Amazon AWS Certified Security - Specialty 2026 (SCS-C03)
Get full access to the updated question bank and pass on your first attempt.
Vendor
Amazon
Certification
Specialty Certifications
Content
107 Qs
Status
Verified
Updated
18 minutes ago
Test the Practice Engine
Experience our real exam environment with free demo questions
Premium Bundle
Complete Success Suite
Save $49 Instantly
-
✓Full PDF + Interactive Engine Everything you need to pass
-
✓All Advanced Question Types Drag & Drop, Hotspots, Case Studies
-
✓Priority 24/7 Expert Support Direct line to certification leads
-
✓90 Days Free Priority Updates Stay current as exams change
Success Metric
98.4% Pass Rate
Standard Simulation
Practice Engine
One-Time Payment
-
Web-Based (Zero Install)
-
Real Testing Environment Virtual & Practice Modes
-
Interactive Engine Drag & Drop, Hotspots
-
60 Days Free Updates
Compatible with All Devices
Basic Tier
PDF Study Guide
Digital Access
- ✓ Exam Questions (PDF)
- ✓ Mobile Friendly
- ✓ 60 Days Updates
Verified 10-Question Preview
Verified Community
The CertoMetrics Standard.
Recommend the #1 platform for verified Amazon certification resources.
Success Network
Help a Colleague Succeed.
Invite a peer to get their own updated SCS-C03 prep kit.
Exam Overview
The AWS Certified Security - Specialty certification validates a candidate's advanced technical skills and experience in securing the AWS platform. Achieving the SCS-C03 demonstrates expertise in designing and implementing robust security solutions, effectively managing security incidents, and adhering to compliance requirements within the AWS cloud. This credential is vital for professionals aiming to solidify their role as a trusted security expert, enabling organizations to protect critical data and applications from evolving threats. It signifies a deep understanding of AWS security services, best practices, and the shared responsibility model, opening doors to high-demand roles and elevating one's career trajectory in the rapidly expanding cloud security domain. This certification positions you as a leader in cloud security.
Questions
65
Passing Score
750/1000
Duration
170 Minutes
Difficulty
Expert
Level
Specialist
Skills Measured
Career Path
Target Roles
Common Questions
Is the material up to date?
Yes. We update our question bank weekly to match the latest Amazon standards. You get free updates for 90 days.
What format do I get?
You get instant access to both the **PDF** (for reading) and our **Premium Test Engine** (for exam simulation).
Is there a guarantee?
Absolutely. If you fail the SCS-C03 exam using our materials, we offer a full money-back guarantee.
When do I get the download?
Instantly. The download link is available in your dashboard immediately after payment is confirmed.
Free Study Guide Samples
Previewing updated SCS-C03 bank (22 Questions).
A company runs a global ecommerce website that is hosted on AWS. The company uses Amazon CloudFront to serve content to its user base. The company wants to block inbound traffic from a specific set of countries to comply with recent data regulation policies.
Which solution will meet these requirements MOST cost-effectively?
Correct Option: C
✅ Option C (Correct) Reasoning: CloudFront's geo-restriction feature is specifically designed to block or allow traffic from specified countries directly at the CloudFront edge. It is a native, highly cost-effective solution for this requirement as it leverages the existing CloudFront service without needing additional services like WAF or custom origin logic, thus minimizing cost.
❌ Why the other choices are incorrect:
- Option A is incorrect: Managing IP ranges for entire countries is operationally complex, prone to errors, requires constant updates, and incurs AWS WAF costs, making it neither simple nor cost-effective.
- Option B is incorrect: While AWS WAF with geo match is effective, it introduces additional costs for WAF web ACLs, rules, and requests processed, making it less cost-effective than CloudFront's native geo-restriction for this specific task.
- Option D is incorrect: Using geolocation headers requires custom logic at the origin (e.g., Lambda@Edge or application code) to process and deny requests, adding complexity and potentially incurring additional compute costs, which is not the most cost-effective approach.
A security engineer needs to control access to data that is encrypted with an AWS Key Management Service (AWS KMS) customer managed key. The security engineer also needs to use additional authenticated data (AAD) to prevent tampering with ciphertext.
Which solution will meet these requirements?
