AWS Certified Security Specialty SCS-C02

Specialty SCS-C02

AWS Certified Security – Specialty validates expertise in creating and implementing security solutions in the AWS Cloud. It tests deep knowledge of incident response, logging, infrastructure security, identity management, and data protection at expert level.

AWS GuardDuty AWS WAF AWS Shield AWS KMS Amazon Cognito CloudTrail Security Hub AWS IAM Secrets Manager Amazon Macie

Exam Domains

Six AWS Security Specialty Domains

SCS-C02 tests deep AWS security expertise across threat detection, logging, infrastructure, identity, data protection, and governance.

Domain 01

Threat Detection & Incident Response

14%

exam weight

›AWS GuardDuty threat intelligence — finding types, suppression rules, and custom threat lists
›Amazon Detective for graph-based security investigation and root cause analysis
›Security incident response — isolate, investigate, eradicate, and recover (PICERL)
›AWS Security Finding Format (ASFF) for standardized findings across services
›EventBridge rules for automated incident response and Lambda-based remediation

Domain 02

Security Logging & Monitoring

18%

exam weight

›AWS CloudTrail — management and data events, organization trails, log file integrity
›Amazon CloudWatch — metric filters, alarms, dashboards, and anomaly detection
›VPC Flow Logs, DNS query logs, and S3 server access logs configuration
›CloudWatch Logs Insights for threat hunting and security event analysis
›AWS Config rules for continuous compliance evaluation and non-compliant notifications

Domain 03

Infrastructure Security

20%

exam weight

›VPC security — security groups, NACLs, Network Firewall, and Gateway Load Balancer
›AWS WAF — web ACLs, managed rule groups, rate limiting, and Bot Control
›AWS Shield Standard and Shield Advanced for DDoS protection and attack mitigation
›Compute security — EC2 Image Builder, Inspector, patch management, and IMDSv2
›Edge security — CloudFront signed URLs, Origin Access Control, and field-level encryption

Domain 04

Identity & Access Management

16%

exam weight

›IAM policy types — identity-based, resource-based, session, and permission boundaries
›Amazon Cognito — user pools, identity pools, JWT tokens, and social federation
›IAM Identity Center (SSO) — permission sets, attribute-based access, and SCIM provisioning
›AWS STS temporary credentials — AssumeRole, AssumeRoleWithWebIdentity, federation
›Troubleshoot IAM — Access Advisor, policy simulator, and CloudTrail event analysis

Domain 05

Data Protection

18%

exam weight

›AWS KMS — CMK types, key policies, grants, key rotation, and cross-account usage
›Envelope encryption — data key generation, caching, and client-side encryption patterns
›AWS Secrets Manager — automatic rotation, cross-service access, and secret versioning
›Amazon Macie — sensitive data discovery, findings, and S3 classification jobs
›S3 security — Object Lock (WORM), MFA Delete, and replication with encryption

Domain 06

Management & Security Governance

14%

exam weight

›AWS Organizations SCPs — deny-list vs allow-list strategies and OU inheritance
›AWS Control Tower guardrails — preventive (SCPs) and detective (Config Rules)
›AWS Config conformance packs and AWS Security Hub security standards (CIS, PCI DSS)
›Data classification strategies and AWS services for regulatory compliance
›AWS Well-Architected Security Pillar — design principles and best practice review

Why SCS-C02

The Definitive AWS Security Certification

Cloud security is the top enterprise priority. SCS-C02 validates expert-level AWS security skills — from threat hunting and incident response to data protection and multi-account governance.

Specialty Tier — Cloud Security Expertise

SCS-C02 requires security experience on AWS. It is the go-to credential for cloud security engineers, security architects, and GRC professionals defending enterprise AWS environments.

Threats Are Constant and Evolving

GuardDuty, Detective, and Security Hub provide continuous threat detection. SCS-C02 proves you can configure, tune, and respond to security findings at enterprise scale.

