10 free AWS SCS-C03 practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 85 questions. Work through them, then open each answer to check your reasoning.
Get all 85 questions (US$39) · Download these 10 as a PDF
Question 1
A security engineer is troubleshooting an AWS Lambda function that is named MyLambdaFunction. The function is encountering an error when the function attempts to read the objects in an Amazon S3 bucket that is named DOC-EXAMPLE-BUCKET. The S3 bucket has the following bucket policy:
Which change should the security engineer make to the policy to ensure that the Lambda function can read the bucket objects?
Show answer and explanation
Correct answer: C. Change the Resource element to "arn:aws:s3:::DOC-EXAMPLE- BUCKET/*''.
EXAMPLE- BUCKET/*''. The Lambda function needs to read objects within the S3 bucket, but the current Resource element only specifies the bucket itself ("arn:aws:s3:::DOC-EXAMPLE-BUCKET"). To allow the function to access and read objects inside the bucket, the Resource must include the bucket contents using the wildcard notation ("arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"). Without this, the s3:GetObject action cannot be applied to individual objects within the bucket.
Why the other options are wrong
- A. Removing the Condition element and changing the Principal to a different service is unnecessary; the Principal already correctly identifies the Lambda function as the entity being granted permission.
- B. Adding s3:GetBucket* actions is not the issue; the problem is that the Resource specification doesn't include the objects within the bucket, preventing GetObject from applying to them.
- D. Changing the Principal to reference a Lambda function ARN is incorrect; the Principal should reference the Lambda function's execution role ARN, not the function itself, and this doesn't address the actual Resource problem.
Question 2
An AWS account administrator created an IAM group and applied the following managed policy to require that each individual user authenticate using multi-factor authentication:
After implementing the policy, the administrator receives reports that users are unable to perform Amazon EC2 commands using the AWS CLI.
What should the administrator do to resolve this problem while still enforcing multi-factor authentication?
Show answer and explanation
Correct answer: B. Instruct users to run the aws sts get-session-token CLI command and pass the multi-factor authentication –serial-number and -token-code parameters. Use these resulting values to make API/CLI calls.
CLI command and pass the multi-factor authentication –serial-number and -token-code parameters. Use these resulting values to make API/CLI calls. The policy shown denies EC2 actions unless MFA is present (aws:MultiFactorAuthPresent is false in the Deny condition, meaning it blocks when MFA is NOT present). However, the CLI cannot automatically provide MFA tokens with regular API calls. The solution is for users to first call aws sts get-session-token with their MFA serial number and token code, which returns temporary credentials valid for MFA-authenticated sessions. Users then use these temporary credentials for subsequent EC2 CLI commands, satisfying the policy's MFA requirement while maintaining enforcement.
Why the other options are wrong
- A. Changing the condition to true would require MFA to be present to DENY access, which inverts the policy logic and defeats the MFA enforcement goal.
- C. Federated SAML access adds unnecessary complexity and doesn't directly solve the immediate problem of CLI users needing to provide MFA credentials with their requests.
- D. While STS assume-role is a valid MFA pattern, adding sts:AssumeRole to NotAction would actually exclude it from the policy restrictions, breaking the intended enforcement mechanism.
Question 3
What is the effect of the following AWS Key Management Service (AWS KMS} key policy that is attached to a customer managed key?
Show answer and explanation
Correct answer: C. The customer managed key can be used for encrypting and decrypting only when the principal is ExampleRole and when the request comes from Amazon WorkMail or Amazon Simple Email Service (Amazon SES) in the specified AWS Region.
encrypting and decrypting only when the principal is ExampleRole and when the request comes from Amazon WorkMail or Amazon Simple Email Service (Amazon SES) in the specified AWS Region. The policy grants the ExampleRole principal Allow permissions for KMS actions (Encrypt, Decrypt, GenerateDataKey, CreateGrant, ListGrants) on all resources (*). However, the critical Condition element restricts these permissions: the kms:ViaService condition specifies that the request must originate from either workmail.us-west-2.amazonaws.com or ses.us-west-2.amazonaws.com. This means the key can only be used when ExampleRole makes requests through these specific AWS services in the specified region, effectively limiting access to encryption/decryption operations that come through Amazon WorkMail or SES.
Why the other options are wrong
- A. The policy does not delegate permissions to ExampleRole; it grants permissions directly to ExampleRole as a principal, and it applies only when requests come through the specified services, not blanket delegation.
- B. The policy does not enable transparent encryption between ExampleRole and AWS; it conditions usage on requests originating from specific AWS services (WorkMail/SES), and applies to any resource, not just email exchanges.
- D. The policy allows ExampleRole to use the key through WorkMail/SES services, not the other way around, the services do not encrypt/decrypt on behalf of ExampleRole; rather, ExampleRole's actions are permitted only when channeled through these services.
