AWS Certified Security - Specialty Practice Test
The AWS Certified Security - Specialty (SCS-C03) focuses on securing AWS workloads and applications, with particular attention to data classification and protection. The subject matter connects access control, encryption, monitoring, and configuration safeguards to practical security work across cloud environments.
Exam overview
About the AWS Certified Security - Specialty Exam
Security work on AWS requires choosing controls that fit the threat and the scope of the environment. This practice bank includes scenarios about using service control policies to set organization-wide permission limits, analyzing IAM activity to identify unused access, and selecting key-management options for encryption. Other questions distinguish CloudTrail activity records from ongoing configuration evaluation with AWS Config, and consider network threat detection for traffic within a VPC. These decisions reflect tasks such as investigating changes, reducing excessive permissions, enforcing resource safeguards, and protecting data at rest. Pay attention to where a control applies, what it can prevent or detect, and whether it operates at the account, organization, resource, or network level.
Sample Practice Questions
Review a selection from this exam's published US Practice Tests practice bank.
A company wants to centrally control permissions granted to all AWS accounts in an Organization, regardless of what individual IAM users or roles are configured to allow. Which mechanism is best for setting those maximum permission boundaries at scale?
Show answer
Correct answer: AService control policies set the maximum available permissions for accounts in an AWS Organization. They are an account-level guardrail, so even if an IAM policy allows an action, the SCP can still block it.
Which AWS feature allows a customer to supply and control the encryption key material used by AWS services while AWS still performs the cryptographic operations?
Show answer
Correct answer: AA customer managed KMS key lets the customer control permissions, rotation settings, and key usage policies while AWS integrations can use the key for encryption and decryption operations.
What is the primary purpose of an AWS CloudTrail trail?
Show answer
Correct answer: BCloudTrail records AWS API calls and related events, which helps with auditing, compliance, and incident investigation. It does not block traffic, encrypt storage, or manage certificates.
A company wants to continuously evaluate whether its AWS resources comply with internal configuration rules, such as whether encryption is enabled on an S3 bucket or a security group is overly permissive. Which service is most appropriate?
Show answer
Correct answer: AAWS Config monitors and records resource configuration changes and can evaluate resources against desired compliance rules. It is the best choice for configuration compliance checks.
A security engineer wants to inspect network traffic patterns and identify threats such as port scanning or unexpected connections between workloads inside a VPC. Which service is the best fit?
Show answer
Correct answer: AVPC Flow Logs capture information about IP traffic going to and from network interfaces in a VPC. They are commonly used to analyze traffic patterns and troubleshoot or investigate suspicious network activity.
A company wants to continuously evaluate AWS resource configurations against compliance rules, such as whether encryption is enabled or a security group is overly permissive. Which AWS service is intended for this ongoing evaluation?
Show answer
Correct answer: AAWS Config continuously evaluates and records resource configurations and can compare them to desired settings using rules. CloudTrail logs API activity, Inspector focuses on vulnerability findings, and Access Analyzer evaluates resource sharing and policy access.
A company wants to centrally prevent all AWS accounts in an organization from using public S3 buckets, even if an administrator accidentally changes a bucket policy. What is the best control to enforce this at scale?
Show answer
Correct answer: BA service control policy can set organization-wide guardrails that limit which actions are possible in member accounts, regardless of local IAM permissions. This makes it appropriate for broadly preventing public S3 configurations at scale.
How to use this practice test
The free US Practice Tests bank contains 50 published questions. Each session presents up to 20 questions selected at random, and results appear after the session. Use the questions to check how well you distinguish AWS security controls and to identify concepts that need another pass.
Preparation tips
- Compare IAM policies, permissions boundaries, and AWS Organizations service control policies by the permissions each can limit and the scope where it applies.
- Practice distinguishing AWS KMS key management from customer-supplied key material, including who controls the material and who performs cryptographic operations.
- Separate CloudTrail's record of account activity from AWS Config's evaluation of resource configurations; identify the operational question each service answers.
- For VPC threat scenarios, note whether the task is detecting suspicious network activity or enforcing traffic access, then match the requirement to the relevant control.
- Use IAM Access Analyzer policy-generation insights to reason about permissions used in practice and how that evidence can support least-privilege policies.