100% Free SCS-C03 Practice Exam Questions and Answers

Stay Ahead with Latest SCS-C03 AWS Certified Security Practice Test Questions 2026

Page: 1 / 48

Total 236 Questions | Updated On: Sep 22, 2026

Add To Cart

Question 1

A company runs workloads in an AWS account. A security engineer observes some unusual findings in Amazon GuardDuty. The security engineer wants to investigate a specific IAM role and generate an investigation report. The report must contain details about anomalous behavior and any indicators of compromise. Which solution will meet these requirements?

A : Use Amazon Detective to perform an investigation on the IAM role.

B : Use AWS Audit Manager to create an assessment. Specify the IAM role. Run an assessment report.

C : Use Amazon Inspector to create an assessment. Specify the IAM role. Run an assessment report.

D : Use Amazon Inspector to run an on-demand scan of the IAM role.

Answer: A

Question 2

A company needs to scan all AWS Lambda functions for code vulnerabilities.

A : Use Amazon Macie.

B : Enable Amazon Inspector Lambda scanning.

C : Use GuardDuty and Security Hub.

D : Use GuardDuty Lambda Protection.

Answer: B

Question 3

A company is using AWS to run a long-running analysis process on data that is stored in Amazon S3 buckets. The process runs on a fleet of Amazon EC2 instances in an Auto Scaling group. The EC2 instances are deployed in a private subnet that does not have internet access. The EC2 instances access Amazon S3 through an S3 gateway endpoint that has the default access policy. Each EC2 instance uses an instance profile role that allows s3:GetObject and s3:PutObject only for required S3 buckets. The company learns that one or more EC2 instances are compromised and are exfiltrating data to an S3 bucket that isoutside the company’s AWS Organization. The processing job must continue to function. Which solution will meet these requirements?

A : Update the policy on the S3 gateway endpoint to allow S3 actions only if aws:ResourceOrgId and aws: PrincipalOrgId match the company’s organization.

B : Update the instance profile role policy to require aws:ResourceOrgId.

C : Add a network ACL rule to block outbound traffic on port 443.

D : Apply an SCP that restricts S3 actions using organization condition keys.

Answer: A

Question 4

A company has a web-based application that runs behind an Application Load Balancer (ALB). Theapplication is experiencing a credential stuffing attack that is producing many failed login attempts.The attack is coming from many IP addresses. The login attempts are using a user agent string of aknown mobile device emulator. A security engineer needs to implement a solution to mitigate thecredential stuffing attack. The solution must still allow legitimate logins to the application.Which solution will meet these requirements?

A : Create an Amazon CloudWatch alarm that reacts to login attempts that contain the specified useragent string. Add an Amazon Simple Notification Service (Amazon SNS) topic to the alarm.

B : Modify the inbound security group on the ALB to deny traffic from the IP addresses that areinvolved in the attack.

C : Create an AWS WAF web ACL for the ALB. Create a custom rule that blocks requests that containthe user agent string of the device emulator.

D : Create an AWS WAF web ACL for the ALB. Create a custom rule that allows requests fromlegitimate user agent strings.

Answer: C

Question 5

An AWS Lambda function was misused to alter data, and a security engineer must identify who invoked the function and what output was produced. The engineer cannot find any logs created by the Lambda function in Amazon CloudWatch Logs. Which of the following explains why the logs are not available?

A : The execution role for the Lambda function did not grant permissions to write log data to CloudWatch Logs.

B : The Lambda function was invoked by using Amazon API Gateway, so the logs are not stored in CloudWatch Logs.

C : The execution role for the Lambda function did not grant permissions to write to the Amazon S3 bucket where CloudWatch Logs stores the logs.

D : The version of the Lambda function that was invoked was not current.

Answer: A

Page: 1 / 48

Total 236 Questions | Updated On: Sep 22, 2026

Add To Cart