AWS SCS-C03 Exam Practice Questions, practice question pack
AWS · SCS-C03

AWS SCS-C03 Exam Practice Questions

85 questionsInstant PDF downloadUpdated September 2026

US$39

Try 10 questions free

Card, Apple Pay or Google Pay. Your PDF is sent by email as soon as you check out.

Pass or your money backFail the exam after using this pack and we refund it. How the guarantee works
Category:
TRY BEFORE YOU BUY

Three of the 85 questions in this pack

Question 1

A security engineer is troubleshooting an AWS Lambda function that is named MyLambdaFunction. The function is encountering an error when the function attempts to read the objects in an Amazon S3 bucket that is named DOC-EXAMPLE-BUCKET. The S3 bucket has the following bucket policy: Which change should the security engineer make to the policy to ensure that the Lambda function can read the bucket objects?

Exhibit for question 1

Exhibit for question 1

Exhibit for question 1

  1. Remove the Condition element. Change the Principal element to the following:
  2. Change the Action element to the following:
  3. Change the Resource element to "arn:aws:s3:::DOC-EXAMPLE- BUCKET/*''.
  4. Change the Resource element to "arn:aws:lambda:::function:MyLambdaFunction". Change the Principal element to the following:
Show answer and explanation

Correct answer: C. Change the Resource element to "arn:aws:s3:::DOC-EXAMPLE- BUCKET/*''.

EXAMPLE- BUCKET/*''. The Lambda function needs to read objects within the S3 bucket, but the current Resource element only specifies the bucket itself ("arn:aws:s3:::DOC-EXAMPLE-BUCKET"). To allow the function to access and read objects inside the bucket, the Resource must include the bucket contents using the wildcard notation ("arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"). Without this, the s3:GetObject action cannot be applied to individual objects within the bucket.

Why the other options are wrong

  • A. Removing the Condition element and changing the Principal to a different service is unnecessary; the Principal already correctly identifies the Lambda function as the entity being granted permission.
  • B. Adding s3:GetBucket* actions is not the issue; the problem is that the Resource specification doesn't include the objects within the bucket, preventing GetObject from applying to them.
  • D. Changing the Principal to reference a Lambda function ARN is incorrect; the Principal should reference the Lambda function's execution role ARN, not the function itself, and this doesn't address the actual Resource problem.

Question 2

An AWS account administrator created an IAM group and applied the following managed policy to require that each individual user authenticate using multi-factor authentication: After implementing the policy, the administrator receives reports that users are unable to perform Amazon EC2 commands using the AWS CLI. What should the administrator do to resolve this problem while still enforcing multi-factor authentication?

Exhibit for question 2

  1. Change the value of aws:MultiFactorAuthPresent to true.
  2. Instruct users to run the aws sts get-session-token CLI command and pass the multi-factor authentication --serial-number and -token-code parameters. Use these resulting values to make API/CLI calls.
  3. Implement federated API/CLI access using SAML 2.0, then configure the identity provider to enforce multi-factor authentication.
  4. Create a role and enforce multi-factor authentication in the role trust policy. Instruct users to run the sts assume-role CLI command and pass --serial-number and --token-code parameters. Store the resulting values in environment variables. Add sts:AssumeRole to NotAction in the policy.
Show answer and explanation

Correct answer: B. Instruct users to run the aws sts get-session-token CLI command and pass the multi-factor authentication --serial-number and -token-code parameters. Use these resulting values to make API/CLI calls.

CLI command and pass the multi-factor authentication --serial-number and -token-code parameters. Use these resulting values to make API/CLI calls. The policy shown denies EC2 actions unless MFA is present (aws:MultiFactorAuthPresent is false in the Deny condition, meaning it blocks when MFA is NOT present). However, the CLI cannot automatically provide MFA tokens with regular API calls. The solution is for users to first call aws sts get-session-token with their MFA serial number and token code, which returns temporary credentials valid for MFA-authenticated sessions. Users then use these temporary credentials for subsequent EC2 CLI commands, satisfying the policy's MFA requirement while maintaining enforcement.

Why the other options are wrong

  • A. Changing the condition to true would require MFA to be present to DENY access, which inverts the policy logic and defeats the MFA enforcement goal.
  • C. Federated SAML access adds unnecessary complexity and doesn't directly solve the immediate problem of CLI users needing to provide MFA credentials with their requests.
  • D. While STS assume-role is a valid MFA pattern, adding sts:AssumeRole to NotAction would actually exclude it from the policy restrictions, breaking the intended enforcement mechanism.

Question 3

What is the effect of the following AWS Key Management Service (AWS KMS} key policy that is attached to a customer managed key?

