SCS
amazon
// aws certified security - specialty scs-c03
SCS-C03
Master key domains like cryptography and threat modeling for the AWS Certified Security - Specialty exam.
52
questions
65
in exam
120m
duration
at a glance
What you get
PDF US$10.00Sub US$10/mopass 720
Free practice questions are available without payment; anyone can start practicing at no cost.
access options
PDF bank or platform subscription?
Two separate purchases: a one-time PDF for SCS-C03, or a monthly subscription for online practice and simulators across the platform. A subscription does not include the PDF download.
option / 01 · pdf file
Full question bank PDF
US$10.00· one-time
- Full question bank as a print-ready PDF
- Lifetime access to this exam only
- Domain-tagged questions with explanations
- Separate from online practice — buy once
option / 02 · subscription
All exams · practice & simulator
US$10.00· per month
- Practice & exam simulator on every bank
- All current and future exams included
- Personal analytics and retention tools
- Cancel anytime — no per-exam upsells
sample · 1 of 52Shuffle
See what's in the bank.
Monitoring and Responsemedium
2 votes · last validated recently
A security engineer for a company needs to design an incident response plan that addresses compromised IAM user account credentials. The company uses an organization in AWS Organizations and AWS IAM Identify Center to manage user access. The company uses a delegated administrator account to implement AWS Security Hub. The delegated administrator account contains an organizational trail in AWS CloudTrail that logs all events to an Amazon S3 bucket. The company has also configured an organizational event data store that captures all events from the trail.
The incident response plan must provide steps that the security engineer can take to immediately disable any compromised IAM user when the security engineer receives a notification of a security incident.
The plan must prevent the IAM user from being used in any AWS account. The plan must also collect all AWS actions that the compromised IAM user performed across all accounts in the previous 7 days.
Which solution will meet these requirements?
The incident response plan must provide steps that the security engineer can take to immediately disable any compromised IAM user when the security engineer receives a notification of a security incident.
The plan must prevent the IAM user from being used in any AWS account. The plan must also collect all AWS actions that the compromised IAM user performed across all accounts in the previous 7 days.
Which solution will meet these requirements?
A
Disable the compromised IAM user in the organization management account. Use Amazon Athena to query the organizational CloudTrail logs in the S3 bucket for actions that the IAM user performed in the previous 7 days.
0%
B
Remove all IAM policies that are attached to the IAM user in the organization management account. Use Security Hub to query the CloudTrail logs for actions that the IAM user performed in the previous 7 days.
0%
C
Remove any permission sets that arc assigned to the IAM user in IAM Identity Center. Use Amazon CloudWatch Logs Insights to directly query the organizational CloudTrail logs in the S3 bucket for actions that the IAM user performed m the previous 7 days.
0%
D
Disable the IAM user's access in IAM Identity Center. Use CloudTrail to query the organizational event data store for actions that the IAM user performed in the previous 7 days.
100%
04 · coverage
Exam domains
Cryptography25%
10 q
Identity and Access Management15%
14 q
Threat Modeling20%
3 q
Risk Management15%
8 q
Monitoring and Response30%
17 q
community questionsview all →
Questions from the community
Top-voted approved contributions for this exam, reviewed before landing in the bank.
// top community questionsview all →
0.0 · 0 reviews
What candidates say
no reviews yet
related
You may also like
More exams based on your interests.
52 questions
PDF US$10.00 one-time·Sub US$10/mo
updated 7h ago·devco · cert
SCS-C03premiumamazon● updated 7h ago
AWS Certified Security - Specialty SCS-C03 SCS.
Master key domains like cryptography and threat modeling for the AWS Certified Security - Specialty exam.
// OFFICIAL EXAM LOGISTICS
source · amazon web services
// PASSING SCORE
750 / 1000· scaled
minimum to pass
75%of scale
// QUESTIONS
65official
// DURATION
120min
// EXAM FEE
300usd
// ITEM TYPES
multiple choice
multiple response
// questions
54in bank
// pass rate
92%self-reported
// last update
7h agoago
// add cadence · 12w
// downloadable pdf bank
Get the whole bank as a PDF
Every question tagged by domain, with a detailed explanation. Preview the first pages free — buy once for lifetime access to the full PDF.
