SCS-C03 practice examsFinished
AWS Certified Security - Specialty
Validates advanced expertise in securing AWS workloads. Covers threat detection, incident response, infrastructure protection, identity management, data protection, and security governance across the AWS cloud platform.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| Detection | 16% |
| Incident Response | 14% |
| Infrastructure Security | 18% |
| Identity and Access Management | 20% |
| Data Protection | 18% |
| Security Foundations and Governance | 14% |
Two sample questions
1. A company is undergoing a SOC 2 audit and needs to demonstrate that all AWS resources are tagged according to their data classification policy (Public, Internal, Confidential, Restricted). How can tag compliance be enforced and monitored?
- Send a weekly email to all development teams listing their untagged resources and request them to manually apply the appropriate classification tags within the following business week
- Create an SCP that denies all resource creation API calls unless the request includes a DataClassification tag with an allowed value, and use AWS Config Tag policies to detect non-compliant existing resources across all accounts — correct
- Use AWS Service Catalog to provision all resources through pre-approved templates that include mandatory classification tags, and block direct API and console access to resource creation
- Configure AWS CloudFormation Guard rules to validate that all CloudFormation templates include classification tags before deployment, blocking stack creation for non-compliant templates only
Why: An SCP with tag conditions prevents resource creation without proper tags at the organization level. AWS Organizations Tag Policies define allowed tag values and Config evaluates compliance for existing resources. This provides both preventive (SCP) and detective (Config/Tag Policies) controls. Email reminders are not auditable enforcement. Service Catalog alone doesn't prevent direct API access. CloudFormation Guard only covers IaC deployments, not console or CLI resource creation.
2. What is an AWS Config rule?
- A check of whether a resource matches the desired configuration — correct
- A record of every change made to a resource over time
- A policy that prevents a resource being created incorrectly
- An alert raised when a resource is deleted from the account
Why: AWS Config rules evaluate resource configurations against desired settings and flag non-compliant resources. They are not network routing rules, IAM policies, or billing rules.
The real SCS-C03 exam
| Length | 170 minutes |
|---|---|
| Questions | 65 |
| Pass mark | 750/1000 |
| Price | $300 USD |
| Recommended before you sit it | Recommended 5+ years IT security experience with 2+ years hands-on AWS security |
| Valid for | 3 years |
Exam facts as published by AWS; always check the vendor’s page before you book.
Study SCS-C03 with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.