EnglishDeutschFrançaisEspañolPortuguês

AWS · SCS-C03 · Advanced

AWS Security - Specialty (SCS-C03) — Practice Questions and Mock Exam

The AWS Certified Security – Specialty validates advanced expertise in securing workloads and architectures on AWS.

Practice for freeTry a practice question first
Try a practice question firstPractice for free
Start practicing SCS-C03 freeBuy SCS-C03 access for $29.99
65Questions per Pass-IT mock exam
170minPass-IT mock exam time limit

Official SCS-C03 exam: 750 out of 1000 points to pass.

Checked against AWS · September 2026 · Current exam version

Try Pass-IT

See what learning with Pass-IT is like.

Answer a SCS-C03 sample question and read the explanation with its source. Right here, with no sign-up.

Infrastructure Security1 / 5

A company is migrating its on-premises web application to AWS. The application must be protected against OWASP Top 10 threats including SQL injection and cross-site scripting (XSS). The security team wants a managed solution that requires minimal rule maintenance. Which approach provides the BEST protection with the LEAST operational overhead?

AlexFull explanation from Alex

AWS WAF with Managed Rules provides pre-configured rule sets that protect against OWASP Top 10 threats with minimal maintenance. The Core Rule Set (CRS) covers general web vulnerabilities including XSS and local file inclusion, while the SQL Database rule group specifically blocks SQL injection attacks. Attaching WAF to the ALB inspects HTTP traffic before it reaches the application. Network Firewall operates at layers 3-4 with Suricata rules—effective but requires custom rule maintenance, adding operational overhead. CloudFront with OAC controls origin access but does not inspect request payloads for injection attacks. A third-party WAF on EC2 requires provisioning, patching, and rule management—the highest operational burden. Key concept: WAF Managed Rules are AWS-maintained, automatically updated, and purpose-built for OWASP protection (docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-list.html).

Sourcedocs.aws.amazon.com

Data Protection2 / 5

A company's security policy requires that all AWS KMS encryption keys used for production data must be stored in hardware security modules (HSMs) that the company physically controls, while still using the KMS API for encryption operations. Which KMS key store option meets this requirement?

AlexFull explanation from Alex

KMS external key stores (XKS) let you use the KMS API while keeping encryption keys in HSMs you physically control outside AWS. XKS proxies cryptographic operations through an XKS proxy endpoint to your external key manager, satisfying regulatory requirements for physical key custody. Imported key material stores keys in AWS KMS HSMs after import—you don't retain physical control during operations. CloudHSM key store uses AWS CloudHSM clusters hosted in AWS data centers—you manage the HSMs but don't physically control the hardware. AWS managed keys are fully AWS-controlled with no customer access to key material. Key distinction: only XKS provides the KMS API while keeping key material entirely outside AWS infrastructure under your physical control (docs.aws.amazon.com/kms/latest/developerguide/concepts.html).

Sourcedocs.aws.amazon.com

Identity and Access Management3 / 5

An organization uses AWS IAM Identity Center (successor to AWS SSO) for workforce access to multiple AWS accounts. Which authentication protocol does IAM Identity Center use to federate with external identity providers?

AlexFull explanation from Alex

SAML 2.0 is correct. IAM Identity Center uses SAML 2.0 assertions for federation with external IdPs like Okta, Azure AD, and Ping Identity. It also supports SCIM for automatic user/group provisioning. Why not others: LDAP — a directory access protocol, not a federation protocol; Identity Center can use LDAP-backed directories but federates via SAML. OAuth 2.0 — an authorization framework for API delegation, not workforce SSO federation. Kerberos — on-premises network authentication protocol, not used for cloud SSO federation.

Sourcedocs.aws.amazon.com

Security Foundations and Governance4 / 5

A network account owns a transit gateway that 150 workload accounts in the same organization must attach to. Today the network team shares the transit gateway with AWS RAM by listing account IDs, and each workload account has to accept an invitation before it can attach. The team wants accounts in the organization to get access without invitations or per-account lists. What should the network team do?

