SCS-C03 Exam Questions 2026 – Practice Test with Verified Answers

Explanation:
AWS KMS key grants are specifically designed to provide temporary, granular permissions to use customer managed keys without modifying key policies. According to the AWS Certified Security C Specialty Study Guide, grants are the preferred mechanism for delegating key usage permissions to AWS principals for short-term or programmatic access scenarios. Grants allow permissions such as Encrypt, Decrypt, or GenerateDataKey and can be created and revoked dynamically.
Using a key grant avoids the operational risk and overhead of editing key policies, which are long-term control mechanisms and should remain stable. AWS documentation emphasizes that frequent key policy changes increase the risk of misconfiguration and accidental privilege escalation. Grants can be revoked immediately when access is no longer required, ensuring strong adherence to the principle of least privilege.
Options A and D violate AWS security best practices because AWS KMS does not allow direct export of key material unless the key was explicitly created as an importable key, and exporting key material increases exposure risk.
Option B requires manual policy changes and rollback, which introduces operational overhead and audit complexity.
AWS recommends key grants as the most efficient and secure way to provide temporary access to KMS keys for applications.
Referenced AWS Specialty Documents:
AWS Certified Security C Specialty Official Study Guide AWS KMS Key Policies and Grants Documentation AWS KMS Best Practices

Explanation:
CloudWatch Logs Insights is a managed, on-demand query capability designed to search and analyze log data stored in CloudWatch Logs without moving the data elsewhere. AWS Certified Security C Specialty documentation highlights Logs Insights as the lowest-effort method for rapid investigations, because it supports filtering, parsing, aggregation, and time-range queries directly over existing log groups. In this scenario, the logs already exist in CloudWatch Logs with sufficient retention. The engineer can write a query that filters for the suspicious IP address, counts occurrences over the last 7 days, and extracts requested URLs using parsing functions. This satisfies both requirements (count and URLs) immediately, without building pipelines or exporting data.
Option B adds operational overhead by provisioning and maintaining OpenSearch ingestion and indexing.
Options A and D require exporting data and additional services that are not necessary for a one-week forensic query. Therefore, Logs Insights is the most efficient and cost-effective approach .
Referenced AWS Specialty Documents:
AWS Certified Security C Specialty Official Study Guide
Amazon CloudWatch Logs Insights Querying and Investigation Workflows

Explanation:
Comprehensive and Detailed 100to 150 words of Explanation From AWS Certified Security C Specialty topics:
NTP traffic is network traffic, not an AWS API call. CloudTrail records AWS API activity, so it cannot identify an EC2 instance contacting an external NTP server on UDP port 123. VPC Flow Logs capture information about IP traffic going to and from network interfaces in a VPC, including source, destination, protocol, ports, and accept/reject status. Therefore, the correct approach is to analyze VPC Flow Logs for outbound NTP traffic to destinations other than the Amazon Time Sync Service. Monitoring traffic to the Amazon Time Sync Service would show compliant behavior, not violations. This is a detection-control question: use CloudTrail for API activity and VPC Flow Logs for network-level traffic visibility.

Explanation:
AWS Health provides real-time visibility into events that affect AWS accounts, including abuse notifications such as AWS_ABUSE_DOS_REPORT. According to the AWS Certified Security C Specialty Study Guide, AWS Health events are natively integrated with Amazon EventBridge, enabling automated, near-real-time responses without polling or custom code.
By creating an EventBridge rule that listens for AWS Health events related to abuse reports and configuring the rule to publish messages to an SNS topic, the security engineer ensures immediate notification to the security team whenever AWS issues a DoS-related abuse report for the account.
Option A and C rely on periodic polling using Lambda functions, which introduces latency and operational complexity.
Option D is incorrect because CloudTrail does not log AWS abuse notifications.
AWS documentation explicitly identifies AWS Health + EventBridge + SNSas the recommended architecture for near-real-time operational and security alerts originating from AWS.
AWS Certified Security C Specialty Official Study Guide
AWS Health User Guide
Amazon EventBridge Documentation
AWS Incident Response Best Practices

Explanation:
Amazon Detective is a purpose-built AWS service designed to analyze, investigate, and visualize security data to help identify the root cause of suspicious or malicious activity. According to the AWS Certified Security C Specialty Official Study Guide, Amazon Detective directly integrates with Amazon GuardDuty findings, AWS CloudTrail logs, Amazon VPC Flow Logs, and Amazon EKS audit logs to automatically create behavior graphs and timelines.
When GuardDuty generates findings related to anomalous activity, Amazon Detective enables security engineers to pivot directly to an investigation focused on a specific IAM role, user, or resource. Detective automatically correlates historical activity, identifies deviations from baseline behavior, and highlights indicators of compromise, such as unusual API calls, credential misuse, or suspicious network activity.
AWS Audit Manager (Option B) is designed for compliance and audit evidence collection, not threat investigation. Amazon Inspector (Options C and D) is focused on vulnerability scanning of compute resources and does not analyze IAM behavior or GuardDuty findings. AWS documentation explicitly states that Amazon Detective is the recommended service for deep-dive investigations following GuardDuty alerts, providing enriched context and investigation reports for security incidents.
AWS Certified Security C Specialty Official Study Guide
Amazon Detective User Guide
Amazon GuardDuty Integration Documentation