AWS Certified Security - Specialty (SCS-C03) practice questions

Question 1

A global bank is modernizing a production AWS environment. Human users, applications, and external systems need distinct authentication paths without shared long-lived credentials. The design must preserve least privilege, centralized evidence, and a tested rollback path. Which approach best meets these requirements?

Accepted Answer

Federate workforce identities, use purpose-built application identity, issue scoped temporary credentials, require strong factors, and troubleshoot from authoritative sign-in evidence.

Answer

Create one IAM user access key that every human and workload shares.

Answer

Embed root credentials in the deployment system so authentication never depends on federation.

Answer

Increase every session duration when one user has an authentication failure, without examining the trust path.

Question 2

A healthcare network is modernizing a production AWS environment. The organization must grant least-privilege access across accounts while preventing unintended permissions from identity, resource, session, and organization policies. The design must preserve least privilege, centralized evidence, and a tested…

Accepted Answer

Model the complete authorization path, use RBAC or ABAC deliberately, constrain delegation, analyze effective access, and remediate unintended grants.

Answer

Attach AdministratorAccess whenever a policy simulation returns an implicit deny.

Answer

Use resource tags as authorization attributes without controlling who can change those tags.

Answer

Inspect only the identity policy and ignore resource policies, trust policies, boundaries, sessions, and organization controls.

Question 3

An online marketplace is modernizing a production AWS environment. A regulated workload needs an incident response capability that responders can invoke safely before a real compromise occurs. The design must preserve least privilege, centralized evidence, and a tested rollback path. Which approach best meets these…

Accepted Answer

Define severity-based plans and runbooks, pre-provision constrained responder access and forensic tooling, and validate the plan with controlled simulations.

Answer

Wait for the first incident to decide who may access affected accounts and which evidence to collect.

Answer

Grant permanent administrator access to every responder so approval steps cannot delay containment.

Answer

Test only that the incident document opens, without exercising access, automation, evidence capture, or recovery.

Question 4

A public-sector agency is modernizing a production AWS environment. The security operations team must detect anomalous activity across independently owned accounts without weakening account isolation. The design must preserve least privilege, centralized evidence, and a tested rollback path. Which TWO actions should…

Accepted Answer

Use organization-aware monitoring with delegated administration, centralized findings, workload health signals, and narrowly scoped automated assessments.

Accepted Answer

Route normalized findings and alarms to the security operations account and retain workload-specific ownership for remediation.

Answer

Rely on operators to inspect each account console after a user reports an incident.

Answer

Send every raw event directly to one administrator email address without correlation or severity controls.

Answer

Disable service-native findings after a central dashboard is created to avoid duplicate evidence.

Question 5

A software-as-a-service provider is modernizing a production AWS environment. The security operations team must detect anomalous activity across independently owned accounts without weakening account isolation. The design must preserve least privilege, centralized evidence, and a tested rollback path. Which approach…

Accepted Answer

Use organization-aware monitoring with delegated administration, centralized findings, workload health signals, and narrowly scoped automated assessments.

Answer

Rely on operators to inspect each account console after a user reports an incident.

Answer

Send every raw event directly to one administrator email address without correlation or severity controls.

Answer

Disable service-native findings after a central dashboard is created to avoid duplicate evidence.

Question 6

A media streaming company is modernizing a production AWS environment. Responders must determine the blast radius of suspicious activity, preserve evidence, contain the threat, and recover the workload. The design must preserve least privilege, centralized evidence, and a tested rollback path. Which approach best…

Accepted Answer

Preserve immutable forensic artifacts, correlate authoritative logs and validated findings, contain affected resources with reversible controls, eradicate the cause, and recover from trusted state.

Answer

Terminate every suspected resource before collecting volatile or durable evidence.

Answer

Trust the first finding severity and skip validation against logs or affected-resource state.

Answer

Restore public connectivity immediately after one malicious process exits.

Question 7

A logistics platform is modernizing a production AWS environment. The organization needs tamper-resistant, searchable security telemetry from applications, identities, and network paths across multiple Regions. The design must preserve least privilege, centralized evidence, and a tested rollback path. Which approach…

Accepted Answer

Enable the required service logs at the organization and workload layers, centralize them in protected storage, and normalize them for correlation and query.

Answer

Keep only application error messages on each instance and rotate them when local storage becomes full.

Answer

Export screenshots of console dashboards weekly as the authoritative audit record.

Answer

Send all logs to an unencrypted public bucket so third-party tools can read them without roles.

Question 8

A research university is modernizing a production AWS environment. An internet-facing application needs layered edge protection that adapts to geography, request rate, application threats, and third-party intelligence. The design must preserve least privilege, centralized evidence, and a tested rollback path. Which…

Accepted Answer

Place the workload behind the appropriate AWS edge services, implement tested WAF and Shield controls, and integrate normalized security intelligence with explicit ownership.

Accepted Answer

Use scoped managed and custom rules, observe before blocking high-risk changes, and validate headers, origins, rate limits, and fail-safe behavior.

Answer

Expose the origin publicly and depend only on application authentication to absorb volumetric attacks.

Answer

Block all traffic from outside one office IP range even though the service has global customers.

Answer

Import third-party rules directly into blocking mode without checking schema, scope, false positives, or rollback.

Question 9

A financial technology company is modernizing a production AWS environment. Compute workloads built from AMIs, containers, functions, and generative AI components must remain hardened throughout delivery and runtime. The design must preserve least privilege, centralized evidence, and a tested rollback path. Which…

Accepted Answer

Build hardened immutable artifacts, use workload roles, scan and patch continuously, provide brokered administration, and enforce pipeline and runtime guardrails.

Answer

Store long-lived access keys in every image so workloads can call AWS services after launch.

Answer

Permit direct inbound administrative access from the internet and rely on password rotation.

Answer

Defer image scanning, patching, and AI guardrails until an external auditor identifies a finding.

Question 10

A telecommunications provider is modernizing a production AWS environment. A hybrid multi-account network needs least-privilege connectivity, segmentation, inspection, and evidence that unintended paths are absent. The design must preserve least privilege, centralized evidence, and a tested rollback path. Which…

Accepted Answer

Segment trust zones, apply stateful and stateless controls at the correct boundaries, secure hybrid links, and analyze intended and unintended reachability.

Answer

Use one flat VPC and one permissive security group so connectivity problems cannot occur.

Answer

Treat route-table entries as authorization controls and remove all workload security groups.

Answer

Expose administrative endpoints publicly when a private hybrid route is temporarily unavailable.

AWS Certified Security - Specialty (SCS-C03) practice questions

Ordered practice form

Exam conditions

Manage your cookie preferences

Loading subject practice

Loading Brainliest

Loading subject practice

AWS Certified Security - Specialty (SCS-C03) practice questions

Ordered practice form

Exam conditions

Practice overview