AWS Certified Security — Specialty (SCS-C03)

Security Hub is the central pane of glass for the whole exam. Know that it aggregates findings from GuardDuty, Inspector, Macie, IAM Access Analyzer, AWS Config, and partners; runs security standards (AWS Foundational Security Best Practices, CIS); supports cross-Region aggregation and delegated administration; and drives automation through EventBridge (all findings automatically), automation rules (on ingest), and custom actions (analyst-triggered). Expect 3-5 questions.

GuardDuty remains the most heavily tested detection service. Know its foundational data sources (CloudTrail management and S3 data events, VPC Flow Logs, DNS query logs — consumed directly, no need to enable them yourself), the protection plans (S3, EKS, Malware Protection, RDS, Lambda, Runtime Monitoring — runtime monitoring of compute is called out in Task 3.2.3), finding types by resource, suppression rules vs trusted IP lists vs threat lists, and multi-account setup with a delegated administrator. Expect 3-5 questions.

The classic exam pattern survives into C03: CloudTrail delivers to a CloudWatch Logs log group, a metric filter matches a pattern (console sign-in without MFA, root account usage, security group changes), the filter feeds a metric, an alarm on the metric notifies an SNS topic. Know metric filters vs subscription filters (filters to metrics vs streaming log events to Lambda/Kinesis), alarm states including INSUFFICIENT_DATA, resource health checks, and CloudWatch Logs encryption with KMS. Expect 3-4 questions.

Macie discovers sensitive data (PII, credentials, financial data) in S3 using managed and custom data identifiers, and separately evaluates bucket-level security posture (public access, encryption, sharing outside the organization). Know sensitive data discovery jobs vs automated discovery, and that findings flow to Security Hub and EventBridge. The classic scenario: "identify which buckets contain PII before a compliance audit". Expect 1-2 questions.

Skill 1.1.5 names the regular-assessment toolkit: AWS Config conformance packs deploy rule bundles org-wide, Security Hub standards re-evaluate controls continuously, Systems Manager State Manager re-applies desired configuration on a schedule, and EventBridge is the routing backbone that aggregates findings and events into automation. Know which tool answers "assess on a schedule" (Config/State Manager) vs "react to an event" (EventBridge). Expect 1-2 questions.

EventBridge is the glue in nearly every Domain 1/2 automation answer. Know event patterns for GuardDuty, Security Hub, Config, and Macie findings; scheduled rules; dead-letter queues and retry behaviour for targets; and cross-account event buses (with resource-based policies) for centralizing security events into one account. When an automation "never ran", check the rule pattern against the actual event structure and the target's resource policy. Expect 2-3 questions, usually embedded in remediation scenarios.

CloudTrail is the most tested logging service on the exam. Know management events vs data events (S3 object-level, Lambda invoke — extra cost, off by default) vs Insights events; organization trails (one trail, all member accounts, members cannot modify it); log file integrity validation with SHA-256 digest files; delivery to S3 (bucket policy must allow cloudtrail.amazonaws.com) and optionally CloudWatch Logs; SSE-KMS encryption of trail logs; and CloudTrail Lake for SQL queries over an immutable event data store. Expect 3-5 questions.

Skill 1.2.6 names the network telemetry menu. VPC Flow Logs: 5-tuple metadata with ACCEPT/REJECT at VPC, subnet, or ENI level, delivered to CloudWatch Logs, S3, or Firehose — no payloads, no DNS-to-AmazonProvidedDNS, no metadata traffic. Transit gateway flow logs extend the same telemetry to inter-VPC and hybrid traffic. Route 53 Resolver query logs capture DNS lookups from VPCs (including to malicious domains). The REJECT record is the exam's favourite way to say "a security group or NACL blocked this". Expect 2-3 questions.

New for SCS-C03. Security Lake builds a purpose-built security data lake in your S3 buckets: it ingests CloudTrail, VPC Flow Logs, Route 53 Resolver logs, Security Hub findings, EKS audit logs, and third-party sources, normalizes everything into the Open Cybersecurity Schema Framework (OCSF) in Parquet format, and shares it with subscribers (Athena, OpenSearch, third-party SIEMs). "Centralize security logs org-wide in a standard schema for our SIEM" is the Security Lake trigger phrase. Expect 1-2 questions.

