AWS practice questions: 890 questions with full explanations

Questions on the exam

about 65 — vendor indicates, no fixed count published

Time allowed

170 minutes format →

890 practice questions for AWS Certified Security – Specialty SCS-C03, grouped by exam domain. Every question below shows all four options, which one is correct, and why each of the other three is not — the wrong answers are where most candidates lose marks.

Not sure where you stand? Take the free 5-min AWS readiness check →

AWS certification: requirements, cost and exam format → ·  AWS exam format →  · 

Questions by domain

• 4: Identity and Access Management — 178 questions →
• 3: Infrastructure Security — 160 questions →
• 5: Data Protection — 160 questions →
• 1: Detection — 142 questions →
• 2: Incident Response — 125 questions →
• 6: Security Foundations and Governance — 125 questions →

Sample questions

Use customer-specific OIDC roles with constrained aud/sub: Which mechanism should be configured?

1. Issue every customer a presigned PUT URL for the same fixed artifact object.

   An object-specific URL neither provides customer-isolated prefixes nor temporary role credentials for each job’s required object operations.
2. Create one IAM user per customer and distribute its access key through each job environment.

   This can separate customers but creates long-term credentials outside AWS, violating the requirement.
3. Use customer-specific OIDC roles with constrained aud/sub trust and prefix-scoped S3 permissions. ✓

   OIDC federation issues temporary credentials without stored AWS keys. Trust conditions restrict which tokens can assume the role, and customer-scoped S3 permissions prevent cross-customer access.
4. Use an S3 bucket policy allowing the provider's public IP range.

   A source IP restriction does not authenticate individual jobs or issue temporary AWS credentials with customer-specific authorization.

All 178 4: Identity and Access Management questions →

Use OAC with always-sign requests: Which configuration should the security engineer implement?

1. Use an S3 website endpoint with OAC, always-sign requests, and a bucket policy restricted to the distribution.

   An S3 website endpoint is configured as a custom origin and does not support CloudFront OAC.
2. Use an OAI and allow its canonical user to read the bucket.

   OAI is a supported legacy mechanism, but it does not provide the required SSE-KMS support without additional workarounds.
3. Use OAC with always-sign requests and a distribution-scoped bucket policy. ✓

   OAC supports regular S3 origins with SSE-KMS. Always-sign requests ensure HTTPS to S3, and the bucket policy can authorize only the CloudFront service principal for this distribution.
4. Make the bucket public and require HTTPS for CloudFront viewers.

   Viewer HTTPS does not prevent direct public S3 access or authorize the origin connection.

All 160 3: Infrastructure Security questions →

Use CloudFront OAC with always-sign requests and set: Which configuration satisfies all requirements?

1. Retain OAI, set the viewer policy to HTTPS only, and leave the S3 origin protocol behavior unchanged.

   OAI is not the recommended design and does not satisfy the stated SSE-KMS and modern origin-control requirements reliably.
2. Use CloudFront OAC with always-sign requests and set the viewer protocol policy to HTTPS only. ✓

   OAC always-sign requests ensures HTTPS to S3, while HTTPS-only viewer policy requires encrypted client-to-CloudFront connections.
3. Use CloudFront OAC with do-not-sign requests and set the viewer policy to redirect HTTP to HTTPS.

   The viewer redirect protects eventual viewer traffic, but do-not-sign requests does not ensure HTTPS from CloudFront to S3.
4. Use OAC with always-sign requests and allow HTTP viewers because CloudFront encrypts the origin connection.

   Origin encryption does not protect viewer-to-CloudFront traffic, so allowing HTTP violates the viewer requirement.

All 160 5: Data Protection questions →

Enable GuardDuty Runtime Monitoring for ECS on Fargate: Which design best satisfies these requirements?

1. Enable GuardDuty Runtime Monitoring for ECS on Fargate, Macie automated discovery, and Security Hub aggregation. ✓

   GuardDuty Runtime Monitoring covers ECS on Fargate using its managed security-agent model, Macie classifies eligible S3 data, and Security Hub centralizes supported findings. Macie automated discovery samples rather than exhaustively scanning every object.
2. Enable GuardDuty Runtime Monitoring for EKS, Macie automated discovery, and Security Hub aggregation across accounts and Regions.

   The workload is ECS on Fargate, not EKS. GuardDuty does not support EKS clusters running on Fargate, and this option selects the wrong runtime coverage.
3. Enable Inspector for supported workloads, Macie automated discovery, and Security Hub aggregation across accounts.