Exhibit for question 3

  1. Amazon WorkMail and Amazon Simple Email Service (Amazon SES) have delegated KMS encrypt and decrypt permissions to the ExampleRole principal in the 111122223333 account.
  2. The ExampleRole principal can transparently encrypt and decrypt email exchanges specifically between ExampleRole and AWS.
  3. The customer managed key can be used for encrypting and decrypting only when the principal is ExampleRole and when the request comes from Amazon WorkMail or Amazon Simple Email Service (Amazon SES) in the specified AWS Region.
  4. The key policy allows Amazon WorkMail or Amazon Simple Email Service (Amazon SES) to encrypt or decrypt on behalf of the ExampleRole for any customer managed key in the account.
Show answer and explanation

Correct answer: C. The customer managed key can be used for encrypting and decrypting only when the principal is ExampleRole and when the request comes from Amazon WorkMail or Amazon Simple Email Service (Amazon SES) in the specified AWS Region.

encrypting and decrypting only when the principal is ExampleRole and when the request comes from Amazon WorkMail or Amazon Simple Email Service (Amazon SES) in the specified AWS Region. The policy grants the ExampleRole principal Allow permissions for KMS actions (Encrypt, Decrypt, GenerateDataKey, CreateGrant, ListGrants) on all resources (*). However, the critical Condition element restricts these permissions: the kms:ViaService condition specifies that the request must originate from either workmail.us-west-2.amazonaws.com or ses.us-west-2.amazonaws.com. This means the key can only be used when ExampleRole makes requests through these specific AWS services in the specified region, effectively limiting access to encryption/decryption operations that come through Amazon WorkMail or SES.

Why the other options are wrong

  • A. The policy does not delegate permissions to ExampleRole; it grants permissions directly to ExampleRole as a principal, and it applies only when requests come through the specified services, not blanket delegation.
  • B. The policy does not enable transparent encryption between ExampleRole and AWS; it conditions usage on requests originating from specific AWS services (WorkMail/SES), and applies to any resource, not just email exchanges.
  • D. The policy allows ExampleRole to use the key through WorkMail/SES services, not the other way around, the services do not encrypt/decrypt on behalf of ExampleRole; rather, ExampleRole's actions are permitted only when channeled through these services.

See all 10 free questions Get the full pack, US$39

85 practice questions for AWS Certified Security, Specialty (SCS-C03), with full explanations.

Every question comes with the correct answer, the reasoning behind it, and a note on why each wrong option is wrong. Work through it once with the answers, then again with the questions-only copy under exam conditions.

  • 85 questions across all six SCS-C03 domains
  • Answers and explanations for every question, including the wrong options
  • A questions-only PDF for timed practice runs
  • Instant delivery by email the moment you check out
  • Free monthly updates for as long as the exam is live
  • Pass or your money back

A failed SCS-C03 attempt costs another US$300, plus the time it takes to restudy. This pack is US$39, paid once, and refunded if you fail.

Try 10 questions free before you buy.

Last updated September 2026 · 85 questions

What makes the SCS-C03 hard

SCS-C03 is a new exam, and most study material has not caught up. AWS replaced the C02 version in December 2025 with restructured domains, generative AI security on Bedrock, Security Lake and OCSF logging, Resource Control Policies, and new ordering and matching question formats, so prep built for the old exam tests a blueprint that no longer exists.

Complex IAM policy evaluation across accounts, KMS key policies and grants, GuardDuty versus Inspector versus Macie versus Detective, incident response automation, and SCP and RCP guardrails are the calls a real security engineer makes every day. 65 questions in 170 minutes, 750 out of 1000 to pass. This pack has 85 practice questions for the SCS-C03 across all domains, so the newer question formats and multi-account security patterns are familiar before you sit down.

About the exam

SCS-C03 certifies security engineers who protect AWS workloads at scale, covering identity, detection, incident response, data protection and governance with IAM, KMS, GuardDuty, Security Hub and AWS Organizations, plus new coverage of generative AI security. AWS recommends several years of security experience. Valid for three years.

Exam domains

  • Identity and access management: 20%
  • Data protection: 18%
  • Infrastructure security: 18%
  • Detection: 16%
  • Threat detection and incident response: 14%
  • Security foundations and governance: 14%

65 questions, 170 minutes, pass mark 750 out of 1000, US$300 per attempt, Pearson VUE test centres or online proctored, valid for three years.

Reviews

There are no reviews yet.

Only logged in customers who have purchased this product may leave a review.

Questions before you buy

What do I get when I buy the AWS SCS-C03 pack?

85 practice questions as a PDF, each with the correct answer, a full explanation and a note on why the other options are wrong, plus a separate questions-only PDF for timed practice.

How quickly do I receive it?

Straight away. The full PDF and a questions-only copy are emailed to you the moment your payment goes through, and the same links are on your order page.

Is there a free sample?

Yes. Ten questions from this pack, with answers and explanations, are free on this page and as a PDF, so you can judge the quality before you pay.

Are updates included?

Yes. The pack is updated every month for as long as the exam is live, and updates are free for everyone who has bought it.

What if I fail the exam?

We refund the pack. Sit the exam 7 to 30 days after buying, then send your official score report within 7 days of the exam date, as set out in the refund policy.

Can I share it with colleagues?

Each purchase is licensed to one person. For a team, school or training organisation, email support@certstash.com for a licence that fits.

Related products