Design answers converge on: centralize logs into a dedicated log-archive account, encrypt with KMS, enforce immutability with Object Lock, transition with lifecycle rules, expire on schedule. For analysis: Athena for ad hoc SQL over logs already in S3 (CloudTrail, flow logs, ALB logs — partition to cut cost); CloudWatch Logs Insights for interactive queries over log groups; CloudTrail Insights for automatic API-rate anomalies; Security Hub insights for finding groupings. The exam tests exactly these distinctions. Expect 2-3 questions.

For "near-real-time dashboards and full-text search across many log sources", the answer is a pipeline into Amazon OpenSearch Service (via Firehose or CloudWatch Logs subscription filters, with Lambda doing transformation), or Amazon Managed Grafana for dashboarding across CloudWatch, Athena, and OpenSearch data sources. Security Lake (section 2.3) is the managed normalization answer. Know the shapes, not the operational detail.

Skill 1.2.1 is about matching the log source to the question being asked. Who read this S3 object: CloudTrail data events (structured, reliable, per-API JSON) vs S3 server access logs (free, best-effort text — fine for billing analysis, not for security assurance). Who invoked this function: Lambda's CloudWatch logs plus CloudTrail data events for invocations. What hit the API: API Gateway execution and access logs. What hit the distribution: CloudFront standard logs. Know the reliability and cost trade-offs of each pair. Expect 1-2 questions.

The usual culprits, in the order to check them: the delivery target's resource policy (S3 bucket policy or CloudWatch Logs resource policy) does not allow the logging service; the KMS key policy does not grant the service; the delivery IAM role is missing permissions; the CloudWatch agent is not installed or its role lacks CloudWatchAgentServerPolicy; or retention/lifecycle already expired the data. Lambda needs logs:CreateLogGroup/CreateLogStream/PutLogEvents in its execution role; API Gateway needs an account-level CloudWatch role ARN for execution logging. Expect 2-3 questions.

When an alert never fired: the metric filter pattern did not match the log format, the alarm is on the wrong statistic/period or stuck in INSUFFICIENT_DATA, the SNS topic policy does not allow the publishing service, the EventBridge rule pattern does not match the event structure, or Security Hub is not enabled in the finding's Region (findings are Regional unless cross-Region aggregation is on). Health checks that report healthy while users see failures usually check the wrong path or port. Expect 1-2 questions.

The AWS Security Incident Response Guide supplies the exam's vocabulary and its runbook logic. Know the credential-compromise runbook cold — deactivate access keys, revoke role session credentials, rotate secrets, review CloudTrail — and know which service performs each step. Runbooks live as Systems Manager Automation documents; OpsCenter tracks operational incidents as OpsItems. Preparation means pre-provisioned break-glass access, pre-deployed security tooling, and blast-radius-limiting account structure. Expect 2-4 questions.

New emphasis in C03: game days and chaos engineering. AWS Fault Injection Service (FIS) runs controlled fault-injection experiments (instance termination, API throttling, network disruption) with stop conditions tied to CloudWatch alarms; Resilience Hub assesses applications against resiliency policies (RTO/RPO) and recommends fixes. "Validate the incident response plan actually works" maps to FIS experiments and simulated events. Usually one question.

The exam's favourite automation chain: GuardDuty or Security Hub finding → EventBridge rule → Lambda function, Systems Manager Automation runbook, or Step Functions state machine → remediation plus SNS notification. Pick Lambda for simple single-step fixes, Step Functions for multi-step workflows with approval, SSM runbooks for actions on instances, and the Automated Forensics Orchestrator solution when the requirement is automated evidence capture from compromised EC2. Expect 2-3 questions.

Memorise the EC2 isolation sequence — it is a natural ordering question: snapshot the EBS volumes first, capture a memory dump if needed, swap the instance into an isolation security group with no rules (removing it from the ASG/ELB), tag it for the forensics team, and never terminate before evidence capture. Stopping an instance loses memory contents; security group changes do not kill existing tracked connections. Recovery means restoring from backups known to predate the compromise. For credentials: deactivate the key, revoke sessions, review CloudTrail. Expect 2-3 questions.

Evidence must be immutable and access-controlled: replicate CloudTrail logs and disk images to a dedicated, isolated forensics account; enforce immutability with S3 Object Lock in compliance mode; keep chain of custody with restricted IAM roles. Know Object Lock modes (governance can be bypassed with s3:BypassGovernanceRetention, compliance cannot — not even by root) and legal holds, and that EBS snapshots can be shared into the forensic account. Expect 1-2 questions.

