AWS Certified Security – Specialty (SCS-C01) Exam Learning Path

AWS Certified Security – Specialty (SCS-C01) Exam Learning Path

I recently re-certified AWS Certified Security – Specialty (SCS-C01) after first clearing the same in 2019 and the format, and domains are pretty much the same however has been enhanced to cover all the latest services.

The AWS Certified Security – Specialty (SCS-C01) exam focuses on the AWS Security and Compliance concepts. It basically validates

  • An understanding of specialized data classifications and AWS data protection mechanisms.
  • An understanding of data-encryption methods and AWS mechanisms to implement them.
  • An understanding of secure Internet protocols and AWS mechanisms to implement them.
  • A working knowledge of AWS security services and features of services to provide a secure production environment.
  • Competency gained from two or more years of production deployment experience using AWS security services and features.
  • The ability to make tradeoff decisions with regard to cost, security, and deployment complexity given a set of application requirements. An understanding of security operations and risks

Refer to AWS Certified Security – Speciality Exam Guide

AWS Certified Security – Speciality (SCS-C01) Exam Resources

AWS Certified Security – Specialty (SCS-C01) Exam Summary

  • AWS Certified Security – Specialty (SCS-C01) exam has 65 questions to be solved in 170 minutes and I made sure I utilized the complete time.
  • AWS Certified Security – Specialty (SCS-C01) exam focuses a lot on Security & Compliance concepts involving Data Encryption at rest or in transit, Data protection, Auditing, Compliance and regulatory requirements, and automated remediation.
  • Each question usually touches multiple AWS services.
  • Most of the questions and answers options have a lot of prose and a lot of reading that needs to be done, so be sure you are prepared and manage your time well.
  • As always, mark the questions for review and move on and come back to them after you are done with all.
  • As always, having a rough architecture or mental picture of the setup helps focus on the areas that you need to improve. Trust me, you will be able to eliminate 2 answers for sure and then need to focus on only the other two. Read the other 2 answers to check the difference area and that would help you reach the right answer or at least have a 50% chance of getting it right.

