AWS Security Specialty (SCS-C03) Certification Guide

The AWS Security Specialty certification validates your expertise in securing AWS workloads. This guide covers everything you need to know to pass the SCS-C03 exam.

Who Should Get This Certification?

• Security engineers and architects
• Cloud security professionals
• Compliance and risk professionals
• DevSecOps engineers

Exam Overview

Aspect	Details
Exam Code	SCS-C03
Duration	170 minutes
Questions	65 questions
Passing Score	750/1000
Format	Multiple choice, multiple response
Cost	$300 USD

Exam Domains

Domain 1: Threat Detection and Incident Response (14%)

• Design incident response plans
• Detect security threats
• Respond to security incidents

Domain 2: Security Logging and Monitoring (18%)

• Design security logging solutions
• Troubleshoot security monitoring
• Design solutions for data protection

Domain 3: Infrastructure Security (20%)

• Design edge security
• Design network security
• Design compute security

Domain 4: Identity and Access Management (16%)

• Design authentication solutions
• Design authorization solutions
• Design cross-account access

Domain 5: Data Protection (18%)

• Design data encryption solutions
• Design key management solutions
• Design data integrity solutions

Domain 6: Management and Security Governance (14%)

• Develop security governance strategies
• Implement security controls

Security Services Deep Dive

AWS IAM Advanced Policies

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyAllOutsideAllowedRegions",
            "Effect": "Deny",
            "NotAction": [
                "iam:*",
                "organizations:*",
                "support:*"
            ],
            "Resource": "*",
            "Condition": {
                "StringNotEquals": {
                    "aws:RequestedRegion": [
                        "us-east-1",
                        "eu-west-1"
                    ]
                }
            }
        },
        {
            "Sid": "DenyWithoutMFA",
            "Effect": "Deny",
            "Action": "*",
            "Resource": "*",
            "Condition": {
                "BoolIfExists": {
                    "aws:MultiFactorAuthPresent": "false"
                }
            }
        },
        {
            "Sid": "AllowOnlyFromVPC",
            "Effect": "Deny",
            "Action": "s3:*",
            "Resource": "*",
            "Condition": {
                "StringNotEquals": {
                    "aws:SourceVpc": "vpc-12345678"
                }
            }
        }
    ]
}

KMS Key Policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Enable IAM policies",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::123456789012:root"
            },
            "Action": "kms:*",
            "Resource": "*"
        },
        {
            "Sid": "Allow key administrators",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::123456789012:role/KeyAdminRole"
            },
            "Action": [
                "kms:Create*",
                "kms:Describe*",
                "kms:Enable*",
                "kms:List*",
                "kms:Put*",
                "kms:Update*",
                "kms:Revoke*",
                "kms:Disable*",
                "kms:Get*",
                "kms:Delete*",
                "kms:ScheduleKeyDeletion",
                "kms:CancelKeyDeletion"
            ],
            "Resource": "*"
        },
        {
            "Sid": "Allow encryption operations",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::123456789012:role/AppRole"
            },
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:DescribeKey"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "kms:ViaService": "s3.us-east-1.amazonaws.com"
                }
            }
        }
    ]
}

Security Hub Automation

import boto3

def auto_remediate_findings(event, context):
    """
    Lambda function to auto-remediate Security Hub findings
    """
    securityhub = boto3.client('securityhub')
    ec2 = boto3.client('ec2')

    for finding in event['detail']['findings']:
        finding_id = finding['Id']
        product_arn = finding['ProductArn']

        # Check finding type
        if 'SG-OPEN-INGRESS' in finding['Types']:
            # Remediate open security groups
            sg_id = finding['Resources'][0]['Id'].split('/')[-1]

            # Revoke insecure rules
            ec2.revoke_security_group_ingress(
                GroupId=sg_id,
                IpPermissions=[{
                    'IpProtocol': '-1',
                    'IpRanges': [{'CidrIp': '0.0.0.0/0'}]
                }]
            )