Correct Option: C
✅
Reasoning: The kms:EncryptionContext condition key in IAM policies enforces that specific authenticated data (AAD) must be provided during Encrypt and Decrypt operations. This simultaneously controls access based on context and prevents tampering, as decryption fails if the context does not match. ❌ Why the other choices are incorrect:
- Option A is incorrect: Passing a key alias identifies the key but does not enforce Additional Authenticated Data (AAD) or control access based on specific
EncryptionContextvalues to prevent tampering. - Option B is incorrect: While IAM policies restrict
EncryptandDecryptactions, this option is too general. It doesn't specify how to enforce AAD (EncryptionContext) to prevent tampering. - Option D is incorrect: Key policies control which IAM principals can use a key. While essential for access control, they don't inherently enforce
EncryptionContextas AAD to prevent tampering at the data context level without explicitkms:EncryptionContextconditions.
A company runs container-based workloads outside of AWS. The company wants the workloads to obtain temporary security credentials to securely access the company’s AWS account The company currently uses AWS IAM Identity Centre to manage user access to the company's AWS resources.
Which solution will meet this requirement?
Correct Option: A
✅ Option A (Correct)
Reasoning: AWS IAM Roles Anywhere enables workloads running outside of AWS to obtain temporary security credentials to access AWS resources. It achieves this by trusting digital certificates issued by a private CA as a trust anchor, and configuring an IAM role to trust the rolesanywhere.amazonaws.com service principal.
❌ Why the other choices are incorrect:
- Option B is incorrect: While IAM federation exists, "IAM service principal" is not the correct trust entity for external workload federation without specifying OIDC or SAML, and Roles Anywhere is the explicit service for this use case.
- Option C is incorrect: AWS IAM Identity Center manages user access. Setting up an application and assigning it to a group of users does not provide temporary credentials to a non-human workload.
- Option D is incorrect: Similar to C, this option focuses on user access via IAM Identity Center for a customer-managed application, not on enabling a workload to obtain temporary credentials.
A consultant agency needs to perform a security audit for a company's production AWS account Several consultants need access to the account. The consultant agency already has its own AWS account
The company requires multi-factor authentication (MFA) for all access to its production account. The company also forbids the use of long-term credentials.
Which solution will provide the consultant agency with access that meets these requirements?
Correct Option: D
✅ Option D (Correct) Reasoning: Creating an IAM role in the company's production account with a trust policy allowing the consultant agency's AWS account as principal, and enforcing MFA, provides temporary credentials. This approach eliminates long-term credentials for consultants in the production account and leverages their existing identities/MFA from their own account for secure cross-account access.
❌ Why the other choices are incorrect:
- Option A is incorrect: Creating IAM users in the company's production account for consultants introduces long-term credentials, violating the "forbids long-term credentials" requirement.
- Option B is incorrect: Amazon Cognito is primarily for web/mobile application user authentication, not the standard, direct cross-account AWS Console/API access for another AWS account's users assuming roles.
- Option C is incorrect: The IAM role should be created in the company's production account (the target account) for permissions, not in the consultant agency's account. The principal and role relationship is inverted.
A company has the following security policy for its Amazon Aurora MySQL databases for a single AWS account:
• Database storage must be encrypted at rest.
• Deletion protection must be enabled.
• Databases must not be publicly accessible.
• Database audit logs must be published to Amazon CloudWatch Logs.
A security engineer must implement a solution that continuously monitors all Aurora MySQL resources for continuous compliance with this policy. The solution must be able to display a database's compliance state for each part of the policy at any time.
Which solution will meet these requirements?
Correct Option: B
✅
Reasoning: AWS Config continuously monitors resource configurations against desired policies using managed rules. It directly checks for encryption, deletion protection, public accessibility, and logging, then displays the compliance state of each Aurora MySQL resource in its dashboard. ❌ Why the other choices are incorrect:
- Option A is incorrect: AWS Audit Manager collects evidence for audit reports, not for continuous, real-time operational compliance monitoring of individual resource configurations and states.
- Option C is incorrect: AWS Security Hub aggregates security findings and monitors against security standards, often consuming findings from Config. It doesn't directly implement continuous configuration monitoring or allow defining granular configuration policies to apply and view compliance states like Config.
- Option D is incorrect: While technically possible, this custom solution requires significant development and maintenance. AWS Config provides this functionality as a managed service with built-in rules, making it a more efficient and robust solution for continuous compliance.
A company creates AWS Lambda functions from container images that are stored in Amazon Elastic Container Registry (Amazon ECR). The company needs to identify any software vulnerabilities in the container images and any code vulnerabilities in the Lambda functions.
