AWS · SCS-C03 · Advanced

AWS Security - Specialty (SCS-C03) — Practice Questions and Mock Exam

Name: Pass-IT
Author: Pass-IT

Prepare for SCS-C03 with original practice questions and clear answer explanations. Ask Alex, your AI tutor, when you need more detail, use your results to identify topics to review, and practice your pacing with timed mock exams.

Start practicing SCS-C03 free Buy SCS-C03 access for $29.99

Buy SCS-C03 access for $29.99 Start practicing SCS-C03 free

65Mock exam questions

170minTime limit

750/ 1000Passing score

Checked against AWS · August 2026 · Current exam version

Overview

About the exam

The AWS Certified Security – Specialty validates advanced expertise in securing workloads and architectures on AWS. It covers threat detection and incident response, infrastructure security, identity and access management, data protection, and security governance. Candidates must demonstrate proficiency in using GuardDuty, Security Hub, AWS KMS, and IAM Access Analyzer to detect threats, encrypt data, and enforce least-privilege access.

This certification is designed for security engineers, architects, and analysts with the equivalent of three to five years of experience securing cloud solutions. It demonstrates the ability to design and implement security solutions, respond to security events, and maintain compliance across complex AWS environments.

Try the practice preview

Try five SCS-C03 questions

Try five practice questions from the app’s current AWS Certified Security - Specialty question bank, with answers and explanations.

Infrastructure Security1 / 5

A company is migrating its on-premises web application to AWS. The application must be protected against OWASP Top 10 threats including SQL injection and cross-site scripting (XSS). The security team wants a managed solution that requires minimal rule maintenance. Which approach provides the BEST protection with the LEAST operational overhead?

AlexFull explanation from Alex

AWS WAF with Managed Rules provides pre-configured rule sets that protect against OWASP Top 10 threats with minimal maintenance. The Core Rule Set (CRS) covers general web vulnerabilities including XSS and local file inclusion, while the SQL Database rule group specifically blocks SQL injection attacks. Attaching WAF to the ALB inspects HTTP traffic before it reaches the application. Network Firewall operates at layers 3-4 with Suricata rules—effective but requires custom rule maintenance, adding operational overhead. CloudFront with OAC controls origin access but does not inspect request payloads for injection attacks. A third-party WAF on EC2 requires provisioning, patching, and rule management—the highest operational burden. Key concept: WAF Managed Rules are AWS-maintained, automatically updated, and purpose-built for OWASP protection (docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-list.html).

Sourcedocs.aws.amazon.com

Detection2 / 5

A security engineer needs to implement a comprehensive logging strategy that captures all API calls made in their AWS account, including read-only management events and data events for S3 and Lambda. How should they configure AWS CloudTrail?

AlexFull explanation from Alex

A CloudTrail trail with both management and data events enabled captures the complete API activity picture. Management events (read/write) log control-plane operations like IAM changes, EC2 provisioning, and security configuration. Data events capture data-plane operations—S3 object-level access (GetObject, PutObject) and Lambda function invocations. VPC Flow Logs capture network traffic metadata, not API calls. AWS Config records resource configuration state changes, not API call details. CloudTrail Event history only retains 90 days of management events and does not support data events. Key concept: trails are required for comprehensive logging; Event history is a limited 90-day default view of management events only (docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-management-events-with-cloudtrail.html).

Sourcedocs.aws.amazon.com

Data Protection3 / 5

A company's security policy requires that all AWS KMS encryption keys used for production data must be stored in hardware security modules (HSMs) that the company physically controls, while still using the KMS API for encryption operations. Which KMS key store option meets this requirement?

AlexFull explanation from Alex

KMS external key stores (XKS) let you use the KMS API while keeping encryption keys in HSMs you physically control outside AWS. XKS proxies cryptographic operations through an XKS proxy endpoint to your external key manager, satisfying regulatory requirements for physical key custody. Imported key material stores keys in AWS KMS HSMs after import—you don't retain physical control during operations. CloudHSM key store uses AWS CloudHSM clusters hosted in AWS data centers—you manage the HSMs but don't physically control the hardware. AWS managed keys are fully AWS-controlled with no customer access to key material. Key distinction: only XKS provides the KMS API while keeping key material entirely outside AWS infrastructure under your physical control (docs.aws.amazon.com/kms/latest/developerguide/concepts.html).

