Exams / SCS-C03
Free AWS Certified Security – Specialty (SCS-C03) practice exam
Start free practice No sign-up. Or choose a timed exam or one domain.
Take the full 65-question practice exam free, with no sign-up and no email. The questions are written like the real exam: short scenarios where you pick the best answer. Every question is original and explains why each option is right or wrong.
- Real exam
- 65 questions
- Time
- 170 minutes
- Domains
- 6
- Free exam
- 65 questions, no sign-up
Last verified against current AWS documentation ·How we write our questions
New to SCS-C03? The study guide explains what each domain tests and how to pick between close answers, with notes on every topic.Read the study guide
Your progress
Loading your progress…
Nothing here yet. After your first session you'll see your scores, accuracy by domain and what to practice next.
Free practice exam
More practice sets
One payment, no subscription
Get all practice setsAll practice sets: 5 sets, 325 new questions
Fresh questions not in the free set, each with an explanation for every option. One payment of $14.99, no subscription, with access for at least 12 months. Includes the randomized test and topic practice across every set, and your answers are saved so you can track your weak areas.
- Practice set 165 questions
- Practice set 265 questions
- Practice set 365 questions
- Practice set 465 questions
- Practice set 565 questions
Taking more than one exam?
Get the all-exams passAll AWS exams pass: $49.99
Every practice set for all 11 AWS exams: 3,790 questions. That's about 3 exams' price for all 11. Includes exams we add later. One payment, no subscription.
Randomized test
For practice set owners. A fresh mix every time, drawn from every set you own: 65 questions in 170 minutes, like the real exam.
By domain
Untimed practice on one domain, with the explanation after each question.
- Detection16% exam guide weighting · 10 free questionsIn my sets: Detection
- Incident Response14% exam guide weighting · 9 free questionsIn my sets: Incident Response
- Infrastructure Security18% exam guide weighting · 12 free questionsIn my sets: Infrastructure Security
- Identity and Access Management20% exam guide weighting · 13 free questionsIn my sets: Identity and Access Management
- Data Protection18% exam guide weighting · 12 free questionsIn my sets: Data Protection
- Security Foundations and Governance14% exam guide weighting · 9 free questionsIn my sets: Security Foundations and Governance
By topic
Narrow it down to one topic. Counts are for the free set; the practice sets have more questions on every topic.
Detection
- Threat detection and findings (GuardDuty, Macie, Security Hub)2 free Threat detection and findings (GuardDuty, Macie, Security Hub) questions to read
- Security metrics, alarms and alert routing (CloudWatch, EventBridge)2 free Security metrics, alarms and alert routing (CloudWatch, EventBridge) questions to read
- Organization-wide logging (CloudTrail organization trails, log archive account)2 free Organization-wide logging (CloudTrail organization trails, log archive account) questions to read
- Security data lakes and third-party tools (Security Lake, OCSF)1 free Security data lakes and third-party tools (Security Lake, OCSF) questions to read
- Analyzing and correlating logs (CloudWatch Logs Insights, Athena, OpenSearch)1 free Analyzing and correlating logs (CloudWatch Logs Insights, Athena, OpenSearch) questions to read
- Network and DNS logs (VPC Flow Logs, Transit Gateway flow logs, Resolver query logs)1 free Network and DNS logs (VPC Flow Logs, Transit Gateway flow logs, Resolver query logs) questions to read
- Troubleshooting missing logs and alerts1 free Troubleshooting missing logs and alerts questions to read
Incident Response
- Incident response plans, runbooks and preparation2 free Incident response plans, runbooks and preparation questions to read
- Testing incident response (Fault Injection Service, Resilience Hub, game days)2 free Testing incident response (Fault Injection Service, Resilience Hub, game days) questions to read
- Automated remediation (EventBridge, Systems Manager Automation, Step Functions, Lambda)2 free Automated remediation (EventBridge, Systems Manager Automation, Step Functions, Lambda) questions to read
- Forensic evidence capture and preservation1 free Forensic evidence capture and preservation questions to read
- Containing, eradicating and recovering from security events1 free Containing, eradicating and recovering from security events questions to read
