Free SCS-C03: AWS Certified Security - Specialty Exam Questions and Answers

Last updated: September 19, 2026

Exam code

SCS-C03

Provider

Amazon

Questions in our bank

1000+

Free to read

First 10, with answers

Our test mode duration & pass mark

130 mins · 70%

Verified answers

Reviewed weekly

Recommended: Switch to Test Mode to start a practice test that simulates the real exam experience.

1. Question #1

   A security team manages a company's AWS Key Management Service (AWS KMS) customer managed keys. Only members of the security team can administer the KMS keys. The company's application team has a software process that needs temporary access to the keys occasionally. The security team needs to provide the application team's software process with access to the keys. Which solution will meet these requirements with the LEAST operational overhead?

   • A. Export the KMS key material to an on-premises hardware security module (HSM). Give the application team access to the key material.
   • B. Edit the key policy that grants the security team access to the KMS keys by adding the application team as principals. Revert this change when the application team no longer needs access.
   • C. Create a key grant to allow the application team to use the KMS keys. Revoke the grant when the application team no longer needs access.
   • D. Create a new KMS key by generating key material on premises. Import the key material to AWS KMS whenever the application team needs access. Grant the application team permissions to use the key.
   Reveal Answer

2. Question #2

   A company stores sensitive data in an Amazon S3 bucket. The company encrypts the data at rest by using server-side encryption with Amazon S3 managed keys (SSE-S3). A security engineer must prevent any modifications to the data in the S3 bucket. Which solution will meet this requirement?

   • A. Configure S3 bucket policies to deny DELETE and PUT object permissions.
   • B. Configure S3 Object Lock in compliance mode with S3 bucket versioning enabled.
   • C. Change the encryption on the S3 bucket to use AWS Key Management Service (AWS KMS) customer managed keys.
   • D. Configure the S3 bucket with multi-factor authentication (MFA) delete protection.
   Reveal Answer

3. Question #3

   A company's security team wants to receive near-real-time email notifications about AWS abuse reports related to DoS attacks. An Amazon SNS topic already exists and is subscribed to by the security team. What should the security engineer do next?

   • A. Poll Trusted Advisor for abuse notifications by using a Lambda function.
   • B. Create an Amazon EventBridge rule that matches AWS Health events for AWS_ABUSE_DOS_REPORT and publishes to SNS.
   • C. Poll the AWS Support API for abuse cases by using a Lambda function.
   • D. Detect abuse reports by using CloudTrail logs and CloudWatch alarms.
   Reveal Answer

4. Question #4

   A security engineer wants to forward custom application-security logs from an Amazon EC2 instance to Amazon CloudWatch. The security engineer installs the CloudWatch agent on the EC2 instance and adds the path of the logs to the CloudWatch configuration file. However, CloudWatch does not receive the logs. The security engineer verifies that the awslogs service is running on the EC2 instance. What should the security engineer do next to resolve the issue?

   • A. Add AWS CloudTrail to the trust policy of the EC2 instance. Send the custom logs to CloudTrail instead of CloudWatch.
   • B. Add Amazon S3 to the trust policy of the EC2 instance. Configure the application to write the custom logs to an S3 bucket that CloudWatch can use to ingest the logs.
   • C. Add Amazon Inspector to the trust policy of the EC2 instance. Use Amazon Inspector instead of the CloudWatch agent to collect the custom logs.
   • D. Attach the CloudWatchAgentServerPolicy AWS managed policy to the EC2 instance role.
   Reveal Answer

5. Question #5

   A company needs to identify the root cause of security findings and investigate IAM roles involved in those findings. The company has enabled VPC Flow Logs, Amazon GuardDuty, and AWS CloudTrail. Which solution will meet these requirements?

   • A. Use Amazon Detective to investigate IAM roles and visualize findings.
   • B. Use Amazon Inspector and CloudWatch dashboards.
   • C. Export GuardDuty findings to S3 and analyze with Athena.
   • D. Use Security Hub custom actions to investigate IAM roles.
   Reveal Answer

6. Question #6

   A company has decided to move its fleet of Linux-based web server instances to an Amazon EC2 Auto Scaling group. Currently, the instances are static and are launched manually. When an administrator needs to view log files, the administrator uses SSH to establish a connection to the instances and retrieves the logs manually. The company often needs to query the logs to produce results about application sessions and user issues. The company does not want its new automatically scaling architecture to result in the loss of any log files when instances are scaled in. Which combination of steps should a security engineer take to meet these requirements MOST cost-effectively? (Select TWO.)

