AWS Certified Security - Specialty (SCS-C01) Exam Prep

A practical breakdown of when to use each identity type with examples for multi-account setups.

We'll build and test policies, covering explicit denies, condition keys, and avoiding common policy mistakes.

Walk through STS workflows and how to securely delegate access across your AWS environment.

Critical steps to lock down the root user and enforce multi-factor authentication for all privileged accounts.

Learn how to assign roles to EC2 instances securely, avoiding the need for long-term credentials.

We'll compare policy types and show you how they interact, especially for S3 buckets and SQS queues.

A practical guide to using Access Analyzer to identify resources shared with external entities.

A problem-solving session on diagnosing and fixing IAM permission issues in real scenarios.

Explore how to use session tags and ABAC to dynamically grant permissions based on user attributes.

Understand key policies, rotation, and when to use CMKs for enhanced control over your data.

Step-by-step walkthroughs of enabling encryption on storage services and managing the encryption keys.

We'll compare encryption methods and show you how to implement client-side encryption with KMS.

A look at the cryptographic process to help you understand KMS API calls and data key handling.

A practical comparison for storing secrets, including rotation, cost, and integration with Lambda.

Learn about certificate management with ACM and enforcing TLS on ELB and API Gateway.

See how Macie uses machine learning to find PII and other sensitive data in S3.

Design resilient backup plans using AWS Backup and understand cross-region replication for DR.

We'll dissect the differences with packet-level examples to master stateless vs. stateful filtering.

A real case study analysis of a 3-tier architecture, focusing on routing and NAT gateways.

Build WAF rules to mitigate common web exploits like SQL injection and cross-site scripting.

Understand what Shield Advanced offers, including cost protection and integration with WAF.

We'll configure GuardDuty and walk through analyzing a sample finding to determine the threat.

Deploy and configure AWS Network Firewall for advanced traffic filtering in your VPC.

Learn how to enable flow logs and query them in Athena to investigate security incidents.

Keep traffic off the public internet by using VPC endpoints for AWS services.

A quick guide to requesting, deploying, and renewing certificates for your applications.

A practical session on protecting your applications from brute-force attacks and traffic spikes.

We'll map the standard IR phases (Preparation, Detection, Containment, etc.) to AWS services.

Learn to query event history, log to S3, and use CloudTrail Insights for anomaly detection.

Build a serverless function to automatically remediate a security finding, like a public S3 bucket.

Set up Config rules to continuously monitor your resource configurations for compliance drift.

A step-by-step guide to preserving evidence from a compromised instance without impacting the attacker.

Eliminate bastion hosts and SSH keys by using Session Manager for secure EC2 access.

Create patch groups and maintenance windows to keep your fleet secure and up-to-date.

Run vulnerability assessments on your instances and container images to find CVEs.

A deeper dive into creating automated playbooks triggered by GuardDuty findings.

A comprehensive review of key concepts from all domains with tips for exam day strategy.