Sourcedocs.aws.amazon.com

Identity and Access Management4 / 5

An organization uses AWS IAM Identity Center (successor to AWS SSO) for workforce access to multiple AWS accounts. Which authentication protocol does IAM Identity Center use to federate with external identity providers?

AlexFull explanation from Alex

SAML 2.0 is correct. IAM Identity Center uses SAML 2.0 assertions for federation with external IdPs like Okta, Azure AD, and Ping Identity. It also supports SCIM for automatic user/group provisioning. Why not others: LDAP — a directory access protocol, not a federation protocol; Identity Center can use LDAP-backed directories but federates via SAML. OAuth 2.0 — an authorization framework for API delegation, not workforce SSO federation. Kerberos — on-premises network authentication protocol, not used for cloud SSO federation.

Sourcedocs.aws.amazon.com

Create a free account

Question pool

340 practice questions

Use the Pass-IT question pool to practice for SCS-C03. Mock exams are set to 65 questions in 170 minutes.

Pool details: SCS-C03

Passing score750 / 1,000

as published by AWS

Objectives in the guide16 objectives listed in the official guide

across 6 domains in the official exam guide

Pool size340 questions

= The pool size is equivalent to 5 sets of 65 questions; this does not mean that each mock exam uses a separate set.

Recorded as checked against sources340 of 340

questions recorded as having their answer, options, and explanation checked against official AWS documentation

How questions are made →

Exam domains

What's on the exam

Identity and Access Management leads at 20%, covering authentication design for humans, applications, and systems, plus the attribute-based and role-based authorization strategies built on top of it. Infrastructure Security and Data Protection tie for second at 18% each — one hardens the network edge and compute layer, the other covers encryption in transit and at rest along with the secrets and cryptographic keys guarding it.

Detection takes 16%, testing monitoring, alerting, and logging design across an account or organization. Security Foundations and Governance and Incident Response split the remaining 14% apiece: one covers multi-account structure and continuous compliance checking, the other covers the runbooks and forensic response an organization needs once a detection fires. No single domain dominates this exam the way one domain can on an associate-level exam — six domains within a narrow 14-to-20% band means every area of AWS security has to be solid.

Exam blueprint: SCS-C03

Detection16%

Stand up account-wide monitoring and alerting to catch anomalies, design where logs get ingested and stored, and diagnose misconfigurations when those detection pipelines stop reporting correctly.

≈ 11 h

Incident Response14%

Write and rehearse the runbooks an organization follows when something goes wrong, then put them into practice by gathering forensic evidence, tracing related log entries, and shutting down an active threat.

≈ 10 h

Infrastructure Security18%

Harden the network perimeter against external threats, lock down compute instances with vetted images and vulnerability checks, and segment internal traffic so a breach in one zone can't spread freely.

≈ 13 h

Identity and Access Management20%

Design how humans, applications, and systems prove who they are, including short-lived credentials, and how their access gets scoped afterward through attribute-based, role-based, and least-privilege policy design.

≈ 14 h

Data Protection18%

Enforce TLS and private connectivity so data moving between resources stays encrypted, apply encryption and lifecycle rules to data sitting in storage, and manage the credentials, secrets, and key material that protect both.

≈ 13 h

Security Foundations and Governance14%

Stand up a multi-account structure with centralized guardrails, roll out cloud resources consistently through code rather than by hand, and continuously check whether the resulting environment still meets security baselines.

≈ 10 h

Format

Exam format and question types

The exam draws 65 questions (50 scored, 15 unscored) from a mix of multiple-choice, multiple-response, ordering, and matching formats inside a 170-minute window. Questions present complex security scenarios that require identifying the threat, selecting the right control, and reasoning through a defense-in-depth architecture rather than recalling a single service's feature list. At roughly 2.6 minutes per question, the extended time reflects how much reading each scenario demands.

Question types: SCS-C03

Multiple Choice50%

Select the single answer that best meets the question’s requirements.

