SCS-C03
Free AWS Certified Security – Specialty (SCS-C03) Practice Test
12 exam-style questions with full explanations — no sign-up. Score yourself, then close your gaps with the full course.
Exam fee ~$3006 exam domainsLevel Expert2 timed practice tests in the course
✅ Free practice — no sign-up📝 Real exam-style questions💡 Detailed explanations💸 30-day money-back via Udemy
A security team needs to detect when an IAM user's access keys are used from an IP address outside their corporate IP range (10.0.0.0/8 and 172.16.0.0/12). The solution must generate alerts within 5 minutes and require minimal operational overhead. Which solution BEST meets these requirements?
EventBridge rules can directly pattern-match on CloudTrail event fields including sourceIPAddress. Using EventBridge with Lambda provides real-time detection (under 1 minute latency), requires no infrastructure management, and allows custom logic to evaluate IP ranges. This is the most operationally efficient solution for this specific IP-based detection requirement.
A security team discovers that an IAM user's access keys have been exposed in a public GitHub repository for the past 72 hours. CloudTrail logs show the keys were used to launch 50 EC2 instances in an unfamiliar region and create multiple S3 buckets. What should be the FIRST step in the incident response process?
The first priority in credential compromise is containment - immediately disable the compromised access keys to prevent further unauthorized actions. This stops the active threat before investigation and remediation. AWS best practice for incident response follows: contain, investigate, eradicate, recover.
A financial services company runs a multi-tier application on Amazon EC2 instances across multiple Availability Zones. The application processes sensitive customer data and must comply with PCI DSS requirements. Security policies mandate that all network traffic between application tiers must be encrypted in transit, and the company needs to verify encryption is enforced. Which solution BEST meets these requirements with minimal operational overhead?
ACM Private CA with TLS certificates provides end-to-end encryption between EC2 instances at the application level, which is required for PCI DSS compliance. VPC Flow Logs with EventBridge can detect unencrypted traffic patterns, and this solution encrypts data in transit between all tiers with verifiable monitoring.
A company has multiple AWS accounts managed through AWS Organizations. The security team needs to ensure that IAM users in the development account cannot create or modify IAM roles that have more permissions than their own user policies. Which solution provides the MOST restrictive control?
Permissions boundaries define the maximum permissions that an identity-based policy can grant to an IAM entity. When applied to users, they prevent those users from creating roles (or other entities) with permissions that exceed the boundary, directly addressing the requirement to prevent privilege escalation.
A financial services company stores customer transaction data in Amazon S3. The company must ensure that all data is encrypted at rest and that they maintain full control over the encryption keys, including the ability to immediately revoke access. The solution must also provide detailed audit logs of all key usage. Which solution meets these requirements?
SSE-KMS with Customer Managed Keys provides full control over encryption keys including the ability to disable or delete keys immediately to revoke access. CloudTrail automatically logs all KMS key usage including encrypt/decrypt operations, providing detailed audit logs. This meets all requirements for control and auditing.
A financial services company must demonstrate compliance with PCI DSS requirements for their AWS infrastructure. They need to implement automated compliance checking, generate evidence reports for auditors, and receive alerts when resources drift from compliant configurations. The solution must minimize operational overhead while providing continuous compliance visibility. Which AWS service BEST meets these requirements?
AWS Audit Manager is purpose-built for continuous compliance auditing with pre-built frameworks including PCI DSS. It automatically collects evidence from AWS services, generates audit-ready reports, maps controls to compliance requirements, and reduces manual effort in compliance demonstration. It directly addresses all requirements: automated checking, evidence reports, and continuous visibility with minimal overhead.
A financial services company must detect and alert when someone attempts to disable CloudTrail logging in any AWS account across their organization. The security team needs a centralized solution that works for all current and future accounts. Which approach provides the MOST comprehensive detection coverage?
