CLOUDPUZ
AWS Certified
Security - Specialty
SCS-C03
150 Practice Questions
Answers & Detailed Explanations
2 practice tests • 75 questions per test • English
Independent study material for certification preparation. This publication is not affiliated with or endorsed by Amazon Web
Services. AWS and related names are trademarks of their respective owners.
Practice questions for learning and revision; no claim is made that these are live certification exam questions.
CLOUDPUZ | SCS-C03 | Practice questions & answers 1
, How to use this question bank
Complete each practice test before consulting its answer key. Select one answer unless the
question specifies multiple answers. Review the explanations for every option, then revisit the
topics you missed.
Each test has three sections: Questions, Quick answer key, and Answers with explanations.
Question numbering restarts at 1 for Test 2.
The questions and explanations retain the content of the Cloudpuz source question banks. Official reference links supplied
in those banks are preserved for further study. Service capabilities and exam objectives may evolve.
CLOUDPUZ | SCS-C03 | Practice questions & answers 2
, Practice Test 1
Questions 1-75
Question 1 | Data Protection
A team enables S3 default encryption and assumes it retroactively changes every existing
object's encryption configuration. What is the correct next step?
A. Assume every old object was rewritten immediately
B. Assess existing objects separately and use an appropriate migration or copy process if
re-encryption is required
C. Delete all old objects without a recovery plan
D. Only change the bucket's description
Select 1 answer.
Question 2 | Incident Response
A forensic collection role can decrypt sensitive evidence with KMS. What should the team ensure?
A. Grant decryption to every account principal
B. Copy plaintext evidence into a public bucket
C. Disable the key before any authorized analysis without a recovery plan
D. Narrow key and artifact access, audit use, and separate investigative duties as required
Select 1 answer.
Question 3 | Data Protection
A workload needs compatible KMS key material in multiple Regions for a supported cryptographic
design. Which capability should be evaluated?
A. A global security group
B. S3 versioning alone
C. KMS multi-Region keys with deliberate regional policy and lifecycle management
D. Copying a key alias string into every Region as the only step
Select 1 answer.
CLOUDPUZ | SCS-C03 | Practice questions & answers 3
, Question 4 | Infrastructure Security
A team needs hardened EC2 images produced repeatedly from approved components and tested
before deployment. Which service supports this workflow?
A. EC2 Image Builder
B. AWS Artifact
C. Route 53 Resolver
D. AWS Shield
Select 1 answer.
Question 5 | Infrastructure Security
A team deploys AWS Network Firewall but sees no inspection logs for traffic using another route.
What is the likely problem?
A. CloudTrail should contain decrypted packet payloads instead
B. The firewall automatically inspects every VPC without routes
C. The DNS TTL must equal the firewall timeout
D. The intended flows are not routed through the firewall endpoints
Select 1 answer.
Question 6 | Incident Response
An automated remediation function uses administrator permissions for a narrow security-group
change. What should be improved?
A. Embed root credentials in the function
B. Make the function publicly invokable without authorization
C. Keep broad privileges because automation cannot be compromised
D. Limit permissions and resource scope to the approved remediation actions
Select 1 answer.
Question 7 | Security Foundations and Governance
An organization applies an SCP denying a service to a member account. What happens to an
administrator role in that account under the covered scope?
A. The role's administrator title automatically overrides every SCP
B. The SCP changes only the billing display
C. Its permissions are constrained by the applicable SCP deny
D. The role is automatically deleted
Select 1 answer.
CLOUDPUZ | SCS-C03 | Practice questions & answers 4
AWS Certified
Security - Specialty
SCS-C03
150 Practice Questions
Answers & Detailed Explanations
2 practice tests • 75 questions per test • English
Independent study material for certification preparation. This publication is not affiliated with or endorsed by Amazon Web
Services. AWS and related names are trademarks of their respective owners.
Practice questions for learning and revision; no claim is made that these are live certification exam questions.
CLOUDPUZ | SCS-C03 | Practice questions & answers 1
, How to use this question bank
Complete each practice test before consulting its answer key. Select one answer unless the
question specifies multiple answers. Review the explanations for every option, then revisit the
topics you missed.
Each test has three sections: Questions, Quick answer key, and Answers with explanations.
Question numbering restarts at 1 for Test 2.
The questions and explanations retain the content of the Cloudpuz source question banks. Official reference links supplied
in those banks are preserved for further study. Service capabilities and exam objectives may evolve.
CLOUDPUZ | SCS-C03 | Practice questions & answers 2
, Practice Test 1
Questions 1-75
Question 1 | Data Protection
A team enables S3 default encryption and assumes it retroactively changes every existing
object's encryption configuration. What is the correct next step?
A. Assume every old object was rewritten immediately
B. Assess existing objects separately and use an appropriate migration or copy process if
re-encryption is required
C. Delete all old objects without a recovery plan
D. Only change the bucket's description
Select 1 answer.
Question 2 | Incident Response
A forensic collection role can decrypt sensitive evidence with KMS. What should the team ensure?
A. Grant decryption to every account principal
B. Copy plaintext evidence into a public bucket
C. Disable the key before any authorized analysis without a recovery plan
D. Narrow key and artifact access, audit use, and separate investigative duties as required
Select 1 answer.
Question 3 | Data Protection
A workload needs compatible KMS key material in multiple Regions for a supported cryptographic
design. Which capability should be evaluated?
A. A global security group
B. S3 versioning alone
C. KMS multi-Region keys with deliberate regional policy and lifecycle management
D. Copying a key alias string into every Region as the only step
Select 1 answer.
CLOUDPUZ | SCS-C03 | Practice questions & answers 3
, Question 4 | Infrastructure Security
A team needs hardened EC2 images produced repeatedly from approved components and tested
before deployment. Which service supports this workflow?
A. EC2 Image Builder
B. AWS Artifact
C. Route 53 Resolver
D. AWS Shield
Select 1 answer.
Question 5 | Infrastructure Security
A team deploys AWS Network Firewall but sees no inspection logs for traffic using another route.
What is the likely problem?
A. CloudTrail should contain decrypted packet payloads instead
B. The firewall automatically inspects every VPC without routes
C. The DNS TTL must equal the firewall timeout
D. The intended flows are not routed through the firewall endpoints
Select 1 answer.
Question 6 | Incident Response
An automated remediation function uses administrator permissions for a narrow security-group
change. What should be improved?
A. Embed root credentials in the function
B. Make the function publicly invokable without authorization
C. Keep broad privileges because automation cannot be compromised
D. Limit permissions and resource scope to the approved remediation actions
Select 1 answer.
Question 7 | Security Foundations and Governance
An organization applies an SCP denying a service to a member account. What happens to an
administrator role in that account under the covered scope?
A. The role's administrator title automatically overrides every SCP
B. The SCP changes only the billing display
C. Its permissions are constrained by the applicable SCP deny
D. The role is automatically deleted
Select 1 answer.
CLOUDPUZ | SCS-C03 | Practice questions & answers 4
