500 scenario-based practice questions covering detection, incident response, infrastructure security, identity and access management, data protection, and security governance. Mapped to the six domains of the official SCS-C03 exam guide.
No credit card required · Upgrade to 500 questions for $11.99
500 Exam-Style Questions
7-Day Money-Back Guarantee
Is this for you?
Your SCS-C03 exam is in the next 2–4 weeks
You've studied the concepts but aren't sure you'll pass
You want questions harder than the real exam
You want to understand why answers are correct, not just memorize
Not for you if:
You're looking for braindumps or exam leaks
You haven't started studying the concepts yet
The AWS Certified Security – Specialty (SCS-C03) is a specialty-level AWS certification. The exam has 65 questions, runs 170 minutes, costs $300, and requires a passing score of 750/1000. CertSharp provides 500 exam-style SCS-C03 practice questions — 30 free with no credit card — each with a detailed explanation.
Study guides teach concepts. We prepare you for the actual SCS-C03 exam.
1
Security scenarios that turn on the details: policy evaluation logic, KMS key policies, SCPs, GuardDuty and Security Hub findings
2
Every answer checked against current AWS documentation, with explanations that say why each distractor fails
3
Written for SCS-C03, the current version of the exam guide, across all six domains
4
Multiple-response questions included. The real exam can also include ordering and matching questions, which CertSharp does not simulate
Free Sample Questions
SCS-C03 Practice Questions (Free Sample)
Real SCS-C03 exam-style questions from our 500-question AWS Certified Security – Specialty bank, each with the correct answer and a detailed explanation.
Question 1 — SCS-C03
A member account in AWS Organizations is confirmed compromised. The company wants to block attacker activity while keeping the account and its resources for investigation. What is the best action?
A
Remove the account from the organization so the attacker loses access to shared resources
B
Close the account immediately so billing and attacker activity stop
C
Attach identity policies to individual users, one at a time, to deny their actions
D
Move the account to a quarantine OU with an SCP that denies actions except the response role
Correct answer: D — Explanation
An SCP applied through a quarantine OU limits what every principal in the account can do, including the attacker, while a response role exception allows investigation. Removing the account loses SCP control. Closing it risks evidence. Per-user policies are slow and miss roles and new principals.
Question 2Identity and Access ManagementEasy
A company needs full Active Directory features in AWS, including Group Policy, schema extensions, and trust relationships, without managing domain controllers. Which service fits?
A
Simple AD, a Samba-based directory with a subset of features
B
AWS Managed Microsoft AD
C
AD Connector, a proxy that forwards authentication to another directory
D
Amazon Cognito user pools, a directory of application users
Show answer & explanation
Correct answer: B — AWS Managed Microsoft AD
AWS Managed Microsoft AD runs real Windows domain controllers managed by AWS and supports Group Policy, schema extensions, and trusts. Simple AD is a Samba-based directory with fewer features and no trusts. AD Connector only proxies to an existing directory. Cognito user pools are for application sign-in and do not offer Windows domain services.
Question 3Infrastructure SecurityEasy
A database tier must have no route to the internet in either direction, including through NAT. Which subnet design meets this requirement?
A
Place the databases in subnets whose route tables contain just the local VPC route, with no internet gateway or NAT gateway route.
B
Place the databases in public subnets without public IP addresses and rely on security groups to deny inbound internet traffic.
C
Place the databases in private subnets with a default route to a NAT gateway and deny outbound traffic using the network ACL.
D
Place the databases in private subnets with a default route to an IPv6 egress gateway and block IPv4 traffic.
Show answer & explanation
Correct answer: A — Place the databases in subnets whose route tables contain just the local VPC route, with no internet gateway or NAT gateway route.
An isolated subnet has no route to an internet gateway, NAT gateway, or egress-only internet gateway, so no internet path exists regardless of other settings. Public subnets keep a route to the internet gateway, and a NAT gateway or egress-only internet gateway route still provides an outbound path that relies on filters rather than the absence of a route.
