breakdown by domain. AWS uses scaled scoring, so treat 75% or more here as a sign you're ready rather than a predicted score.
Where is my progress saved?
In your browser, on this device. Nothing is sent to us apart from the answers you check, and clearing site data resets it.