Play free

AWS · Certification path · SCS-C03

SCS-C03: Security - Specialty

63 stages in study order, about 31 hours to complete, drawn from Networking, Data engineering, Security and Core architecture. Each stage names the section of the SCS-C03 exam guide it practises.

Open the path in the game The exam guide

The path, in study order

63 stages2 free without buying

  1. 1Deny WinsFreeSecurity · Security World 1 · Skill 4.2.3, Skill 4.2.4
  2. 2Trust Both WaysSecurity · Security World 1 · Skill 4.2.1, Skill 4.1.2
  3. 3Tag Says SoSecurity · Security World 1 · Skill 4.2.2, Skill 4.2.3
  4. 4Inside the BoundarySecurity · Security World 1 · Skill 4.2.3, Skill 4.2.5
  5. 5Who Are YouSecurity · Security World 1 · Skill 4.1.1, Skill 4.1.2
  6. 6Access Denied, Why?Security · Security World 1 · Skill 4.1.3, Skill 4.2.4, Skill 4.2.5
  7. 7Fence the OrgSecurity · Security World 2 · Skill 6.1.1, Skill 6.1.3
  8. 8Resource SideSecurity · Security World 2 · Skill 6.1.3
  9. 9Landing ZoneSecurity · Security World 2 · Skill 6.1.2, Skill 6.1.4, Skill 6.1.5
  10. 10Same EverywhereSecurity · Security World 2 · Skill 6.2.1, Skill 6.2.2, Skill 6.2.3
  11. 11Prove ItSecurity · Security World 2 · Skill 6.3.1, Skill 6.3.2, Skill 6.3.3
  12. 12Guardrail DetectiveSecurity · Security World 2 · Skill 6.1.1, Skill 6.1.3, Skill 6.3.1
  13. 13Key Policy FirstSecurity · Security World 3 · Skill 5.2.1, Skill 5.3.5, Skill 4.2.1
  14. 14Whose Key Is ItSecurity · Security World 3 · Skill 5.3.2, Skill 5.3.3, Skill 5.3.5, Skill 5.2.1
  15. 15At Rest EverywhereSecurity · Security World 3 · Skill 5.2.1, Skill 5.2.4
  16. 16On the WireSecurity · Security World 3 · Skill 5.1.1, Skill 5.1.2, Skill 5.1.3
  17. 17Secrets and MasksSecurity · Security World 3 · Skill 5.3.1, Skill 5.3.4
  18. 18Hold the LineSecurity · Security World 3 · Skill 5.2.2, Skill 5.2.3, Skill 5.2.4
  19. 19Front DoorSecurity · Security World 4 · Skill 3.1.2, Skill 3.1.3
  20. 20Rule OrderSecurity · Security World 4 · Skill 3.1.1, Skill 3.1.2, Skill 3.1.3, Skill 3.1.4
  21. 21Weather the StormSecurity · Security World 4 · Skill 3.1.1, Skill 2.1.2, Skill 6.2.3
  22. 22Hardened HostsSecurity · Security World 4 · Skill 3.2.1, Skill 3.2.2, Skill 3.2.3, Skill 3.2.4, Skill 3.2.5, Skill 3.2.6, Skill 3.2.7
  23. 23Zero Trust DoorSecurity · Security World 4 · Skill 3.3.3, Skill 3.3.1, Skill 5.1.2
  24. 24Breach PathSecurity · Security World 4 · Skill 3.1.1, Skill 3.2.3, Skill 3.3.5, Skill 1.2.6
  25. 25Log What MattersSecurity · Security World 5 · Skill 1.2.1, Skill 1.2.2, Skill 1.2.6
  26. 26Finding RunSecurity · Security World 5 · Skill 1.1.3, Skill 1.1.4, Skill 1.1.5
