Free Amazon SCS-C03 Exam Questions

Become Amazon Certified with updated SCS-C03 exam questions and correct answers

Page: 1 / 36

Total 178 Questions | Updated On: May 24, 2026

Add To Cart

Question 1

During design, in a design-build delivery method, what is the design-builder responsible for delivering to the owner?

A : Submittals

B : Record documents

C : Geotechnical reports

D : Construction documents

Answer: D

Question 2

What can value analysis be used for?

A : To provide the owner with the lowest construction cost.

B : To enhance project value or reduce initial or long-term cost.

C : A phase for future work to allow higher quality items up front.

D : To change the perceived value by owner and stakeholder.

Answer: B

Question 3

A company runs workloads in an AWS account. A security engineer observes some unusual findings in Amazon GuardDuty. The security engineer wants to investigate a specific IAM role and generate an investigation report. The report must contain details about anomalous behavior and any indicators of compromise. Which solution will meet these requirements?

A : Use Amazon Detective to perform an investigation on the IAM role.

B : Use AWS Audit Manager to create an assessment. Specify the IAM role. Run an assessment report.

C : Use Amazon Inspector to create an assessment. Specify the IAM role. Run an assessment report.

D : Use Amazon Inspector to run an on-demand scan of the IAM role.

Answer: A

Question 4

A company is building a secure solution that relies on an AWS Key Management Service (AWS KMS) customer managed key. The company wants to allow AWS Lambda to use the KMS key. However, the company wants to prevent Amazon EC2 from using the key. Which solution will meet these requirements?

A : Use IAM explicit deny for EC2 instance profiles and allow for Lambda roles.

B : Use a KMS key policy with kms:ViaService conditions to allow Lambda usage and deny EC2 usage.

C : Use aws:SourceIp and aws:AuthorizedService condition keys in the KMS key policy.

D : Use an SCP to deny EC2 and allow Lambda.

Answer: B

Question 5

A company is using AWS to run a long-running analysis process on data that is stored in Amazon S3 buckets. The process runs on a fleet of Amazon EC2 instances in an Auto Scaling group. The EC2 instances are deployed in a private subnet that does not have internet access. The EC2 instances access Amazon S3 through an S3 gateway endpoint that has the default access policy. Each EC2 instance uses an instance profile role that allows s3:GetObject and s3:PutObject only for required S3 buckets. The company learns that one or more EC2 instances are compromised and are exfiltrating data to an S3 bucket that isoutside the company’s AWS Organization. The processing job must continue to function. Which solution will meet these requirements?

A : Update the policy on the S3 gateway endpoint to allow S3 actions only if aws:ResourceOrgId and aws: PrincipalOrgId match the company’s organization.

B : Update the instance profile role policy to require aws:ResourceOrgId.

C : Add a network ACL rule to block outbound traffic on port 443.

D : Apply an SCP that restricts S3 actions using organization condition keys.

Answer: A

Page: 1 / 36

Total 178 Questions | Updated On: May 24, 2026

Add To Cart