This is the free Amazon SCS-C03 practice question bank —
50 of 84 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-08-04.
Every answer is verified against official Amazon documentation —
see our methodology.
Question 1
A company runs an application on a fleet of Amazon EC2 instances. The application is accessible to users around the world. The company associates an AWS WAF web ACL with an Application Load Balancer (ALB) that routes traffic to the EC2 instances.
A security engineer is investigating a sudden increase in traffic to the application. The security engineer discovers a significant amount of potentially malicious requests coming from hundreds of IP addresses in two countries. The security engineer wants to quickly limit the potentially malicious requests. The security engineer does not want to prevent legitimate users from accessing the application.
Which solution will meet these requirements?
A. Use AWS WAF to implement a rate-based rule for all incoming requests.
B. Use AWS WAF to implement a geographical match rule to block all incoming traffic from the two countries.
C. Edit the ALB security group to include a geographical match rule to block all incoming traffic from the two countries
D. Add deny rules to the ALB security group that prohibit incoming requests from the IP addresses.
Show Answer
Correct Answer: A
Explanation: A rate-based AWS WAF rule is designed to quickly mitigate spikes of requests by tracking request rates per source IP and applying actions such as block or challenge when a threshold is exceeded. This limits abusive traffic while still allowing legitimate users that stay below the threshold. Blocking entire countries (B) would likely prevent legitimate users from those countries from accessing the application. ALB security groups do not support geographic match rules (C), and security groups cannot practically maintain hundreds of dynamic IP deny rules (D).
Question 2
A company needs to develop a code-signing application that will use a certificate authority (CA) to sign a code-signing certificate. The solution must use an AWS Key Management Service (AWS KMS) asymmetric key. The solution needs to collect and store immutable evidence about the creation, origin, and use of the KMS key for compliance purposes. This information must be made available to internal auditors.
Which solution meets these requirements?
A. Create an Amazon S3 bucket with S3 Object Lock enabled. Create an AWS CloudTrail trail with an event selector and log file validation enabled for all kms.amazonaws.com CreateKey events. Configure the event selector to send the CreateKey events to the S3 bucket. Create the KMS key. Update the event selector to filter for API calls that reference the KMS key ARN. Provide the auditors with access to the S3 bucket.
B. Implement logging for application operations that reference the KMS key. Ensure that the logs contain all associated metadata. Store the logs in an Amazon CloudWatch Logs log group. Configure an automated export of the log group Send the export to the auditors.
C. Create an Amazon DynamoDB table that the auditors can access. Create an AWS Lambda function that an Amazon EventBridge rule invokes. Configure the EventBridge rule to monitor KMS API calls. Configure the EventBridge rule to filter for all API calls that reference the KMS key ARN. Configure the Lambda function to store the contents of the API calls in the DynamoDB table.
D. Set up Amazon CloudWatch Logs Insights with a custom metric to track KMS key usage. Visualize the metrics by using a CloudWatch dashboard with real-time monitoring. Configure CloudWatch alarms. Use a subscription filter to replicate the data to a separate account for the auditors to review.
Show Answer
Correct Answer: A
Explanation: CloudTrail provides authoritative audit records for KMS API activity, including CreateKey and subsequent key usage. Storing CloudTrail logs in an Amazon S3 bucket with S3 Object Lock provides immutable (WORM) retention, and CloudTrail log file validation provides integrity verification for compliance. Auditors can review the immutable logs directly from S3. The other options rely on mutable stores or monitoring features that do not provide compliance-grade, tamper-evident audit evidence.
Question 3
A security engineer needs to implement a logging solution that captures detailed information about objects in an Amazon S3 bucket. The solution must include details such as the IAM identity that makes the request and the time the object was accessed. The data must be structured and available in near real time.
Which solution meets these requirements?
A. Enable Amazon S3 server access logging on the S3 bucket. Create a new S3 bucket to store the logs. Analyze the logs from the logging S3 bucket.
B. Enable AWS CloudTrail data event logging. Create a new S3 bucket to store the logs. Analyze the logs from the logging S3 bucket.
C. Configure AWS Config rules to log access to the objects stored in the S3 bucket.
D. Enable Amazon Macie to log access to the objects stored in the S3 bucket.
Show Answer
Correct Answer: B
Explanation: AWS CloudTrail data events record S3 object-level API activity such as GetObject, PutObject, and DeleteObject, including the IAM identity, request time, and other structured event details. These events are delivered in near real time through CloudTrail. S3 server access logging provides access logs but is less suitable for detailed structured auditing of IAM identities and API events. AWS Config tracks resource configuration changes, not object access, and Amazon Macie discovers and classifies sensitive data rather than logging object access.
Question 4
HOTSPOT
-
A security engineer is using the AWS Well-Architected Tool to evaluate a multi-tier web application that a company hosts on AWS. During the assessment, the security engineer identifies several resources that violate design principles of the Well-Architected Framework security pillar.
Select the security pillar design principle from the following list that each assessment finding primarily violates. Select each security pillar design principle one time.
• Configure service and application logging
• Reduce manual management and interactive access.
• Deploy software programmatically.
