Questions & answers (free, no sign-in needed)

10 beginner questions across all six SCS-C03 domains: Detection (GuardDuty, organization trails), Incident Response (isolating an instance, Amazon Detective), Infrastructure Security (AWS WAF, Session Manager), Identity and Access Management (IAM Access Analyzer, policy evaluation), Data Protection (enforcing TLS to S3) and Security Foundations and Governance (SCPs).

Ready to test yourself? Take the graded Beginner test (free; sign in with Google, one click) to get your score.

1. A security team wants a managed service that continuously analyzes AWS CloudTrail events, VPC Flow Logs and DNS logs to detect threats such as compromised credentials or crypto-mining. Which service should they turn on?

   • A. Amazon Macie
   • B. Amazon GuardDuty ✔ correct
   • C. Amazon Inspector
   • D. AWS Artifact

   Answer: B. Amazon GuardDuty is a threat detection service that analyzes foundational data sources such as CloudTrail events, VPC Flow Logs and DNS logs. Macie discovers sensitive data in S3; Inspector scans for software vulnerabilities.

   Source: docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html · Domain: Detection

2. A company uses AWS Organizations and wants one CloudTrail trail that logs events for every account in the organization. What should the security engineer create?

   • A. A separate CloudWatch dashboard in each account
   • B. VPC Flow Logs on every VPC in the organization
   • C. An organization trail from the management account ✔ correct
   • D. An IAM credential report in each member account

   Answer: C. An organization trail, created in the management account or by a delegated administrator, logs events for the management account and all member accounts. Member accounts can see it but cannot remove or modify it.

   Source: docs.aws.amazon.com/awscloudtrail/latest/userguide/creating-trail-organization.h · Domain: Detection

3. GuardDuty reports that an EC2 instance is communicating with a known malicious IP address. The team wants to contain the instance but keep it running for forensic analysis. What is an appropriate first containment step?

   • A. Terminate the instance and launch a new one from the same AMI
   • B. Reboot the instance so that the suspicious processes stop
   • C. Delete the instance's EBS volumes to remove the malware
   • D. Replace its security groups with an isolation security group ✔ correct

   Answer: D. Replacing the instance's security groups with a restrictive isolation group blocks new network activity while the instance keeps running, so memory and disk evidence are preserved. Terminating, rebooting or deleting volumes destroys evidence.

   Source: docs.aws.amazon.com/security-ir/latest/userguide/contain.html · Domain: Incident Response

4. Amazon Detective helps analysts investigate the root cause of security findings by automatically collecting log data and showing the relationships between resources, users and activity.

   • A. True ✔ correct
   • B. False

   Answer: A. True. Detective collects data from sources such as CloudTrail, VPC Flow Logs and GuardDuty findings, and builds linked visualizations so analysts can investigate the scope and root cause of activity.

   Source: docs.aws.amazon.com/detective/latest/userguide/what-is-detective.html · Domain: Incident Response

5. A public web application behind an Application Load Balancer must be protected against SQL injection and cross-site scripting (XSS) requests. Which service should be used?

   • A. AWS WAF with a web ACL ✔ correct
   • B. AWS Shield Standard
   • C. A network ACL on the subnet
   • D. Amazon GuardDuty

   Answer: A. AWS WAF inspects HTTP(S) requests to resources such as an ALB, and its rules can block requests with likely SQL injection or cross-site scripting. Shield Standard protects against DDoS; network ACLs cannot read HTTP content.

   Source: docs.aws.amazon.com/waf/latest/developerguide/what-is-aws-waf.html · Domain: Infrastructure Security

6. Administrators need interactive shell access to EC2 instances in private subnets. The security team forbids open inbound SSH ports and bastion hosts and wants every session logged. Which option meets these needs?

   • A. EC2 key pairs with port 22 open to the company IP range
   • B. AWS Systems Manager Session Manager ✔ correct
   • C. An AWS Site-to-Site VPN to each private subnet
   • D. AWS Direct Connect to the VPC

   Answer: B. Session Manager provides secure, auditable node access without opening inbound ports, running bastion hosts or managing SSH keys, and can log session activity. VPN and Direct Connect still need SSH open on the instance.

   Source: docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html · Domain: Infrastructure Security

7. A security engineer wants to find S3 buckets, IAM roles and KMS keys in the account that are shared with principals outside the company's AWS organization. Which tool is designed for this?

   • A. Amazon Inspector
   • B. AWS Artifact
   • C. IAM Access Analyzer ✔ correct
   • D. AWS Trusted Advisor cost checks

   Answer: C. IAM Access Analyzer external access analysis uses logic-based reasoning on resource policies to report resources shared outside your zone of trust, such as your account or organization.

   Source: docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html · Domain: Identity and Access Management

8. Which two statements about IAM policy evaluation within a single account are true? (Select TWO)

   • A. An explicit deny in any applicable policy overrides any allow ✔ correct
   • B. A permissions boundary grants permissions to the IAM role it is attached to
   • C. An allow in an identity-based policy overrides a deny in an SCP
   • D. Requests by IAM users and roles are implicitly denied unless a policy allows them ✔ correct
   • E. Resource-based policies are ignored when an identity-based policy exists

   Answer: A, D. Requests start as implicitly denied, an applicable allow is needed, and an explicit deny in any policy always wins. Permissions boundaries and SCPs only limit permissions; they never grant them.

   Source: docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic_pol · Domain: Identity and Access Management

9. A company must ensure that every request to an S3 bucket uses HTTPS (TLS). Which control enforces this?

   • A. Turn on default encryption with SSE-S3
   • B. Turn on S3 Versioning for the bucket
   • C. Turn on S3 Object Lock in governance mode
   • D. A bucket policy that denies requests when aws:SecureTransport is false ✔ correct

   Answer: D. A bucket policy using the aws:SecureTransport condition key can deny any request not sent over HTTPS. Default encryption protects data at rest; it does not block unencrypted connections.

   Source: docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html · Domain: Data Protection

10. A company uses AWS Organizations. No one in the member accounts, including account administrators, may stop or delete CloudTrail trails. What should the security team use?

    • A. A service control policy that denies those CloudTrail actions ✔ correct
    • B. An AWS Config managed rule that checks CloudTrail status
    • C. A permissions boundary added to each administrator
    • D. Amazon GuardDuty in every member account

    Answer: A. An SCP sets the maximum permissions for every IAM user and role in member accounts, so a deny on actions such as cloudtrail:StopLogging applies even to administrators. Config rules detect but do not prevent.

    Source: docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.htm · Domain: Security Foundations and Governance

Original practice questions written by xOps School (DevOpsSchool Private Limited) from the public AWS exam objectives (SCS-C03 exam guide version 1.0 (2026-03-26)), checked 2026-10-25. They are not actual exam questions. xOps School is not affiliated with or endorsed by AWS; exam names are trademarks of their owners. Official exam page: aws.amazon.com/certification/certified-security-specialty/.