Question 4Data ProtectionMedium
A bank requires a single-tenant hardware security module that the bank alone administers, with keys used by an application through PKCS#11, and AWS personnel must have no access to key material. Which service should be chosen?
A
AWS KMS with an AWS managed key
B
AWS Secrets Manager with automatic rotation
C
AWS Certificate Manager with an exported key
D
AWS CloudHSM with a cluster the bank manages
Show answer & explanation
Correct answer: D — AWS CloudHSM with a cluster the bank manages
CloudHSM provides dedicated, single-tenant HSMs where the customer controls the HSM users and keys, and it exposes PKCS#11, JCE and CNG interfaces. KMS is multi-tenant and uses AWS managed APIs rather than PKCS#11. Secrets Manager stores secrets, not HSM keys. ACM manages certificates and does not provide an HSM.
Question 5DetectionMedium
An organization trail delivers to a bucket in the log archive account. The security architect wants the bucket policy to let CloudTrail write logs while preventing another account's trail from writing into the bucket. Which bucket policy statement achieves this?
A
Allow s3:PutObject for the principal * with a condition requiring a TLS connection
B
Allow s3:PutObject for the root user of each member account on the bucket prefix
C
Allow s3:PutObject for the bucket owner and grant public-read ACLs to the log prefix
D
Allow s3:PutObject for cloudtrail.amazonaws.com with an aws:SourceArn condition matching the trail's ARN
Show answer & explanation
Correct answer: D — Allow s3:PutObject for cloudtrail.amazonaws.com with an aws:SourceArn condition matching the trail's ARN
Granting the CloudTrail service principal with aws:SourceArn scoped to the specific trail prevents the confused deputy problem, so a trail in another account cannot write to the bucket. A wildcard principal with only a TLS condition lets anyone write. Granting member account roots does not match how trail delivery works. Public-read ACLs expose the logs.
Question 6Security Foundations and GovernanceMedium
The security team wants to list every unencrypted EBS volume across all accounts and Regions in the organization from one account, without assuming roles in member accounts. Which method accomplishes this?
A
Run an Athena query over the organization trail logs to find CreateVolume events without encryption
B
Run a script that assumes a role in each member account and calls describe-volumes in each Region
C
Run an advanced query against the Config aggregator with select-aggregate-resource-config filtering encrypted=false
D
Run a Macie discovery job over the volumes to flag the ones that are missing encryption
Show answer & explanation
Correct answer: C — Run an advanced query against the Config aggregator with select-aggregate-resource-config filtering encrypted=false
Config advanced queries can run against an aggregator and return resource configuration attributes across accounts and Regions from a single account. CloudTrail analysis shows creation events only for the logged period and may miss older volumes. A script that assumes roles contradicts the requirement. Macie scans S3 data and does not assess EBS volumes.
Question 7Identity and Access ManagementMedium
A credential broker calls AssumeRole with a session policy. What are the effective permissions of the resulting session?
A
The union of the role's identity-based policies and the session policy
B
The intersection of the role's identity-based policies and the session policy
C
The session policy alone, which replaces the role's identity-based policies
D
The role's identity-based policies, because session policies are ignored without a boundary
Show answer & explanation
Correct answer: B — The intersection of the role's identity-based policies and the session policy
Session policies limit what a session can do, and the effective permissions are the intersection of identity-based policies and the session policy, so the session policy cannot grant more than the role. A union would allow escalation. Replacing role policies would also let a session exceed the role. Session policies are evaluated whether or not a boundary exists.
Question 8Infrastructure SecurityMedium
A security team must prevent all accounts in an AWS Organization from launching instances from AMIs that are not published by the central image-builder account. The control must apply even to account administrators. Which approach is best?
