SCS-C03 — AWS Certified Security - Specialty
Amazon

AWS Certified Security - Specialty (SCS-C03) Practice Questions

★★★★★★ 4.7 87 verified reviews
85 questions
June 13, 2026 updated
✓ Online quiz simulator
▶ Start Free Practice Exam

Domain coverage

  • Detection (16%)
  • Incident Response (14%)
  • Infrastructure Security (18%)
  • Identity and Access Management (20%)
  • Data Protection (18%)
  • Security Foundations and Governance (14%)

Sample Questions (9 of 85 shown)

Q1 Detection (16%)
Which configuration enables an organization to continuously monitor for unauthorized behavior across all AWS accounts and S3 data in a multi-account environment using machine learning and threat intelligence?
  1. AWS Config
  2. Amazon GuardDuty with delegated administrator
  3. AWS CloudTrail organization trail
  4. AWS Trusted Advisor
✓ Correct Answer: B
Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity using ML, anomaly detection, and threat intelligence. It analyzes CloudTrail logs, VPC Flow Logs, DNS logs, EKS audit logs, and S3 data events. Delegated administrator management through AWS Organizations enables organization-wide coverage.
Q2 Detection (16%)
An Amazon GuardDuty finding indicates a compromised EC2 instance is generating cryptocurrency mining traffic. What is the correct order of actions to preserve forensic evidence while stopping the threat?
  1. Immediately terminate the instance
  2. Snapshot EBS volumes, replace the security group with an isolated group, capture memory, then stop or terminate
  3. Reboot the instance and detach its IAM role
  4. Change the SSH key pair and continue monitoring
✓ Correct Answer: B
Forensic best practice preserves volatile (memory) and non-volatile (disk) evidence before isolation. The correct sequence: 1) Snapshot EBS volumes; 2) Replace the security group with one that blocks all traffic; 3) Capture memory via SSM or forensic AMI; 4) Stop or terminate the instance.
Q3 Detection (16%)
Which AWS service provides automated vulnerability scanning of EC2 instances, ECR container images, and Lambda function code?
  1. Amazon Inspector
  2. AWS Config
  3. Amazon Macie
  4. AWS Trusted Advisor
✓ Correct Answer: A
Amazon Inspector continuously scans EC2 instances, Amazon ECR container images (enhanced scanning), and Lambda functions (including layers and dependencies) for software vulnerabilities and unintended network exposure. It generates prioritized findings integrated with Security Hub.
Q4 Detection (16%)
Security Hub aggregates findings across accounts. A team needs automatic ticket creation in ITSM and automated Lambda remediation for every new CRITICAL finding. What is the recommended integration approach?
  1. Poll the Security Hub API from a Lambda function every 5 minutes
  2. Use EventBridge to match "Security Hub Findings - Imported" events with critical severity and route to multiple targets
  3. Enable an SNS topic on the Security Hub master account
  4. Configure CloudTrail Insights to trigger Security Hub events
✓ Correct Answer: B
Security Hub publishes findings as "Security Hub Findings - Imported" events to the default EventBridge bus. EventBridge rules can filter by severity and distribute events to Lambda, Step Functions, SNS, or partner targets like ServiceNow and Jira.
Q5 Detection (16%)
A SOC analyst needs to investigate the relationship between IAM principals, EC2 instances, and external IP addresses associated with a GuardDuty finding. Which AWS service is designed for graph-based investigations?
  1. AWS Config Aggregator
  2. Amazon Detective
  3. AWS CloudTrail Lake
  4. AWS Audit Manager
✓ Correct Answer: B
Amazon Detective ingests CloudTrail, VPC Flow Logs, GuardDuty, and EKS audit data to build a behavior graph. Analysts can start from a finding and pivot to related entities, timeline activity, and historical baselines for rapid investigation.
Q6 Detection (16%)
After GuardDuty reports a suspicious EC2 instance, the security team needs to detect whether EBS volumes contain malware. The solution must not disrupt the running workload. Which capability meets this requirement?
  1. Run ClamAV via SSM on the running instance
  2. GuardDuty Malware Protection, which snapshots EBS volumes and scans in an AWS-owned account
  3. AWS Support manual analysis
  4. Inspector scanning EBS snapshots after they are copied to S3
✓ Correct Answer: B
GuardDuty Malware Protection snapshots the suspicious instance's EBS volumes, restores them in an AWS-owned account, scans for malware, and reports findings. This has zero impact on the running workload.
Q7 Detection (16%)
GuardDuty continuously generates findings for benign penetration testing from the company's corporate IP range. The team wants these findings to stop appearing without disabling detection. What is the correct mechanism?
  1. Disable the GuardDuty detector
  2. Create a GuardDuty suppression rule to auto-archive matching findings
  3. Add the IP range to Network Firewall allow rules
  4. Manually delete findings daily
✓ Correct Answer: B
GuardDuty suppression rules allow you to define filter criteria (finding type, source IP, account, etc.). Matching findings are automatically archived and hidden from the active list while detection continues for everything else.
Q8 Detection (16%)
A GuardDuty finding indicates runtime activity on an EKS cluster consistent with a reverse shell. Which GuardDuty capability surfaces this type of in-container threat?
  1. GuardDuty Runtime Monitoring for EKS, ECS, and EC2
  2. GuardDuty S3 Protection
  3. GuardDuty Lambda Protection
  4. Inspector container scanning
✓ Correct Answer: A
GuardDuty Runtime Monitoring uses eBPF-based agents to inspect process, file, network, and kernel behavior inside running containers and EC2 instances. It detects threats that only appear at runtime, such as reverse shells, crypto miners, or kernel tampering.
Q9 Detection (16%)
Which feature enables a multi-account organization to receive consolidated findings from GuardDuty, Inspector, and Security Hub in a single delegated security account?
  1. Manual cross-account IAM role chaining
  2. AWS Organizations delegated administrator per security service
  3. Resource Access Manager for sharing findings
  4. EventBridge cross-region replication
✓ Correct Answer: B
AWS Organizations supports delegated administrator for GuardDuty, Inspector, Security Hub, Macie, Detective, and other services. This enables automatic enablement for new accounts and centralized management.

