AWS Security Specialty (SCS-C03) key terms

A managed threat-detection service that continuously analyzes CloudTrail, VPC flow, and DNS logs with threat intelligence and machine learning and surfaces suspicious activity as findings.

A service that aggregates findings from GuardDuty, Inspector, Macie, and partner tools, evaluates them against security standards, and gives one consolidated view of account posture.

A service that builds behavioral graphs from log data so investigators can visualize relationships and trace the root cause behind a GuardDuty or Security Hub finding.

An automated vulnerability scanner for EC2 instances, container images, and Lambda functions that continuously checks for software vulnerabilities and unintended network exposure.

A serverless event bus that routes AWS service events, scheduled events, and custom events to targets such as Lambda or SSM Automation, enabling automated incident response.

A documented, tested set of roles, steps, and communication paths for detecting, containing, eradicating, and recovering from a security event, aligned to frameworks such as NIST SP 800-61.

A documented emergency procedure, often using a tightly controlled privileged role with alerting, that grants temporary elevated access when normal authentication or authorization fails.

A service that records account API activity as events, showing who made which request, from where, and when, for auditing, compliance, and forensic investigation.

A managed, queryable event data store that ingests CloudTrail events and other sources so you can run SQL queries for investigations without building your own pipeline.

A CloudTrail trail created in the management account that logs events for every member account in AWS Organizations and delivers them to one central bucket.

Records of accepted and rejected IP traffic through network interfaces, subnets, or VPCs, used for connectivity troubleshooting and for detecting anomalous traffic patterns.

A pattern applied to log events that counts occurrences or extracts values into a CloudWatch metric, which can then drive alarms and automated responses.

A service that normalizes logs from AWS and third-party sources into the Open Cybersecurity Schema Framework and stores them in an S3 data lake you own.

A stateful virtual firewall attached to an elastic network interface that permits only traffic explicitly allowed by its rules and automatically allows return traffic for established connections.

A stateless, subnet-level filter with ordered allow and deny rules that is evaluated separately for traffic entering and leaving the subnet in each direction.

A private connection from a VPC to an AWS service or third-party endpoint service that keeps traffic on the AWS network and can be constrained with endpoint policies.

A web application firewall that inspects HTTP requests against rules such as IP sets, rate limits, and managed rule groups to block common exploits before traffic reaches your application.

A managed DDoS protection tier offering enhanced detection, cost protection, and access to the AWS response team for resources such as CloudFront distributions and load balancers.

A managed stateful firewall and intrusion prevention service for VPCs that filters traffic by domain, port, and protocol and supports Suricata-compatible rule groups.

A Systems Manager capability that provides shell access to instances without opening inbound ports or running bastion hosts, with sessions optionally recorded to S3 or CloudWatch Logs.

The order AWS uses to decide a request: an explicit deny always wins, service control policies must allow it, and an identity or resource policy must permit it.

A managed policy that caps the maximum permissions an identity-based policy can grant to an IAM user or role, so the effective permission is the intersection of both.

A JSON policy attached to an Organizations OU or account that limits the maximum permissions available to all principals in that account without granting any permissions itself.

A tool that uses policy analysis and access logs to identify resources shared outside your account or organization and to validate or generate least-privilege policies.

A service that provides single sign-on to multiple AWS accounts and applications from a central identity store or external IdP, using permission sets instead of per-account IAM users.

An API that returns temporary credentials for an IAM role, enabling cross-account access, federation, and short-lived credentials instead of long-term access keys.

A JSON policy attached directly to a resource such as an S3 bucket, SQS queue, or KMS key that states which principals may act on it and under what conditions.

Practices for the account root identity: enable MFA, delete long-lived access keys, avoid daily use, and constrain it with organizational controls and alerting.

The primary policy that determines who may administer and use a KMS key; without an allowing statement here, IAM policies alone cannot grant access to the key.

A scheme where a data key encrypts the data and a KMS master key encrypts the data key, protecting large payloads without sending them to KMS.

A KMS key you create and control, including its key policy, rotation schedule, and deletion, as opposed to an AWS managed key whose policy the service controls.

Account- and bucket-level settings that override bucket policies and ACLs to reject public access to S3 objects, even when a policy would otherwise allow it.

A write-once-read-many setting that prevents object versions from being deleted or overwritten for a retention period or indefinitely, supporting compliance and ransomware recovery.

A managed service that uses machine learning and pattern matching to discover and classify sensitive data such as credentials or personal information stored in S3.

A scheduled, Lambda-driven process that periodically replaces a stored secret with a new value and updates the database or service that consumes it.

A service that records resource configuration changes over time and evaluates resources against rules, letting you detect drift and noncompliance and trigger automated remediation.

A bundle of AWS Config rules and remediation actions packaged as a template and deployed across accounts to assess an entire framework such as CIS or PCI DSS.

A self-service portal that provides AWS compliance reports, certifications, and agreements, such as SOC and ISO reports and the Business Associate Addendum.

A service that continuously collects evidence from AWS usage and configuration into assessments mapped to frameworks such as PCI DSS, SOC 2, or internal controls.

An Organizations member account designated to manage a security service such as GuardDuty or Security Hub for the whole organization on behalf of the management account.