Four response formats — two of them new
Lesson 2 of 3 in The SCS-C03 Exam.
Every other AWS exam on this site uses two response types. SCS-C03 names four, and the guide's own wording is worth reading literally rather than paraphrased:
- Multiple choice — "has one correct response and three incorrect responses (distractors)".
- Multiple response — "has two or more correct responses out of five or more response options".
- Ordering — "has a list of 3–5 responses to complete a specified task. You must select the correct responses and place the responses in the correct order to receive credit for the question."
- Matching — "has a list of responses to match with a list of 3–7 prompts. You must match all the pairs correctly to receive credit for the question."
Ordering and matching are the new ones, and they are not cosmetic. An ordering item asks you to reconstruct a procedure — a containment sequence, a key-rotation sequence, a policy-evaluation sequence — which tests whether you know the dependencies between steps, not just the steps. A matching item is usually service recognition in disguise: three to seven requirements on the left, services or features on the right. Both are graded brutally.
| Format | What it looks like | How it is graded | The tactic |
|---|---|---|---|
Multiple choice | 1 correct of 4 options. | Right or wrong. | Read the question sentence first, then the body. Eliminate on the qualifier before comparing survivors. |
Multiple response | 2 or more correct out of 5 or more options. The stem states how many. | Exact set. One right answer out of two scores zero. | Count the required answers off the stem before you read the options. Then complete the set — a half-set is a zero, so a guess for the last slot is free. |
Ordering (new in C03) | 3–5 responses to place in the correct order. | All steps, correctly sequenced, or nothing. | Anchor the step that can only be first and the one that can only be last, then work inward on forced dependencies. |
Matching (new in C03) | Responses paired with 3–7 prompts. There may be more responses than prompts. | Every pair correct, or nothing. | Commit the certain pairs first and let elimination resolve the rest. Watch for a response that pairs with nothing — it is there to tempt you. |
Three grading facts, and all three change how you spend time.
Everything is all or nothing. There is no partial credit anywhere on this exam — not for a nearly right set, not for a sequence with two steps swapped, not for three of four pairs. A multi-part item therefore pays exactly the same as the easiest multiple-choice item on the paper. That is the strategic point: an ordering item you cannot reconstruct deserves a fast plausible arrangement and a flag, not eight minutes of agonising.
Unanswered is scored as incorrect, and there is no penalty for guessing. So a blank is strictly worse than any guess, including a random one. On an ordering item, submit an order. On a matching item, pair everything. Never hand back an empty question.
The new formats read slower than the average. At 2 minutes 37 seconds per question, a matching item with seven prompts will eat four minutes and an easy multiple-choice item will give you ninety seconds back. Budget across the paper, not per item.
Working an ordering item — anchor the ends, then work inward
- Read the task, not the steps
What procedure is being reconstructed — containment? key rotation? an evaluation chain? Name it before you look at the responses, or the responses will name it for you.
- Find the step that can only be first
Usually the one with no prerequisite: stop the bleeding, revoke the credential, enable the trail. Security procedures almost always begin with containment or with turning on the thing that records what happens next.
- Find the step that can only be last
Usually destructive or final: terminate the instance, delete the key material, close the case, hand the report to the auditor. Anything irreversible belongs at the end.
- Chain the middle on dependencies
Ask of each remaining pair: does A produce something B needs? Contain before you collect; collect before you destroy; snapshot before you detach; rotate before you revoke.
- Does it read like a runbook?
- Commit and move on
A plausible full order plus a flag beats a perfect order that cost you two other questions.
- Swap the pair that reads wrong
If the sequence would destroy evidence, grant access before restricting it, or alert before logging, you have found the inversion. Swap exactly that pair and re-read.
Multiple response — count first, then read
The stem tells you how many to select ("Select TWO", "Select THREE"). Read that number before the options, because it changes how you read them: with two correct answers, the right pair often cooperates — one turns a control on, the other points it at the right signal. Two options that do the same job in different ways are usually both wrong, or only one is right and the other is its distractor twin.
And finish the set. Grading is an exact set, so leaving the third slot empty scores exactly the same as getting all three wrong.
Ordering — the four sequences worth memorising
Security procedures repeat, so a handful of chains cover most ordering items:
- Incident containment: stop new traffic → isolate the resource → preserve evidence → eradicate → recover → review.
- Credential compromise: revoke active sessions → rotate or disable the credential → audit what it touched in CloudTrail → close the path that leaked it.
- Policy troubleshooting: check for an explicit deny → check organization policies → check boundaries and session policies → check identity and resource policies → check the KMS key policy.
- Key lifecycle: create or import material → enable and grant use through the key policy → rotate → schedule deletion with a waiting period → verify nothing still references it.
If an item's responses map onto one of those, you already have the order.
Matching — do the certain pairs first
Matching items reward service recognition, which means they reward the reflex table more than reasoning. Work in three sweeps: pair everything you are sure of, then use elimination on what is left (if only Macie and Detective remain, and one prompt says "classify sensitive objects", you are done), then sanity-check the whole set — a service used twice when every prompt needs a distinct answer is a signal you mispaired something earlier.
Watch for more responses than prompts. The guide allows it, and the spare response is normally the plausible neighbour of a correct one: Security Hub next to Config, GuardDuty next to Detective, Shield next to WAF.
Why these formats exist at all
Multiple choice tests recognition; multiple response tests whether you can assemble a complete solution. Ordering tests dependency knowledge, which is exactly what separates someone who has run an incident from someone who has read about one — knowing that a snapshot taken after termination is a snapshot of nothing. Matching tests breadth of the in-scope service list cheaply, several services per item.
So the formats are not an obstacle to study around; they tell you what to study. Learn procedures as ordered chains and services as one-line jobs, and both new formats stop being novel.
Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.
Key terms: Ordering item, Matching item, All-or-nothing grading, Multiple response, Pacing (2.6 minutes per question)