AWS-CERTIFIED-SECURITY-SPECIALTY-SCS-C03Updated 8d ago · Aug 28, 2026

AWS Certified Security - Specialty SCS-C03

88 questions across 1 topics, with suggested answers, explanations where available, and imported community discussion. The first 8 questions are free to preview.

Browse questions Practice mode

Topics

#	Topic	Questions	Free
1	Identity and Access Management	88	8

Preview

8 of 88 accessible

Question 1 · Identity and Access Management Open

A security engineer is troubleshooting an AWS Lambda function that is named MyLambdaFunction. The function is encountering an error when the function attempts to read the objects in an Amazon S3 bucket that is named DOC-EXAMPLE-BUCKET. The S3 bucket has the following bucket policy: Which change should the security engineer make to the policy to ensure that the Lambda function can read the bucket objects?

Answer: C `s3:GetObject` is an S3 object operation, so its policy `Resource` must be an object ARN. Appending `/*` to `arn:aws:s3:::DOC-EXAMPLE-BUCKET` grants access to the objects in that bucket rather than only identifying the bucket itself. AWS documents `arn:aws:s3:::bucket-name/*` as the required resource form for object operations such as `GetObject`. **Learn more:** [How Amazon S3 works with IAM](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security_iam_service-with-iam.html)

Question 2 Open

HOTSPOT - A company is building a web application that needs to authenticate external users across multiple microservices that the company hosts on Amazon Elastic Container Service (Amazon ECS). The solution must use temporary credentials and minimize the management overhead required to maintain user databases. Select and order the correct steps from the following list to implement a secure authentication strategy that meets these requirements. Select each step one time or not at all. Configure Amazon Cognito user pools for user authentication. Set up an IAM role for each microservice. Grant each role appropriate permissions. Implement an Amazon API Gateway HTTP API with AWS Lambda authorizers to validate tokens before forwarding requests to microservices. Create an Amazon DynamoDB table to store user credentials for each microservice. Create an Amazon Cognito application client to interact with the web application. Set up AWS IAM Identity Center to give users access to the microservices.

Answer: —

Question 3 · Identity and Access Management Open

An AWS account administrator created an IAM group and applied the following managed policy to require that each individual user authenticate using multi-factor authentication: After implementing the policy, the administrator receives reports that users are unable to perform Amazon EC2 commands using the AWS CLI. What should the administrator do to resolve this problem while still enforcing multi-factor authentication?

Answer: B Long-term IAM user access keys do not include MFA context, so the explicit deny blocks EC2 API calls. Users should call AWS STS `get-session-token` with their MFA device `--serial-number` and current `--token-code`, then use the returned temporary credentials for API or CLI calls. Those credentials include MFA context and can satisfy policies that require MFA for individual API operations. **Learn more:** [Secure API access with MFA - AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html) · [Permissions for GetSessionToken - AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_getsessiontoken.html)