SCS-C02 Study Guide — How to Pass AWS Security Specialty

Weeks 1–2

Threat Detection and Incident Response: GuardDuty, Security Hub, Detective, Macie

Tip: Amazon GuardDuty continuously monitors VPC flow logs, CloudTrail events, and DNS logs for threat patterns. Know the GuardDuty finding types: Reconnaissance, InstanceCompromise, Policy violations, and Stealth findings. Security Hub aggregates GuardDuty findings with those from other services into a single dashboard.

Weeks 3–5

Security Logging and Monitoring: CloudTrail, CloudWatch Logs, S3 access logs, VPC flow logs

Tip: VPC Flow Logs capture IP traffic to/from network interfaces. Know the flow log record format: srcaddr, dstaddr, srcport, dstport, protocol, action (ACCEPT/REJECT). Questions give a flow log excerpt and ask what type of traffic it represents or why a connection was rejected.

Weeks 6–8

Infrastructure Security: WAF, Shield, Network Firewall, Security Groups, NACLs, PrivateLink

Tip: AWS WAF rules are tested in depth. Know the difference between AWS Managed Rules (pre-built rule groups like AWSManagedRulesCommonRuleSet), rate-based rules (throttle by IP), IP set rules (block/allow specific addresses), and regex pattern set rules (match request patterns).

Weeks 9–12

IAM, Data Protection, KMS, Secrets Manager, Certificate Manager, and Governance

Tip: KMS key types: AWS Managed Keys (AWS creates and manages, free, no access to key material), Customer Managed Keys (you control key policy, rotation, deletion — cost per key per month), and Customer Provided Keys (SSE-C for S3, you manage the key material completely). Know the use case for each.