Validate your expertise in securing AWS workloads. Covers threat detection, incident response, infrastructure security, identity and access management, data protection, and security governance.
No sign-up — instant feedback after every question
Get instant feedback after each question. See explanations and track your progress as you learn.
Timed session with no feedback until the end. Experience real exam conditions and test your knowledge.
10 questions · pick a topic · 5 minutes · shareable
Every in-scope security service, detection pattern, IAM and data-protection decision the SCS-C03 exam actually tests — organised by the six exam domains with policy patterns and runbooks
The AWS Certified Security Specialty (SCS-C03) is AWS's dedicated security certification. It validates your expertise in securing AWS workloads, including identity management, infrastructure protection, data encryption, incident response, and compliance. It's one of the most valued specialty certifications in the market.
This exam targets security engineers, security architects, cloud security analysts, and anyone whose primary role involves securing AWS environments. AWS recommends the equivalent of three to five years of experience securing cloud solutions, plus a strong understanding of compliance frameworks and incident response.
The SCS-C03 exam has 65 questions (50 scored, 15 unscored) in multiple-choice and multiple-response format, and may include ordering and matching questions. You get 170 minutes, and the passing score is 750/1000 (approximately 75%). The exam costs $300 USD.
Recommended experience: The equivalent of three to five years of experience securing cloud solutions (as AWS recommends), plus familiarity with security frameworks, encryption, and identity management.
Written in the style of the real exam. Answer each one, then open the answer to check.
Question 1 · Identity and Access Management
A company stores curated datasets in an Amazon S3 bucket in a central data account. The objects are encrypted with SSE-KMS by using a customer managed key in the same account. IAM roles in every account under the Analytics OU of the company's organization must be able to read the objects, and new accounts are added to the Analytics OU every few weeks. The roles already have identity-based policies that allow s3:GetObject and kms:Decrypt on the bucket and the key. Accounts outside the Analytics OU must not get access. Which combination of steps will meet these requirements with the LEAST ongoing effort? (Select TWO.)
Answers: C, E
Options C and E are correct: cross-account access needs the resource policies of both the bucket and the KMS key to allow the callers, and the aws:PrincipalOrgPaths condition matches any principal in an account under the Analytics OU, so new accounts get access with no policy change. Option A works but must be edited every time an account is added. Option B fails because AWS RAM does not share S3 buckets or KMS keys. Option D uses a condition key meant for requests made by AWS service principals, and an organization-wide match would also admit accounts outside the Analytics OU.
Sources: AWS documentation 1, AWS documentation 2, AWS documentation 3
Question 2 · Infrastructure Security
A company runs workloads on Amazon EC2 instances in private subnets that reach the internet through NAT gateways. A new policy states that instances may make outbound HTTPS connections only to a short list of approved partner domains. Connections must be blocked even if malicious software on an instance connects to a hard-coded IP address instead of resolving a domain name. The approved partners use content delivery networks, so their IP addresses change frequently. Which solution will meet these requirements?
Answer: B
Option B is correct: a Network Firewall stateful domain list rule group inspects the Server Name Indication (SNI) in the TLS handshake of the traffic itself, so it filters by domain without depending on DNS and without tracking changing IP addresses. Option A filters DNS queries only, so a connection to a hard-coded IP address bypasses it. Option C cannot keep up with frequently changing CDN addresses and filters by IP, not by domain. Option D has the same IP-tracking problem, and stateless network ACLs also need rules for return traffic.
Sources: AWS documentation
Question 3 · Data Protection
A healthcare company uses AWS Backup to back up Amazon RDS databases and Amazon EBS volumes. After a ransomware incident at another organization, the company requires that no one, including administrators and the AWS account root user, can delete recovery points or shorten their retention below 35 days. The backup team wants a short period to test the configuration before it becomes permanent. Which solution will meet these requirements?
Answer: D
Option D is correct: Vault Lock in compliance mode makes the vault and its lock immutable after the grace time ends, so no user, including the root user, and not even AWS can delete recovery points early or change the lock; the grace time of at least 72 hours gives the team a window to test and remove the lock. Option A can be removed or changed by an administrator or the root user. Option B allows users with sufficient IAM permissions to remove the lock. Option C can be detached by the management account and does not apply to the management account itself.
Sources: AWS documentation
These sample questions are not part of the SCS-C03 practice exam, so you won't meet them again when you take it.
This practice exam has 65 questions, and exam mode gives you 170 minutes to answer them. The real SCS-C03 exam has 65 questions (50 scored and 15 unscored) in 170 minutes, so a full attempt here is the same length. Practice mode has no timer.
In format, yes: questions are multiple choice (one correct answer) or multiple response (two or more), spread across the 6 exam domains in close to the weights the official exam guide gives them. The real exam can also include ordering and matching questions, which this practice exam does not have. Scoring differs: AWS reports a scaled score from 100 to 1,000 and you pass at 750, while this practice exam shows the raw percentage you got right. For how hard the exam is, whether it is worth it and how long to study, read our AWS Security Specialty certification guide.
Aim for 80% or more, consistently, on full-length attempts in exam mode, not just once. That leaves a margin over the 750 out of 1,000 you need on the real SCS-C03 exam, whose questions will all be new to you. Repeat attempts here show the same questions, so judge yourself by first attempts and by whether you can explain each answer. No practice score guarantees a pass.
No. The SCS-C03 practice exam is free and needs no account. Your progress and score history are saved in this browser, so they stay on this device and are lost if you clear your browser data.
Start in practice mode, which tells you after each question whether you were right and explains the answer. When you score well there, switch to exam mode: 170 minutes and no feedback until the end, like test day. Your results break the score down by domain, so you can see which domains to study before your next attempt.
Affiliate links — if you enrol through them, CloudNinja may earn a commission at no extra cost to you.
Studying for more than one certification? All our practice tests are free.