The division of labour the exam tests: GuardDuty detects, Detective investigates (behaviour graph over CloudTrail, VPC Flow Logs, GuardDuty findings — "what did this role/IP/instance do around the finding"), Athena and CloudTrail Lake query raw logs for scope, and Security Hub tracks the finding's workflow status. Validating a finding means correlating it across sources: the GuardDuty finding, the CloudTrail entries, and the flow log records that corroborate it. Expect 2-3 questions.

Skill 2.2.3 tests finding hygiene: assess scope and impact before acting. In Security Hub, severity plus the workflow status field (NEW, NOTIFIED, SUPPRESSED, RESOLVED) tracks triage state; GuardDuty severity levels (low/medium/high) and finding details (resource, actor, first/last seen) size the blast radius; suppression rules archive expected findings without disabling detection. A finding is validated when independent sources corroborate it — the CloudTrail entries and flow log records behind the GuardDuty finding. Expect 1-2 questions.

Know what WAF attaches to (CloudFront, ALB, API Gateway, AppSync — not NLB, not EC2 directly), web ACL structure (rules, rule groups, priority, default action), managed rule groups (Core rule set for OWASP-style threats, IP reputation, Bot Control — Bot Control's JA3/client fingerprinting covers Skill 3.1.3's "client fingerprinting"), rate-based rules for HTTP floods, geo-match statements, and third-party Marketplace rule groups for Skill 3.1.4. SQL injection and XSS scenarios are answered with WAF managed rules. Expect 2-4 questions.

Shield Standard is free, automatic, and covers common layer 3/4 attacks for everyone. Shield Advanced adds cost protection, 24/7 access to the Shield Response Team (SRT), advanced attack diagnostics, health-based detection, and automatic application-layer DDoS mitigation (which deploys WAF rules for you) — for CloudFront, Route 53, Global Accelerator, ALB, NLB, and Elastic IPs. "SRT" or "cost protection" in the question means Shield Advanced; Skill 2.1.2 also names pre-configuring Shield Advanced as incident preparation. Expect 1-2 questions.

CloudFront questions are about restricting access: Origin Access Control so S3 is reachable only through the distribution, custom origin headers verified at the ALB so nobody bypasses CloudFront, signed URLs/cookies for private content, geo restriction, HTTPS enforcement both viewer-side and origin-side, response security headers via response headers policies (Skill 3.1.2's "CloudFront headers"), and field-level encryption. S3 CORS controls which browser origins may call a bucket — a misconfigured wildcard is the exam's favourite CORS flaw. Expect 2-3 questions.

Quick distinctions: Route 53 Resolver DNS Firewall blocks queries to known-bad domains from your VPCs; DNSSEC signing protects public hosted zones from spoofing; AWS IoT Core policies (named in Skill 3.1.2) authorize device MQTT actions per certificate identity — least privilege applies to things too. Usually one distinguishing question.

Know golden-image pipelines with EC2 Image Builder (hardening components, Inspector test stages, automated distribution), IMDSv2 (session-oriented, token via PUT, defends against SSRF credential theft — enforce with HttpTokens=required), and the role taxonomy of Skill 3.2.2: instance profiles for EC2, task roles for ECS, execution roles for Lambda — each scoping least privilege to the workload, never embedded credentials. Never put secrets in user data. Expect 2-3 questions.

Inspector continuously scans EC2 instances (SSM-agent-based or agentless), ECR container images (enhanced scanning on push and continuously), and Lambda functions for CVEs; findings carry a risk score and flow to Security Hub. GuardDuty Runtime Monitoring covers behavioural threats at runtime — the C03 skill statement pairs them deliberately: Inspector finds vulnerabilities, GuardDuty spots active exploitation. Patch Manager closes the loop with baselines, patch groups, and maintenance windows. Expect 2-4 questions.

The modern answer to "SSH/RDP access without exposing ports": Session Manager — no inbound rules, no bastion, no key management, IAM-controlled, and every session can be logged to S3/CloudWatch Logs with KMS encryption. Port forwarding covers RDP and database tunnels. EC2 Instance Connect pushes short-lived SSH keys via IAM but still needs port 22 open. If the question emphasises auditability of interactive access, it is Session Manager. Expect 1-2 questions.

New for C03, Skill 3.2.6: shifting security left into the pipeline. Amazon CodeGuru Security scans code for security vulnerabilities and hardcoded secrets in CI/CD; Amazon Q Developer scans and suggests remediations from the IDE. Know which tool sits where (pipeline scan vs developer assistant) — usually one distinguishing question.