A
An identity policy in each account that denies ec2:RunInstances unless the AMI has an Approved=true tag
B
An AWS Config managed rule that evaluates launched instances and starts an automatic remediation to stop them
C
An EventBridge rule on RunInstances that invokes a Lambda function to terminate instances with unapproved AMIs
D
An Organizations declarative policy that sets EC2 allowed images to AMIs owned by the central image-builder account
Show answer & explanation
Correct answer: D — An Organizations declarative policy that sets EC2 allowed images to AMIs owned by the central image-builder account
Declarative policies enforce the Allowed AMIs setting at the service level across the organization, so the block applies to all principals and cannot be overridden by account administrators. Per-account IAM policies can be changed by those administrators, and tags are mutable. Config remediation and EventBridge-Lambda termination are reactive because the unapproved instance has already launched.
Question 9Incident ResponseHard
A response workflow must snapshot volumes, wait for completion that can take hours, then isolate the instance after an analyst approves. Which orchestration fits?
A
A single Lambda function that polls snapshot status in a loop and sleeps until the analyst replies
B
An EventBridge Scheduler entry that re-invokes a Lambda function each minute until approval arrives
C
A Step Functions standard workflow that waits for snapshots and pauses on a task token for approval
D
A CloudWatch alarm action on the snapshot metric that terminates the instance when the alarm fires
Show answer & explanation
Correct answer: C — A Step Functions standard workflow that waits for snapshots and pauses on a task token for approval
Standard Step Functions workflows can run for long periods, track state, and pause on a task token until a human responds. A Lambda function is limited to 15 minutes per invocation, a scheduler loop has no built-in state or approval, and an alarm action cannot collect approval.
Want more SCS-C03 practice questions?
Take the free SCS-C03 practice test: 30 questions per session with instant explanations. Unlock all 500 questions plus timed exam mode for $11.99 one-time.
Everything you need to know about AWS Certified Security – Specialty
What is the SCS-C03 exam?
SCS-C03 is the AWS Certified Security – Specialty exam. It validates expertise in securing AWS products and services. The exam costs $300, has 65 questions in 170 minutes, and requires a scaled score of 750 out of 1000 to pass.
How many questions are on SCS-C03?
The SCS-C03 exam has 65 questions: 50 scored and 15 unscored. The time limit is 170 minutes.
What question types are on SCS-C03?
SCS-C03 can include multiple choice, multiple response, ordering (put 3–5 steps in the right order), and matching (match responses to 3–7 prompts) questions. You must get every part of an ordering or matching question right to earn credit. CertSharp practice questions are multiple choice and multiple response.
What is the SCS-C03 passing score?
The SCS-C03 passing score is 750 on a scale of 100–1000. Scoring is compensatory, so you need to pass the exam overall rather than every domain.
What are the SCS-C03 exam domains?
SCS-C03 has six domains: Detection (16%), Incident Response (14%), Infrastructure Security (18%), Identity and Access Management (20%), Data Protection (18%), and Security Foundations and Governance (14%).
How hard is SCS-C03?
SCS-C03 is a Specialty exam and one of the harder AWS certifications. It expects precise knowledge of IAM policy evaluation, KMS, multi-account controls, and AWS security services, applied to long scenarios where small wording differences change the answer.
What experience does AWS recommend for SCS-C03?
AWS recommends the equivalent of 3–5 years of experience securing cloud solutions, including identity at scale, multi-account governance, incident response, logging and monitoring, and encryption. There is no formal prerequisite.
How long does it take to prepare for SCS-C03?
Plan for 8–12 weeks at 1–2 hours per day if you already work in cloud security. Practise writing and debugging IAM, SCP, and KMS policies, and work through GuardDuty, Security Hub, and incident response runbooks hands-on.
How much does the SCS-C03 exam cost?
The AWS Certified Security – Specialty (SCS-C03) exam costs $300 USD plus applicable taxes, at a Pearson VUE test center or online with a remote proctor. The certification is valid for 3 years.
Is there a free SCS-C03 practice test?
Yes. CertSharp offers a free SCS-C03 practice test for the AWS Security – Specialty exam: 30 questions per session with detailed explanations, no credit card required. The full 500-question SCS-C03 bank, including timed exam mode, is $11.99 one-time with lifetime access, or included in Pro.
Also on CertSharp
Related AWS Certification Practice Tests
Same 500-question depth, with 30 free questions per session.