AWS Certified Security – Specialty (Security Engineering on AWS)

Module 1: AWS Security Foundations

• AWS security principles
• AWS Shared Responsibility Model
• AWS security architecture
• AWS global infrastructure
• Security best practices
• Security design principles
• AWS security services
• Compliance and governance

Module 2: Identity and Access Management

• AWS IAM
• IAM users and groups
• IAM roles
• IAM policies
• Identity-based policies
• Resource-based policies
• Permissions boundaries
• Service Control Policies
• AWS Organizations
• Multi-factor authentication
• Federation
• Identity Center
• Least-privilege access

Module 3: Infrastructure Security

• Amazon VPC security
• Security Groups
• Network ACLs
• VPC endpoints
• PrivateLink
• AWS Network Firewall
• AWS WAF
• AWS Shield
• DDoS protection
• Network segmentation
• Secure hybrid connectivity
• Infrastructure security architecture

Module 4: Data Protection and Encryption

• Data protection principles
• Encryption at rest
• Encryption in transit
• AWS Key Management Service (KMS)
• AWS CloudHSM
• AWS Certificate Manager
• Secrets Manager
• Systems Manager Parameter Store
• S3 security
• EBS encryption
• Database encryption
• Key rotation and management

Module 5: Security Logging and Monitoring

• AWS CloudTrail
• AWS Config
• Amazon CloudWatch
• VPC Flow Logs
• AWS Security Hub
• Centralized logging
• Security monitoring
• Audit trails
• Log analysis
• Security dashboards
• Security event correlation

Module 6: Threat Detection and Investigation

• Amazon GuardDuty
• Amazon Detective
• Amazon Inspector
• Amazon Macie
• Threat intelligence
• Vulnerability management
• Security findings
• Threat investigation
• Anomaly detection
• Security incident analysis

Module 7: Incident Response

• AWS incident response
• Security incident preparation
• Incident detection
• Incident analysis
• Containment
• Eradication
• Recovery
• Evidence collection
• Forensic considerations
• Automated incident response
• Post-incident activities

Module 8: Application and Workload Security

• EC2 security
• Container security
• Amazon ECS
• Amazon EKS
• AWS Lambda security
• Serverless security
• API security
• Application authentication
• Secure application architecture
• Runtime protection
• Vulnerability management

Module 9: Security Automation and DevSecOps

• Security automation
• AWS Systems Manager
• AWS Lambda automation
• Event-driven security
• Amazon EventBridge
• Infrastructure as Code security
• AWS CloudFormation security
• CI/CD security
• DevSecOps principles
• Automated remediation
• Security orchestration

Module 10: Governance, Risk, and Compliance

• AWS security governance
• Compliance frameworks
• AWS Artifact
• AWS Audit Manager
• AWS Organizations
• Service Control Policies
• Resource policies
• Security standards
• Regulatory requirements
• Risk management
• Security assessments

Module 11: Secure Multi-Account and Hybrid Architectures

• AWS multi-account strategy
• AWS Organizations
• Control Tower security concepts
• Centralized security management
• Security account architecture
• Hybrid cloud security
• On-premises integration
• Cross-account access
• Centralized logging
• Security guardrails

Module 12: Security Engineering Workshop

• Design a secure AWS environment
• Configure IAM and least-privilege policies
• Secure VPC infrastructure
• Implement encryption with KMS
• Configure centralized logging
• Enable threat detection
• Investigate security findings
• Implement automated remediation
• Configure security monitoring
• Conduct a simulated incident response exercise

• Cloud Security Engineers
• AWS Security Engineers
• Cybersecurity Engineers
• Security Architects
• Cloud Architects
• AWS Solutions Architects
• Security Administrators
• DevSecOps Engineers
• Security Operations Professionals
• Incident Response Professionals
• Cloud Infrastructure Engineers
• Network Security Engineers
• Compliance and Risk Professionals
• Professionals responsible for securing AWS workloads and infrastructure
• Professionals preparing for the AWS Certified Security – Specialty certification

• Design and implement secure AWS architectures.
• Apply the AWS Shared Responsibility Model.
• Implement least-privilege access using AWS IAM.
• Manage multi-account security using AWS Organizations and Service Control Policies.
• Secure AWS networks using Security Groups, Network ACLs, AWS WAF, AWS Shield, and AWS Network Firewall.
• Protect data using AWS KMS, CloudHSM, Secrets Manager, and encryption technologies.
• Implement centralized security logging using CloudTrail, CloudWatch, and AWS Config.
• Detect threats using GuardDuty, Security Hub, Inspector, Macie, and Detective.
• Investigate and respond to AWS security incidents.
• Secure EC2, containers, Kubernetes, serverless applications, and APIs.
• Automate security operations and remediation.
• Apply DevSecOps and Infrastructure as Code security practices.
• Implement AWS governance, compliance, and audit controls.
• Design secure multi-account and hybrid cloud environments.
• Develop advanced AWS security skills aligned with the AWS Certified Security – Specialty certification.

• Experience with AWS security controls and services.
• Understanding of cloud security architecture.
• Knowledge of networking and infrastructure security.
• Understanding of IAM and access-control concepts.
• Familiarity with encryption and key management.
• Experience with security logging and monitoring.
• Knowledge of incident response and vulnerability management.
• Familiarity with compliance and governance requirements.

Certification: AWS Certified Security – Specialty
Exam: SCS-C03
Level: Specialty
Exam Duration: 170 Minutes
Number of Questions: 65
Question Types: Multiple-choice and multiple-response
Passing Score: 750 out of 1000