Entirely new for SCS-C03 (Skill 3.2.7). Know the OWASP Top 10 for LLM Applications categories at a recognition level (prompt injection, insecure output handling, sensitive information disclosure, model denial of service) and the AWS controls that map to them: Amazon Bedrock Guardrails (content filters, denied topics, sensitive-information/PII filters, prompt-attack filters), Bedrock's data-privacy posture (prompts and completions are not used to train base models, stay in-Region), IAM and PrivateLink for model access, and CloudWatch/CloudTrail for invocation logging. SageMaker AI notebook and endpoint security rounds it out. Expect 1-2 questions.

Absolute must-know: security groups are stateful, allow-only, instance/ENI-level, and can reference other security groups; NACLs are stateless, ordered allow-and-deny rules, subnet-level, and need ephemeral port ranges for return traffic. To block a specific IP, use a NACL deny (security groups cannot deny). Connection tracking means tightening a security group does not cut established flows. Expect 2-4 questions, plus these concepts embedded everywhere.

Network Firewall is the managed, stateful, Suricata-compatible firewall for when security groups and NACLs are not enough: domain filtering for egress, IDS/IPS signatures, and east/west inspection between VPCs or subnets. Know the deployment model (firewall endpoints in dedicated subnets, routed through via route tables, often centralized behind a Transit Gateway inspection VPC) and stateless vs stateful rule groups. Segmentation questions (Skill 3.3.4) combine isolated subnets, TGW route tables, and Network Firewall for north/south and east/west control. Expect 2-3 questions.

Know the encryption story for each option: Site-to-Site VPN is IPsec-encrypted by default (two tunnels per connection); Direct Connect is private but NOT encrypted — add a VPN over the DX connection for IPsec, or use MACsec for layer 2 encryption on supported dedicated connections. Transit Gateway hubs many VPCs and on-premises links; VPC peering is non-transitive. Expect 1-2 questions.

AWS Verified Access (new in C03) provides VPN-less, zero-trust access to internal applications: every request is evaluated against identity (IAM Identity Center or OIDC) and device-trust signals before reaching the app. For "identify unnecessary network access" (Skill 3.3.5): Network Access Analyzer finds unintended network paths at scale against a scope you define; Inspector's network reachability findings flag instances exposed to the internet; flow log REJECT records confirm what got blocked at runtime. Expect 1-2 questions.

The baseline hygiene the exam assumes everywhere: no long-term access keys where a role would do, MFA on privileged identities (and the aws:MultiFactorAuthPresent condition to enforce it in policies), credential reports to audit key age and MFA status, Access Advisor for last-used services, and locked-down root (no access keys, MFA, used only for root-only tasks). Expect 2-3 questions plus constant background presence.

Roles and STS are the answer to nearly every credential question. Know AssumeRole (cross-account, requires a trust policy AND permission to call sts:AssumeRole), AssumeRoleWithSAML and AssumeRoleWithWebIdentity (federation), external ID to prevent the confused deputy problem with third parties, session duration limits, and how to revoke active sessions (temporary credentials cannot be revoked individually — you invalidate them with a policy condition on TokenIssueTime). S3 presigned URLs, named in Skill 4.1.2, inherit the signer's permissions and expire — a compromised presigned URL is limited by the signing role's session. Expect 2-4 questions.

Map the identity source to the mechanism: corporate workforce at scale across many accounts → IAM Identity Center permission sets (which materialize as roles in each account), with SCIM provisioning from an external IdP; legacy direct federation → SAML 2.0 IdP in IAM; consumer/mobile app users → Cognito; self-managed Active Directory → AWS Managed Microsoft AD or AD Connector. Troubleshooting permission sets (Skill 4.1.3) usually comes down to propagation or the underlying role's policies. Expect 2-3 questions.

Cognito is the "customer-facing application users" answer: user pools authenticate and issue JWTs; identity pools exchange tokens for temporary AWS credentials via STS, with authenticated and unauthenticated roles. C03 names Cognito in both authentication design and troubleshooting skills — know token types (ID vs access vs refresh) and where a misconfigured app client or callback URL breaks the flow. Expect 1-2 questions.

