SCS-C03 AWS Certified Security – Specialty Free Practice Questions and Answers

A Lambda function can reach an S3 bucket but receives Access Denied when reading objects. The bucket policy allows s3:GetObject but names only the bucket ARN as its resource. What should the security engineer change?

• A. Use the object ARN pattern arn:aws:s3:::bucket-name/* in the Resource element
• B. Replace s3:GetObject with s3:ListAllMyBuckets
• C. Add an EC2 instance profile to the Lambda function
• D. Set the bucket to public read

A web application on ECS needs external users to sign in and obtain temporary credentials without maintaining its own password database. Which design is suitable?

• A. Amazon Cognito user pools with an app client, token validation, and least-privilege IAM roles
• B. A DynamoDB table containing reusable plaintext passwords
• C. An IAM user for every external customer with permanent keys
• D. A shared root account for all customers

An IAM policy denies EC2 API calls unless the caller has MFA context. A user’s long-term access key works for non-EC2 calls but the CLI EC2 commands are denied. What should the user do?

• A. Use STS GetSessionToken with MFA parameters and use the returned temporary credentials
• B. Disable the MFA condition in the policy
• C. Put the MFA code in the EC2 instance user data
• D. Create a second long-term access key

An organization must limit member accounts in an OU to one AWS Region while still allowing selected global services. Which control should the security team apply?

• A. An SCP with an explicit deny for requests outside the allowed Region, excluding required global services
• B. A billing alarm for every other Region
• C. A security group on each VPC
• D. A tag policy that names the allowed Region

A company connects IAM Identity Center to an external SAML identity provider and wants users and groups provisioned automatically. Which setup is required?

• A. Exchange SAML metadata between IAM Identity Center and the IdP, then configure SCIM provisioning on both sides
• B. Create a KMS key and attach it to each user
• C. Use a public hosted zone to distribute credentials
• D. Create an IAM user access key for each employee