About This Guide
This practice guide distills 50+ exam-style scenarios into key concept cards organized by SCS-C03 domain. Each card covers the scenario theme, the core AWS concept being tested, a concise explanation, and the AWS services involved.
Use this alongside the main study guide to reinforce your understanding of how concepts appear in exam questions.
SCS-C03 Exam Structure
| Domain | Weight | Focus Areas |
|---|---|---|
| 1. Threat Detection & Incident Response | 14% | GuardDuty, Detective, incident workflows, forensics |
| 2. Security Logging & Monitoring | 18% | CloudTrail, CloudWatch, Config, log analysis |
| 3. Infrastructure Security | 20% | VPC, WAF, Shield, NACLs, Security Groups, firewalls |
| 4. Identity & Access Management | 16% | IAM policies, roles, federation, SCPs, ABAC |
| 5. Data Protection | 32% | KMS, encryption, S3 security, Secrets Manager, ACM |
Data Protection is 32% of the exam — spend the most time here. KMS key policies, S3 encryption enforcement, and Secrets Manager rotation are heavily tested.
Questions often test whether you know the correct combination of services, not just individual service features.
How to Use This Guide
- Read the scenario — understand what the question is really asking
- Study the key concept — this is the core knowledge being tested
- Review the explanation — understand why this is the correct approach
- Note the services — build mental maps of which services solve which problems
Backdoor:EC2/C&CActivity.B). When a finding fires, use EventBridge to trigger a Lambda function that invokes SSM Inventory collection on the flagged instance, gathering installed packages, running processes, and network connections for forensic analysis.~/.ssh/authorized_keys file to add a new public key. Unmount and detach the volume, reattach it as the root volume of the original instance, and start it. Alternatively, use EC2 Instance Connect or SSM Session Manager which don't require key pairs at all.Isolate, don't terminate: The correct IR response for EC2 is always to isolate (change SG) and snapshot, never terminate.
GuardDuty is regional: It must be enabled per-region. Use Organizations delegated admin for centralized management.
Disable, don't delete compromised access keys — deleting removes the key ID needed for CloudTrail investigation.
Detective vs. GuardDuty: GuardDuty detects threats; Detective investigates them with behavior graphs.
filter, stats, sort, and parse. Example: filter @message like /UnauthorizedAccess/ | stats count(*) by sourceIPAddress. It automatically discovers fields in JSON logs. Queries run against one or more log groups and return results in seconds even over large datasets.$context.identity.sourceIp, $context.requestTime, $context.status. Route logs to CloudWatch and query with Logs Insights to identify suspicious patterns, top callers, and error rates.awslogs or awsfirelens log driver. Use a Kinesis Data Analytics application or Lambda consumer to process logs in real-time, applying security rules and alerting on suspicious patterns. For archival, use Kinesis Data Firehose to deliver to S3. This architecture provides sub-second detection latency compared to polling-based approaches.aws kms get-key-rotation-status to check if rotation is enabled for each key. CloudTrail logs the RotateKey event when automatic rotation occurs. Automatic rotation generates new key material every year (configurable 90-2560 days) while keeping the same key ID — previously encrypted data doesn't need re-encryption. Use AWS Config rule cmk-backing-key-rotation-enabled for continuous compliance checking. Note: AWS managed keys rotate automatically every year and cannot be configured.ScheduleKeyDeletion API event. KMS requires a mandatory waiting period of 7-30 days before deletion, giving time to respond. The EventBridge rule can trigger SNS for immediate notification and Lambda for automated response (e.g., canceling the deletion with CancelKeyDeletion, or alerting the security team). Also monitor DisableKey events as disabled keys can't encrypt/decrypt.restricted-ssh which checks that security groups don't allow unrestricted SSH access. Config continuously evaluates resources against rules and marks them as COMPLIANT or NON_COMPLIANT. For automated remediation, pair with Config remediation actions using SSM Automation documents to automatically remove the offending inbound rule. Config also provides a compliance timeline showing when resources became non-compliant.vpc-id, tcp-flags, pkt-srcaddr. Note: Flow Logs do NOT capture packet content — use VPC Traffic Mirroring for that.errorCode = "AccessDenied"), root account usage (userIdentity.type = "Root"), console sign-in failures, IAM policy changes, and VPC changes. Each metric filter feeds a CloudWatch Alarm that triggers SNS notifications. This is a core CIS AWS Foundations Benchmark requirement. Security Hub automates these checks with its CIS standard.CloudTrail vs. Config: CloudTrail logs who did what (API calls). Config tracks what changed (resource configuration over time).
