FirstTry
SCS-C03AWS Certified Security Specialty

Practice Exam 1

The first 5 of 65 questions, free. The explanation on every one of them is free too, at every tier, and always will be.

  1. Question 1 of 65

    Threat Detection and Incident ResponseModerate

    A rule must fire only on CloudTrail events whose sourceIPAddress falls inside 198.51.100.0/26, which covers the first 64 addresses of that block. Which clause expresses it?

  2. Question 2 of 65

    Threat Detection and Incident ResponseHard

    A team hard codes one severity per GuardDuty finding type in their SIEM routing table. Findings of the same type later arrive at a different severity. What did they get wrong?

  3. Question 3 of 65

    Threat Detection and Incident ResponseHard

    This rule is meant to page on high and critical GuardDuty findings, but a finding scored 7.5 never reaches the target.

    {
  "source": ["aws.guardduty"],
  "detail-type": ["GuardDuty Finding"],
  "detail": {
    "severity": ["7", "8", "9"]
  }
}

    What is the fix?

  4. Question 4 of 65

    Threat Detection and Incident ResponseEasy

    A responder opens the finding below and has to decide how urgently it should be worked.

    {
  "schemaVersion": "2.0",
  "accountId": "111122223333",
  "region": "us-east-1",
  "type": "Behavior:EC2/NetworkPortUnusual",
  "severity": 5,
  "resource": {
    "resourceType": "Instance",
    "instanceDetails": { "instanceId": "i-0ab1c2d3e4f56789a" }
  },
  "service": { "archived": false, "count": 3 }
}

    What does that severity value describe?

  5. Question 5 of 65

    Threat Detection and Incident ResponseModerate

    An engineer writes the rule below to catch any Security Hub event carrying findings, and the target is never invoked.

    {
  "source": ["aws.securityhub"],
  "detail": {
    "findings": [ { "exists": true } ]
  }
}

    Why does the pattern fail to match?

0 of 65 completed

0%

The remaining 60 questions are the rest of this form: same 170 minute clock, same 750 cut score, and the same explanation on every question, which is never behind the wall. Practice Exam 1 of 1 on Security Specialty.

What the rest of this exam covers

  • Threat Detection and Incident Response9 questions / 14% of the exam
  • Security Logging and Monitoring12 questions / 18% of the exam
  • Infrastructure Security13 questions / 20% of the exam
  • Identity and Access Management10 questions / 16% of the exam
  • Data Protection12 questions / 18% of the exam
  • Management and Security Governance9 questions / 14% of the exam

Checking what you already have access to.

Every question is original, written from the published objectives. We never reproduce, paraphrase, or imitate real exam content, and neither should anything else you study from.