AWS Certified Security – Speciality (SCS-C01) Exam Summary

Security, Identity & Compliance

  • Identity and Access Management (IAM)
    • IAM Roles to grant the service, users temporary access to AWS services.
      • IAM Role can be used to give cross-account access and usually  involves creating a role within the trusting account with a trust and permission policy and granting the user in the trusted account permissions to assume the trusting account role.
    • Identity Providers & Federation to grant external user identity (SAML or Open ID compatible IdPs) permissions to AWS resources without having to be created within the AWS account.
    • IAM Policies help define who has access & what actions can they perform.
  • Deep dive into Key Management Service (KMS). There would be quite a few questions on this.
    • is a managed encryption service that allows the creation and control of encryption keys to enable data encryption. 
    • uses Envelope Encryption which uses a master key to encrypt the data key, which is then used to encrypt the data.
    • Understand how KMS works
    • Understand IAM Policies, Key Policies, Grants to grant access.
      • Key policies are the primary way to control access to KMS keys. Unless the key policy explicitly allows it, you cannot use IAM policies to allow access to a KMS key.
    • are regional, however, supports multi-region keys, which are KMS keys in different AWS Regions that can be used interchangeably – as though you had the same key in multiple Regions.
    • KMS Multi-region keys
      • are AWS KMS keys in different AWS Regions that can be used interchangeably – as though having the same key in multiple Regions.
      • are not global and each multi-region key needs to be replicated and managed independently.
    • Understand the difference between CMK with generated and imported key material esp. in rotating keys
    • KMS usage with VPC Endpoint which ensures the communication between the VPC and KMS is conducted entirely within the AWS network.
    • KMS ViaService condition
  • AWS GuardDuty
    • is a threat detection service that continuously monitors the AWS accounts and workloads for malicious activity and delivers detailed security findings for visibility and remediation.
    • supports CloudTrail S3 data events and management event logs, DNS logs, EKS audit logs, and VPC flow logs.
  • AWS Inspector
    • is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS.
  • Amazon Macie
    • is a security service that uses machine learning to automatically discover, classify, and protect sensitive data in S3.
  • AWS Artifact is a central resource for compliance-related information that provides on-demand access to AWS’ security and compliance reports and select online agreements
  • AWS Certificate Manager (ACM)
    • helps provision, manage, and deploy public and private SSL/TLS certificates for use with AWS services
    • to use an ACM Certificate with CloudFront, the certificate must be imported into the US East (N. Virginia) region.
    • is regional and you need to request certificates in all regions and associate individually in all regions.
    • does not support EC2 instances and private keys cannot be exported.
  • Cloud HSM
    • is a cloud-based hardware security module (HSM) that enables you to easily generate and use your own encryption keys on the AWS Cloud
  • AWS Secrets Manager
    • protects secrets needed to access applications, services, etc.
    • enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle
    • supports automatic rotation of credentials for RDS, DocumentDB, etc.
  • Secrets Manager vs Systems Manager Parameter Store
    • Secrets Manager supports automatic rotation while SSM Parameter Store does not
    • Parameter Store is cost-effective as compared to Secrets Manager.
  • AWS Shield & Shield Advanced
    • for DDoS protection and integrates with Route 53, CloudFront, ALB, and Global Accelerator.
    • protects from common attack techniques like SQL injection and XSS, Conditions based include IP addresses, HTTP headers, HTTP body, and URI strings.
    • integrates with CloudFront, ALB, and API Gateway.
    • supports Web ACLs and can block traffic based on IPs, Rate limits, and specific countries as well
    • allows IP match set rule to allow/deny specific IP addresses and rate-based rule to limit the number of requests.
    • logs can be sent to the CloudWatch Logs log group, an S3 bucket, or Kinesis Data Firehose.
  • AWS Security Hub is a cloud security posture management service that performs security best practice checks, aggregates alerts, and enables automated remediation.
  • AWS Network Firewall is a stateful, fully managed, network firewall and intrusion detection and prevention service (IDS/IPS) for VPCs.
  • AWS Resource Access Manager helps you securely share your resources across AWS accounts, within your organization or organizational units (OUs), and with IAM roles and users for supported resource types.
  • AWS Signer is a fully managed code-signing service to ensure the trust and integrity of your code.
  • AWS Audit Manager to map your compliance requirements to AWS usage data with prebuilt and custom frameworks and automated evidence collection.
  • AWS Cognito esp. User Pools