Real-time = Kinesis: When a question says "real-time" log processing, think Kinesis Data Streams. CloudWatch Logs has near-real-time but not true real-time processing.
Athena for historical: For queries beyond 90 days, always use Athena against CloudTrail S3 logs.
Flow Logs ≠ packet capture: VPC Flow Logs capture metadata only. Use Traffic Mirroring for actual packet content.
s3:GetObject only from the CloudFront distribution using a condition on AWS:SourceArn. Remove any public access on the bucket. OAC supports SSE-KMS encrypted objects (OAI does not). Block public access via S3 Block Public Access settings.| Feature | NACL | Security Group |
|---|---|---|
| Level | Subnet | Instance (ENI) |
| Deny rules | Yes | No (allow only) |
| Statefulness | Stateless | Stateful |
| Rule evaluation | Number order | All rules evaluated |
| Default | Custom: deny all | Deny all inbound, allow all outbound |
AmazonSSMManagedInstanceCore policy and outbound connectivity to SSM endpoints (or VPC endpoint).Block IPs = NACL: Only NACLs can explicitly deny traffic. Security groups are allow-only.
No SSH keys = Session Manager: When the question mentions eliminating SSH key management or bastion hosts, Session Manager is the answer.
OAC over OAI: For CloudFront + S3, OAC is the modern approach and supports SSE-KMS.
Encryption over Direct Connect: Direct Connect alone is private but NOT encrypted. Add VPN for encryption.
Gateway vs Interface endpoints: Gateway = S3 and DynamoDB only (free). Interface = everything else (paid, uses ENI).
dynamodb:GetItem) on the specific table ARN. Use aws/lambda resource-based policy for invocation permissions."Principal": {"AWS": "arn:aws:iam::ACCOUNT-B:root"}). 2) A permissions policy granting S3 read access. In Account B, grant the application's role permission to call sts:AssumeRole on the cross-account role ARN. The application calls AssumeRole to get temporary credentials. This is more secure than sharing access keys and allows fine-grained control with external ID conditions."aws:RequestedRegion": ["us-east-1", "eu-west-1"]. When developers create roles, require them to attach this permission boundary. The roles they create can never exceed the boundary's permissions, preventing privilege escalation."Condition": {"StringEquals": {"aws:ResourceTag/Project": "${aws:PrincipalTag/Project}"}}. Tag IAM users and Secrets Manager secrets with a Project tag. New teams or secrets automatically inherit the right permissions based on tags — no policy updates needed. ABAC scales better than RBAC for dynamic environments.update-saml-provider). 3) The SAML provider in IAM can hold multiple certificates during rotation. 4) Update the IdP to use the new certificate. AWS supports SAML 2.0 for both console access (via federation endpoint) and API access (via AssumeRoleWithSAML).Never hard-code keys: If a question mentions embedded credentials, the answer involves IAM roles (execution roles, instance profiles, task roles).
Explicit deny always wins: In any policy evaluation question, look for explicit denies first — they override everything.
ABAC = tags, RBAC = policies: When scaling access control for many teams/projects, ABAC with tags scales better.