AlexFull explanation from Alex

AWS RAM lets a resource owner share supported resources, such as transit gateways, with other accounts. To share inside an organization without listing every account, you first enable sharing with AWS Organizations in AWS RAM, then share the resource with the whole organization or with specific OUs. AWS RAM does not send invitations to principals in the organization in that case, and accounts that join the OU later get access automatically. Transit gateways do not use resource-based policies for attachment permissions, so a policy keyed on the organization ID is not how sharing works. Building a transit gateway per account multiplies cost and routing work. A cross-account IAM role would let workload teams act inside the network account, which widens their access unnecessarily. Exam tip: organization-wide sharing without invitations is AWS RAM with Organizations sharing enabled.

Sourcedocs.aws.amazon.com

How to prepare for SCS-C03 with Pass-IT.

Currently 340 practice questions for SCS-C03, with new ones added regularly. Focus on what you still need to learn.

Get past difficult questions.

Understand why an answer is correct. Alex explains the concepts and answers your follow-up questions so you can apply what you learn to the next task.

Meet Alex →

Conversation preview · SCS-C03

Keys outside AWS

  1. You

    Can we keep keys on hardware we control and still use KMS?

  2. Alex · AI tutor

    An external key store connects KMS to your external key manager through an XKS proxy.

    Read the documentation ↗
  3. You

    Does AWS operate that external hardware?

  4. Alex · AI tutor

    Your organization operates the external system and is responsible for its availability and key durability.

    Read the documentation ↗

Make your study time count.

Practice at your level.
For new practice sessions, Pass-IT adjusts the difficulty based on your previous answers.

Learn from mistakes.
Incorrect answers automatically become flashcards. When you review them, you rate how confidently you remember; Pass-IT schedules the next review.

See how focused practice works →

Animated feature preview

Turn your mistakes into knowledge you can rely on.

How Pass-IT works

Your review

Answered a question incorrectly?

Pass-IT saves it for your review.

SCS-C03 · Question excerpt

Keys outside AWS

View the full question

A company's security policy requires that all AWS KMS encryption keys used for production data must be stored in hardware security modules (HSMs) that the company physically controls, while still using the KMS API for encryption operations. Which KMS key store option meets this requirement?

Understand the correct answer.

AWS KMS with an external key store (XKS)

An external key store keeps the external key material outside AWS.

Read the documentation ↗

How confidently do you remember?

During review, you assess how well you still know the answer.

Correct after hesitating

Pass-IT schedules your next review.

The date depends on your self-assessment and previous reviews.

Simplified demonstration. No learning progress is saved.

Practice for the moment that counts.

Take a full mock exam with a time limit and find out whether you can finish in time.

Your SCS-C03 mock exam

Questions
65
Minutes
170

Illustration of an exam session

  1. Start
  2. Answer questions
  3. Finish

Length and time limit of the Pass-IT mock exam.

Go into your exam with more confidence.

Your Readiness Score helps you assess whether you are ready for the exam. Results by exam domain show you where you should keep practicing.

Your money back if you fail despite 80% Readiness.
If your Readiness Score is at least 80% when you take the exam and you still fail, we refund the Pass-IT purchase price for this certification.

For active, paid access. Submit proof of failing within 14 days.

Further guarantee conditions

You need at least 80% Readiness and active, paid access to the certification when you take the exam. Take the exam within your access period and submit official proof of failing within 14 days after the exam.

For purchases through Apple or Google, refunds are handled by the respective store. See the full terms for further details.

Read the guarantee terms →

The Readiness Score describes your practice progress, not a probability of passing.

Guarantee requirement

80%

At least 80% Readiness
when you take the exam

Money back if you fail

Question counts and mock exam settings from the current Pass-IT catalog.

Exam domains

What you practice for SCS-C03.

Exam topics, relevant practice and sources you can check.

Detect threats and investigate missing signalsSee the guide for weighting54 QuestionsPass-IT questions

Build monitoring and logging that help you recognize suspicious activity across AWS.

  • Choose health checks, security findings and alerts that reveal unusual behavior, and automate recurring assessments.
  • Collect and store the right logs, then normalize and correlate them to investigate activity across services.
  • Find configuration or permission problems that prevent monitoring, logging or alerts from reporting correctly.
Official certification objectives
Prepare for and respond to incidentsSee the guide for weighting38 QuestionsPass-IT questions

Plan how to investigate, contain and recover from security incidents.

  • Write and test response runbooks, prepare access and security tools, and automate suitable response steps.
  • Preserve forensic evidence and correlate findings to establish an incident’s scope, impact and root cause.
  • Contain affected resources, remove threats and recover services using the response plan.
Official certification objectives
Protect networks and workloadsSee the guide for weighting58 QuestionsPass-IT questions

Apply security controls at the network edge, inside workloads and between environments.