Networking & Content Delivery

  • Virtual Private Connect – VPC
    • Security Groups, NACLs
      • NACLs are stateless, Security groups are stateful
      • NACLs at subnet level, Security groups at the instance level
      • NACLs need to open ephemeral ports for response traffic.
    • VPC Gateway Endpoints to provide access to S3 and DynamoDB
    • VPC Interface Endpoints or PrivateLink provide access to a variety of services like SQS, Kinesis, or Private APIs exposed through NLB.
    • VPC Peering
      • to enable communication between VPCs within the same or different regions.
      • Route tables need to be configured on either VPC for them to be able to communicate.
      • does not allow cross-region security group reference.
    • VPC Flow Logs help capture information about the IP traffic going to and from network interfaces in the VPC
    • NAT Gateway provides managed NAT service that provides better availability, higher bandwidth, and requires less administrative effort.
  • Virtual Private Network – VPN & Direct Connect to establish connectivity a secured, low latency access between an on-premises data center and VPC.
    • IPSec VPN over Direct Connect to provide secure connectivity.
  • CloudFront 
    • integrates with S3 to improve latency, and performance.
    • provides multiple security features
    • supports encryption at rest and end-to-end encryption
      • Viewer Protocol Policy and Origin Protocol Policy to enforce HTTPS – can be configured to require that viewers use HTTPS to request the files so that connections are encrypted when CloudFront communicates with viewers.
      • Integrates with ACM and requires certs to be in the us-east-1 region
      • Underlying origin can be applied certs from ACM or issued by the third party.
    • CloudFront Origin Shield
      • helps improve the cache hit ratio and reduce the load on the origin.
      • requests from other regional caches would hit the Origin shield rather than the Origin.
      • should be placed at the regional cache and not in the edge cache
      • should be deployed to the region closer to the origin server
    • CloudFront provides Encryption at Rest
      • uses SSDs which are encrypted for edge location points of presence (POPs), and encrypted EBS volumes for Regional Edge Caches (RECs).
      • Function code and configuration are always stored in an encrypted format on the encrypted SSDs on the edge location POPs, and in other storage locations used by CloudFront.
    • Restricting access to content
  • Route 53
    • is a highly available and scalable DNS web service.
    • Resolver Query logging
      • logs the queries that originate in specified VPCs, on-premises resources that use inbound resolver or ones using outbound resolver as well as the responses to those DNS queries.
      • can be logged to CloudWatch logs, S3, and Kinesis Data Firehose
    • Route 53 DNSSEC secures DNS traffic, and helps protect a domain from DNS spoofing man-in-the-middle attacks. 
  • Elastic Load Balancer
    • End to End encryption
      • can be done NLB with TCP listener as pass through and terminating SSL on the EC2 instances
      • can be done with ALB with SSL termination and using HTTPS between ALB and EC2 instances
  • Gateway Load Balancer – GWLB
    • helps deploy, scale, and manage virtual appliances, such as firewalls, IDS/IPS systems, and deep packet inspection systems.

Management & Governance Tools

  • CloudWatch
  • CloudTrail for audit and governance
    • CloudTrail can be enabled for all regions at one go and supports log file integrity validation
    • With Organizations, the trail can be configured to log CloudTrail from all accounts to a central account.
  • AWS Config
    • AWS Config rules can be used to alert for any changes and Config can be used to check the history of changes. AWS Config can also help check approved AMIs compliance
    • allows you to remediate noncompliant resources using AWS Systems Manager Automation documents.
    • AWS Config -> EventBridge -> Lambda/SNS
  • CloudTrail vs Config
    • CloudTrail provides the WHO and Config provides the WHAT.
  • Systems Manager
    • Parameter Store provides secure, scalable, centralized, hierarchical storage for configuration data and secret management. Does not support secrets rotation. Use Secrets Manager instead
    • Systems Manager Patch Manager helps select and deploy the operating system and software patches automatically across large groups of EC2 or on-premises instances
    • Systems Manager Run Command provides safe, secure remote management of your instances at scale without logging into the servers, replacing the need for bastion hosts, SSH, or remote PowerShell
    • Session Manager provides secure and auditable instance management without the need to open inbound ports, maintain bastion hosts, or manage SSH keys.
  • AWS Organizations
    • is an account management service that enables consolidating multiple AWS accounts into an organization that can be managed centrally.
    • can configure Organization Trail to centrally log all CloudTrail logs.
    • Service Control Policies 
      • acts as guardrails and specify the services and actions that users and roles can use in the accounts that the SCP affects.
      • are similar to IAM permission policies except that they don’t grant any permissions.
  • AWS Trusted Advisor
    • inspects the AWS environment to make recommendations for system performance, saving money, availability, and closing security gaps
  • CloudFormation
    • Deletion Policy to prevent, retain, or backup RDS, EBS Volumes
    • Stack policy can prevent stack resources from being unintentionally updated or deleted during a stack update. Stack Policy only applies for Stack updates and not stack deletion.
  • Control Tower
    • to setup, govern, and secure a multi-account environment
    • strongly recommended guardrails cover EBS encryption