  27. 27One PaneSecurity · Security World 5 · Skill 1.1.3, Skill 1.1.4, Skill 1.1.5
  28. 28Lake of LogsSecurity · Security World 5 · Skill 1.2.3, Skill 1.2.4, Skill 1.2.5
  29. 29Threshold AlarmSecurity · Security World 5 · Skill 1.1.1, Skill 1.1.2, Skill 1.1.4, Skill 1.1.5
  30. 30Missing LogsSecurity · Security World 5 · Skill 1.3.1, Skill 1.3.2
  31. 31Before It HappensSecurity · Security World 6 · Skill 2.1.1, Skill 2.1.2, Skill 2.1.3
  32. 32Contain the InstanceSecurity · Security World 6 · Skill 2.2.1, Skill 2.2.4, Skill 2.1.4
  33. 33Exposed KeySecurity · Security World 6 · Skill 2.2.2, Skill 2.2.3, Skill 2.2.4
  34. 34Automatic ResponseSecurity · Security World 6 · Skill 2.1.4, Skill 2.2.4
  35. 35Trace the RootSecurity · Security World 6 · Skill 2.2.2, Skill 2.2.3, Skill 2.2.5
  36. 36Recover the BucketSecurity · Security World 6 · Skill 2.2.4, Skill 2.2.1, Skill 5.2.4
  37. 37Open for BusinessFreeNetworking · World 1 · Skill 3.3.4
  38. 38Guard RailsNetworking · World 1 · Skill 3.3.1
  39. 39Shortcut to S3Networking · World 1 · Skill 5.1.2
  40. 40Tunnel VisionNetworking · World 2 · Skill 3.3.2
  41. 41Dedicated LineNetworking · World 2 · Skill 3.3.2
  42. 42Service BridgeNetworking · World 2 · Skill 5.1.2
  43. 43Routing DomainsNetworking · World 3 · Skill 3.3.4
  44. 44Belt and BracesNetworking · World 3 · Skill 3.3.2
  45. 45Inspection LaneNetworking · World 4 · Skill 3.3.1, Skill 3.3.4
  46. 46Bump in the WireNetworking · World 4 · Skill 3.3.1, Skill 3.3.4
  47. 47Transit VIFNetworking · World 4 · Skill 3.3.2
  48. 48Wide AreaNetworking · World 4 · Skill 3.3.4
  49. 49Global EdgeNetworking · World 4 · Skill 5.1.2
  50. 50Flight RecorderNetworking · World 5 · Skill 1.2.6, Skill 3.3.1
  51. 51Path FinderNetworking · World 5 · Skill 3.3.4, Skill 3.3.5
  52. 52Mirror ImageNetworking · World 5 · Skill 1.2.6, Skill 3.3.1
  53. 53Sealed LinksNetworking · World 5 · Skill 3.3.2
  54. 54Keep, Tier, ExpireData engineering · Data World 1 · Skill 5.2.3
  55. 55Who Holds the KeysData engineering · Data World 4 · Skill 4.2.5
  56. 56Tag the LakeData engineering · Data World 4 · Skill 4.2.2
  57. 57Share AcrossData engineering · Data World 4 · Skill 6.2.4
  58. 58Lock the DataData engineering · Data World 4 · Skill 5.2.1, Skill 5.1.1
  59. 59Find the PIIData engineering · Data World 4 · Skill 1.1.4, Skill 1.2.2
  60. 60Share the WarehouseData engineering · Data World 5 · Skill 4.2.2
  61. 61Who Touched the DataData engineering · Data World 6 · Skill 2.2.1, Skill 2.2.2
  62. 62Back It UpCore architecture · Architecture World 1 · Skill 5.2.4
  63. 63Images and RegistriesCore architecture · Architecture World 4 · Skill 3.2.3