  • Configure and troubleshoot edge protections such as AWS WAF rules and AWS Shield defenses against expected attacks.
  • Harden and patch compute workloads, check vulnerabilities and secure administrative access, including safeguards for generative AI applications.
  • Control and segment network traffic, secure hybrid connections and diagnose unnecessary or blocked access.
Official certification objectives
Control identity and accessSee the guide for weighting67 QuestionsPass-IT questions

Design how people and workloads prove their identity and receive appropriate permissions.

  • Configure and troubleshoot authentication, identity provider integration and temporary credentials for people, applications and systems.
  • Design least-privilege authorization with roles, attributes and IAM policies, including cross-account access.
  • Investigate authorization failures and unintended privileges, then correct the policies responsible.
Official certification objectives
Protect data and its keysSee the guide for weighting72 QuestionsPass-IT questions

Choose controls for data in transit, stored data and the secrets that protect access.

  • Require encryption in transit and configure private access and encrypted communication between resources.
  • Protect stored data with suitable encryption, integrity controls, retention rules and secure backups or replication.
  • Manage and rotate secrets, keys and certificates, distinguish imported from AWS-generated key material, and mask sensitive data.
Official certification objectives
Govern security across accountsSee the guide for weighting51 QuestionsPass-IT questions

Manage accounts and shared security controls consistently, then check compliance.

  • Organize accounts with AWS Organizations and AWS Control Tower, centralize security administration and protect root access.
  • Deploy secure resources consistently with infrastructure as code, centrally enforced policies and controlled resource sharing.
  • Detect and remediate noncompliant resources, collect audit evidence and assess architectures against security best practices.
Official certification objectives
Question formats you can practice
Multiple Choice
Select one answer.
Multiple Response
Select multiple applicable answers.
Ordering
Put steps in the correct order.
Matching
Match each item with its corresponding item, following the question’s instructions.

These are practice formats in Pass-IT. See the Official certification objectives for the official exam requirements.

Frequently asked questions

Your preparation

How much study time should I plan for SCS-C03?

For planning, Pass-IT estimates roughly 40–105 hours. Relevant experience may put you toward the lower end; starting from scratch may put you toward the higher end. Your needs may fall outside this range. This is not a time requirement from AWS or a promise that you will be exam-ready within that time.

Using Pass-IT

What language are Pass-IT questions in?

Questions in the app are currently in English. Translations of the sample questions on this page apply only to this preview. Check with AWS for the languages available for the official exam.

How long does my SCS-C03 access last?

Access covers this certification for 12 months. You pay once, with no automatic renewal.

When does the money-back guarantee apply?

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days. Guarantee terms

About the SCS-C03 exam

Where can I take the SCS-C03 exam?

Pearson VUE testing center or online proctored exam.

How long is the AWS Certified Security - Specialty exam?

The SCS-C03 exam has 65 questions and a 170-minute time limit.

What experience does AWS Security Specialty assume?

AWS sets no formal prerequisite but writes SCS-C03 for people with three to five years of experience securing cloud workloads and deep familiarity with AWS security services. It is an advanced exam, and the questions assume you have debugged real IAM policies rather than read about them.

How long is AWS Security Specialty valid?

The certification is valid for three years. Passing the latest version of the exam renews it for three more years. While your certification is active, you can also maintain it on AWS Skill Builder to extend it by one year.

What happens if you fail AWS Security Specialty?

AWS asks for a 14-day wait between attempts and sets no cap on how many times you can sit the exam. The 170-minute format means a failed attempt is usually a pacing problem as much as a knowledge one.

Your preparation for SCS-C03

$29.99one-time

12 months of access for SCS-C03 · No automatic renewal

Buy SCS-C03 access

Questions in the app are currently in English.

Try 20 questions for freeFree account required. No credit card.

Already have an account? Log in

Prefer a subscription? View subscriptions →

Money back if you fail with at least 80% Readiness, for eligible purchases under the guarantee terms.

Guarantee terms

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days.

Full guarantee terms →

Related certifications

AWS Certified Advanced Networking - SpecialtyAWS Certified AI Business StrategistAWS Certified AI PractitionerAWS Certified CloudOps Engineer - AssociateAll AWS certifications →