Skill 4.1.3 is its own troubleshooting discipline. CloudTrail records every sign-in and AssumeRole attempt — ConsoleLogin events show MFA use and failure reasons; AccessDenied on sts:AssumeRole means the trust policy, the caller's IAM permission, or a condition (external ID, MFA) failed. Identity Center problems are usually permission-set propagation or attribute mapping from the IdP; Cognito failures are app client settings, callback URLs, or token expiry; Directory Service failures are trust relationships and DNS. Expect 1-2 questions.

The single most important page for this exam is the policy evaluation logic: explicit deny always wins; then SCPs, RCPs, resource-based policies, identity-based policies, permissions boundaries, and session policies combine to determine the allow. Within one account, either an identity-based OR a resource-based policy allow is sufficient; cross-account requires an allow on both sides. Be able to read Principal, NotPrincipal, NotAction, Condition operators, and policy variables. Expect 4-6 questions that hinge on this.

Know the two cross-account patterns: a resource-based policy naming the foreign principal (S3, KMS, SQS, SNS, Lambda, Secrets Manager support them) versus assuming a role in the resource account — and that role trust policies (named in Skill 4.2.1) are themselves resource-based policies on the role. aws:PrincipalOrgID restricts a resource policy to your whole organization in one condition; aws:SourceArn/aws:SourceAccount block the confused deputy for service principals. S3 bucket policy questions are guaranteed. Expect 3-4 questions.

ABAC scales permissions with tags: aws:PrincipalTag matched against resource tags means new projects need no policy changes — the exam contrasts it with RBAC (a role per function, more policies to maintain). Permissions boundaries cap what an identity-based policy can grant — the classic use is safe delegated IAM administration ("developers may create roles but only within this boundary"). Session policies scope down a single assumed-role session. Boundaries and session policies grant nothing on their own — the effective permission is the intersection. Expect 2-3 questions.

Two new C03 name-drops. IAM Roles Anywhere issues temporary AWS credentials to workloads outside AWS that authenticate with X.509 certificates from your CA (registered as a trust anchor) — the answer to "on-premises servers need AWS credentials without long-term keys". Amazon Verified Permissions is fine-grained application-level authorization using the Cedar policy language — authorization inside your app, not for AWS resources. One distinguishing question each at most.

Given an AccessDenied, work the layers in order: explicit deny somewhere (SCP, RCP, boundary, resource policy)? Missing allow (cross-account needs both sides)? Wrong principal or condition? Tools: IAM policy simulator to test policies without executing, CloudTrail errorCode/errorMessage to see the denied call and which policy type denied it, Access Advisor for unused permissions, and IAM Access Analyzer both to find unintended external/unused access (Skill 4.2.5) and to validate policies at author time. Expect 2-3 questions.

Know the enforcement mechanism per service: S3 bucket policy denying aws:SecureTransport false; ALB/NLB TLS listeners with security policies pinning minimum TLS versions (Skill 5.1.1 names ELB security policies explicitly); RDS parameter rds.force_ssl; API Gateway minimum TLS via custom domain security policy; EFS file system policy requiring TLS mounts. ACM supplies the certificates: free public certs, auto-renewing with DNS validation, non-exportable, attachable to ELB/CloudFront/API Gateway — never directly to EC2. Expect 2-4 questions.

"Keep traffic off the public internet" almost always means VPC endpoints. Know gateway endpoints (S3 and DynamoDB only, free, route-table entry) vs interface endpoints (PrivateLink, ENI with private IP, most services, hourly cost); endpoint policies to restrict which principals/resources can be reached; and the bucket-policy pattern aws:SourceVpce to require access through a specific endpoint. AWS Client VPN provides TLS-based remote user access into a VPC; Verified Access is its zero-trust, per-application alternative. Expect 2-3 questions.

New C03 skill, tested at recognition level: EMR security configurations enable in-transit encryption between cluster nodes (TLS certificates you supply); EKS traffic between pods can be encrypted and its API traffic is TLS; SageMaker AI supports inter-container traffic encryption for training jobs; and traffic between Nitro-based instances in the same VPC that supports it is transparently encrypted at the hardware layer. Learn the one-liners and move on.

Non-negotiable knowledge: envelope encryption (KMS encrypts data keys; data keys encrypt data — GenerateDataKey is the API to know); key types (AWS managed vs customer managed vs AWS owned — only customer managed keys give you key policies, rotation control, and grants); symmetric vs asymmetric keys; the 4 KB direct-encrypt limit that forces envelope encryption; and client-side vs server-side encryption selection. KMS keys never leave KMS. Expect 4-6 questions across the exam.

