Amazon AWS Certified Security - Specialty SCS-C03 Free Practice Test - 20 Questions
This practice bank of 20 questions exercises core security decisions around IAM policy evaluation, logging integrity, encryption at rest, network security filters, incident response automation, and cross-account access. You will differentiate stateful vs stateless firewalls, choose the correct service for DDoS protection, understand CloudTrail log validation, and grasp KMS key rotation limitations. The bank also tests your ability to select the most efficient S3 access control method, identify the right tool for detecting compromised instances, and properly apply permissions boundaries. Use this deck to reinforce the key logic behind each answer, especially where marked answers conflict with explanations—always trust the detailed rationale over a possibly incorrect selection.
What this SCS-C03 practice set measures
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
IAM and Identity Management
IAM policies follow an explicit deny override rule, permissions boundaries intersect with permission policies to limit maximum permissions, and cross-account KMS access requires a key policy granting the external account and appropriate IAM roles or grants. Trust policies control who can assume a role, while permission policies define what actions are allowed. The practice bank highlights that IAM is the cornerstone of AWS security, with policy evaluation logic being deterministic: deny always wins. Also, for granting least privilege, KMS grants allow limiting actions to encrypt only.
- Explicit deny overrides any allow, regardless of other policies.
- Permissions boundaries define the maximum permissions; effective permissions are the intersection of the boundary and the permissions policy.
- For cross-account KMS decryption, the key policy must grant account B, and account B must have an IAM policy allowing use of the key.
Logging, Monitoring, and Incident Response
CloudTrail provides API call history, with log file validation using digest files to ensure integrity. VPC Flow Logs capture network traffic metadata to identify source/destination IPs. GuardDuty findings can trigger automated remediation via EventBridge and Lambda to modify security groups. The practice bank emphasizes choosing the correct log source for specific needs: CloudTrail for API calls, Flow Logs for network flows, and Config for configuration changes. Automated isolation is best achieved by event-driven Lambda functions rather than manual or notification-only methods.
- CloudTrail log integrity is verified by comparing digests, not encryption alone.
- VPC Flow Logs, not Config, reveal outbound traffic to malicious IPs.
- GuardDuty + EventBridge + Lambda can automatically isolate a compromised EC2 instance by modifying security group rules.
Network and Application Security
Security groups are stateful (return traffic automatically allowed) while network ACLs are stateless (explicit rules required). For DDoS protection at layer 7, AWS Shield Advanced with WAF is preferred over Network Firewall. SQL injection is blocked by AWS WAF SQL database managed rule group. S3 bucket access can be restricted by IP using a bucket policy with aws:SourceIp condition—not S3 ACLs or block public access alone. The practice bank clarifies that choosing the right service (WAF vs. Shield vs. Network Firewall) depends on the attack layer and scope.
- Security groups: stateful; Network ACLs: stateless, support deny rules.
- Layer 7 DDoS protection: AWS Shield Advanced (includes WAF).
- S3 IP restriction: use bucket policy with aws:SourceIp condition.
Encryption and Secrets Management
KMS automatic rotation is enabled by the customer and cannot be disabled once enabled; it applies to symmetric keys only. CloudWatch Logs can be encrypted directly with a KMS key, not only via S3. S3 default encryption (SSE-S3) applies when no encryption headers are provided. For secrets like database credentials, AWS Systems Manager Parameter Store with SecureString is a cost-effective option; Secrets Manager offers automatic rotation via Lambda. Macie detects PII in S3 objects. The practice bank tests your ability to match encryption features to services.
- KMS automatic rotation: once enabled, cannot be disabled; only for symmetric keys.
- CloudWatch Logs encryption: associate a KMS key with a log group.
- Parameter Store SecureString encrypts and integrates with EC2 via SSM agent.
Practice Amazon AWS Certified Security - Specialty SCS-C03 with real flashcards
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Static practice bank
Start the 20-question diagnostic
The complete question bank is embedded in this pre-rendered page. There is no database request or second content download when you begin.
When evaluating an IAM policy, which of the following is true regarding an explicit deny?
Show hint
Domain 4.1 Design and implement IAM policies
Study workflow
Turn one SCS-C03 attempt into a study plan
- 1
Evaluate IAM Policy Effect
Start by reading all applicable policies (identity-based, resource-based, permissions boundary, SCP). If any statement explicitly denies the action, the result is Deny. If there is no explicit deny but an allow, and the request passes all boundaries, it's Allow. Otherwise, implicit Deny.
- 2
Select Logging Tool for Investigation
Identify what you need to trace: API calls → CloudTrail; network flows → VPC Flow Logs; configuration changes → AWS Config; DNS queries → Route 53 Resolver Query Logs. For each scenario, pick the service that captures the required data.
- 3
Automate Incident Response for GuardDuty
Create an EventBridge rule that matches GuardDuty findings (e.g., UnauthorizedAccess:EC2/SSHBruteForce). Target a Lambda function that modifies the EC2 security group (revoke ingress/egress rules or attach a new restrictive group). Test with sample findings.
- 4
Implement Cross-Account KMS Decryption
In the key-owning account, edit the key policy to grant the external account's root user (or specific roles) permissions: kms:Decrypt, kms:DescribeKey, etc. In the external account, create an IAM role/policy that allows using the key via kms:Decrypt and attach to the user/resource.
- 5
Set Up Automatic Secret Rotation with Parameter Store
For simple rotation, use Parameter Store with a Lambda function triggered by EventBridge (scheduled event). The Lambda retrieves the current secret, generates a new password, updates the database, and stores the new value in Parameter Store. For automatic rotation without custom code, use Secrets Manager.
FAQ
Questions about this SCS-C03 practice page
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
What is the difference between Security Groups and Network ACLs?+
Security groups are stateful: if you allow inbound traffic, outbound return is automatically allowed. Network ACLs are stateless: you must explicitly allow both inbound and outbound traffic. Also, security groups support only allow rules; NACLs support both allow and deny rules.
How does CloudTrail log file validation work?+
When enabled, CloudTrail creates digest files containing SHA-256 hashes of log files, signed with the private key of an AWS key pair. You can use the public key to verify the digest, ensuring no log file was modified after delivery.
Can AWS KMS automatic key rotation be disabled?+
No. Once you enable automatic rotation for a customer managed symmetric key, you cannot disable it. KMS will rotate the key material annually. The key ID remains the same, so existing ciphertext remains decryptable.
What is the most efficient way to restrict S3 bucket access to a specific IP range?+
Use an S3 bucket policy with a condition block using aws:SourceIp. For example: "Condition": {"IpAddress": {"aws:SourceIp": "203.0.113.0/24"}}. This does not require VPC endpoints or additional infrastructure.
How can I automate isolation of a compromised EC2 instance using GuardDuty?+
Set up an Amazon EventBridge rule that matches GuardDuty findings (e.g., command-and-control communication). The rule triggers an AWS Lambda function that modifies the instance's security group to deny all inbound/outbound traffic, effectively isolating the instance.
Build the next review session
Browse another free bank or use the study strategy guide to turn your misses into spaced review.