Which solution will meet these requirements?
Correct Option: C
✅
Reasoning: Amazon Inspector performs automated vulnerability management. Its ECR enhanced scanning identifies software vulnerabilities in container images. Its Lambda code scanning detects code vulnerabilities and configuration issues directly within Lambda functions, precisely meeting both requirements. ❌ Why the other choices are incorrect:
- Option A is incorrect: GuardDuty is a threat detection service for malicious activity, not for scanning static software or code vulnerabilities in ECR or Lambda functions.
- Option B is incorrect: GuardDuty's Runtime Monitoring and Lambda Protection detect runtime threats and suspicious behavior, not static software or code vulnerabilities as required.
- Option D is incorrect: Security Hub aggregates findings; it doesn't perform direct vulnerability scanning. "Runtime Monitoring and Lambda Protection" are GuardDuty features, not Security Hub.
A company hosts its public website on Amazon EC2 instances behind an Application Load Balancer (ALB). The website is experiencing a global DDoS attack by a specific IoT device brand that has a unique user agent
A security engineer is creating an AWS WAF web ACL and will associate the web ACL with the ALB. The security engineer must implement a rule statement as part of the web ACL to block the requests. The rule statement must mitigate the current attack and future attacks from these IoT devices without blocking requests from customers.
Which rule statement will meet these requirements?
Correct Option: D
✅ Option D (Correct)
Reasoning: The scenario specifies a "unique user agent" from a "specific IoT device brand." A string match rule, targeting the User-Agent header for that specific brand's identifier, precisely blocks the attacking devices without affecting legitimate users.
❌ Why the other choices are incorrect:
- Option A is incorrect: IoT device IP addresses can be dynamic, numerous, or shared, making IP set management impractical and prone to blocking legitimate traffic globally.
- Option B is incorrect: Blocking entire countries for a global attack would severely impact legitimate customers worldwide, as the attack origin is global.
- Option C is incorrect: A rate-based rule alone doesn't differentiate between malicious IoT traffic and legitimate high-volume requests, potentially blocking customers or failing to stop the specific attack.
A company has a PHP-based web application that uses Amazon S3 as an object store for user files. The S3 bucket that stores the files is configured for server-side encryption with Amazon S3 managed encryption keys (SSE-S3).
According to new security requirements, the company must control all encryption keys. Additionally, all objects in the S3 bucket must be encrypted by a key that the company controls.
Which combination of steps must a security engineer take to meet these requirements? (Select THREE.)
Correct Option: A,E,F
✅ **Create a new customer managed key in AWS Key Management Service (AWS KMS) **
Reasoning: To meet the requirement of controlling encryption keys, the company must create a Customer Managed Key (CMK) in AWS KMS. SSE-S3 uses AWS-managed keys, not customer-controlled keys. A CMK provides explicit control over key policies and usage.
✅ **Change the SSE-S3 configuration on the S3 bucket to server-side encryption with AWS KMS managed encryption keys (SSE-KMS) **
Reasoning: Configuring the S3 bucket for SSE-KMS allows it to use an AWS KMS key for server-side encryption. When combined with a CMK , this satisfies the requirement for the company to control the encryption key used for new objects.
✅ **Change all the S3 objects in the bucket to use the new encryption key **
Reasoning: Setting default bucket encryption only applies to new uploads. Existing objects, currently encrypted with SSE-S3, must be re-encrypted with the new CMK (via SSE-KMS) to ensure all objects in the bucket meet the new encryption requirements. ❌ Why the other choices are incorrect:
- Option B is incorrect: SSE-C requires the application to provide and manage the encryption key with each request, offering less centralized control and auditability compared to KMS, and does not integrate with S3 default encryption.
- Option C is incorrect: SSE-S3 is server-side encryption using AWS-managed keys. The idea of configuring a PHP SDK to use an "SSE-S3 key" for client-side encryption is contradictory and incorrect.
- Option D is incorrect: An AWS managed key for S3 in KMS (e.g.,
aws/s3) is managed by AWS, not controlled by the company, failing the primary requirement.
A company is operating an open-source software platform that is internet facing. The legacy software platform no longer receives security updates. The software platform operates using Amazon Route S3 weighted load balancing to send traffic to Amazon EC2 instances that connect to an Amazon RDS cluster. A recent report suggests this software platform is vulnerable to SQL injection attacks, with samples of attacks provided. The company's security engineer must secure this system against SQL injection attacks within 24 hours. The security engineer's solution must involve the least amount of effort and maintain normal operations during implementation.