- Scoping events and root cause analysis (Detective)1 free Scoping events and root cause analysis (Detective) questions to read
Infrastructure Security
- Web application firewall rules (AWS WAF, rate limiting, bot and fraud controls)1 free Web application firewall rules (AWS WAF, rate limiting, bot and fraud controls) questions to read
- DDoS protection (Shield Advanced, CloudFront, Route 53)1 free DDoS protection (Shield Advanced, CloudFront, Route 53) questions to read
- Securing CloudFront origins and edge access (OAC, signed URLs, headers, CORS)1 free Securing CloudFront origins and edge access (OAC, signed URLs, headers, CORS) questions to read
- Hardened AMIs and container images (EC2 Image Builder)1 free Hardened AMIs and container images (EC2 Image Builder) questions to read
- Instance profiles, service roles and execution roles1 free Instance profiles, service roles and execution roles questions to read
- Vulnerability scanning and patching (Inspector, Patch Manager, GuardDuty Runtime Monitoring)1 free Vulnerability scanning and patching (Inspector, Patch Manager, GuardDuty Runtime Monitoring) questions to read
- Secure administrative access (Session Manager, EC2 Instance Connect)1 free Secure administrative access (Session Manager, EC2 Instance Connect) questions to read
- Finding vulnerabilities in code and pipelines (Inspector code security, Amazon Q Developer)1 free Finding vulnerabilities in code and pipelines (Inspector code security, Amazon Q Developer) questions to read
- Guardrails for generative AI applications (Bedrock Guardrails, OWASP LLM Top 10)1 free Guardrails for generative AI applications (Bedrock Guardrails, OWASP LLM Top 10) questions to read
- Security groups, network ACLs, Network Firewall and DNS Firewall1 free Security groups, network ACLs, Network Firewall and DNS Firewall questions to read
- Secure hybrid connectivity (Site-to-Site VPN, Direct Connect, MACsec, Verified Access)1 free Secure hybrid connectivity (Site-to-Site VPN, Direct Connect, MACsec, Verified Access) questions to read
- Network segmentation and finding unneeded access (inspection VPCs, Network Access Analyzer)1 free Network segmentation and finding unneeded access (inspection VPCs, Network Access Analyzer) questions to read
Identity and Access Management
- Workforce identity and MFA (IAM Identity Center, external IdPs, Directory Service)2 free Workforce identity and MFA (IAM Identity Center, external IdPs, Directory Service) questions to read
- Customer and app identity (Amazon Cognito)2 free Customer and app identity (Amazon Cognito) questions to read
- Temporary credentials (AWS STS, S3 presigned URLs)1 free Temporary credentials (AWS STS, S3 presigned URLs) questions to read
- Workload identity outside AWS (IAM Roles Anywhere, OIDC federation)1 free Workload identity outside AWS (IAM Roles Anywhere, OIDC federation) questions to read
- Troubleshooting sign-in and authentication1 free Troubleshooting sign-in and authentication questions to read
- Cross-account access (trust policies, resource policies, external IDs)1 free Cross-account access (trust policies, resource policies, external IDs) questions to read
- Attribute-based and role-based access control (tags, session tags)1 free Attribute-based and role-based access control (tags, session tags) questions to read
- Least-privilege policies (permissions boundaries, session policies, conditions)1 free Least-privilege policies (permissions boundaries, session policies, conditions) questions to read
- Troubleshooting access denied and policy evaluation1 free Troubleshooting access denied and policy evaluation questions to read
- Finding and removing unintended access (IAM Access Analyzer)1 free Finding and removing unintended access (IAM Access Analyzer) questions to read
- Fine-grained app authorization (Amazon Verified Permissions)1 free Fine-grained app authorization (Amazon Verified Permissions) questions to read
Data Protection
- Requiring encryption in transit (TLS policies, aws:SecureTransport, ACM)2 free Requiring encryption in transit (TLS policies, aws:SecureTransport, ACM) questions to read
- Private access to services (VPC endpoints, endpoint policies, PrivateLink, Client VPN)1 free Private access to services (VPC endpoints, endpoint policies, PrivateLink, Client VPN) questions to read
- Encryption between nodes and services (EMR, EKS, SageMaker AI, Nitro)1 free Encryption between nodes and services (EMR, EKS, SageMaker AI, Nitro) questions to read
