AWS Security – Specialty Roadmap
The six AWS Certified Security – Specialty (SCS-C02) exam domains: threat detection & incident response, security logging & monitoring, infrastructure security, identity & access management, data protection, and management & security governance.
concepts mastered
Threat Detection & IR
0% · 0/5Detecting threats with GuardDuty, Security Hub, Detective and Inspector, then responding with automated remediation, forensics and isolation (Domain 1 · 14%)
Logging & Monitoring
0% · 0/5Capturing, centralising, validating and analysing logs - CloudTrail, CloudWatch Logs, VPC Flow Logs, Config and Athena (Domain 2 · 18%)
Infrastructure Security
0% · 0/5Securing the network and edge - security groups, NACLs, Network Firewall, WAF, Shield, plus hardening, bastion-free access and patching (Domain 3 · 20%)
Identity & Access Management
0% · 0/4Advanced IAM - policy evaluation logic, permission boundaries, SCPs, resource and cross-account policies, federation, Identity Center and ABAC (Domain 4 · 16%)
Data Protection
0% · 0/6Protecting data with KMS key policies and grants, envelope encryption, rotation, CloudHSM, ACM, S3 encryption, Secrets Manager and Macie (Domain 5 · 18%)
Governance
0% · 0/5Governing many accounts at scale - Organizations and SCPs, Control Tower, Config conformance packs, Audit Manager, Artifact and the economics of security (Domain 6 · 14%)
Finish line