Every KMS key has exactly one key policy, and unlike other resource policies it is mandatory: IAM policies grant nothing on a key unless the key policy enables IAM. Know the default key policy, separating key administrators from key users, grants for temporary programmatic delegation, the kms:ViaService and kms:EncryptionContext conditions, and cross-account key use (key policy allows the external account; that account's IAM policies allow its principals). CloudHSM is the answer when requirements say single-tenant hardware, FIPS 140-2 Level 3, or full key custody — combine with KMS via custom key stores. Expect 3-4 questions.

Know the encryption menu cold: SSE-S3 (default), SSE-KMS (auditable via CloudTrail, key policies apply, bucket keys cut KMS costs), DSSE-KMS, SSE-C (you supply the key per request), and client-side. Enforce with Block Public Access (account-level settings win), bucket policies denying unencrypted puts, Object Ownership disabling ACLs, versioning + MFA delete for recovery, and Object Lock for immutability. Prevent public snapshots and AMIs with the EC2 block-public-access settings. Expect 3-5 questions.

Integrity controls (Skill 5.2.2): S3 Object Lock (governance can be bypassed with s3:BypassGovernanceRetention, compliance cannot — not even by root), Glacier Vault Lock for legacy vaults, versioning against overwrite, checksums/additional checksum algorithms for file validation, and AWS Signer for code signing (Lambda can enforce signed deployment packages). Lifecycle (Skill 5.2.3): S3 Lifecycle transitions and expirations, EFS lifecycle policies to IA storage, FSx for Lustre backup policies, and CloudWatch log group retention. Expect 2-3 questions.

AWS Backup centralizes backup plans, retention, and cross-account/cross-Region copies across EBS, RDS, DynamoDB, EFS and more, with Backup Vault Lock providing WORM protection for recovery points — the ransomware-protection answer, because attackers who can delete your backups own you. Amazon Data Lifecycle Manager automates just EBS snapshots and AMIs; S3 replication copies objects cross-account/cross-Region; DataSync moves file data securely between on-premises and AWS. Expect 1-2 questions.

Service-specific facts the exam tests: EBS encryption is transparent, can be defaulted per Region (encryption by default), and unencrypted volumes cannot be encrypted in place — snapshot, copy-with-encryption, restore. RDS encryption must be set at creation (else snapshot-copy-restore), and read replicas inherit it. DynamoDB is always encrypted at rest (choose AWS owned, AWS managed, or customer managed key). SQS supports SSE-KMS and SSE-SQS; producers need kms:GenerateDataKey on the key. EFS encrypts at file system creation. Expect 2-3 questions.

Secrets Manager is the answer for anything that must rotate: managed rotation for RDS/Redshift/DocumentDB credentials, Lambda-based rotation for everything else, cross-account access via resource policies, KMS encryption of every secret, and replication to other Regions. Versus Parameter Store: rotation and cross-account resource policies are the Secrets Manager differentiators; cost and simple config storage are Parameter Store's (SecureString is KMS-encrypted, but no native rotation). Expect 2-3 questions.

Skills 5.3.2 and 5.3.3 are about key custody. AWS-generated key material: KMS creates and holds it, automatic rotation available, no expiry. Imported key material (BYOK): you generate it, wrap it, and upload — no automatic rotation (re-import under a new key and repoint the alias), you can set expiry or delete the material on demand (instant unusability), and you must keep a copy because AWS cannot recover it. External key stores (XKS) go further: the keys stay in your external HSM and KMS proxies every operation to it. Expect 1-2 questions on these distinctions.

Skill 5.3.5 covers cryptography across Regions: KMS multi-Region keys are related keys with the same key material and key ID suffix, replicated so each Region encrypts/decrypts locally (per-Region key policies still apply) — the answer for cross-Region DR of encrypted data without re-encryption. AWS Private CA issues private certificates for internal TLS and mutual TLS, integrates with ACM for issuance, and supports a CA hierarchy; contrast with public ACM certificates. Expect 1-2 questions.

New for C03 (Skill 5.3.4). CloudWatch Logs data protection policies detect and mask sensitive data (credit cards, keys, PII) in log events as they are ingested — masked for everyone except principals granted logs:Unmask. SNS message data protection does the same for messages in transit through a topic: audit, de-identify (mask/redact), or deny delivery based on data identifiers. Macie remains the at-rest discovery tool for S3. Expect 1-2 questions matching the masking tool to the data path.