54 questions
// what's inside
- 54 exam-style questions with verified answers
- Every question tagged by domain (5 domains covered)
- A detailed explanation / rationale for every question
// sample · 1 of 52
See what's in the bank.
#06055718-b700-4823-b380-da9f8fd85ed2Monitoring and Responsemedium
↑ +47· 1 comments· seen 1,284×
A security engineer for a company needs to design an incident response plan that addresses compromised IAM user account credentials. The company uses an organization in AWS Organizations and AWS IAM Identify Center to manage user access. The company uses a delegated administrator account to implement AWS Security Hub. The delegated administrator account contains an organizational trail in AWS CloudTrail that logs all events to an Amazon S3 bucket. The company has also configured an organizational event data store that captures all events from the trail.
The incident response plan must provide steps that the security engineer can take to immediately disable any compromised IAM user when the security engineer receives a notification of a security incident.
The plan must prevent the IAM user from being used in any AWS account. The plan must also collect all AWS actions that the compromised IAM user performed across all accounts in the previous 7 days.
Which solution will meet these requirements?
The incident response plan must provide steps that the security engineer can take to immediately disable any compromised IAM user when the security engineer receives a notification of a security incident.
The plan must prevent the IAM user from being used in any AWS account. The plan must also collect all AWS actions that the compromised IAM user performed across all accounts in the previous 7 days.
Which solution will meet these requirements?
A
Disable the compromised IAM user in the organization management account. Use Amazon Athena to query the organizational CloudTrail logs in the S3 bucket for actions that the IAM user performed in the previous 7 days.
0%B
Remove all IAM policies that are attached to the IAM user in the organization management account. Use Security Hub to query the CloudTrail logs for actions that the IAM user performed in the previous 7 days.
0%C
Remove any permission sets that arc assigned to the IAM user in IAM Identity Center. Use Amazon CloudWatch Logs Insights to directly query the organizational CloudTrail logs in the S3 bucket for actions that the IAM user performed m the previous 7 days.
0%D
Disable the IAM user's access in IAM Identity Center. Use CloudTrail to query the organizational event data store for actions that the IAM user performed in the previous 7 days.
100%Community converges on D. Official key confirms.
2 votes · last validated recently
// explanation
Disabling the user in IAM Identity Center immediately revokes their access across every account in the organization, and querying the organizational CloudTrail event data store retrieves that identity's API activity across all accounts for the prior seven days.
contributed by
N1
@netdiver· revised by @cloud_chris// coverage · 5 domains
What this bank tests.
D125%
Cryptography10 q
D215%
Identity and Access Management14 q
D320%
Threat Modeling3 q
D415%
Risk Management8 q
D530%
Monitoring and Response17 q
// composition
By format & difficulty.
// by format
81%
19%
single · 42multi · 10
// by difficulty
easy
14· 27%
medium
34· 65%
hard
4· 8%
// contributors · 0 engineers
Built by people who took the exam.
Every question is contributed by someone who recently sat SCS-C03, then reviewed by an SME before landing in the bank. These are the most prolific contributors.
No contributors for this exam yet. Be the first to contribute a question.
// community questions
Questions from the community
Top-voted approved contributions for this exam, reviewed before landing in the bank.
// top community questionsview all →
// compare
One bank, or the whole platform?
this bank
$10.00· one-time
platform · subscribed
$10.00· per month
This bank
All other banks · 23+ exams
Lifetime access
All future updates included
Personal analytics + retention
Cancel anytime
—
// 0 reviews
0.0/ 5
5
0
4
0
3
0
2
0
1
0
No reviews yet. Be the first to share your experience with this question bank.
// faq
Things buyers ask before they buy.
Q.
Can I practice for free?
Free practice questions are available without payment; anyone can start practicing at no cost.
Q.
What do subscribers get?
Subscribers unlock the full practice question bank for each certification exam.
Q.
How much can I see without a subscription?
Approximately 1/2 of the question bank is accessible without a subscription.
Q.
What is the passing score?
The official passing mark for this exam is 720.
Q.
How long is the certification valid?
The certification is valid for 3 years. Renew every three years or maintain certification through AWS training and exams.
Q.
What experience is recommended?
Recommended for candidates with at least 2 years of hands-on experience in cloud security.
// related
You may also like
Discover more exams based on your interests.
// ready when you are
52 questions. 92% pass rate. $10.00 once.
Lifetime access · all updates included · 30-day refund