AWS Certified Security – Specialty (SCS-C03)
Last updated on November 1, 2026
509 Questions & Answers
Review AWS identity, access control, data protection, detection, incident response, and security governance This independent practice material is not an official AWS exam.
Questions 6–10
A KMS key policy should allow a role to use a key only when Amazon SES or Amazon WorkMail makes the request on its behalf. Which policy condition helps enforce this?
Reveal Solution
The kms:ViaService condition restricts use to calls made through specified AWS services, alongside principal and encryption-context controls.
A company needs to block one federated principal from a single S3 bucket while leaving the principal’s other AWS permissions intact. What is the narrowest approach?
Reveal Solution
An explicit deny in the bucket policy can be limited to the named principal and this bucket’s objects, leaving unrelated permissions unchanged.
A security team needs to correlate findings from multiple AWS detection services to identify multi-stage attacks across accounts and Regions. Which service should aggregate the findings?
Reveal Solution
Security Hub centralizes and correlates security findings from supported AWS services and accounts for consolidated investigation.
A company copies critical S3 backups to a secondary Region and must prevent administrators from permanently deleting the recovery copies. Which design best meets the requirement?
Reveal Solution
Vault Lock in compliance mode enforces retention and protects recovery points from deletion, including by privileged administrators.
A security engineer finds a multi-Region KMS key scheduled for deletion, but related key material still exists in replica Regions during the waiting period. What should the engineer verify?
Reveal Solution
Multi-Region KMS keys have related regional key resources. Their deletion lifecycle must be checked across the primary and replica keys and their waiting periods.