- Encryption at rest (KMS, CloudHSM, server-side and client-side encryption)1 free Encryption at rest (KMS, CloudHSM, server-side and client-side encryption) questions to read
- Data integrity and immutability (S3 Object Lock, Glacier Vault Lock, code signing)1 free Data integrity and immutability (S3 Object Lock, Glacier Vault Lock, code signing) questions to read
- Data retention and lifecycle (S3 Lifecycle, EFS lifecycle, FSx backups)1 free Data retention and lifecycle (S3 Lifecycle, EFS lifecycle, FSx backups) questions to read
- Secure backup and ransomware recovery (AWS Backup, Vault Lock, Data Lifecycle Manager)1 free Secure backup and ransomware recovery (AWS Backup, Vault Lock, Data Lifecycle Manager) questions to read
- Secrets and credential rotation (Secrets Manager)1 free Secrets and credential rotation (Secrets Manager) questions to read
- Imported key material and external key stores1 free Imported key material and external key stores questions to read
- Masking sensitive data (CloudWatch Logs data protection, Macie)1 free Masking sensitive data (CloudWatch Logs data protection, Macie) questions to read
- KMS key policies, grants, multi-Region keys and Private CA1 free KMS key policies, grants, multi-Region keys and Private CA questions to read
Security Foundations and Governance
- Organizations, Control Tower and delegated administrators1 free Organizations, Control Tower and delegated administrators questions to read
- Organization policies (SCPs, RCPs, declarative policies, AI opt-out)1 free Organization policies (SCPs, RCPs, declarative policies, AI opt-out) questions to read
- Root user protection and break-glass access1 free Root user protection and break-glass access questions to read
- Secure infrastructure as code (StackSets, CloudFormation Guard, Hooks)1 free Secure infrastructure as code (StackSets, CloudFormation Guard, Hooks) questions to read
- Tagging strategy and tag policies1 free Tagging strategy and tag policies questions to read
- Central security policies with Firewall Manager1 free Central security policies with Firewall Manager questions to read
- Sharing resources securely (AWS RAM, Service Catalog)1 free Sharing resources securely (AWS RAM, Service Catalog) questions to read
- Compliance rules and remediation (AWS Config, Security Hub CSPM)1 free Compliance rules and remediation (AWS Config, Security Hub CSPM) questions to read
- Audit evidence and best-practice reviews (AWS Artifact, Config, Well-Architected Tool)1 free Audit evidence and best-practice reviews (AWS Artifact, Config, Well-Architected Tool) questions to read
Frequently asked questions
Is the SCS-C03 practice exam really free?
- Yes. The free full-length 65-question SCS-C03 practice exam needs no sign-up and no email, and you can take it as often as you like, timed or at your own pace.
How many questions and how much time does the real SCS-C03 exam have?
- The AWS Certified Security – Specialty exam has 65 questions and a time limit of 170 minutes, across 6 exam domains. The timed practice mode follows that pace.
Are these real exam questions?
- No. Every question is original practice material written for ExamPark, and each explains why every option is right or wrong, with links to the AWS documentation. We don't use recalled or leaked exam content. How we write questions is explained on the "How we write questions" page.
Do I need an account?
- Not for the free practice exam: it works without one, and your progress is saved on your device. You sign in with your email, with no password, to buy practice sets and keep your progress on every device.
What do the paid SCS-C03 practice sets add?
- 5 more full-length practice sets, 325 questions that are not in the free exam, plus randomized tests drawn from every set, topic practice across all of them, and answers saved so your weak areas are tracked over time. It is one payment with no subscription.
How long do I keep access to the practice sets?
- Access lasts at least 12 months from purchase, and it is a one-off payment, so there is nothing to cancel.
How do I know if I'm ready for SCS-C03?
- Take the timed practice exam and look at your score by domain: the weakest domains show where to study next. ExamPark's readiness estimate uses your recent timed exams. It is our own estimate, not an official AWS score, and no practice exam can promise a pass.
Additional resources
The official exam guide, free courses and the AWS reading the questions draw on.
See study resources