Storage & Databases

  • Simple Storage Service – S3
    • Undertstand S3 Security in detail
    • S3 Encryption supports both data at rest and data in transit encryption.
      • Data in transit encryption can be provided by enabling communication via SSL or using client-side encryption
      • Data at rest encryption can be provided using Server Side or Client Side encryption
      • Enforce S3 Encryption at Rest using default encryption of bucket policies
      • Enforce S3 encryption in transit using secureTransport in the S3 bucket policy
    • S3 permissions can be handled using
    • S3 Object Lock helps to store objects using a WORM model and can help prevent objects from being deleted or overwritten for a fixed amount of time or indefinitely.
    • S3 Block Public Access provides controls across an entire AWS Account or at the individual S3 bucket level to ensure that objects never have public access, now and in the future.
    • S3 Access Points simplify data access for any AWS service or customer application that stores data in S3.
    • S3 Versioning with MFA Delete can be enabled on a bucket to ensure that data in the bucket cannot be accidentally overwritten or deleted.
    • S3 Access Analyzer monitors the access policies, ensuring that the policies provide only the intended access to your S3 resources.
  • EBS Encryption
  • Glacier Vault Lock
  • Relational Database Services – RDS
    • is a web service that makes it easier to set up, operate, and scale a relational database in the cloud.
    • supports the same encryption at rest methods as EBS
    • does not support enabling encryption after creation. Need to create a snapshot, copy the snapshot to an encrypted snapshot and restore it as an encrypted DB.


Integration Tools

  • Know how CloudWatch integration with SNS and Lambda can help in notification (Topics are not required to be in detail)

Whitepapers and articles

All the Best…

55 thoughts on “AWS Certified Security – Specialty (SCS-C01) Exam Learning Path

  1. Hey Jay is it Braincert AWS Certified Security – Speciality Practice Exams really helpfull and do you recommend any other practice test ?

    1. They cover quite a lot, that would help you prepare for the exam for sure.

  2. It’s T J. I follow your instruction, again and no surprise, pass the exam with higher score than 939 😉 HAHA. Thank you for everything you collect and summary – everything is well-organized, informative and freshest.

    My next target is the Big Data Specialty. Would you mind share something with us?

    1. Congrats TJ and thats a great score 🙂
      For Big Data, I would be sharing the learning path very soon.

    2. Congrats TJ that was a very good score. Just a quick one, did you use the braincert practice text in your preparation for the exam as Jay suggested and was it any useful?


    3. Congrats TJ that was a very good score. Just a quick one, did you use the braincert practice text in your preparation for the exam as Jay suggested and was it any useful?


    4. Hi TJ Congrats… I am also planning for aws security specialty ..which one you used Zeal Vora or Linux Academy .. from above mentioned…

  3. Hi,
    Can you please clarify the below question.

    A company wants to enable single sign-on (SSO) so its employees can log in to the management console using their corporate directory identity. Which steps below are required as part of the process? (Select 2)


    A. Create a Direct Connect connection between the corporate network and the AWS region with the company’s infrastructure.
    B. Create IAM policies that can be mapped to group memberships in the corporate directory.
    C. Create a Lambda function to assign IAM roles to the temporary security tokens provided to the users.
    D. Create IAM users that can be mapped to the employees corporate identities.
    E. Create an IAM role that establishes a trust relationship between IAM and the corporate directory identity provider(IdP).

    Right Answer:- A,D

    But some website’s are mentioned right answer B,D.

    Answer B – Create IAM policies that can be mapped to group memberships in the corporate directory is wrong.
    (Because IAM policies are not directly mapped to group memberships in the corporate directory.
    IAM roles are mapped.)

    Please advise,


  4. A company wants to enable single sign-on (SSO) so its employees can log in to the management console using their corporate directory identity. Which steps below are required as part of the process? (Select 2)


    A. Create a Direct Connect connection between the corporate network and the AWS region with the company’s infrastructure.
    B. Create IAM policies that can be mapped to group memberships in the corporate directory.
    C. Create a Lambda function to assign IAM roles to the temporary security tokens provided to the users.
    D. Create IAM users that can be mapped to the employees corporate identities.
    E. Create an IAM role that establishes a trust relationship between IAM and the corporate directory identity provider(IdP).