   Select 2 answers.

   • A. Configure a cron job on the instances to forward the log files to Amazon S3 periodically.
   • B. Configure AWS Glue and Amazon Athena to query the log files.
   • C. Configure the Amazon CloudWatch agent on the instances to forward the logs to Amazon CloudWatch Logs.
   • D. Configure Amazon CloudWatch Logs Insights to query the log files.
   • E. Configure the instances to write the logs to an Amazon Elastic File System (Amazon EFS) volume.
   Reveal Answer

7. Question #7

   A company runs an application on an Amazon EC2 instance. The application generates invoices and stores them in an Amazon S3 bucket. The instance profile that is attached to the instance has appropriate access to the S3 bucket. The company needs to share each invoice with multiple clients that do not have AWS credentials. Each client must be able to download only the client's own invoices. Clients must download their invoices within 1 hour of invoice creation. Clients must use only temporary credentials to access the company's AWS resources. Which additional step will meet these requirements?

   • A. Update the S3 bucket policy to ensure that clients that use pre-signed URLs have the S3:Get* permission and the S3:List* permission to access S3 objects in the bucket.
   • B. Add a StringEquals condition to the IAM role policy for the EC2 instance profile. Configure the policy condition to restrict access based on the s3:ResourceTag/ClientId tag of each invoice. Tag each generated invoice with the ID of its corresponding client.
   • C. Update the script to use AWS Security Token Service (AWS STS) to obtain new credentials each time the script runs by assuming a new role that has S3:GetObject permissions. Use the credentials to generate the pre-signed URLs.
   • D. Generate an access key and a secret key for an IAM user that has S3:GetObject permissions on the S3 bucket. Embed the keys into the script. Use the keys to generate the pre-signed URLs.
   Reveal Answer

8. Question #8

   A company uses AWS IAM Identity Center to manage access to its AWS accounts. The accounts are in an organization in AWS Organizations. A security engineer needs to set up delegated administration of IAM Identity Center in the organization's management account. Which combination of steps should the security engineer perform in IAM Identity Center before configuring delegated administration? (Select THREE.)

   Select 3 answers.

   • A. Grant least privilege access to the organization's management account.
   • B. Create a new IAM Identity Center directory in the organization's management account.
   • C. Set up a second AWS Region in the organization's management account.
   • D. Create permission sets for use only in the organization's management account.
   • E. Create IAM users for use only in the organization's management account.
   • F. Create user assignments only in the organization's management account.
   Reveal Answer

9. Question #9

   A company is running its application on AWS. The company has a multi-environment setup, and each environment is isolated in a separate AWS account. The company has an organization in AWS Organizations to manage the accounts. There is a single dedicated security account for the organization. The company must create an inventory of all sensitive data that is stored in Amazon S3 buckets across the organization's accounts. The findings must be visible from a single location. Which solution will meet these requirements?

   • A. Set the security account as the delegated administrator for Amazon Macie and AWS Security Hub. Enable and configure Macie to publish sensitive data findings to Security Hub.
   • B. Set the security account as the delegated administrator for AWS Security Hub. In each account, configure Amazon Inspector to scan the S3 buckets for sensitive data. Publish sensitive data findings to Security Hub.
   • C. In each account, configure Amazon Inspector to scan the S3 buckets for sensitive data. Enable Amazon Inspector integration with AWS Trusted Advisor. Publish sensitive data findings to Trusted Advisor.
   • D. In each account, enable and configure Amazon Macie to detect sensitive data. Enable Macie integration with AWS Trusted Advisor. Publish sensitive data findings to Trusted Advisor.
   Reveal Answer

10. Question #10

    A company uses an organization in AWS Organizations to manage multiple AWS accounts. The company wants to centrally give users the ability to access Amazon Q Developer. Which solution will meet this requirement?

    • A. Enable AWS IAM Identity Center and set up Amazon Q Developer as an AWS managed application.
    • B. Enable Amazon Cognito and create a new identity pool for Amazon Q Developer.
    • C. Enable Amazon Cognito and set up Amazon Q Developer as an AWS managed application.
    • D. Enable AWS IAM Identity Center and create a new identity pool for Amazon Q Developer.
    Reveal Answer