• Control traffic flow within your network layers.
• Protecting data in transit.
Show Answer
Correct Answer: 1. Deploy software programmatically.
2. Reduce manual management and interactive access.
3. Control traffic flow within your network layers.
4. Protecting data in transit.
5. Configure service and application logging.
Explanation: Each finding maps directly to the primary AWS Well-Architected Security Pillar design principle it violates: manual patching bypasses automation, interactive production access should be minimized, overly permissive security groups violate network traffic control, HTTP violates in-transit protection, and manual log review without alerting indicates inadequate logging/monitoring configuration.
Question 5
A company is planning to deploy a new log analysis environment. The company needs to implement a solution to analyze logs from multiple AWS services in near real time. The solution must provide the ability to search the logs. The solution also must send alerts to an existing Amazon Simple Notification Service (Amazon SNS) topic when specific logs match detection rules.
Which solution will meet these requirements?
A. Analyze the logs by using Amazon OpenSearch Service. Search the logs from the OpenSearch API. Use OpenSearch Service Security Analytics to match logs with detection rules and to send alerts to the SNS topic.
B. Analyze the logs by using AWS Security Hub. Search the logs from the Findings page in Security Hub. Create custom actions to match logs with detection rules and to send alerts to the SNS topic.
C. Analyze the logs by using Amazon CloudWatch Logs. Use a subscription filter to match logs with detection rules and to send alerts to the SNS topic. Search the logs manually by using CloudWatch Logs Insights.
D. Analyze the logs by using Amazon QuickSight. Search the logs by listing the query results in a dashboard. Run queries to match logs with detection rules and to send alerts to the SNS topic
Show Answer
Correct Answer: A
Explanation: Amazon OpenSearch Service is designed for near real-time log ingestion and search across multiple AWS services. Its Security Analytics capability supports detection rules and can generate alerts that integrate with Amazon SNS. Security Hub is for security findings rather than general log analysis, CloudWatch Logs Insights supports log queries but not this integrated detection/search workflow, and QuickSight is a BI visualization service, not a log analytics and alerting platform.
Question 6
A company uses AWS Organizations to manage an organization that consists of three workload OUs: Production. Development, and Testing. The company uses AWS CloudFormation templates to define and deploy workload infrastructure in AWS accounts that are associated with the OUs. Different SCPs are attached to each workload OU.
The company successfully deployed a CloudFormation stack update to workloads in the Development OU and the Testing OU. When the company uses the same CloudFormation template to deploy the stack update in an account in the Production OU, the update fails. The error message reports insufficient IAM permissions.
What is the FIRST step that a security engineer should take to troubleshoot this issue?
A. Review the AWS CloudTrail logs in the account in the Production OU. Search for any failed API calls from CloudFormation during the deployment attempt.
B. Remove all the SCPs that are attached to the Production OU. Rerun the CloudFormation stack update to determine if the SCPs were preventing the CloudFormation API calls
C. Confirm that the role used by CloudFormation has sufficient permissions to create, update, and delete the resources that are referenced in the CloudFormation template
D. Make all the SCPs that are attached to the Production OU the same as the SCPs that are attached to the Testing OU.
Show Answer
Correct Answer: A
Explanation: The first troubleshooting step is to review CloudTrail for the failed CloudFormation API calls. CloudTrail shows which API operation was denied and whether the denial was caused by IAM permissions, an SCP, or another policy control. This identifies the root cause before making potentially disruptive policy changes. Removing or changing SCPs is not an appropriate first step, and although verifying the CloudFormation execution role is important, the error should first be investigated using the authoritative audit logs.
Question 7
HOTSPOT
-
A company uses an organization in AWS Organizations to manage multiple AWS accounts. A security engineer needs to monitor the security compliance of AWS resources across the organization. The security engineer wants to receive notifications when any AWS resources does not comply with the company's security policies.
Select the correct AWS Config based solution from the following list to meet each requirement. Select each AWS Config based solution one time.
• AWS Config aggregator
• AWS Config conformance packs
• AWS Config with AWS Systems Manager
• AWS Config rules
• AWS Config with AWS User Notifications
Show Answer
Correct Answer: AWS Config conformance packs
AWS Config aggregator
AWS Config rules
AWS Config with AWS Systems Manager
AWS Config with AWS User Notifications
Explanation: Conformance packs deploy collections of rules organization-wide. Aggregators centralize compliance data across accounts/Regions. Config rules evaluate resource configurations. Systems Manager integrates for auto-remediation. User Notifications delivers alerts for compliance/configuration changes.
Question 8
A security engineer needs to protect a public web application that runs in a VPC. The VPC hosts the origin for an Amazon CloudFront distribution. The application has experienced multiple layer 7 DDoS attacks. An AWS WAF web ACL is associated with the CloudFront distribution. The web ACL contains one AWS managed rule to protect against known IP addresses that have bad reputations.
The security engineer must configure an automated solution that detects and mitigates layer 7 DDoS attacks in real time with no manual effort.
Which solution will meet these requirements?