What should the security engineer do to meet these requirements?
Correct Option: A
✅ Option A (Correct) Reasoning: Creating an ALB with existing EC2s as targets, applying an AWS WAF web ACL with SQL injection rules, then redirecting Route 53, is the most effective and least effort solution. It leverages a managed service to mitigate the vulnerability externally, preventing code changes, maintaining operations via controlled cutover, and strengthening security by restricting EC2 direct access.
❌ Why the other choices are incorrect:
- Option B is incorrect: Specifying only one EC2 instance as a CloudFront origin would remove existing load balancing and reduce availability, not maintaining normal operations.
- Option C is incorrect: This involves significant code changes for a legacy platform that no longer receives updates, making it high effort and unlikely within 24 hours.
- Option D is incorrect: AWS WAF cannot be directly applied to EC2 instances. SQL injection occurs through the application, not direct internet access to the database port.
A company's web application is hosted on Amazon EC2 instances running behind an Application Load Balancer (ALB) in an Auto Scaling group. An AWS WAF web ACL is associated with the ALB. AWS CloudTrail is enabled, and stores logs in Amazon S3 and Amazon CloudWatch Logs.
The operations team has observed some EC2 instances reboot at random. After rebooting, all access logs on the instances have been deleted. During an investigation, the operations team found that each reboot happened just after a PHP error occurred on the new-user-creation.php file. The operations team needs to view log information to determine if the company is being attacked.
Which set of actions will identify the suspect attacker's IP address for future occurrences?
Correct Option: D
✅ Option D (Correct)
Reasoning: WAF logs contain the client IP address and the full request URI, which is essential to identify new-user-creation.php access. Sending logs to S3 via Firehose and querying with Athena provides a durable, scalable, and cost-effective solution for security analysis, directly addressing the need for attacker IP identification.
❌ Why the other choices are incorrect:
- Option A is incorrect: VPC Flow Logs record network flow metadata (IP, port, protocol) but do not capture application-layer details like HTTP URI paths (
new-user-creation.php). Thus, they cannot identify the specific file access. - Option B is incorrect: The Application Load Balancer (ALB) does not support installing a CloudWatch agent to send application logs. ALB access logs are configured differently, typically sent directly to S3 or CloudWatch Logs.
- Option C is incorrect: While ALB access logs contain client IP and URI, WAF logs are superior for security investigations. WAF logs provide additional security context such as WAF rule actions, offering more specific insights into potential attacks detected by the WAF already in place.
A company's application team needs a new AWS Key Management Service (AWS KMS) customer managed key to use with Amazon S3. The company's security policy requires separate keys for different AWS services to limit security exposure.
How can a security engineer limit the KMS customer managed key to work with only Amazon S3?
Premium Solution Locked
Unlock all 107 answers & explanations
A company has an AWS account that hosts a production application. The company receives an email notification that Amazon GuardDuty has detected an Impact: Lam User Anomalous behavior finding in the account A security engineer needs to run the investigation playbook for this security incident and must collect and analyze the information without affecting the application.
Which solution will meet these requirements MOST quickly?
Premium Solution Locked
Unlock all 107 answers & explanations
A company in France uses Amazon Cognito with the Cognito Hosted IJI as an identity broker for sign-in and sign-up processes. The company is marketing an application and expects that all the application's users will come from France.
When the company launches the application, the company's security team observes fraudulent sign-ups for the application. Most of the fraudulent registrations are from users outside of France.
The security team needs a solution to perform custom validation at sign-up. Based on the results of the validation, the solution must accept or deny the registration request.
Which combination of steps will meet these requirements? (Select TWO.)
Premium Solution Locked
Unlock all 107 answers & explanations
A company wants to establish separate AWS Key Management Servrice (AWS KMS) keys to use for different AWS services. The companys security engineer created the following key policy to allow the infrastructure deployment team to create encrypted Amazon Elastic Block Store (Amazon EBS) volumes by assuming the InfrastructureDeployment IAM role:
The security engineer recently discovered that IAM roles other than the InfrastructureDeployment role used this key for other services.
Which change to the policy should the security engineer make to resolve these issues?
Premium Solution Locked
Unlock all 107 answers & explanations
A company uses AWS Organizations with all features enabled. The company has enabled AWS Security Hub in all member accounts and in all AWS Regions. The company has created a VPC in the eu-central-l Region in a member AWS account.