Logging Is the Foundation of Security

CloudTrail, VPC Flow Logs, and CloudWatch Logs Insights are your audit trail. SCS-C02 tests your ability to design logging architectures and perform forensic analysis.

KMS Is Everywhere

Encryption with KMS is tested across S3, RDS, Lambda, EBS, and Secrets Manager. SCS-C02 validates deep understanding of key hierarchy, rotation, and cross-account access.

Zero Trust Starts with IAM

Permission boundaries, SCPs, session policies, and resource-based policies together form the zero-trust perimeter. SCS-C02 ensures you master every IAM control plane.

Security Roles Command Premium Pay

Cloud security engineers and architects are among the highest-paid professionals in IT. SCS-C02 qualifies you for security lead, CISO advisory, and compliance roles.

Curriculum

16-Topic SCS-C02 Programme

Expert AWS security curriculum covering incident response, logging, infrastructure security, IAM, data protection, and governance.

AWS best practices for cloud incident response — PICERL framework
GuardDuty finding types — reconnaissance, instance compromise, and data exfiltration
Roles and responsibilities in the AWS incident response plan
AWS Security Finding Format (ASFF) and Security Hub aggregation
Automated response — EventBridge, Lambda, and Systems Manager for containment

AWS GuardDuty — threat intelligence, ML models, custom threat lists, and suppression
Amazon Detective — behavior graphs, finding groups, and investigation workflows
Anomaly correlation across CloudTrail, VPC Flow Logs, and DNS logs
Strategies to centralize findings — Security Hub standards and cross-account aggregation
CloudWatch anomaly detection for baseline deviation alerting

AWS Security Incident Response Guide — isolation and forensic preservation
EC2 instance isolation — security group changes, snapshot preservation, memory capture
S3 forensics — object versioning, access log analysis, and data exfiltration investigation
IAM credential compromise — credential rotation, CloudTrail review, and access revocation
Post-incident — eradication, recovery, and lessons-learned documentation

CloudWatch metric filters for security events — failed logins, root activity, and policy changes
Amazon EventBridge rules for automated alerting and remediation workflows
AWS Security Hub custom insights and automated findings correlation
GuardDuty severity-based routing to SNS, PagerDuty, and ticketing systems
CloudTrail Insights for unusual API call patterns and anomalous management events

Security Hub standard configuration — CIS AWS Foundations, PCI DSS, and AWS Best Practices
Diagnose missing CloudTrail logs — trail status, S3 bucket policy, and delivery failures
CloudWatch Logs agent configuration and log stream troubleshooting
GuardDuty false positive management — trusted IP lists and suppression rules
Config recorder status, delivery channel errors, and rule evaluation delays

CloudTrail organisation trails — management events, data events, and Insights events
VPC Flow Logs — format, traffic types, and integration with CloudWatch and S3
DNS query logging with Route 53 Resolver and integration with Security Lake
Amazon Security Lake for centralised log aggregation using OCSF format
Log retention policies — S3 lifecycle, Glacier, and compliance-driven retention requirements

CloudTrail — missing events, S3 delivery failures, and CloudWatch Logs integration
VPC Flow Logs — log record format, fields, and accepted vs rejected traffic
S3 server access logging vs CloudTrail data events — scope and use case differences
IAM permissions for logging services — roles, bucket policies, and KMS key access
Log immutability — CloudTrail log file validation and S3 Object Lock for WORM compliance

CloudWatch Logs Insights query language — filter, stats, parse, and sort commands
Amazon Athena for ad hoc SQL queries on CloudTrail and VPC Flow Log data in S3
Security Hub insights for cross-account finding aggregation and trend analysis
Amazon OpenSearch Service for real-time log analysis and SIEM integration
Log format parsing — CloudTrail JSON, VPC Flow Logs, and ALB access log patterns