Question 4
A company needs a solution to protect critical data from being permanently deleted. The data is stored in Amazon S3 buckets.
The company needs to replicate the S3 objects from the company's primary AWS Region to a secondary Region to meet disaster recovery requirements. The company must also ensure that users who have administrator access cannot permanently delete the data in the secondary Region.
Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Implement S3 Object Lock in compliance mode in the primary Region. Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region.
primary Region. Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region. S3 Object Lock in compliance mode is the definitive solution for preventing permanent deletion, even by administrators. When replicated to the secondary Region, the Object Lock settings are preserved, ensuring administrators cannot delete objects in either Region. This meets both the disaster recovery requirement (replication) and the immutability requirement (Object Lock compliance mode prevents all deletions until retention period expires).
Why the other options are wrong
- A. AWS Backup Vault Lock governance mode allows privileged users to modify or delete the vault lock settings, so administrators could still delete backups.
- C. A bucket policy denying s3:ReplicateDelete does not prevent direct object deletion; administrators can still use s3:DeleteObject regardless of the policy.
- D. Versioning alone allows deletion of current versions and doesn't prevent administrators from permanently removing all versions through delete markers.
Question 5
A security engineer is responding to an incident that is affecting an AWS account. The ID of the account is 1234156789012. The attack created workloads that are distributed across multiple AWS Regions.
The security engineer contains the attack. The security engineer removes all compute and storage resources from all affected Regions. However, the attacker also created an
AWS KMS key. The key policy on the KMS key explicitly allows IAM principal kms:* permissions.
The key was scheduled to be deleted the previous day. However, the key is still enabled and usable. The key has an ARN of arn:aws;kms:us-east-
2:123456789012:key/mrk-0bb0212cd9864fdea0dcamzo26efb5670. The security engineer must delete the key as quickly as possible.
Which solution will meet this requirement?
Show answer and explanation
Correct answer: B. Identify the other Regions where the KMS key ID is present and schedule the key for deletion in 7 days.
present and schedule the key for deletion in 7 days. The mrk- prefix shows this is a multi-Region key. Scheduling deletion of a primary key that still has replicas moves it to the Pending replica deletion state, which is why the key is still enabled and usable. The engineer must find the Regions that hold the replicas and schedule those replica keys for deletion with the 7-day minimum waiting period. After the last replica is deleted, the primary key's own waiting period starts and the key is removed.
Why the other options are wrong
- A. Root credentials do not help. Deletion is blocked by the existing replica keys, not by permissions, and the key policy already grants full access on the key.
- C. The principal already has kms:* on the key, so changing permissions changes nothing; the replica keys are what keep the primary key alive.
- D. Disabling does not delete the key, 30 days is slower than the 7-day minimum, and the replicas would still block removal of the primary key.
Question 6
A company has installed a third-party application that is distributed on several Amazon EC2 instances and on-premises servers. Occasionally, the company's IT team needs to use SSH to connect to each machine to perform software maintenance tasks. Outside these time slots, the machines must be completely isolated from the rest of the network.
The company does not want to maintain any SSH keys. Additionally, the company wants to pay only for machine hours when there is an SSH connection.
Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Set up AWS Systems Manager Session Manager to allow temporary connections.
allow temporary connections. Session Manager gives shell access to both EC2 instances and on-premises servers through the SSM Agent, with no SSH keys, no open inbound ports, and no bastion to operate. Access is granted through IAM policies that can be limited to the maintenance time slots, and every session is logged for audit. Session Manager itself is offered at no additional charge, so cost is limited to the machine hours of the instances.
Why the other options are wrong
- A. A bastion host requires maintaining SSH keys and keeping an extra instance running continuously, adding cost and attack surface.
- C. CloudShell provides a shell environment for AWS service management but is not designed for SSH connections to arbitrary EC2 instances or on-premises servers.
- D. VPC endpoints enable private connectivity but do not provide SSH access, authentication, or key management; they address network isolation rather than secure terminal access.
Question 7
A company runs several applications on Amazon Elastic Kubernetes Service (Amazon EKS). The company needs a solution to detect any Kubernetes security risks by monitoring Amazon EKS audit logs in addition to operating system, networking, and file events. The solution must send email alerts for any identified risks to a mailing list that is associated with a security team.
Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Enable Amazon GuardDuty Enable EKS Protection and Runtime Monitoring for Amazon EKS in GuardDuty. Create an Amazon Simple Notification Service (Amazon SNS) topic and set the security team's mailing list as a subscriber. Use an Amazon EventBridge rule to send relevant GuardDuty events to the SNS topic.
and Runtime Monitoring for Amazon EKS in GuardDuty. Create an Amazon Simple Notification Service (Amazon SNS) topic and set the security team's mailing list as a subscriber. Use an Amazon EventBridge rule to send relevant GuardDuty events to the SNS topic. Amazon GuardDuty with EKS Protection and Runtime Monitoring is purpose-built for Kubernetes security threat detection. It monitors EKS audit logs, operating system events, network activity, and file system changes across the cluster. GuardDuty findings automatically integrate with EventBridge, enabling alerts through SNS to the security team's mailing list. This provides comprehensive coverage of all required monitoring areas.