A security engineer has verified that no security group rules in the VPC allow inbound traffic from all IP addresses on TCP port 22. The security engineer needs an automated system. The system must prevent the creation of security group rules in the VPC that allow traffic from all IP addresses on TCP port 22.
Which solution will meet these requirements?
Premium Solution Locked
Unlock all 107 answers & explanations
A company has a large fleet of Amazon Linux 2 Amazon EC2 instances that run an application. The application processes sensitive data and has the following compliance requirements:
• No remote access management ports to tho EC2 instances can be exposod internally or extomally.
• All remote session activity must be recorded in an audit loge
• All remote access to the EC2 instances must be authenticated and authorized by AWS IAM Identity Center
The companfs DevOps team occasionally needs to connect to one of the EC2 instances to troubleshoot issues.
Which solution will provide remote access to the EC2 instances while meeting the compliance requirements?
Premium Solution Locked
Unlock all 107 answers & explanations
A healthcare company stores more than 1 million patient records in an Amazon S3 bucket. The patient records include personally identifiable information (PII). The S3 bucket contains hundreds of terabytes of data.
A security engineer receives an alert that was triggered by an Amazon GuardDuty Exfiltration:S3/AnomalousBehavior finding. The security engineer confirms that an attacker is using temporary credentials that were obtained from a compromised Amazon EC2 instance that has s3:GetObject permissions for the S3 bucket. The attacker has begun downloading the contents of the bucket. The security engineer contacts a development team. The development team will require 4 hours to implement and deploy a fix.
The security engineer must take immediate action to prevent the attacker from downloading more data from the S3 bucket.
Which solution will meet this requirement?
Premium Solution Locked
Unlock all 107 answers & explanations
A security engineer receives a notice about suspicious activity from a Linux-based Amazon EC2 instance that uses Amazon Elastic Block Store (Amazon EBS)-based storage. The instance is making connections to known malicious addresses.
The instance is in a development account within a VPC that is in the us-east-I Region. The VPC contains an internet gateway and has a subnet in us-east-la and us-east-lb. Each subnet is associated with a route table that uses the internet gateway as a default route. Each subnet also uses the default network ACL. The suspicious EC2 instance runs within the us-east-lb subnet During an initial investigation, a security engineer discovers that the suspicious instance is the only instance that runs in the subnet.
Which response will immediately mitigate the attack and help investigate the root cause?
Premium Solution Locked
Unlock all 107 answers & explanations
A company has an encrypted Amazon Aurora DB cluster in the us-east-I Region. The DB cluster is encrypted with an AWS Key Management Service (AWS KMS) customer managed key. To meet compliance requirements, the company needs to copy a DB snapshot to the us-west-I Region. However, when the company tries to copy the
snapshot to us-west-I, the company cannot access the key that was used to encrypt the original database.
What should the company do to set up the snapshot in us-west-I with proper encryption?
Premium Solution Locked
Unlock all 107 answers & explanations
A company stores sensitive data in an Amazon S3 bucket. The company encrypts the data at rest by using server-side encryption with Amazon S3 managed keys (SSE-S3). A security engineer must prevent any modifications to the data in the S3 bucket.
Which solution will meet this requirement?
Premium Solution Locked
Unlock all 107 answers & explanations
A company runs container-based workloads outside of AWS. The company wants the workloads to obtain temporary security credentials to securely access the company's AWS account. The company currently uses AWS IAM Identity Center to manage user access to the company's AWS resources.
Which solution will meet this requirement?
Premium Solution Locked
Unlock all 107 answers & explanations
A security engineer is designing a solution that will provide end-to-end encryption between clients and Docker containers running in Amazon Elastic Container Service (Amazon ECS). This solution will also handle volatile traffic patterns.
Which solution would have the MOST scalability and LOWEST latency?
Premium Solution Locked
Unlock all 107 answers & explanations
Full Question Bank Locked
You have reached the end of the free study guide preview. Upgrade now to unlock all 107 questions and the full simulation engine.
Certification Path
Related Certifications
Customer Reviews
Global Community Feedback
David M.
"The practice engine is incredible. It feels exactly like the real testing environment and helped me build so much confidence."
Sarah J.
"The PDF is very well organized and the explanations for the answers are actually helpful, not just random text."
Michael C.
"I was skeptical, but the content is high quality and definitely worth the price. I passed on my first try!"