SCS-C02 Cheat Sheet

#	Domain	Weight	Questions	Practice
3.0	Infrastructure Security	20%	353	Practice →
5.0	Data Protection	18%	321	Practice →
Total	38%	1,851

Domain

Weight

Questions

Practice

3.0

Infrastructure Security

20%

353

Practice →

5.0

Data Protection

18%

321

Practice →

Total

38%

1,851

Domain Quick Reference

3.0Infrastructure Security

Choose and configure Security Groups, NACLs, AWS WAF, Network Firewall, and PrivateLink to protect workloads, then verify access with Reachability Analyzer and harden EC2 using SSM Session Manager instead of SSH.

20%

Key concepts

✓Choosing security groups versus NACLs for stateful subnet and instance-level filtering
✓Configuring AWS Network Firewall, WAF rules and Shield Advanced for edge protection
✓Using VPC endpoints, PrivateLink and Gateway Endpoints to keep traffic off the internet
✓Hardening EC2 access with Systems Manager Session Manager, key pairs and IMDSv2

Watch out for

⚠Treating security groups as stateless or NACLs as stateful, then selecting the wrong control for return traffic
⚠Assuming Interface Endpoints are free and always preferred; forgetting Gateway Endpoints only serve S3 and DynamoDB
⚠Leaving IMDSv1 enabled, allowing SSRF attackers to steal instance role credentials instead of enforcing IMDSv2

5.0Data Protection

Choose and troubleshoot SSE-KMS vs SSE-S3, KMS key policies and grants, ACM certificates, S3 Object Lock, and Secrets Manager rotation. Most critical: get KMS key policies and IAM permissions right, since AccessDenied errors usually stem from key policy gaps.

18%

Key concepts

✓Selecting SSE-S3, SSE-KMS, or DSSE-KMS for S3 objects based on audit and key control needs
✓Writing KMS key policies and grants that permit cross-account decrypt without wildcard principals
✓Enforcing TLS-only access using aws:SecureTransport conditions in S3 and IAM policies
✓Configuring Secrets Manager automatic rotation with Lambda and KMS-encrypted secret values

Watch out for

⚠Assuming an IAM policy granting kms:Decrypt is enough; the KMS key policy must also allow the principal.
⚠Confusing SSE-KMS bucket default encryption with per-object encryption, missing that existing objects stay unencrypted.
⚠Forgetting that KMS grants are needed for temporary cross-account access when key policy edits are impractical.

Exam Day Reminders

→Read every question stem fully — look for qualifiers like 'MOST likely,' 'BEST,' or 'EXCEPT.'

→Flag uncertain questions and come back — don't waste time on one question.

→Eliminate obviously wrong options first, then choose between remaining ones.

→Trust your first instinct unless you have a specific reason to change.

→For SCS-C02, scenarios typically have one clearly best answer — look for the option that matches the specific constraints in the question.

#	Domain	Weight	Questions	Practice
3.0	Infrastructure Security	20%	353	Practice →
5.0	Data Protection	18%	321	Practice →
Total	38%	1,851

Domain

Weight

Questions

Practice

3.0

Infrastructure Security

20%

353

Practice →

5.0

Data Protection

18%

321

Practice →

Total

38%

1,851

Domain Quick Reference

3.0Infrastructure Security

20%

Key concepts

✓Choosing security groups versus NACLs for stateful subnet and instance-level filtering
✓Configuring AWS Network Firewall, WAF rules and Shield Advanced for edge protection
✓Using VPC endpoints, PrivateLink and Gateway Endpoints to keep traffic off the internet
✓Hardening EC2 access with Systems Manager Session Manager, key pairs and IMDSv2

Watch out for

⚠Treating security groups as stateless or NACLs as stateful, then selecting the wrong control for return traffic
⚠Assuming Interface Endpoints are free and always preferred; forgetting Gateway Endpoints only serve S3 and DynamoDB
⚠Leaving IMDSv1 enabled, allowing SSRF attackers to steal instance role credentials instead of enforcing IMDSv2

5.0Data Protection

18%

Key concepts

✓Selecting SSE-S3, SSE-KMS, or DSSE-KMS for S3 objects based on audit and key control needs
✓Writing KMS key policies and grants that permit cross-account decrypt without wildcard principals
✓Enforcing TLS-only access using aws:SecureTransport conditions in S3 and IAM policies
✓Configuring Secrets Manager automatic rotation with Lambda and KMS-encrypted secret values

Watch out for

⚠Assuming an IAM policy granting kms:Decrypt is enough; the KMS key policy must also allow the principal.
⚠Confusing SSE-KMS bucket default encryption with per-object encryption, missing that existing objects stay unencrypted.
⚠Forgetting that KMS grants are needed for temporary cross-account access when key policy edits are impractical.

Exam Day Reminders

→Read every question stem fully — look for qualifiers like 'MOST likely,' 'BEST,' or 'EXCEPT.'

→Flag uncertain questions and come back — don't waste time on one question.

→Eliminate obviously wrong options first, then choose between remaining ones.

→Trust your first instinct unless you have a specific reason to change.

→For SCS-C02, scenarios typically have one clearly best answer — look for the option that matches the specific constraints in the question.

SCS-C02 Exam Blueprint — At a Glance

Domain Quick Reference

3.0Infrastructure Security

5.0Data Protection

Exam Day Reminders

More SCS-C02 resources

SCS-C02 Cheat Sheet

SCS-C02 Exam Blueprint — At a Glance

Domain Quick Reference

3.0Infrastructure Security

5.0Data Protection

Exam Day Reminders

More SCS-C02 resources