You've viewed 3 of 85 questions. Start the free practice exam to answer all questions with instant feedback.

Exam overview

The AWS Certified Security - Specialty (SCS-C03) is the definitive certification for cloud security professionals, validating advanced expertise in securing the AWS Cloud. This Specialty-level exam, the latest version replacing SCS-C02, tests your ability to implement comprehensive security controls across all AWS services — from threat detection and incident response to identity management, infrastructure protection, and data security governance.

The target candidate should have the equivalent of 3–5 years of experience securing cloud solutions, with deep knowledge of the AWS shared responsibility model, identity management at scale, multi-account governance, vulnerability management, firewall design (L3–L7), incident root cause analysis, and encryption methodologies. The exam covers six domains spanning the full security lifecycle. A distinguishing feature is its ordering and matching question types alongside traditional multiple choice and multiple response — requiring procedural security knowledge beyond conceptual understanding.

Our SCS-C03 practice test product provides comprehensive preparation with 500+ exam-style questions covering all six domains. Each question includes detailed explanations that explore security tradeoffs, service integration patterns, and compliance frameworks. The package features domain-wise practice modules, full-length simulation exams (65 questions, 170 minutes) with all four question types, and a downloadable PDF study guide featuring IAM policy patterns, security architecture blueprints, encryption strategy comparisons, and incident response playbooks for offline review.

Official Exam Domains & Weighting

To successfully pass the SCS-C03 exam, candidates must demonstrate security expertise across the following six domains:
  • Domain 1: Detection (16%)
Design and implement logging and monitoring for threat detection using CloudTrail, CloudWatch, VPC Flow Logs, and GuardDuty; analyze and respond to findings from Security Hub, Inspector, and Macie; implement automated detection mechanisms using EventBridge and Lambda; and configure centralized logging across multiple accounts using AWS Organizations and CloudTrail Lake.
  • Domain 2: Incident Response (14%)
Design incident response plans and runbooks for AWS environments; investigate security incidents using forensic analysis tools and root cause analysis techniques; automate containment and recovery actions using Systems Manager and Step Functions; manage security findings lifecycle from detection through remediation; and coordinate incident response with AWS Support and relevant stakeholders.
  • Domain 3: Infrastructure Security (18%)
Design and implement secure network architectures using VPC design, security groups, NACLs, WAF, Shield, and Network Firewall; implement secure edge protection using CloudFront and Route 53; design host-based security using EC2 security groups and Systems Manager; and implement secure service-to-service communication using VPC endpoints, PrivateLink, and API Gateway security.
  • Domain 4: Identity and Access Management (20%)
Design and implement identity management at scale using IAM (policies, roles, permission boundaries), AWS Organizations (SCPs), and SSO; implement federated access using Cognito, SAML, and OIDC; design RBAC and ABAC strategies; manage secrets with Secrets Manager and encrypt with KMS and CloudHSM; and implement privileged access management and temporary credentials.
  • Domain 5: Data Protection (18%)
Design and implement data encryption strategies for data at rest (S3, EBS, RDS, DynamoDB encryption with KMS and CloudHSM) and data in transit (TLS, VPN, ACM); classify data using Macie and implement appropriate protection controls; manage encryption key lifecycle with KMS and CloudHSM; implement S3 security features (bucket policies, Object Lock, versioning, access points); and design secure data sharing across accounts.
  • Domain 6: Security Foundations and Governance (14%)
Implement multi-account security governance using AWS Organizations, Control Tower, and Config; design compliance monitoring with Security Hub and Audit Manager; manage software supply chain risks; implement vulnerability management programs; respond to audits using AWS Artifact; and apply the AWS Well-Architected Security Pillar best practices.