SCPs are guardrails on principals in member accounts: they cap maximum permissions (including each member account's root user) but never grant, and they do not affect the management account or service-linked roles. RCPs — new in C03 — are the resource-side twin: organization-wide caps on what resource-based policies can allow (for example, deny S3 access from outside the org regardless of any bucket policy). Also know AI service opt-out policies (stop AWS AI services using your content for improvement) and declarative policies (enforce service baselines like EBS snapshot block-public-access at the org level). Deny-list vs allow-list SCP strategies, OU inheritance, and the canonical deny patterns are guaranteed material. Expect 3-4 questions.

Control Tower is the managed landing zone: it sets up Organizations, log archive and audit accounts, Account Factory for provisioning, and controls — preventive (SCP-implemented), detective (Config-implemented), and proactive (CloudFormation-hook-implemented). Know mandatory vs strongly recommended vs elective controls, custom controls, drift detection for manual changes, and enrolling existing organizations (Skill 6.1.2 says "new and existing environments" — conflicting Config recorders and CloudTrail setups are the classic obstacle). Expect 1-2 questions.

The reference pattern: a dedicated security tooling account is the delegated administrator for GuardDuty, Security Hub, Macie, Inspector, Detective, Config, and Firewall Manager; findings aggregate there (plus cross-Region aggregation in Security Hub and Config aggregators for configuration data); logs centralize in a separate log archive account. Delegated administration keeps day-to-day security operations out of the management account. Expect 1-2 questions.

Skill 6.1.5 got a dedicated upgrade in C03. Know root user best practices (no access keys, hardware MFA, use only for root-only tasks), centralized root access — an IAM/Organizations capability that removes root credentials from member accounts entirely and lets the management account perform the few privileged root actions centrally — and break-glass design: a pre-provisioned emergency role or account with monitored, alarmed usage (CloudTrail metric filter on root or break-glass activity). Expect 1-2 questions.

Security-flavoured CloudFormation: StackSets for multi-account rollout, drift detection for console changes that diverged from the template, stack policies to protect resources during updates, service roles so users deploy with the role's permissions instead of their own, and dynamic references to pull secrets from Secrets Manager/Parameter Store instead of hardcoding. Pre-deployment validation is the C03 twist: cfn-lint checks template syntax and best practices; CloudFormation Guard evaluates policy-as-code rules ("no security group open to the world") before anything deploys. Expect 1-2 questions.

Firewall Manager centrally deploys and enforces WAF web ACLs, Shield Advanced protections, security groups, Network Firewall, and DNS Firewall policies across all accounts in an organization — including resources created in the future. Prerequisites the exam loves: AWS Organizations with all features, a designated administrator account, and AWS Config enabled. "New accounts must automatically get the WAF rules" is the Firewall Manager trigger phrase. Expect 1-2 questions.

One-line distinctions: Service Catalog lets end users launch pre-approved, pre-hardened products without holding the underlying permissions (launch constraints use a role); AWS RAM shares resources (subnets, TGWs, Route 53 rules) across accounts without duplicating them; tag policies in Organizations standardize tag keys/values; resource groups collect resources by tag for management by department, cost center, or environment. Expect 1-2 quick questions.

Config records resource configuration history and evaluates it against rules (managed or custom Lambda/Guard), with optional automatic remediation through SSM Automation and notifications through EventBridge/SNS. Know the trigger types (configuration change vs periodic), conformance packs for rule bundles, aggregators for org-wide views, and the split the exam loves: Config answers "is this resource configured correctly and who changed it", CloudTrail answers "who called what API", GuardDuty answers "is something attacking us". Expect 3-4 questions.

Two easily confused services: AWS Artifact is where you download AWS's own compliance reports (SOC, PCI, ISO) and sign agreements — evidence about AWS. Audit Manager continuously collects evidence about your usage against frameworks (CIS, PCI DSS, custom) into assessment reports — evidence about you. Security Hub findings and Config snapshots feed Audit Manager assessments. One distinguishing question.

The Well-Architected Tool runs structured reviews of workloads against the framework pillars and surfaces high-risk issues — Skill 6.3.3's "evaluate architecture for compliance with best practices". Trusted Advisor's security checks (public snapshots, open security groups, IAM use, MFA on root, S3 bucket permissions) are the quick wins; full checks need Business/Enterprise Support. Both surface findings toward remediation rather than performing it. Expect 1-2 questions.