Why the other options are wrong
- A. Security Hub is a compliance and configuration tool focused on security standards and best practices; it does not provide the runtime threat detection needed for EKS audit logs and OS-level events.
- B. This combination lacks the real-time threat detection capability; Inspector focuses on image vulnerabilities, and Detective is for post-incident investigation rather than proactive monitoring.
- D. Systems Manager Agent is not designed for EKS monitoring, and CloudWatch alarms triggered by absence of logs are not an effective security monitoring solution.
Question 8
A company allows users to download its mobile app onto their phones. The app is MQTT based and connects to AWS IoT Core lo subscribe la specific client-related topics.
Recently, the company discovered that some malicious attackers have been trying to get a Trojan horse onto legitimate mobile phones. The Trojan horse poses as the authentic application and uses a client ID with injected special characters to gain access to topics outside the client's privilege scope.
Which combination of actions should the company take to prevent this threat? (Choose two.)
Show answer and explanation
Correct answer: A, E
A. In the application, use an IoT thing name as the client ID to conned the device to AWS IoT Core. E. Apply an AWS IoT Core policy to the device to allow "iot:Connect" with the resource set to "client/${iot:Connection.Thing.ThingName)". Using the IoT thing name as the client ID (option A) ties every MQTT connection to a registered thing. The policy in option E allows iot:Connect only when the resource matches client/${iot:Connection.Thing.ThingName}, and AWS IoT Core resolves that policy variable server-side from the thing attached to the device certificate. A Trojan that supplies a client ID with injected characters no longer matches, so the connection is denied.
Why the other options are wrong
- B. Client-side validation of special characters is insufficient because attackers with a Trojan can bypass client logic; the threat requires server-side enforcement.
- C. AWSIoTWirelessDataAccess applies to LoRaWAN and Sidewalk wireless data, not to MQTT client connections to AWS IoT Core.
- D. ${iot:ClientId} resolves to whatever client ID the device sends, so a manipulated client ID still satisfies the policy and the connection succeeds.
Question 9
A security engineer wants to evaluate configuration changes to a specific AWS resource to ensure that the resource meets compliance standards.
However, the security engineer is concerned about a situation in which several configuration changes are made to the resource in quick succession. The security engineer wants to record only the latest configuration of that resource to indicate the cumulative impact of the set of changes.
Which solution will meet this requirement in the MOST operationally efficient way?
Show answer and explanation
Correct answer: B. Use AWS Config to detect the configuration changes and to record the latest configuration in case of multiple configuration changes.
and to record the latest configuration in case of multiple configuration changes. AWS Config is purpose-built for tracking configuration changes and automatically records the latest state of resources. When multiple configuration changes occur in succession, Config records only the final state, capturing the cumulative impact without requiring manual correlation or filtering of multiple events. This is more operationally efficient than analyzing raw API call logs.
Why the other options are wrong
- A. CloudTrail records all API calls individually; extracting the latest state from multiple rapid changes requires manual analysis and is operationally inefficient.
- C. CloudWatch is designed for metrics and logs, not configuration tracking; it does not maintain configuration state snapshots.
- D. AWS Cloud Map is a service discovery tool, not a configuration tracking solution; it does not provide compliance evaluation or configuration change recording.
Question 10
A security engineer needs to implement a solution to create and control the keys that a company uses for cryptographic operations. The security engineer must create symmetric keys in which the key material is generated and used within a custom key store that is backed by an AWS CloudHSM cluster.
The security engineer will use symmetric and asymmetric data key pairs for local use within applications. The security engineer also must audit the use of the keys.
How can the security engineer meet these requirements?
Show answer and explanation
Correct answer: D. To create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster. For auditing, use AWS CloudTrail.
Service (AWS KMS) and the custom key stores with the CloudHSM cluster. For auditing, use AWS CloudTrail. AWS KMS with custom key stores backed by CloudHSM is the correct service for generating and managing symmetric keys with key material kept within the HSM cluster. AWS CloudTrail provides comprehensive audit logging of all key usage and management operations, meeting the security and compliance requirements. This combination enables the security engineer to create, control, and audit cryptographic keys as specified.
Why the other options are wrong
- A. Amazon Athena is a query service for data analysis, not a key auditing solution; it cannot audit KMS key operations.
- B. Amazon S3 is not a key management service and cannot create or manage cryptographic keys or custom key stores.
- C. Amazon GuardDuty is a threat detection service, not an auditing tool for key usage and management operations.
That was 10 of 85.
The full AWS SCS-C03 pack has all 85 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.