Articles on SCS-C03

One topic each, from the documentation, ending at a stage you can play

SCS-C03 · Security

How AWS decides a request: why an explicit deny always wins

Every request starts denied. An Allow lets it through, and one Deny in any policy ends it. The order AWS reads policies in, and how to find the Deny.

Ends at Deny WinsFree5 min read · video coming

SCS-C03 · Security

Identity policy or bucket policy: which one has to allow?

In one account, either side can allow. Across accounts, both must. An account principal only delegates, and Block Public Access overrides a public policy.

Ends at Deny WinsFree6 min read · video coming

SAA-C03 · Networking

Security group or network ACL: which one dropped the packet?

Security groups are stateful and only allow. Network ACLs are stateless, numbered and can deny. Follow one HTTPS request to see which layer drops what.

Ends at Guard Rails Paid5 min read · video coming

SAP-C02 · Networking

Transit gateway route tables: association and propagation, with one packet

Association picks the table a packet is looked up in. Propagation picks which tables know a VPC. Follow one packet to see how a transit gateway segments.

Ends at Routing Domains Paid5 min read · video coming

SAA-C03 · Networking

What actually makes a subnet public

Not its name, not a public IP, not the gateway alone. The subnet's route table decides, and the main route table decides for every subnet you forgot.

Ends at Open for BusinessFree5 min read · video coming

Every article on SCS-C03

Guide sections the path practises

SectionAs the guide words itStages
Skill 1.1.1Analyze workloads to determine monitoring requirements1
Skill 1.1.2Design and implement workload monitoring strategies (for example, by configuring resource health checks)1
Skill 1.1.3Aggregate security and monitoring events2
Skill 1.1.4Create metrics, alerts, and dashboards to detect anomalous data and events (for example, Amazon GuardDuty, Amazon Security Lake, AWS Security Hub, Amazon Macie)4
Skill 1.1.5Create and manage automations to perform regular assessments and investigations (for example, by deploying AWS Config conformance packs, Security Hub, AWS Systems Manager State Manager)3
Skill 1.2.1Identify sources for log ingestion and storage based on requirements1
Skill 1.2.2Configure logging for AWS services and applications (for example, by configuring an AWS CloudTrail trail for an organization, by creating a dedicated Amazon CloudWatch logging account, by configuring the Amazon CloudWatch Logs agent)2
Skill 1.2.3Implement log storage and log data lakes (for example, Security Lake) and integrate with third-party security tools1
Skill 1.2.4Use AWS services to analyze logs (for example, CloudWatch Logs Insights, Amazon Athena, Security Hub findings)1
Skill 1.2.5Use AWS services to normalize, parse, and correlate logs (for example, Amazon OpenSearch Service, AWS Lambda, Amazon Managed Grafana)1
Skill 1.2.6Determine and configure appropriate log sources based on network design, threats, and attacks4
Skill 1.3.1Analyze the functionality, permissions, and configuration of resources (for example, Lambda function logging, Amazon API Gateway logging, health checks, Amazon CloudFront logging)1
Skill 1.3.2Remediate misconfiguration of resources (for example, by troubleshooting CloudWatch Agent configurations, troubleshooting missing logs)1
Skill 2.1.1Design and implement response plans and runbooks to respond to security incidents (for example, Systems Manager OpsCenter, Amazon SageMaker AI notebooks)1
Skill 2.1.2Use AWS service features and capabilities to configure services to be prepared for incidents (for example, by provisioning access, deploying security tools, minimizing the blast radius, configuring AWS Shield Advanced protections)2
Skill 2.1.3Recommend procedures to test and validate the effectiveness of an incident response plan (for example, AWS Fault Injection Service, AWS Resilience Hub)1
Skill 2.1.4Use AWS services to automatically remediate incidents (for example, Systems Manager, Automated Forensics Orchestrator for Amazon EC2, AWS Step Functions, Amazon Application Recovery Controller, Lambda functions)2
Skill 2.2.1Capture and store relevant system and application logs as forensic artifacts3
Skill 2.2.2Search and correlate logs for security events across applications and AWS services3
Skill 2.2.3Validate findings from AWS security services to assess the scope and impact of an event2
Skill 2.2.4Respond to affected resources by containing and eradicating threats, and recover resources (for example, by implementing network containment controls, restoring backups)4
Skill 2.2.5Describe methods to conduct root cause analysis (for example, Amazon Detective)1
Skill 3.1.1Define and select edge security strategies based on anticipated threats and attacks3
Skill 3.1.2Implement appropriate network edge protection (for example, CloudFront headers, AWS WAF, AWS IoT policies, protecting against OWASP Top 10 threats, Amazon S3 cross-origin resource sharing [CORS], Shield Advanced)2
Skill 3.1.3Design and implement AWS edge controls and rules based on requirements (for example, geography, geolocation, rate limiting, client fingerprinting)2
Skill 3.1.4Configure integrations with AWS edge services and third-party services (for example, by ingesting data in Open Cybersecurity Schema Framework [OCSF] format, by using third-party WAF rules)1
Skill 3.2.1Design and implement hardened Amazon EC2 AMIs and container images to secure compute workloads and embed security controls (for example, Systems Manager, EC2 Image Builder)1
Skill 3.2.2Apply instance profiles, service roles, and execution roles appropriately to authorize compute workloads1
Skill 3.2.3Scan compute resources for known vulnerabilities (for example, scan container images and Lambda functions by using Amazon Inspector, monitor compute runtimes by using GuardDuty)3
Skill 3.2.4Deploy patches across compute resources to maintain secure and compliant environments by automating update processes and by integrating continuous validation (for example, Systems Manager Patch Manager, Amazon Inspector)1
Skill 3.2.5Configure secure administrative access to compute resources (for example, Systems Manager Session Manager, EC2 Instance Connect)1
