What is the primary function of Amazon CodeGuru Security?

To manage API keys and secrets.

To automatically detect security vulnerabilities and code quality issues in application code.

To provide a firewall for web applications.

To monitor runtime behavior of applications for anomalies.

What is the purpose of a patch baseline in Systems Manager Patch Manager?

To store encrypted secrets for applications.

To provide a secure shell session to an instance.

To define which patches are approved for installation.

To define the IAM role for the instance.

What is a key practice for hardening container images?

Use minimal base images and scan for vulnerabilities.

Disable all logging to reduce data exposure.

Run containers as root to simplify permission management.

Use a large base image with many tools to ensure all dependencies are available.

Which of the following is an example of embedding a security control during the container image build process?

Exposing all ports to simplify networking.

Storing secrets as environment variables in the Dockerfile.

Using the latest tag for the base image to get automatic updates.

Adding a non-root user and setting the USER directive in the Dockerfile.

How does Systems Manager Session Manager provide auditable access to EC2 instances?

By storing session transcripts in the instance's local disk.

By requiring a password for each session.

By sending an email to the security team after each session.

By logging all sessions to AWS CloudTrail and optionally to Amazon S3 or CloudWatch Logs.

AWSCertified Security - Specialty

Domain 3Objective 2

Task 3.2: Design, Implement, and Troubleshoot Security Controls for Compute Workloads SCS-C03 Practice Questions (Page 1)

Part of the Content Domain 3: Infrastructure Security domain, which accounts for 18% of the SCS-C03 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~13–21 in this domain), expect 4–7 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

17concepts

18%of the exam

17 Concepts in This Objective

Hardened AMI Design
Container Image Hardening
EC2 Image Builder Pipelines
Instance Profiles for EC2
Service Roles for AWS Services
Execution Roles for Compute
Amazon Inspector Vulnerability Scanning
GuardDuty Runtime Monitoring
Patch Management with Systems Manager
Continuous Compliance Validation
Systems Manager Session Manager
EC2 Instance Connect
Pipeline Security Scanning
Amazon Q Developer Security
Amazon CodeGuru Security
GenAI OWASP Top 10 Protections
Guardrails for Generative AI

Questions 1–5

1foundation · easy
What is the primary function of Amazon CodeGuru Security?
Select an answer first
2foundation · easy
What is the purpose of a patch baseline in Systems Manager Patch Manager?
Select an answer first
3foundation · easy
What is a key practice for hardening container images?
Select an answer first
4foundation · easy
Which of the following is an example of embedding a security control during the container image build process?
Select an answer first
5foundation · easy
How does Systems Manager Session Manager provide auditable access to EC2 instances?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCS-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SCS-C03” is a trademark of its owner, used for identification only.