AWS Security Specialty (SCS-C03) study plan
AWS Security Specialty (SCS-C03) · Give each week a clear focus.
8 weeks · About 8 hours per week
Infrastructure Security
Diagram the VPC security layers you would deploy for a three-tier app (subnets, security groups, NACLs, route tables, endpoints) from memory
Compare security group, network ACL, and AWS Network Firewall enforcement points and write down two scenarios where each is the correct control
Configure an interface VPC endpoint with a restrictive endpoint policy and verify that traffic no longer traverses the internet gateway
List every AWS edge protection service (Shield Standard/Advanced, WAF, Firewall Manager, CloudFront security features) and state the attack type each one mitigates
Explain how AWS PrivateLink and VPC peering differ in blast radius and write the trade-off in one paragraph
Your checkpoint
A one-page architecture sketch of a three-tier VPC with every security control labeled, plus a written justification for each control choice
Security Logging and Monitoring & Infrastructure Security
Enable CloudTrail with multi-Region trails, log file validation, and delivery to a dedicated logging account, then verify integrity validation succeeds
Distinguish management events, data events, and Insights events and describe when each is required for an audit finding
Enable AWS Config with the managed rules that detect public S3 buckets and unencrypted EBS volumes, and confirm each rule evaluates existing resources
Trace a single API call across CloudTrail, Config history, and VPC Flow Logs and document the timestamp correlation
Harden a compute workload's network posture using security groups, IMDSv2 enforcement, and Systems Manager Session Manager instead of SSH
Your checkpoint
A working multi-account CloudTrail and Config setup with a screenshot-free written validation log recording the evidence each service produced
Security Logging and Monitoring
Design a centralized logging architecture that ships CloudTrail, VPC Flow Logs, and application logs into a single immutable destination with retention controls
Write the S3 bucket policy and KMS key policy combination that prevents the logging account from deleting or altering delivered logs
Query CloudTrail logs with Athena to find every principal that called a specific sensitive API in the last 30 days
Configure CloudWatch Logs metric filters and alarms that fire on root account usage and on repeated authorization failures
Integrate GuardDuty, Security Hub, and EventBridge so a high-severity finding triggers an automated notification and containment action
Your checkpoint
An Athena query plus saved result set showing all callers of a chosen sensitive API over 30 days, and an EventBridge rule JSON that reacts to a GuardDuty high-severity finding
Threat Detection and Incident Response
Classify GuardDuty finding types by resource family and write the first three response actions for each of five finding families
Draft an incident response playbook for a compromised EC2 instance that covers isolation, snapshotting, memory capture, and credential rotation
Describe how to preserve forensic evidence from a compromised instance without destroying volatile data, and identify which AWS services support that workflow
Explain how Amazon Detective, Security Hub, and Macie findings feed an investigation and state the unique question each answers
Map the AWS shared responsibility model to incident response phases and identify which phases AWS owns
Your checkpoint
A written incident response runbook for a compromised EC2 instance with concrete CLI or console steps for each phase and a list of evidence artifacts to preserve
Identity and Access Management
Write an IAM policy from scratch that enforces least privilege for a specific job function, then validate it with IAM Access Analyzer policy checks
Apply a permissions boundary together with an identity policy and explain which one wins in a given evaluation scenario
Configure service control policies in AWS Organizations that deny root usage and block leaving the organization, and verify the effect from a member account
Design a federation flow using IAM Identity Center or OIDC and enumerate the trust policy conditions that prevent confused-deputy abuse
Identify when to use an IAM role versus a resource policy versus an ACL to grant cross-account access and justify the choice in two scenarios
Your checkpoint
A policy set (identity policy, permissions boundary, and one SCP) with a written evaluation walkthrough showing the exact allow or deny outcome for three different requests
Data Protection
Select the correct KMS key type and key policy for a multi-account encryption requirement and explain the implications of each choice
Enable S3 default encryption, block public access, and enforce TLS-only access via bucket policy, then prove that a non-compliant request is denied
Describe envelope encryption and key rotation behavior for customer managed keys, and state what happens to data when a key is scheduled for deletion
Configure Secrets Manager rotation for a database credential and trace how the application retrieves the secret without hardcoding it
Compare Macie, GuardDuty, and DLP-style controls for discovering sensitive data in S3 and pick the right tool for two given requirements
Your checkpoint
An encryption design document covering KMS key policy, S3 bucket policy, and secret rotation for a single workload, with the deny conditions written out explicitly
Management and Security Governance & Threat Detection and Incident Response
Deploy AWS Control Tower or an equivalent Organizations baseline and enumerate the detective and preventive controls it applies
Use AWS Audit Manager to collect evidence for one compliance framework and state which artifacts map to which control
Distinguish preventive, detective, and responsive governance controls and assign each of the SCS-C03 domain areas to one category
Re-run the week 4 playbook against a new scenario (leaked access key) and update the gaps you find
Review the week 1 and week 5 artifacts and correct any control you can now justify differently
Your checkpoint
A governance control matrix mapping at least 15 AWS security services to preventive, detective, or responsive categories with a one-line justification each
Threat Detection and Incident Response & Security Logging and Monitoring & Infrastructure Security & Identity and Access Management & Data Protection & Management and Security Governance
Take two full-length timed practice exams and record every missed question by domain and by root cause (unknown fact, misread, or wrong service choice)
Re-study only the two weakest domains identified by practice exam results and rewrite the relevant artifacts from weeks 1 through 7
Recite from memory the default behavior of the top 20 services tested (GuardDuty, Config, CloudTrail, KMS, IAM, Organizations, Macie, Security Hub)
Build a personal quick-reference sheet of the service-selection decisions you got wrong twice or more
Your checkpoint
A scored practice exam log with per-domain accuracy percentages and a one-page final quick-reference sheet of corrected decision points
Milestones
Week 2: Can explain, without notes, how CloudTrail, Config, VPC Flow Logs, and GuardDuty differ in what they record and name the exact scenario each is required for
Week 4: Can walk through a compromised-EC2 incident end to end, naming the isolation step, the evidence to preserve, and the notification path, in under five minutes
Week 6: Can read an arbitrary IAM policy plus SCP plus permissions boundary and correctly state the resulting allow or deny for a given request
Week 7: Scores 70 percent or higher on a first full-length timed practice exam, with no domain below 60 percent
Week 8: Scores 80 percent or higher on a second full-length timed practice exam and has zero remaining domains below 70 percent