AWS WAF — web ACLs, managed rule groups (AMR), rate-based rules, and Bot Control
AWS Shield Standard vs Advanced — DDoS protection tiers and cost protection
CloudFront security — signed URLs, signed cookies, OAC, and field-level encryption
Route 53 DNSSEC and query logging for DNS security monitoring
OWASP Top 10 mitigations using WAF — SQLi, XSS, path traversal, and RCE rules

VPC security groups — stateful rules, inbound/outbound, and security group referencing
Network ACLs — stateless rules, ephemeral ports, and subnet-level controls
AWS Network Firewall — stateful and stateless rule groups, domain filtering, IPS
Inter-VPC security — Transit Gateway route tables, security group referencing across VPCs
VPC Reachability Analyzer and Network Access Analyzer for security validation

EC2 Image Builder — golden images, vulnerability scanning, and patching pipelines
Amazon Inspector — EC2 and container vulnerability scanning, finding severity levels
IAM instance profiles vs IAM service roles — scope and credential delivery
IMDSv2 enforcement — token-based instance metadata for SSRF protection
ECS/EKS security — task roles, secrets injection, network policies, and image scanning

VPC Reachability Analyzer — path analysis for connectivity and access issues
TCP/IP fundamentals — ports, protocols, OSI model, and stateful vs stateless filtering
Interpret VPC Flow Logs — ACCEPT vs REJECT, source/destination IP, and port analysis
WAF ACL logging — allow, block, and count actions with full request details
Route 53 Resolver DNS Firewall for blocking malicious domain resolution

IAM Identity Center — permission sets, account assignments, and SCIM provisioning
Amazon Cognito — user pool configuration, hosted UI, MFA, and custom auth flows
AWS STS — AssumeRole, federation with SAML/OIDC, and temporary credential use
Long-term vs temporary credentials — root key deprecation and role-based access
Troubleshoot auth failures — CloudTrail ConsoleLogin, AssumeRole, and error codes

IAM policy evaluation logic — explicit deny, SCPs, permission boundaries, and session policies
Resource-based policies — S3, KMS, Lambda, SNS, and SQS resource policy design
Service control policies (SCPs) — deny-list and allow-list strategies across OUs
Attribute-based access control (ABAC) — IAM tags for dynamic permissions
IAM Access Analyzer — external and internal finding types and policy generation

AWS KMS — symmetric vs asymmetric keys, envelope encryption, and data key caching
S3 encryption modes — SSE-S3, SSE-KMS, SSE-C, and client-side encryption
RDS and EBS encryption — at-rest encryption, snapshot sharing, and KMS integration
TLS certificates — ACM, private CA, and mutual TLS (mTLS) for API authentication
Secrets Manager — automatic rotation, cross-account access, and Lambda rotation functions

AWS Organizations SCPs — service restriction, region restriction, and guardrail patterns
AWS Control Tower — preventive guardrails (SCPs) and detective guardrails (Config Rules)
AWS Config conformance packs — CIS, PCI DSS, HIPAA, and custom compliance frameworks
AWS Security Hub — multi-account aggregation, findings workflow, and custom actions
AWS Well-Architected Security Pillar — design principles, shared responsibility, and review

Course Snapshot

16 Topics

Full SCS-C02 domains

41+ Hours

Total learning time

Specialty Cert

Security expert level

Tech Support

Call / WhatsApp

Mon–Fri

9 AM – 6 PM

Enroll Now Download Brochure

Have Questions?

Chat with our AWS Security certified trainers instantly.

WhatsApp Us

SCS-C02 Careers in Cloud Security

Cloud security specialists are in extreme demand. SCS-C02 qualifies you for security engineering, architecture, and GRC roles commanding the highest compensation in cloud.

Infosys

Security Eng.

TCS

Cloud SecOps

Wipro

IAM Architect

Accenture

Security Lead

Security

Specialty SCS-C02

Six AWS Security Specialty Domains

The Definitive AWS Security Certification

16-Topic SCS-C02 Programme

Get a Custom Quotation

SCS-C02 Careers in Cloud Security

Ready to Master AWS Cloud Security?