SCS-C03 study notes
- Threat detection and monitoring SCS-C03 notes on GuardDuty, Security Hub, Macie, Detective, Security Lake, CloudTrail, CloudWatch Logs, Athena, OpenSearch, VPC Flow Logs, Route 53 Resolver logs, Config conformance packs and troubleshooting missing logs. 16%
- Incident response SCS-C03 notes on incident response plans and runbooks, preparation and blast radius, testing with Fault Injection Service, automated remediation, forensics, containment of EC2, IAM and S3 incidents, and Amazon Detective root cause analysis. 14%
- Infrastructure security SCS-C03 notes on edge protection (CloudFront, WAF, Shield, CORS, IoT policies), compute hardening (AMIs, Image Builder, Inspector, Patch Manager, Session Manager), pipeline scanning, generative AI guardrails, security groups, NACLs, Network Firewall, hybrid connectivity and segmentation. 18%
- Identity and access management SCS-C03 notes on IAM Identity Center, Cognito, federation, MFA, STS and presigned URLs, policy evaluation logic, resource policies, trust policies, ABAC, permission boundaries, session policies, Verified Permissions, Roles Anywhere, Access Analyzer and troubleshooting access. 20%
- Data protection SCS-C03 notes on TLS and ELB security policies, VPC endpoints and PrivateLink, Client VPN, inter-node encryption, KMS and CloudHSM, imported key material and external key stores, S3 encryption and Object Lock, backups and ransomware protection, Secrets Manager, data masking and AWS Private CA. 18%
- Security foundations and governance SCS-C03 notes on AWS Organizations, Control Tower, SCPs, RCPs, declarative policies, delegated administrators, root access management, CloudFormation StackSets and Guard, tagging, Firewall Manager, RAM, Service Catalog, Config, Audit Manager, Artifact and Well-Architected. 14%