A. Enable AWS Shield Advanced on the CloudFront distribution. Configure alerts in Amazon CloudWatch for DDoS indicators.
B. Enable AWS Shield Advanced and configure proactive engagement with the AWS DDoS Response Team.
C. Deploy AWS Network Firewall in the VPCreate security policies that detect DDoS indicators. Create an AWS Lambda function to automatically update the web ACL rules during an attack.
D. Add a rate-based rule to the web ACL. Enable AWS Shield Advanced. Enable automatic application layer DDoS mitigation on the CloudFront distribution.
Show Answer
Correct Answer: D
Explanation: AWS Shield Advanced with automatic application layer DDoS mitigation integrates with AWS WAF to automatically create and deploy mitigations for layer 7 attacks on CloudFront. Adding a rate-based rule complements this protection by throttling excessive requests. CloudWatch alerts and proactive engagement do not provide automatic mitigation, and Network Firewall is not the appropriate control for layer 7 web DDoS mitigation at CloudFront.
Sources:
https://aws.amazon.com/blogs/security/protect-apis-with-amazon-api-gateway-and-perimeter-protection-services
https://aws.amazon.com/blogs/security/how-to-protect-dynamic-web-applications-against-ddos-attacks-by-using-amazon-cloudfront-and-amazon-route-53
Question 9
A company uses AWS Organizations with all features enabled. The company has enabled AWS Security Hub in all member accounts and in all AWS Regions. The company has created a VPC in the eu-central-1 Region in a member AWS account.
A security engineer has verified that no security group rules in the VPC allow inbound traffic from all IP addresses on TCP port 22. The security engineer needs an automated system. The system must prevent the creation of security group rules in the VPC that allow traffic from all IP addresses on TCP port 22.
Which solution will meet these requirements?
A. Enable an AWS CloudTrail organization trail that logs to an Amazon CloudWatch Logs log group. Create a CloudWatch alarm based on a log group metric filter. Configure the alarm to publish to an Amazon Simple Notification Service (Amazon SNS) topic when a security group rule is added that allows inbound traffic from all IP addresses. Subscribe the security engineer's email address to the SNS topic.
B. Create an Amazon EventBridge rule that filters for Security Hub findings about security group rules that allow inbound traffic from all IP addresses on TCP port 22. Configure the EventBridge rule to target an AWS Lambda function that removes the unwanted security group rule.
C. Create an SCP that prevents the creation or modification of security group rules that allow inbound traffic from all IP addresses on TCP port 22.
D. Deploy AWS Network Firewall with a rule that inspects all inbound traffic and prevents incoming traffic on TCP port 22.
Show Answer
Correct Answer: B
Explanation: Security Hub generates findings for overly permissive security groups, and Amazon EventBridge can match those findings and invoke a Lambda function to automatically remove the offending rule. This provides automated remediation. Option A only notifies after the fact. Option C cannot enforce this level of request-parameter granularity for specific CIDRs and ports. Option D filters traffic but does not prevent creation of the insecure security group rule.
Question 10
A company with 50 AWS accounts managed through AWS Organizations needs to set up a centralized threat detection solution. The solution must identify suspicious and potentially malicious activity across all accounts in the organization.
The company uses AWS Control Tower and wants to centralize security findings into an audit account. A security team must receive email alerts within 5 minutes of any new security findings.
Which solution will meet these requirements?
A. Configure Amazon GuardDuty with a delegated administrator in the audit account. Enable GuardDuty across all member accounts through the delegated administrator account. Create an Amazon EventBridge rule to send GuardDuty findings to an Amazon SNS topic that delivers email notifications to the security team.
B. Set up Amazon GuardDuty in each member account, and create IAM roles to allow cross-account access from the audit account. Configure Amazon CloudWatch alarms in each account to monitor for security findings and to send notifications to an Amazon Simple Notification Service (Amazon SNS) topic in the audit account.
C. Enable AWS Config in the audit account and create custom rules to detect security issues across the organization. Use AWS Systems Manager to collect security findings from all member accounts and to store the findings in a centralized Amazon S3 bucket. Create an AWS Lambda function to monitor the S3 bucket and to send email notifications to the security team when new findings are detected.
D. Deploy Amazon Inspector agents across all Amazon EC2 instances in the organization. Configure the Amazon Inspector agents to report to a central Amazon Inspector console in the audit account. Create Amazon EventBridge rules in each member account to forward findings to an Amazon Simple Notification Service (Amazon SNS) topic in the audit account.
Show Answer
Correct Answer: A
Explanation: Amazon GuardDuty is the AWS managed threat detection service designed to detect suspicious and malicious activity. With AWS Organizations, you can designate the audit account as the GuardDuty delegated administrator and enable GuardDuty organization-wide. GuardDuty findings can be centralized in the delegated administrator account. Amazon EventBridge can match new GuardDuty findings and publish them to an Amazon SNS topic for email notifications, typically within minutes, satisfying the alerting requirement. Option B lacks centralized organization management and uses unnecessary per-account setup. Option C uses AWS Config, which is for compliance/configuration monitoring rather than threat detection. Option D uses Amazon Inspector, which focuses on vulnerability management rather than detecting malicious account and workload activity.
$19
Get all 84 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