What Our Customers Say 87 verified reviews

4.7 ★★★★★★ Based on 87 reviews
★★★★★★
The progress tracking feature for SCS-C03 really motivated me. Seeing my improvement over time was incredibly satisfying.
— Daniel H.
★★★★★★
I’ve purchased a few Amazon exam dumps over the years and this SCS-C03 one is easily the best quality.
— Samuel T.
★★★★★★
Detailed, organized, and accurate. Exactly what you want in SCS-C03 prep material. The explanations deserve special mention.
— Gabriel L.
★★★★★
Passed the SCS-C03 exam today! The scenario-based questions here were extremely similar to what I saw on the test.
— Riley B.
★★★★★★
Honestly, I wouldn’t have passed SCS-C03 without these. The explanations actually teach you instead of just giving the answer.
— Jordan P.
★★★★★★
The SCS-C03 explanations are detailed and educational. I learned more from reviewing wrong answers than from any book.
— Rachel S.

Log in to rate this exam and leave a review.

Submitted for moderation before publishing. Keep it helpful and respectful.

Frequently Asked Questions

The SCS-C03 is the latest version of the AWS Security Specialty exam, featuring updated domains and modernized content. Key changes include: a stronger focus on multi-account security governance (Organizations, Control Tower), expanded coverage of incident response automation, the addition of ordering and matching question types, updated coverage reflecting new AWS security services and features, and domain restructuring from 5 domains (SCS-C02) to 6 domains (SCS-C03). The new exam better reflects modern security practices emphasizing DevSecOps, automated remediation, and enterprise-scale governance.

IAM is the highest-weighted domain at 20% and is critical across all other domains. Key topics include: IAM policies (identity-based, resource-based, permission boundaries, trust policies), SCPs at the organizational level, cross-account access patterns (roles vs resource-based policies), federated access (SAML, OIDC, Cognito), RBAC vs ABAC strategies, IAM Access Analyzer for identifying unintended access, and temporary credentials with STS. You should be able to design IAM solutions for complex scenarios involving multiple accounts, federation with external identity providers, and least-privilege access at scale.

Incident response (14%) and detection (16%) together represent 30% of the exam — nearly one-third. You need to understand the full incident response lifecycle: preparation (runbooks, automated remediation), detection and analysis (GuardDuty, Security Hub findings, CloudTrail investigation), containment and eradication (automated response with Lambda/Step Functions, isolating compromised resources), and post-incident activity (root cause analysis, corrective actions). The exam emphasizes automation — knowing how to use Systems Manager, EventBridge, and Lambda to automatically respond to security events rather than manual intervention.

Our product provides 500+ practice questions organized across all six domains, using all four question types (multiple choice, multiple response, ordering, matching). Each question includes detailed explanations that explore security service integration and compliance considerations. You get full-length simulation exams (65 questions, 170 minutes), domain-wise practice modules (Detection, Incident Response, Infrastructure Security, IAM, Data Protection, Security Foundations), and a downloadable PDF study guide featuring IAM policy design patterns, encryption strategy comparisons, incident response playbooks, and multi-account security governance frameworks.

SCS-C03 is a Specialty-level exam requiring significant security expertise. Candidates with SAA-C03 and 2+ years of security experience typically need 8-12 weeks (120-150 hours). Those with limited security background may need 14-18 weeks (180-240 hours). Recommended approach: (1) Master core AWS concepts (SAA-C03 level); (2) Study official exam guide and in-scope services; (3) Complete AWS Skill Builder security courses; (4) Gain hands-on experience with security services (GuardDuty, Security Hub, IAM, KMS, WAF); (5) Use our practice tests for domain-wise assessment; (6) Take multiple full-length simulation exams; (7) Review all explanations systematically.

Yes — encryption and key management appear across multiple domains, particularly Domain 5 (Data Protection, 18%) and indirectly in IAM (20%) and Detection (16%). You need comprehensive knowledge of: KMS key types (AWS managed, customer managed, custom key stores), key policies and grants, envelope encryption, key rotation strategies, CloudHSM use cases, S3 encryption options (SSE-S3, SSE-KMS, DSSE-KMS, SSE-C, client-side), RDS/DynamoDB/EBS encryption at rest, and TLS/ACM for data in transit. Understanding when to use KMS vs CloudHSM and designing encryption strategies for multi-account environments are critical exam topics.

The SCS-C03 is one of the most sought-after Specialty certifications due to the universal importance of cloud security. Certified professionals are positioned for roles such as Cloud Security Architect, Security Engineer, DevSecOps Engineer, Compliance Officer, and Security Consultant. The certification validates expertise in the most critical area of cloud computing — security — and is often listed as a prerequisite for senior security roles. With cybersecurity consistently ranked among the highest-paying IT fields, this certification significantly enhances both career prospects and earning potential, with many certified professionals commanding $150,000-$200,000+ salaries.