Multiple Response25%

Select multiple answers. Follow the question’s instructions on how many to choose.

Ordering15%

Arrange the steps in the sequence needed to complete the process.

Matching10%

Match each item with its corresponding item, following the question’s instructions.

See AWS for official question-format information. The shares shown describe the Pass-IT practice pool; they do not establish the proportions on the official exam.

Planning

Preparing for SCS-C03

The exam runs through Pearson VUE, either at a testing center or online with a remote proctor, and is offered in English, Japanese, Korean, Portuguese (Brazil), Spanish (Latin America), and Simplified Chinese. Certification holds for 3 years; renewal means passing a recertification exam before it expires, or earning a higher-level AWS certification, which renews it automatically.

Preparation and logistics: SCS-C03

Preparation

Illustrative study time40–105 h

illustrative planning range: 40 h with relevant experience to 105 h when starting out; your needs may fall outside this range

LevelAdvanced

Taking and maintaining the certification

DeliveryPearson VUE testing center or online proctored exam

Retake policy14-day waiting period between exam attempts, no limit on total number of attempts

Certification validity3 years

Pass a recertification exam before the 3-year expiration date, or earn a higher-level AWS certification to automatically renew

Official guideView on provider site

Study notes

Common pitfalls

Topics to review: SCS-C03

01KMS Complexity
Not understanding KMS key policies, grants, CMK rotation, cross-account key sharing, and envelope encryption leads to wrong answers on data protection questions.
02IAM Policy Logic
Misunderstanding policy evaluation logic including explicit denies, permission boundaries, SCPs, and resource-based vs identity-based policy interactions.
03Detection Services
Confusing GuardDuty, Inspector, Macie, Security Hub, and Detective capabilities and not knowing which service addresses which threat type.
04Network Security
Mixing up security groups, NACLs, WAF rules, Shield, and Network Firewall for different layers of network protection.
05Incident Response
Not knowing the correct sequence of containment, investigation, and remediation steps using AWS-native security tools and automation.

Practice with questions and explanations in Pass-IT →

Questions

Frequently asked questions

How long is the AWS Certified Security - Specialty exam?

The SCS-C03 exam has 65 questions and a 170-minute time limit.

What is the passing score for AWS Certified Security - Specialty?

The passing score for the SCS-C03 exam is 750 / 1000.

Which pitfalls should I review when preparing for AWS Certified Security - Specialty?

Topics to review include KMS Complexity, IAM Policy Logic, Detection Services, Network Security, Incident Response. Work through examples to check that you understand the distinctions and can explain your answer.

What experience does AWS Security Specialty assume?

AWS sets no formal prerequisite but writes SCS-C03 for people with three to five years of experience securing cloud workloads and deep familiarity with AWS security services. It is an advanced exam, and the questions assume you have debugged real IAM policies rather than read about them.

How long is AWS Security Specialty valid?

Three years. You renew by passing the recertification exam before that date, or automatically by earning a higher-level AWS certification during the term.

Which SCS-C03 domains carry the most weight?

Identity and access management is the largest domain at 20%, with infrastructure security and data protection at 18% each and detection at 16%. Incident response and the security foundations and governance domain round it out at 14% each. AWS publishes the split, so the spread is genuinely even and no single area can be skipped.

What happens if you fail AWS Security Specialty?

AWS asks for a 14-day wait between attempts and sets no cap on how many times you can sit the exam. The 170-minute format means a failed attempt is usually a pacing problem as much as a knowledge one.

How does SCS-C03 relate to the other AWS certifications?

It is a specialty exam, so it sits alongside the professional-level certifications rather than below them. Passing SAP-C02 or DOP-C02 renews it automatically, and many people take Solutions Architect Associate first to get the service breadth this exam assumes.

One certification, 12 months

Practice for SCS-C03

Focus your practice on one certification, or choose Pro to practice across all certifications.

Buy SCS-C03 access for $29.99

Start a free practice sessionTry the first 20 questions without a card to see whether the practice suits you.

For eligible purchases: money-back guarantee if you fail your exam.

View guarantee terms →