Permission boundary ≠ permissions: Boundaries set the maximum; the user still needs identity-based policies to grant actual access.
kms:ViaService condition key restricts KMS key usage to requests that come from a specific AWS service. Example: "Condition": {"StringEquals": {"kms:ViaService": "s3.us-east-1.amazonaws.com"}}. This means the key can ONLY be used when S3 makes the encryption/decryption call on behalf of the user. Direct kms:Encrypt or kms:Decrypt API calls will be denied. Useful for enforcing that keys are only used for their intended purpose.PutObject if the s3:x-amz-server-side-encryption header is not aws:kms or if s3:x-amz-server-side-encryption-aws-kms-key-id doesn't match the required key ARN. 2) Default encryption: Set the bucket's default encryption to SSE-KMS with the specific key. Note: default encryption applies only when the request doesn't specify encryption — the bucket policy deny is needed to enforce it. Both together provide defense in depth.| Feature | Governance Mode | Compliance Mode |
|---|---|---|
| Override possible? | Yes, with s3:BypassGovernanceRetention | No one, not even root |
| Retention can be shortened? | Yes, with permission | No, never |
| Use case | Testing, soft protection | Regulatory compliance (HIPAA, SEC) |
| Delete during retention? | With permission | Impossible |
kms:DescribeKey, kms:CreateGrant, kms:ReEncrypt*, kms:Decrypt). 2) Share the snapshot with Account B via ModifySnapshotAttribute. 3) In Account B, copy the snapshot re-encrypting with a KMS key owned by Account B. 4) Create volumes from the re-encrypted snapshot. Note: AWS managed keys (aws/ebs) cannot be shared cross-account — only customer managed keys (CMKs).GetSecretValue API, which always returns the current version. Secrets are encrypted with KMS.secrets section, and ECS injects the secret value as an environment variable at container startup. The ECS task execution role needs secretsmanager:GetSecretValue and KMS kms:Decrypt permissions. The task role (different from execution role) grants the container's runtime permissions. Never store secrets in container images, Dockerfiles, or task definition environment variables in plaintext.kms:Decrypt. 5) Key is in a different region than the resource. Check CloudTrail for KMS API errors to identify the exact cause.| Feature | KMS | CloudHSM |
|---|---|---|
| FIPS validation | Level 2 (some Level 3) | Level 3 |
| Key control | Shared (AWS manages HSM) | Full customer control |
| Multi-tenant | Yes | Single-tenant (dedicated HSM) |
| Pricing | Per-request | Per-hour per HSM |
| Integration | Native with all AWS services | Custom via PKCS#11, JCE, OpenSSL |
| HA | Built-in | Must deploy across AZs |
PutObject without the correct encryption header. Use AWS Config rule s3-bucket-server-side-encryption-enabled to monitor compliance. SSE-C (customer-provided keys) requires the customer to manage key material and provide it with every request.ACM + CloudFront = us-east-1: This is the most commonly tested ACM fact. Always us-east-1 for CloudFront certificates.
Can't encrypt existing RDS: Snapshot → Copy (encrypt) → Restore is the only path.
Compliance Mode = immutable: No one, not even root, can delete objects in Compliance Mode. Governance Mode can be overridden.
AWS managed keys can't be shared: For cross-account encryption, you must use customer managed keys (CMKs).
kms:ViaService: Locks a key to a specific service — prevents direct API use.
Secrets Manager vs. Parameter Store: Secrets Manager has built-in rotation. Parameter Store is simpler and cheaper but requires custom Lambda for rotation.
