SCS-C03 syllabus: every exam domain and topic

Threat detection and monitoring

16%

Watching accounts and workloads, collecting the right logs, analysing them and fixing monitoring that doesn't work.

Monitoring and alerting

Working out what to monitor for a given workload
Resource health checks, alarms and monitoring strategies
Aggregating security events across accounts and Regions
Metrics, alerts and dashboards for anomalies using GuardDuty, Security Lake, Security Hub and Macie
Automated assessments with Config conformance packs, Security Hub and Systems Manager State Manager

Logging solutions

Choosing log sources and storage for the requirements
Configuring logging: organization CloudTrail, a dedicated CloudWatch logging account, the CloudWatch agent
Log storage and data lakes with Security Lake, and feeding third-party tools
Analysing logs with CloudWatch Logs Insights, Athena and Security Hub findings
Normalising, parsing and correlating logs with OpenSearch Service, Lambda and Managed Grafana
Network log sources: VPC Flow Logs, transit gateway flow logs, Route 53 Resolver query logs

Troubleshooting monitoring

Checking permissions and configuration for Lambda, API Gateway and CloudFront logging and health checks
Fixing CloudWatch agent configuration and missing logs

14%

Preparing for incidents, testing the plan, and containing, investigating and recovering when something goes wrong.

Response plans and preparation

Response plans and runbooks with Systems Manager OpsCenter and notebooks
Preparing accounts: access for responders, deployed security tools, small blast radius, Shield Advanced
Testing the plan with Fault Injection Service and Resilience Hub
Automatic remediation with Systems Manager, the Automated Forensics Orchestrator, Step Functions, Application Recovery Controller and Lambda

Responding to events

Capturing logs and system data as forensic evidence
Searching and correlating logs across services and applications
Validating findings to judge scope and impact
Containment, eradication and recovery: network isolation, credential revocation, restoring backups
Root cause analysis with Amazon Detective

18%

Protecting the edge, hardening compute and its pipeline, and controlling network traffic.

20%

Authenticating people, applications and systems, and getting authorisation exactly right. The largest domain.

Authentication

Identity solutions for people and systems: IAM Identity Center, Cognito, MFA, IdP integration
Temporary credentials with STS and S3 presigned URLs
Troubleshooting sign-in with CloudTrail, Cognito, permission sets and Directory Service

Authorisation design

Authorisation controls: Verified Permissions, IAM paths, Roles Anywhere, cross-account resource policies, trust policies
Role-based and attribute-based access control with tags
Least-privilege policies with permission boundaries and session policies

Troubleshooting authorisation

18%

Encrypting data in transit and at rest, keeping it intact and recoverable, and protecting secrets and keys.

14%

Managing many accounts centrally, deploying resources consistently and proving compliance.