Skill 3.2.6Configure security tools to discover and remediate vulnerabilities within a pipeline (for example, Amazon Q Developer, Amazon CodeGuru Security)1
Skill 3.2.7Implement protections and guardrails for generative AI applications (for example, by applying GenAI OWASP Top 10 for LLM Applications protections)1
Skill 3.3.1Design and troubleshoot appropriate network controls to permit or prevent network traffic as required6
Skill 3.3.2Design secure connectivity between hybrid and multi-cloud networks5
Skill 3.3.3Determine and configure security workload requirements for communication between hybrid environments and AWS (for example, by using AWS Verified Access)1
Skill 3.3.4Design network segmentation based on security requirements6
Skill 3.3.5Identify unnecessary network access (for example, AWS Verified Access, Network Access Analyzer, Amazon Inspector network reachability findings)2
Skill 4.1.1Design and establish identity solutions for human, application, and system authentication (for example, AWS IAM Identity Center, Amazon Cognito, multi-factor authentication [MFA], identity provider [IdP] integration)1
Skill 4.1.2Configure mechanisms to issue temporary credentials (for example, AWS STS, Amazon S3 presigned URLs)2
Skill 4.1.3Troubleshooting authentication issues (for example, CloudTrail, Amazon Cognito, IAM Identity Center permission sets, AWS Directory Service)1
Skill 4.2.1Design and evaluate authorization controls for human, application, and system access (for example, Amazon Verified Permissions, IAM paths, IAM Roles Anywhere, resource policies for cross-account access, IAM role trust policies)2
Skill 4.2.2Design attribute-based access control (ABAC) and role-based access control (RBAC) strategies (for example, by configuring resource access based on tags or attributes)3
Skill 4.2.3Design, interpret, and implement IAM policies by following the principle of least privilege (for example, permission boundaries, session policies)3
Skill 4.2.4Analyze authorization failures to determine causes or effects (for example, IAM Policy Simulator, IAM Access Analyzer)2
Skill 4.2.5Investigate and correct unintended permissions, authorizations, or privileges granted to a resource, service, or entity (for example, IAM Access Analyzer)3
Skill 5.1.1Design and configure mechanisms to require encryption when connecting to connect to resources (for example, by configuring Elastic Load Balancing [ELB] security policies, by enforcing TLS configurations)2
Skill 5.1.2Design and configure mechanisms for secure and private access to resources5
Skill 5.1.3Design and configure inter-resource encryption in transit (for example, inter-node encryption configurations for Amazon EMR, Amazon EKS, SageMaker AI, Nitro encryption)1
Skill 5.2.1Design, implement, and configure data encryption at rest based on specific requirements (for example, by selecting the appropriate encryption key service such as AWS CloudHSM or AWS KMS or by selecting the appropriate encryption type such as client-side encryption or server-side encryption)4
Skill 5.2.2Design and configure mechanisms to protect data integrity (for example, S3 Object Lock, S3 Glacier Vault Lock, versioning, digital code signing, file validation)1
Skill 5.2.3Design automatic lifecycle management and retention solutions for data (for example, S3 Lifecycle policies, S3 Object Lock, Amazon EFS Lifecycle policies, Amazon FSx for Lustre backup policies)2
Skill 5.2.4Design and configure secure data replication and backup solutions (for example, Amazon Data Lifecycle Manager, AWS Backup, ransomware protection, AWS DataSync)4
Skill 5.3.1Design management and rotation of credentials and secrets (for example, AWS Secrets Manager)1
Skill 5.3.2Manage and use imported key material (for example, by managing and rotating imported key material, by managing and configuring external key stores)1
Skill 5.3.3Describe the differences between imported key material and AWS generated key material1
Skill 5.3.4Mask sensitive data (for example, CloudWatch Logs data protection policies, Amazon SNS message data protection)1
Skill 5.3.5Create and manage encryption keys and certificates across a single AWS Region or multiple Regions (for example, AWS KMS customer managed AWS KMS keys, AWS Private Certificate Authority)2
Skill 6.1.1Deploy and configure organizations by using AWS Organizations2
Skill 6.1.2Implement and manage AWS Control Tower in new and existing environments, and deploy optional and custom controls1
Skill 6.1.3Implement organization policies to manage permissions (for example, SCPs, RCPs, AI service opt-out policies, declarative policies)3
Skill 6.1.4Centrally manage security services (for example, delegated administrator accounts)1
Skill 6.1.5Manage AWS account root user credentials (for example, by centralizing root access for member accounts, managing MFA, designing break-glass procedures)1
Skill 6.2.1Use infrastructure as code (IaC) to deploy cloud resources consistently and securely across accounts (for example, CloudFormation stack sets, third-party IaC tools, CloudFormation Guard, cfn-lint)1
Skill 6.2.2Use tags to organize AWS resources into groups for management (for example, by grouping by department, cost center, environment)1
Skill 6.2.3Deploy and enforce policies and configurations from a central source (for example, AWS Firewall Manager)2
Skill 6.2.4Securely share resources across AWS accounts (for example, AWS Service Catalog, AWS Resource Access Manager [AWS RAM])1
Skill 6.3.1Create or enable rules to detect and remediate noncompliant AWS resources and to send notifications (for example, by using AWS Config to aggregate alerts and remediate non-compliant resources, Security Hub)2
Skill 6.3.2Use AWS audit services to collect and organize evidence (for example, AWS Audit Manager, AWS Artifact)1
Skill 6.3.3Use AWS services to evaluate architecture for compliance with AWS security best practices (for example, AWS Well-Architected Framework tool)1

A domain and a path are separate products. What you own is the union of what you bought, so a stage you already own is never sold to you twice: the game offers the cheapest way to unlock the stage in front of you. Path $30, exam $300.