SCS-C03 Tests Layered, Organization-Wide Security Controls — Not Single-Service Trivia
SCS-C03 replaced SCS-C02 on 2 December 2025. Aimed at security engineers who protect multi-account AWS estates, it rewards answers that scope controls organization-wide and preserve evidence before acting.
Check Your Readiness →Most candidates understand AWS Certified Security - Specialty (SCS-C03) concepts — and still fail. This exam tests how you apply knowledge under pressure.
Several answers usually work; the winner covers every account at the right layer with the least overhead. IAM items show JSON policies and multi-policy evaluation. The guide also lists ordering and matching items, while the certification page mentions only multiple choice and multiple response.
Trust the vendor's AWS account in the role with no conditions
Require sts:ExternalId in the trust policy condition to block the confused deputy problem, where another vendor customer tricks the vendor into using your role. Grant only the read permissions the integration needs.
Issue them Client VPN profiles
Client VPN grants network-level access to whole subnets. AWS Verified Access evaluates identity and device signals per request for a specific application, with no VPN client, which matches least privilege.
Add more S3 actions to the bucket policy
Cross-account reads of SSE-KMS objects need three allows: the bucket policy, the caller's IAM policy, and the KMS key policy granting kms:Decrypt to that role. Fixing only the bucket side leaves the key blocking access.
Deploy a hardened bastion host allowing SSH from the office
Session Manager connects through the SSM Agent over outbound HTTPS, needs no inbound ports or SSH keys, and logs sessions to CloudWatch Logs or S3. Add VPC interface endpoints for instances without internet access.
Run Amazon Inspector to find the running miner
Inspector finds CVEs and network exposure, not runtime threats. GuardDuty already detected it; route the finding through EventBridge to an automated isolation runbook, then use Amazon Detective to scope related activity.
Termination destroys memory and possibly volumes. Move the instance into a dedicated isolation security group rather than editing a shared one, capture memory, snapshot EBS volumes, tag it, then investigate from a forensic account instead of logging in.
GetObject is a data event and is not logged by default. Enable S3 data events on an organization trail or in CloudTrail Lake. Likewise, VPC Flow Logs never show domain names; Route 53 Resolver query logs do.
Identity and resource policies grant. Permission boundaries, SCPs, RCPs and session policies only filter. An explicit deny anywhere wins, so attaching AdministratorAccess never fixes an access denied caused by an SCP or boundary.
Users with s3:BypassGovernanceRetention can shorten or remove governance-mode locks. Compliance mode is strict WORM: nobody, including the root user, can delete the locked version before retention ends. Backup Vault Lock gives similar protection for AWS Backup recovery points.
Automatic scheduled rotation applies to keys with AWS-generated material. With imported material you own rotation planning and durability, since material can expire or be deleted. External key stores keep material outside AWS; CloudHSM gives single-tenant control.
Strengthen weak areas with exam-style practice questions and detailed explanations.
Simulate the real exam experience and assess your readiness under timed conditions.
Review key concepts, objectives, and exam topics in one place.
Get personalized explanations, learning recommendations, and instant answers.
Follow a structured learning path designed to help you prepare efficiently.
SCS-C03 rewards organization-wide controls and evidence-first response. Test whether your instincts match.