Threat Detection Services
| Service | What It Does | Key Fact |
|---|---|---|
| GuardDuty | Threat detection from CloudTrail, VPC Flow Logs, DNS | Regional; must enable per-region |
| Detective | Investigate findings with behavior graphs | 12-month data retention |
| Security Hub | Aggregates findings, compliance checks | Uses ASFF format; delegated admin |
| Inspector | Vulnerability scanning for EC2/ECR/Lambda | Agentless for ECR; SSM agent for EC2 |
| Macie | PII discovery in S3 | ML-based classification |
Logging & Monitoring Services
| Service | What It Does | Key Fact |
|---|---|---|
| CloudTrail | API call logging | 90 days in Event History; S3 for longer |
| CloudWatch Logs | Log aggregation and analysis | Logs Insights for queries |
| AWS Config | Resource configuration tracking | Managed rules for compliance |
| VPC Flow Logs | Network traffic metadata | No packet content; metadata only |
| EventBridge | Event routing and automation | Near real-time; pattern matching |
Infrastructure Security Services
| Service | What It Does | Key Fact |
|---|---|---|
| WAF | Layer 7 web application firewall | Rate-based rules for DDoS |
| Shield Standard | Free Layer 3/4 DDoS protection | Automatic, always-on |
| Shield Advanced | Enhanced DDoS + DRT + cost protection | $3,000/month; includes WAF |
| Network Firewall | VPC stateful inspection, IPS | Suricata-compatible rules |
| Firewall Manager | Centralized firewall rule management | Requires Organizations + Config |
Identity & Access Services
| Service | What It Does | Key Fact |
|---|---|---|
| IAM | Users, roles, policies, groups | Explicit deny always wins |
| STS | Temporary credentials | AssumeRole for cross-account |
| Organizations + SCPs | Multi-account management, guardrails | SCPs affect all users including root |
| IAM Access Analyzer | External access detection, policy generation | Uses CloudTrail for policy generation |
| Cognito | User authentication for apps | User Pools = auth; Identity Pools = AWS creds |
Data Protection Services
| Service | What It Does | Key Fact |
|---|---|---|
| KMS | Key management, encryption | FIPS 140-2 Level 2; kms:ViaService condition |
| CloudHSM | Dedicated HSM, full key control | FIPS 140-2 Level 3; single-tenant |
| ACM | SSL/TLS certificate management | CloudFront = us-east-1 only |
| Secrets Manager | Secret storage with rotation | Native RDS rotation; encrypted with KMS |
| S3 Object Lock | WORM storage | Compliance mode = no one can delete |
Common Service Comparisons
Secrets Manager vs. Systems Manager Parameter Store
| Feature | Secrets Manager | Parameter Store |
|---|---|---|
| Built-in rotation | Yes (native RDS) | No (custom Lambda) |
| Cost | $0.40/secret/month | Standard: Free |
| Cross-account | Yes (resource policy) | No |
| Max size | 64 KB | 8 KB (standard) / 8 KB (advanced) |
NACL vs. Security Group
| Feature | NACL | Security Group |
|---|---|---|
| Level | Subnet | Instance ENI |
| State | Stateless | Stateful |
| Deny rules | Yes | No |
| Rule order | Numbered (lowest first) | All evaluated |
| IP blocking | Yes | No |
S3 Object Lock: Governance vs. Compliance
| Feature | Governance Mode | Compliance Mode |
|---|---|---|
| Override | With s3:BypassGovernanceRetention | No one |
| Root can delete? | With permission | No |
| Shorten retention? | Yes | No |
| Use case | Testing, internal policy | Regulatory (HIPAA, SEC 17a-4) |
KMS Key Types
| Type | Management | Cross-Account | Rotation |
|---|---|---|---|
| AWS Owned | AWS (invisible) | N/A | Varies |
| AWS Managed | AWS (visible) | No | Every year (automatic) |
| Customer Managed | Customer | Yes | Configurable (90-2560 days) |
Read carefully: Exam questions often have 2-3 plausible answers. Look for the one that is MOST secure, LEAST operational overhead, or MOST cost-effective based on what the question asks.
Service combinations: Many correct answers involve 2-3 services working together. Understand how services integrate.
Eliminate distractors: If an option suggests a manual process when an automated AWS service exists, it's usually wrong.
Region awareness: Many services are regional. Know which ones are global (IAM, CloudFront, Route 53, WAF for CloudFront).