   Inspector can assess supported software and workloads, but it does not provide Fargate runtime process and network visibility.
4. Enable CloudTrail S3 data events, Inspector workload assessment, Macie automated discovery, and Security Hub aggregation across the organization.

   CloudTrail S3 data events record API activity, and Inspector assesses supported workloads; neither supplies process and network visibility inside Fargate tasks.

All 142 1: Detection questions →

Run AWSSupport-ContainEC2Instance and restore the saved: Which design best meets these constraints?

1. Attach an additional restrictive security group while leaving the instance running.

   Adding a security group is additive and cannot reliably remove permissions granted by existing security groups.
2. Terminate the EC2 instance immediately and restore it from the latest Amazon EBS snapshot.

   Termination destroys volatile evidence and does not preserve the original running system for investigators.
3. Remove the instance from its target group and leave its existing security groups unchanged.

   Target-group removal limits application routing but does not prevent other network communications from the instance.
4. Run AWSSupport-ContainEC2Instance and restore the saved security groups after investigation. ✓

   The supported containment automation keeps the instance running and intact, replaces its security groups to block new network activity, and permits reversal after the investigation.

All 125 2: Incident Response questions →

Create a production OU: Which design is best?

1. Create a production OU, attach a tested SCP denying public S3 changes, and move accounts into that OU gradually. ✓

   An SCP centrally limits member-account principals, can deny public-access changes, and supports staged testing through OU placement.
2. Attach an IAM policy denying public S3 changes to administrators in every production account.

   Separate identity policies require account-by-account administration and can be changed locally, lacking the requested organization-level guardrail.
3. Attach the SCP directly to the management account to prevent production administrators from changing S3 settings.

   SCPs do not affect principals in the management account and therefore cannot provide the stated production-account guardrail there.
4. Attach an RCP denying public S3 changes to the production OU and move accounts into it gradually.

   RCPs constrain supported resources and external principals, whereas this requirement limits IAM principals operating within member accounts.

All 125 6: Security Foundations and Governance questions →

Align the API audience validation or client flow: Which troubleshooting action should the team take?

1. Align the API audience validation or client flow with the intended enabled app client. ✓

   The token audience identifies a different app client from the one accepted by the API, so the validation configuration or client flow must be aligned.
2. Replace the user pool with an identity pool so the application receives temporary AWS credentials.

   Identity pools provide AWS credentials but do not correct the API's existing JWT audience mismatch.
3. Enable unauthenticated identity-pool access for the requests.

   Guest identity-pool access does not make the API accept a JWT issued for the wrong app client.
4. Rotate the external OIDC provider certificate and leave the API audience configuration unchanged.

   The issuer has already passed the stated check; certificate rotation does not resolve an audience mismatch.

All 178 4: Identity and Access Management questions →

Combine an IP set rule: Which rule design best meets these requirements?

1. Combine an IP set rule, AWS WAF intelligent threat mitigation, and a rate-based rule using an appropriate client fingerprint. ✓

   The IP set blocks known ranges, intelligent mitigation identifies automation, and client-fingerprint aggregation limits abuse beyond simple IP identity.
2. Combine an IP set rule, AWS WAF intelligent threat mitigation, and a rate-based rule using forwarded IP aggregation.

   Forwarded-IP aggregation remains vulnerable to shared or manipulated addresses and does not meet the stable-client-characteristic requirement.
3. Combine an IP set rule, AWS WAF managed rules, and a rate-based rule aggregated by a chosen forwarded-IP address.

   Managed rules address common threats, but forwarded-IP aggregation cannot distinguish legitimate shared NAT users from abusive clients reliably.
4. Combine an IP set rule, a request-labeling rule based on headers, and a rate-based rule with a suitable aggregation key.

   Header labels can classify requests, but this design does not provide the requested stable client characteristic for automated-abuse detection.

All 160 3: Infrastructure Security questions →

AWS exam: the facts

How many questions are on the AWS exam?

Around 65. The vendor does not publish a fixed count for AWS, so this is the figure it indicates rather than a guaranteed number.

How long is the AWS exam?

170 minutes. Across 65 questions that is about 157 seconds per question.

What topics does the AWS exam cover?

6 domains: 4: Identity and Access Management, 3: Infrastructure Security, 5: Data Protection, 1: Detection, 2: Incident Response, 6: Security Foundations and Governance. Weights: 4: Identity and Access Management 20%, 3: Infrastructure Security 18%, 5: Data Protection 18%, 1: Detection 16%, 2: Incident Response 14%, 6: Security Foundations and Governance 14%.

How many AWS practice questions does Certsqill have?

890, spread across 6 exam domains. Every one shows all options, which is correct, and why each of the others is not.