            # Update finding status
            securityhub.batch_update_findings(
                FindingIdentifiers=[{
                    'Id': finding_id,
                    'ProductArn': product_arn
                }],
                Note={
                    'Text': 'Auto-remediated by Lambda',
                    'UpdatedBy': 'security-automation'
                },
                Workflow={'Status': 'RESOLVED'}
            )

Network Security

VPC Security Architecture

┌─────────────────────────────────────────────────────────┐
│                         VPC                              │
│  ┌─────────────────────────────────────────────────┐    │
│  │              Public Subnets                      │    │
│  │  ┌─────────┐  ┌─────────┐  ┌─────────┐         │    │
│  │  │   NAT   │  │   ALB   │  │ Bastion │         │    │
│  │  │ Gateway │  │         │  │  Host   │         │    │
│  │  └────┬────┘  └────┬────┘  └────┬────┘         │    │
│  └───────┼────────────┼────────────┼───────────────┘    │
│          │            │            │                     │
│  ┌───────▼────────────▼────────────▼───────────────┐    │
│  │              Private Subnets                     │    │
│  │  ┌─────────┐  ┌─────────┐                       │    │
│  │  │   EC2   │  │   ECS   │   ←── Security Group │    │
│  │  │ Workers │  │  Tasks  │   ←── NACL           │    │
│  │  └────┬────┘  └────┬────┘                       │    │
│  └───────┼────────────┼────────────────────────────┘    │
│          │            │                                  │
│  ┌───────▼────────────▼────────────────────────────┐    │
│  │              Database Subnets                    │    │
│  │  ┌─────────┐  ┌─────────┐                       │    │
│  │  │   RDS   │  │Elasticache│  ←── Isolated      │    │
│  │  │ Primary │  │         │   ←── No Internet   │    │
│  │  └─────────┘  └─────────┘                       │    │
│  └──────────────────────────────────────────────────┘    │
└──────────────────────────────────────────────────────────┘

VPC Flow Logs Analysis

# Athena query for suspicious traffic
query = """
SELECT
    srcaddr,
    dstaddr,
    dstport,
    COUNT(*) as connection_count,
    SUM(bytes) as total_bytes
FROM vpc_flow_logs
WHERE
    action = 'REJECT'
    AND date >= date_add('day', -1, current_date)
GROUP BY srcaddr, dstaddr, dstport
HAVING COUNT(*) > 100
ORDER BY connection_count DESC
LIMIT 100
"""

Encryption Best Practices

Envelope Encryption

import boto3
from cryptography.fernet import Fernet
import base64

def encrypt_with_envelope(plaintext, kms_key_id):
    kms = boto3.client('kms')

    # Generate data key
    response = kms.generate_data_key(
        KeyId=kms_key_id,
        KeySpec='AES_256'
    )

    # Encrypt data with plaintext key
    plaintext_key = response['Plaintext']
    cipher = Fernet(base64.urlsafe_b64encode(plaintext_key))
    ciphertext = cipher.encrypt(plaintext.encode())

    # Return encrypted data key + ciphertext
    return {
        'encrypted_key': base64.b64encode(response['CiphertextBlob']).decode(),
        'ciphertext': base64.b64encode(ciphertext).decode()
    }

def decrypt_with_envelope(encrypted_data):
    kms = boto3.client('kms')

    # Decrypt the data key
    encrypted_key = base64.b64decode(encrypted_data['encrypted_key'])
    response = kms.decrypt(CiphertextBlob=encrypted_key)

    # Decrypt data with plaintext key
    plaintext_key = response['Plaintext']
    cipher = Fernet(base64.urlsafe_b64encode(plaintext_key))
    ciphertext = base64.b64decode(encrypted_data['ciphertext'])

    return cipher.decrypt(ciphertext).decode()

Practice with ExamCert

Ready to become an AWS Security specialist? ExamCert provides 750+ practice questions for the SCS-C03 exam covering IAM, encryption, network security, and incident response.

👉 Practice AWS Security Specialty questions at ExamCert

Conclusion

The AWS Security Specialty certification demonstrates your expertise in securing AWS workloads. Master IAM policies, encryption strategies, and security monitoring to pass the exam and protect cloud environments effectively.