An organization trail in the management account automatically applies to all accounts in the organization including future accounts. EventBridge rules matching StopLogging (cloudtrail:StopLogging) API calls provide real-time detection of attempts to disable logging. This centralized approach requires minimal configuration and automatically covers new accounts without additional deployment.
A company's Security Operations Center (SOC) needs to automate incident response for GuardDuty findings classified as 'High' severity. The solution must isolate affected EC2 instances by modifying security groups, capture forensic snapshots, and notify the security team via email. Which solution provides this automation with the LEAST operational overhead?
EventBridge + Lambda + SNS is the AWS-native, serverless approach with lowest operational overhead. EventBridge natively integrates with GuardDuty findings as event sources, Lambda provides custom remediation logic (security group isolation, EBS snapshots via API), and SNS handles notifications. All fully managed services with no infrastructure to maintain.
A company uses AWS Organizations with multiple AWS accounts for development, staging, and production environments. The security team needs to prevent any EC2 instance in the development accounts from being launched with a public IP address, while production accounts must retain this capability for specific use cases. Which approach provides the MOST centralized and effective control?
SCPs provide centralized, preventive controls at the organization level that cannot be overridden by local account administrators. An SCP applied to the development OU will block EC2 instance launches with public IPs across all development accounts while leaving production accounts unaffected, meeting the requirement for differentiated control.
A financial services application uses Amazon Cognito user pools for authentication. Regulatory requirements mandate that user session tokens must be revoked within 5 minutes if a user's account is disabled. The current configuration uses the default 1-hour access token validity. What is the MOST efficient solution to meet this requirement?
AdminUserGlobalSignOut immediately invalidates all tokens (access, refresh, and ID tokens) for a specific user, meeting the 5-minute requirement. This can be triggered automatically when an account is disabled, providing immediate token revocation without reducing token validity for all users.
A healthcare application running on Amazon EC2 processes patient records containing Protected Health Information (PHI). The security team requires that all Amazon EBS volumes attached to these instances be encrypted, and they want to prevent any team from launching EC2 instances with unencrypted EBS volumes in the future. What is the MOST effective way to enforce this requirement?
Enabling EBS encryption by default at the Region level ensures that all new EBS volumes are automatically encrypted without requiring any additional configuration. This is the most effective preventive control because it works at the infrastructure level and requires no user action, eliminating human error. Once enabled, it applies to all volumes created by any user or service.
An organization uses AWS Organizations with multiple AWS accounts across development, staging, and production environments. Security policies require that all S3 buckets must have versioning enabled and all EC2 instances must be launched from approved AMIs only. These policies must be enforced preventively across all accounts including future accounts. What is the MOST effective solution?
Service Control Policies (SCPs) provide preventive controls at the organization level that block actions before they occur. SCPs can deny the ability to disable versioning and restrict EC2 launches to approved AMIs only. SCPs automatically apply to all accounts in the organization including future accounts, enforcing compliance before violations occur rather than detecting and remediating after.
Ready for the real thing?
The full course: two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed explanations.
$119.99 $34.99 with code FREETEST33 — valid through August 23.
Get my $34.99 deal →SCS-C03 exam — quick answers
How much does the SCS-C03 exam cost?
The exam fee is approximately $300 and varies by region — confirm current pricing with the certification vendor before you book.
What topics are on the exam?
It covers 6 domains: Detection (16%), Incident Response (14%), Infrastructure Security (18%), Identity and Access Management (20%), Data Protection (18%), Security Foundations and Governance (14%). The full course has a dedicated chapter, lab and practice-test coverage for each.
Is this practice test really free?
Yes — all questions on this page are free with explanations and no sign-up. The paid Udemy course adds two full-length timed exams, video lessons and hands-on labs.
How do I get the discount?
Use code FREETEST33 at checkout for $34.99 (list $119.99) through August 23 — the enroll button applies it automatically.
Will this prepare me for the real exam?
The questions mirror the real exam's style and are mapped to the official domains. This is exam-focused preparation — combine the free test with the full course's timed simulations to gauge your readiness.