AWS Certified Security – Specialty (SCS-C03) Practice Exam v2.0 150 Advanced Multiple-Choice Questions with Detailed Explanations a well detailed one 2025 / 2026 written and graded A+ upgraded

1




AWS Certified Security – Specialty
(SCS-C03) Practice Exam v2.0 150
Advanced Multiple-Choice
Questions with Detailed
Explanations a well detailed one
written and graded
A+ upgraded

, 2




Domain 1: Detection (16%)

Question 1
A Security Engineer is building a centralized threat detection pipeline. The company wants to
detect anomalous API activity such as unusual geographic access patterns, excessive resource
creation, and unusual user behavior. Which combination of AWS services provides the MOST
comprehensive detection?

A) Amazon GuardDuty with AWS CloudTrail and VPC Flow Logs
B) AWS CloudTrail with Amazon CloudWatch Logs and metric filters
C) Amazon Detective with AWS Security Hub
D) AWS Config with AWS CloudTrail

- detailed answer 100% correct :- A
Rationale: Amazon GuardDuty ingests CloudTrail, VPC Flow Logs, and DNS logs to detect
anomalous behavior using machine learning and threat intelligence. It is purpose-built for threat
detection and provides the most comprehensive coverage for API and network anomalies.



Question 2
A Security Engineer needs to receive real-time alerts when an Amazon EC2 security group is
modified to allow inbound SSH access from any IP address. Which AWS service combination is
MOST efficient for this requirement?

A) AWS Config with an SNS topic
B) AWS CloudTrail with Amazon EventBridge
C) Amazon GuardDuty with CloudWatch Events
D) AWS Trusted Advisor with email notifications

- detailed answer 100% correct :- B
Rationale: CloudTrail records AuthorizeSecurityGroupIngress API calls. EventBridge can filter for
specific events (e.g., adding 0.0.0.0/0 on port 22) and trigger immediate notifications via SNS,
Lambda, or other targets. This provides real-time detection.

, 3



Question 3
A Security Engineer discovers that GuardDuty is not generating findings for a specific AWS
account even though it is enabled. The account has resources in multiple regions. What is the
MOST likely cause?

A) GuardDuty is not enabled in all regions where the account has resources
B) The GuardDuty findings are being suppressed by a filter
C) The account has no CloudTrail trails configured
D) The account is not a member of an AWS Organization

- detailed answer 100% correct :- A
Rationale: GuardDuty is a regional service. It must be enabled independently in each AWS
region to monitor resources and activity in that region. Even if enabled in one region, it will not
generate findings for other regions.



Question 4
A Security Engineer wants to use AWS Config to detect when any S3 bucket is configured with a
bucket policy that grants public read access. Which approach is correct?

A) Use the managed rule s3-bucket-public-read-prohibited
B) Write a custom Lambda function and configure it as a custom Config rule
C) Use the managed rule s3-bucket-public-write-prohibited
D) Enable Amazon GuardDuty S3 protection

- detailed answer 100% correct :- A
Rationale: AWS Config provides a managed rule s3-bucket-public-read-prohibited that checks if
an S3 bucket policy or ACL grants public read access. This rule is readily available and requires
no custom coding.



Question 5
A Security Engineer needs to detect when a new IAM policy is created that contains an
administrative action ("Action": "*"). Which service should be used to continuously evaluate
this?

A) AWS Config with a custom rule
B) AWS CloudTrail with EventBridge
C) Amazon GuardDuty
D) AWS IAM Access Analyzer

, 4



- detailed answer 100% correct :- A
Rationale: AWS Config can continuously evaluate IAM policies for compliance. A custom rule
can parse policy documents to detect the presence of "Action": "*" and flag them as non-
compliant. CloudTrail/EventBridge provide real-time alerts but not continuous compliance
evaluation.



Question 6
A Security Engineer notices that GuardDuty is generating a high volume
of Recon:EC2/PortProbeUnprotectedPort findings. What is the best remediation action?

A) Restrict the affected EC2 instance's security groups to only necessary ports and IP ranges
B) Terminate the EC2 instance immediately
C) Enable AWS Shield Advanced to stop the port scans
D) Create an AWS Config rule to automatically close all ports

- detailed answer 100% correct :- A
Rationale: This finding indicates that external sources are scanning open ports on the instance.
The proper remediation is to review and tighten security group rules to expose only necessary
ports to trusted IP ranges. Terminating the instance is an overreaction; scanning does not
necessarily mean compromise.



Question 7
A Security Engineer needs to identify which IAM user created an Amazon S3 bucket and when it
was created. Which AWS service should be queried?

A) AWS CloudTrail
B) Amazon S3 access logs
C) AWS Config
D) AWS Trusted Advisor

- detailed answer 100% correct :- A
Rationale: AWS CloudTrail records all API calls, including s3:CreateBucket. The event includes
the identity of the caller (IAM user or role) and the timestamp. This is the authoritative source
for API activity.



Question 8
A Security Engineer has enabled GuardDuty in the master account of an AWS Organization. The