AWS Security Specialty SCS-C03 Exam Guide 2026: What Changed and How to Study
Video
A security engineer needs continuous monitoring for malicious or unauthorized behavior across AWS accounts and S3 data, leveraging machine learning and threat intelligence. Which service should be enabled organization-wide?
Aws Sec Detection
Question · Easy
The two on the door: security group vs network ACL
Short
Prepare for the 2026 AWS Certified Security Specialty SCS-C03 exam with official domain weights, 65-question format, 750 passing score, new ordering/matching items, IAM emphasis, GenAI security, and free practice.
Blog
GuardDuty has produced a high-severity finding for a compromised EC2 instance generating cryptocurrency-mining traffic. Which sequence best preserves forensic evidence while stopping the threat?
Aws Sec Incident Response
Question · Hard
Chapter 0: Getting Started with the SCS-C03 Exam
0.1 SCS-C03 Exam Format, Domains & Study Strategy
Study guide
A team wants to scan running EC2 instances, container images in ECR, and Lambda functions for OS, language-package, and code vulnerabilities, using a single managed service. Which service provides this?
Tech Exam Prep Podcast
Listen on Spotify
Podcast
Security Hub aggregates findings across accounts. The team wants every new CRITICAL finding to automatically open a ticket in their ITSM system and trigger a Lambda remediation. Which integration approach is recommended?
Question · Medium
A SOC analyst needs to investigate the relationships between an IAM principal, an EC2 instance, and external IP addresses involved in a GuardDuty finding. Which AWS service is purpose-built for this graph-based investigation?
AWS or YOU?
The security team wants to detect EBS volumes containing malware after GuardDuty reports a suspicious EC2 instance. Which capability provides this without disrupting the workload?
Chapter 1: Security Monitoring, Alerting & Threat Detection Services
1.1 Workload Monitoring & Health Check Strategies
GuardDuty keeps generating findings for benign penetration testing originating from a corporate IP block. The team wants those specific findings to stop appearing without disabling detection. What is the correct mechanism?
A finding indicates EKS cluster runtime activity consistent with reverse-shell behavior. Which GuardDuty feature surfaces this kind of in-container threat?
Which capability lets a multi-account organization receive consolidated GuardDuty, Inspector, and Security Hub data in a single delegated security account?
Aws Sec Governance
The team needs to automatically remediate a finding by isolating an EC2 instance and rotating its IAM role credentials, with auditable approvals between steps. Which combination is most appropriate?
1.2 Amazon GuardDuty Architecture & Finding Types
CloudTrail Insights has flagged an unusual spike in `iam:CreateAccessKey` calls. What does this signal indicate?
Which Macie capability helps detect company-specific identifiers (like internal customer IDs) that the built-in managed identifiers do not cover?
Aws Sec Data Protection
After containment of an incident, the post-incident phase requires lessons-learned documentation. Which AWS-recommended practice supports continuous improvement of IR procedures?
Which architecture supports near-real-time central security log analytics across hundreds of accounts with built-in normalization to a common schema?
1.3 AWS Security Hub & Automated Conformance Assessment
A team requires every CloudTrail log file to be tamper-evident so auditors can prove logs were not altered after delivery. Which feature must be enabled?
A governance team needs to capture S3 GetObject and PutObject API activity for sensitive buckets. By default these are not in management events. What must they enable?
Which statement about an AWS Organizations trail is correct?
A team needs a query interface that runs SQL against years of CloudTrail logs without managing infrastructure. Which AWS option fits?
1.4 Amazon Macie & Automated Data Classification
Logs from CloudWatch Logs need to be streamed to a third-party SIEM in near real time. Which integration provides reliable, scalable delivery?
VPC Flow Logs are required to capture rejected packets in a development VPC at the lowest cost while still allowing periodic Athena queries. Which configuration is most efficient?
Which CloudWatch Logs feature lets you derive a metric (like number of failed SSH attempts) from log lines and alarm on it?
A team needs to run ad-hoc investigations against high-volume CloudWatch Logs without exporting them. Which feature is purpose-built for this?
Chapter 2: Enterprise Logging Architecture & Analysis
2.1 Multi-Account CloudTrail & Organization Trails
A regulatory requirement says CloudTrail logs must be immutable for seven years even from account administrators. Which two S3 features together provide WORM storage?
Which AWS Config feature lets a security team apply a curated bundle of rules (for example, the AWS Foundational Security Best Practices) consistently across many accounts and regions?
An auditor needs DNS query logs from the on-VPC resolver to investigate suspected data exfiltration via DNS tunneling. Which feature captures these queries?
What is the primary benefit of using EventBridge with Security Hub findings instead of polling Security Hub APIs?
2.2 Amazon Security Lake & OCSF Log Normalization
Which Security Hub standard provides controls aligned to the U.S. Foundational Security Best Practices and is enabled by default when Security Hub is turned on?
A workload routes traffic from the internet through an Application Load Balancer. The team must protect against SQL injection and bot-driven credential stuffing. Which combination is appropriate?
Aws Sec Infrastructure Security
An organization needs to centrally manage WAF rules across all member-account ALBs and CloudFront distributions, and prevent local administrators from disabling them. Which service enforces this?
Which Shield Advanced benefit is most relevant for an enterprise running mission-critical Route 53 + CloudFront workloads?
2.3 Network Telemetry: VPC Flow Logs & Route 53 Resolver Logs
A security team wants L4-L7 stateful inspection, IPS signatures, and TLS inspection for east-west and egress traffic in a multi-VPC environment. Which AWS service is purpose-built?
Which statement about security groups versus network ACLs is correct?
A workload in a private subnet must call the S3 API without traversing the public internet. Which option is most cost-effective and scalable?
Two VPCs in different AWS accounts must privately reach a web service hosted in account A. Account A wants to expose only the service, not the VPC. Which AWS feature provides this?
2.4 Troubleshooting Security Telemetry & Log Ingestion
Loading more…
