AWS Certified Security Specialty Exam Study Guide [SCS-C01]
You can access SCS-C01 Exam AWS official page here
Preparing for the AWS Certified Security Specialty (SCS-C01) exam? Don’t know where to start? This post is the AWS Certified Security Specialty Certificate Study Guide (with links to each objective in the exam domain).
I have curated a detailed list of articles from AWS documentation and other blogs for each objective of the AWS Certified Security Specialty (SCS-C01) exam. Please share the post within your circles so it helps them to prepare for the exam.
Skills Measured
- Incident Response – 12%
- Logging and Monitoring – 20%
- Infrastructure Security – 26%
- Identity and Access Management – 20%
- Data Protection – 22%
SCS-C01 Exam Free Study Guide
For each test objective, I’ve compiled a thorough collection of articles from Microsoft documentation. Please feel free to forward this page to your friends and coworkers in order to assist them in preparing for the test .
Incident Response - 12%
Given an AWS Abuse Notice, Evaluate the Suspected Compromised Instance or Exposed Access Keys
Verify That the Incident Response Plan Includes Relevant AWS Services
Evaluate the Configuration of Automated Alerting, and Execute Possible Remediation of Security-related Incidents and Emerging Issues
- Automate alerting:
- 1. Automate notifications when AMI permissions are updated
- 2. Automate AWS Security Hub Alerts
- Automate remediation steps:
- 1. YouTube video on Automating Incident Response
- 2. Automate Remediation with AWS Security Hub
- 3. Automate processes for remediating AWS Abuse alerts
- 4. Automatically remediate unintended permissions in AWS S3 Object ACLs
- 5. Automate remediation actions for Amazon EC2 notifications
- 6. Remediate Amazon Inspector Security Findings Automatically
- 7. Remediating Security Issues Discovered by GuardDuty
Logging and Monitoring - 20%
Design and Implement Security Monitoring and Alerting
- Implement security monitoring with Amazon GuardDuty:
- 1. Continuously monitor security & threat detection
- 2. What Amazon GuardDuty can detect?
- 3. Threat Response Scenarios Using Amazon GuardDuty
- Other tools for monitoring security & implementing alerts:
- 1. Amazon Inspector: An automated Security Assessment Service
- 2. AWS Config: Continuously monitor & record the AWS resource configurations
- 3. Amazon CloudWatch Events: Describe changes in AWS resources
- 4. Amazon CloudWatch Logs: Monitor, store & access log files
- 5. Configure Amazon S3 event notifications
- 6. AWS CloudTrail: Records actions in your AWS account
Troubleshoot Security Monitoring and Alerting
Design and Implement a Logging Solution
- Review the whitepaper on Logging in AWS
- Demo: AWS CloudTrail Logging
- Amazon CloudWatch Logs (store & query log files from AWS resources)
- Stream CloudWatch logs to a centralized location
- Implement a logging solution:
- 1. Send CloudTrail events to CloudWatch logs
- 2. Publish VPC flow logs to CloudWatch Logs
- Capture information about the IP traffic moving in and out of the Virtual Private Network (VPC) & publish to a centralized location
- 3. Collect logs & metrics from EC2 instances
- 4. Log DNS queries
- 5. Send Logs Directly to Amazon S3
- Centralized Logging: To combine logs from multiple AWS accounts
Troubleshoot Logging Solutions
Infrastructure Security - 26%
Design Edge Security on AWS
- Services resident at the AWS edge locations (provide a security perimeter for your apps):
- 1. Amazon CloudFront (Content Delivery Network)
- Think of CloudFront as the front door to your app. So, effectively, you are moving the attack surface from your infrastructure (with sensitive data) to the edge.
- 2. AWS Shield (Protects against DDoS attacks)
- 3. AWS Web Application Firewall (protect web applications from threats)
- 4. Amazon Route 53 (DNS Web service)
- Security features on AWS CloudFront edge locations:
- 1. Using SSL/TLS to deliver your content
- 2. AWS Certificate Manager to create a custom SSL certificate for CloudFront
- 3. Serving Private Content with Signed URLs
- 4. Serving Private Content with Signed Cookies
- 5. Advanced CloudFront Security (Full/half bridge HTTPS connections, OCSP stapling)
- 6. CloudFront Field-level Encryption
- For encrypting sensitive data (like the Credit card details) using field-specific encryption keys
Design and Implement a Secure Network Infrastructure
- Amazon Virtual Private Cloud (VPC) design
- AWS Security Groups (Firewall that allows/blocks traffic at the instance level)
- Network ACLs (additional security to SG, but operates at the subnet level)
- Connecting networks:
- 1. VPC Peering
- 2. AWS Site-to-Site VPN
- 3. AWS Client VPN
- 4. AWS DirectConnect
- 4. AWS VPN CloudHub (Multiple Remote sites can connect with each other)
- Finally, review security best practices
Troubleshoot a Secure Network Infrastructure
Design and Implement Host-based Security
Identity and Access Management - 20%
Design and Implement a Scalable Authorization and Authentication System to Access AWS Resources
Troubleshoot an Authorization and Authentication System to Access AWS Resources
Data Protection - 22%
Design and Implement Key Management and Use
Troubleshoot Key Management
Design and Implement a Data Encryption Solution for Data at Rest and Data in Transit
- How do you protect your data at rest?
- How do you protect your data in transit?
- Encryption At Rest (KMS with different AWS services):
- 1. How Amazon DynamoDB uses AWS KMS?
- 2. How Amazon Elastic Block Store uses AWS KMS?
- 3. How Amazon S3 encrypts data at rest with AWS KMS?
- 4. How Amazon Redshift uses AWS Key Management Service?
- 5. How Relational Database Service (RDS) encrypts data with AWS KMS?
- …and pretty much every other AWS service in the documentation.
- Protecting Data in Transit
- 1. Amazon Redshift
- 2. Amazon SageMaker
- 3. Amazon EMR
- Encrypting & Decrypting data with AWS Encryption CLI
- What are the AWS Encryption SDKs?
This brings us to the end of the AWS Certified Security Specialty [SCS-C01] Exam Preparation Study Guide.
Follow Me to Receive Updates on SCS-C01 Exam
Share the SCS-C01 Study Guide in Your Network
Share on facebook
Share on twitter
Share on linkedin
