Free Amazon SCS-C03 Exam Practice Questions

- PDF Questions
  Exam Code: SCS-C03
  
  Exam Name: AWS Certified Security - Specialty
  
  Total Questions: 231
  
  PDF Price: $29.50 / ~~$59.00~~
- Bundle Pack
  Exam Code: SCS-C03
  
  Exam Name: AWS Certified Security - Specialty
  
  Total Questions: 231
  
  Bundle Price: $49.50 / ~~$99~~
- Online Engine
  Exam Code: SCS-C03
  
  Exam Name: AWS Certified Security - Specialty
  
  Total Questions: 231
  
  Practice Test Price: $34.50 / ~~$69.00~~

1. Page: 1/47
  Total 231 Questions
  
  PDF Questions & Answers Web-Based Practice Test
Question No 1

A security administrator is setting up a new AWS account. The security administrator wants to secure the data that a company stores in an Amazon S3 bucket. The security administrator also wants to reduce the chance of unintended data exposure and the potential for misconfiguration of objects that are in the S3 bucket. Which solution will meet these requirements with the LEAST operational overhead?

Choose the Choices:

Configure the S3 Block Public Access feature for the AWS account.

Configure the S3 Block Public Access feature for all objects that are in the bucket.

Deactivate ACLs for objects that are in the bucket.

Use AWS PrivateLink for Amazon S3 to access the bucket.

A
Question No 2

A company’s developers are using AWS Lambda function URLs to invoke functions directly. The company must ensure that developers cannot configure or deploy unauthenticated functions in production accounts. The company wants to meet this requirement by using AWS Organizations. The solution must not require additional work for the developers. Which solution will meet these requirements?

Choose the Choices:

Require the developers to configure all function URLs to support cross - origin resource sharing (CORS) when the functions are called from a different domain.

Use an AWS WAF delegated administrator account to view and block unauthenticated access to function URLs in production accounts, based on the OU of accounts that are using the functions.

Use SCPs to allow all lambdaCreateFunctionUrlConfig and lambdaUpdateFunctionUrlConfig actions that have a lambdaFunctionUrlAuthType condition key value of AWS_IAM.

Use SCPs to deny all lambdaCreateFunctionUrlConfig and lambdaUpdateFunctionUrlConfig actions that have a lambdaFunctionUrlAuthType condition key value of NONE.

D
Question No 3

A security engineer receives a notice about suspicious activity from a Linux - based Amazon EC2 instance that uses Amazon Elastic Block Store (Amazon EBS) - based storage. The instance is making connections to known malicious addresses. The instance is in a development account within a VPC that is in the us - east - 1 Region. The VPC contains an internet gateway and has a subnet in us - east - 1a and us - east - 1b. Each subnet is associated with a route table that uses the internet gateway as a default route. Each subnet also uses the default network ACL. The suspicious EC2 instance runs within the us - east - 1b subnet. During an initial investigation, a security engineer discovers that the suspicious instance is the only instance that runs in the subnet. Which response will immediately mitigate the attack and help investigate the root cause?

Choose the Choices:

Log in to the suspicious instance and use the netstat command to identify remote connections. Use the IP addresses from these remote connections to create deny rules in the security group of the instance. Install diagnostic tools on the instance for investigation. Update the outbound network ACL for the subnet in us - east - 1b to explicitly deny all connections as the first rule during the investigation of the instance.

Update the outbound network ACL for the subnet in us - east - 1b to explicitly deny all connections as the first rule. Replace the security group with a new security group that allows connections only from a diagnostics security group. Update the outbound network ACL for the us - east - 1b subnet to remove the deny all rule. Launch a new EC2 instance that has diagnostic tools. Assign the new security group to the new EC2 instance. Use the new EC2 instance to investigate the suspicious instance.

Ensure that the Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the suspicious EC2 instance will not delete upon termination. Terminate the instance. Launch a new EC2 instance in us - east - 1a that has diagnostic tools. Mount the EBS volumes from the terminated instance for investigation.

Create an AWS WAF web ACL that denies traffic to and from the suspicious instance. Attach the AWS WAF web ACL to the instance to mitigate the attack. Log in to the instance and install diagnostic tools to investigate the instance.

C
Question No 4

A company has a VPC that has no internet access and has the private DNS hostnames option enabled. An Amazon Aurora database is running inside the VPC. A security engineer wants to use AWS Secrets Manager to automatically rotate the credentials for the Aurora database. The security engineer configures the Secrets Manager default AWS Lambda rotation function to run inside the same VPC that the Aurora database uses. However, the security engineer determines that the password cannot be rotated properly because the Lambda function cannot communicate with the Secrets Manager endpoint. What is the MOST secure way that the security engineer can give the Lambda function the ability to communicate with the Secrets Manager endpoint?

Choose the Choices:

Add a NAT gateway to the VPC to allow access to the Secrets Manager endpoint.

Add a gateway VPC endpoint to the VPC to allow access to the Secrets Manager endpoint.

Add an interface VPC endpoint to the VPC to allow access to the Secrets Manager endpoint.

Add an internet gateway for the VPC to allow access to the Secrets Manager endpoint.

C
Question No 5

A security engineer wants to forward custom application - security logs from an Amazon EC2 instance to Amazon CloudWatch. The security engineer installs the CloudWatch agent on the EC2 instance and adds the path of the logs to the CloudWatch configuration file. However, CloudWatch does not receive the logs. The security engineer verifies that the awslogs service is running on the EC2 instance. What should the security engineer do next to resolve the issue?

Choose the Choices:

Add AWS CloudTrail to the trust policy of the EC2 instance. Send the custom logs to CloudTrail instead of CloudWatch.

Add Amazon S3 to the trust policy of the EC2 instance. Configure the application to write the custom logs to an S3 bucket that CloudWatch can use to ingest the logs.

Add Amazon Inspector to the trust policy of the EC2 instance. Use Amazon Inspector instead of the CloudWatch agent to collect the custom logs.

Attach the CloudWatchAgentServerPolicy AWS managed policy to the EC2 instance role.

Next Question

D
1. Page: 1/47
  Total 231 Questions
  
  Previous Page Next Page

About This SCS-C03 Question Bank

This page has 231 free practice questions for the Amazon SCS-C03 (AWS Certified Security - Specialty) exam, last refreshed on 27th Aug 2026. Answer each question, then reveal the correct choice to check your understanding before deciding whether to unlock the full question bank.

The demo above is a sample of the complete SCS-C03 question set. The full bank includes the PDF, downloadable practice test, and online exam-engine formats listed above, with free updates included for the duration you choose.

Frequently Asked Questions

How many free SCS-C03 questions can I try here?

This demo includes a sample from our 231-question SCS-C03 bank so you can check the format and difficulty before purchasing.

Are these SCS-C03 questions updated?

Yes, the Amazon SCS-C03 question bank is reviewed and refreshed periodically to reflect current exam objectives.

What formats are available for the full SCS-C03 question bank?

PDF download, an online practice-test engine, and a combined bundle pack with 3, 6, or 12-month free updates.

Is there a refund if I don't pass?

Yes, purchases include a money-back guarantee — see our refund policy for details.

Free Amazon SCS-C03 Exam Practice Questions

PDF Questions

Bundle Pack

Online Engine

Question No 1

Question No 2

Question No 3