AWS Certified Security - Specialty (SCS-C03) practice questions

Domain coverage 6 domains

• Detection (16%)
• Incident Response (14%)
• Infrastructure Security (18%)
• Identity and Access Management (20%)
• Data Protection (18%)
• Security Foundations and Governance (14%)

Sample questions 9 of 86 shown

1. Q1 Detection (16%)

   Which configuration enables an organization to continuously monitor for unauthorized behavior across all AWS accounts and S3 data in a multi-account environment using machine learning and threat intelligence?

   1. AWS Config
   2. Amazon GuardDuty with delegated administrator
   3. AWS CloudTrail organization trail
   4. AWS Trusted Advisor

   Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity using ML, anomaly detection, and threat intelligence. It analyzes CloudTrail logs, VPC Flow Logs, DNS logs, EKS audit logs, and S3 data events. Delegated administrator management through AWS Organizations enables organization-wide coverage.
2. Q2 Detection (16%)

   An Amazon GuardDuty finding indicates a compromised EC2 instance is generating cryptocurrency mining traffic. What is the correct order of actions to preserve forensic evidence while stopping the threat?

   1. Immediately terminate the instance
   2. Snapshot EBS volumes, replace the security group with an isolated group, capture memory, then stop or terminate
   3. Reboot the instance and detach its IAM role
   4. Change the SSH key pair and continue monitoring

   Forensic best practice preserves volatile (memory) and non-volatile (disk) evidence before isolation. The correct sequence: 1) Snapshot EBS volumes; 2) Replace the security group with one that blocks all traffic; 3) Capture memory via SSM or forensic AMI; 4) Stop or terminate the instance.
3. Q3 Detection (16%)

   Which AWS service provides automated vulnerability scanning of EC2 instances, ECR container images, and Lambda function code?

   1. Amazon Inspector
   2. AWS Config
   3. Amazon Macie
   4. AWS Trusted Advisor

   Amazon Inspector continuously scans EC2 instances, Amazon ECR container images (enhanced scanning), and Lambda functions (including layers and dependencies) for software vulnerabilities and unintended network exposure. It generates prioritized findings integrated with Security Hub.
4. Q4 Detection (16%)

   Security Hub aggregates findings across accounts. A team needs automatic ticket creation in ITSM and automated Lambda remediation for every new CRITICAL finding. What is the recommended integration approach?

   1. Poll the Security Hub API from a Lambda function every 5 minutes
   2. Use EventBridge to match "Security Hub Findings - Imported" events with critical severity and route to multiple targets
   3. Enable an SNS topic on the Security Hub master account
   4. Configure CloudTrail Insights to trigger Security Hub events

   Security Hub publishes findings as "Security Hub Findings - Imported" events to the default EventBridge bus. EventBridge rules can filter by severity and distribute events to Lambda, Step Functions, SNS, or partner targets like ServiceNow and Jira.
5. Q5 Detection (16%)

   A SOC analyst needs to investigate the relationship between IAM principals, EC2 instances, and external IP addresses associated with a GuardDuty finding. Which AWS service is designed for graph-based investigations?

   1. AWS Config Aggregator
   2. Amazon Detective
   3. AWS CloudTrail Lake
   4. AWS Audit Manager

   Amazon Detective ingests CloudTrail, VPC Flow Logs, GuardDuty, and EKS audit data to build a behavior graph. Analysts can start from a finding and pivot to related entities, timeline activity, and historical baselines for rapid investigation.
6. Q6 Detection (16%)

   After GuardDuty reports a suspicious EC2 instance, the security team needs to detect whether EBS volumes contain malware. The solution must not disrupt the running workload. Which capability meets this requirement?

   1. Run ClamAV via SSM on the running instance
   2. GuardDuty Malware Protection, which snapshots EBS volumes and scans in an AWS-owned account
   3. AWS Support manual analysis
   4. Inspector scanning EBS snapshots after they are copied to S3

   GuardDuty Malware Protection snapshots the suspicious instance's EBS volumes, restores them in an AWS-owned account, scans for malware, and reports findings. This has zero impact on the running workload.
7. Q7 Detection (16%)

   GuardDuty continuously generates findings for benign penetration testing from the company's corporate IP range. The team wants these findings to stop appearing without disabling detection. What is the correct mechanism?

   1. Disable the GuardDuty detector
   2. Create a GuardDuty suppression rule to auto-archive matching findings
   3. Add the IP range to Network Firewall allow rules
   4. Manually delete findings daily

   GuardDuty suppression rules allow you to define filter criteria (finding type, source IP, account, etc.). Matching findings are automatically archived and hidden from the active list while detection continues for everything else.
8. Q8 Detection (16%)

   A GuardDuty finding indicates runtime activity on an EKS cluster consistent with a reverse shell. Which GuardDuty capability surfaces this type of in-container threat?

   1. GuardDuty Runtime Monitoring for EKS, ECS, and EC2
   2. GuardDuty S3 Protection
   3. GuardDuty Lambda Protection
   4. Inspector container scanning

   GuardDuty Runtime Monitoring uses eBPF-based agents to inspect process, file, network, and kernel behavior inside running containers and EC2 instances. It detects threats that only appear at runtime, such as reverse shells, crypto miners, or kernel tampering.
9. Q9 Detection (16%)

   Which feature enables a multi-account organization to receive consolidated findings from GuardDuty, Inspector, and Security Hub in a single delegated security account?

   1. Manual cross-account IAM role chaining
   2. AWS Organizations delegated administrator per security service
   3. Resource Access Manager for sharing findings
   4. EventBridge cross-region replication

   AWS Organizations supports delegated administrator for GuardDuty, Inspector, Security Hub, Macie, Detective, and other services. This enables automatic enablement for new accounts and centralized management.

Answer all 86 questions with instant feedback →

Reader reviews 112 ratings

• Excellent value for SCS-C03 prep. The lifetime access means I can always come back to review concepts when needed.

  ★★★★★★ Samantha L.

• Three of my coworkers used this for SCS-C03 and all passed. Figured I’d give it a shot — worked like a charm.

  ★★★★★★ Derek S.

• My boss asked me to get the SCS-C03 cert for work. This was the best study tool I found. Passed in three weeks.

  ★★★★★★ Austin P.

• Best SCS-C03 prep I’ve found online. The question pool is deep and the randomized practice mode keeps you on your toes.

  ★★★★★★ Mason T.

• The SCS-C03 bank has a good mix of easy, medium, and hard questions. Kept me engaged and prevented me from getting complacent.

  ★★★★★★ Skylar M.

• The SCS-C03 certification opened up a promotion for me at work. These practice questions were a big part of that success.

  ★★★★★★ Ryan J.

Frequently asked questions

Free study resources

Community-verified analysis of 17 questions from real test-taker discussions — 5 deep analyses and 0 FAQs.

More Amazon exams