    Right answers:- A,D.

    But some website mentioned answers are B,D.

    Answe B:- Create IAM policies that can be mapped to group memberships in the corporate directory is wrong.

    (Because IAM policies are not directly mapped to group memberships in the corporate directory.
    IAM roles are mapped.)

    Please advise.


  5. Hi, I’ve been working in the security field for about three years now and do not have any experience working in an AWS environment.

    I’m planning to take the security speciality cert to improve my profile.

    My question is, is it possible for someone without any real work experience handling AWS workloads to crack this test by just studying the content of ACG and Linux academy and white papers and whatever I can get my hands on?

    1. Hi Sanjay,

      AWS Security focuses more on the AWS Security services like KMS, Encryption with various other services at rest and in transit, IAM and fine grained access control. So with a security background it surely gives you a jump start as you don’t need to understand the concepts but focus mostly on AWS pieces and it can be cleared easily without practical experience.

  6. Hi,
    Have you compared acloudguru course for security speciality? Is it inline with linuxacademy course? Need to buy one of those.
    Please suggest.


    1. For Speciality exams, i haven’t checked acloudguru courses. I used Linux Academy mostly but surely it does not cover all the details that are required for the exam. Check for the practice tests in the resources, they can be a great help in building and preparing for the exam.

  7. Hi,

    I am planning for sysops. How much can expect from Whizlabs questions set. Your views on it.


    1. Not seen much on Whizlabs lately, but have good feedback for Braincert. But then use the practice exams to clear the concepts. As long as you do not treat them as dumps, the associate exams are easy to clear.

      1. Hi Jay,
        I have passed the exam with score 860. Would thank you for centralize the content and studying material.

        Would be great if you share your LinkedIn profile.

  8. I have don’t have daily experience in working with aws but will I able to complete the certification of aws security with the course offered by Linux academy or acloudguru ?

  9. Hi Jay,
    I have completed the “AWS Certified Security Specialty” certification and thank u for your valuable course material.

    1. How helpful were Braincert Practice exams? I checked they’ve only got 178 Questions. Are they enough or do you need more for practice?

  10. Hi Jayant,

    which Practice Tests is better whizlab or braincerr for AWS Certified Security Specialty?


  11. Hi ,

    To prepare for the AWS security specialty exam is that mandatory AWS solution architect associate certification is must, could you please clarify.


    1. Professional and Specialty exams have not prerequisites so its not mandatory. But its good to go for SA-Associate exam for Professional and Specialty exams.

  12. Hi Jay,

    I recently passed AWS certified solutions architect associate with score 862. I didn’t have any prior experience of working for any company who is into cloud computing.
    Now, I am thinking to pursue AWS Security Speciality, my question is can I directly take this exam without doing professional cert?

    Also, does solutions architect professional cert helps in clearing Security Speciality?
    Your detailed guidance will be highly valuable.

    1. Hi Gomezi, Specialty and Professional certification does not have any prerequisites now, so you can appear directly. Professional certs would help a bit, but they are mostly parallel paths now.

  13. Your blog is having good information. Thanks, Jayendra for connecting on LinkedIn

  14. Hello Jayendra ,

    I have completed my AWS SAA-C01 associate exam couple of months back. I am thinking to go more. I am a solution architect. Do you know what is next popular exam that i should opt for?

    1. Solution Architect Professional is surely the next one to target.

      1. Thanks Jayendra,

        I have been told profactional is huge jump from associate. I was thinking to do the security speciality. Do you think it may worth doing security speciality compare to profactional first?

        Could you also tell how much time should I target for each exam?

        1. Professional and Specialty exams are at a different level than Associate ones. I would recommend you practice atleast 2-3 months for Professional one. After your first professional, you can pace the other ones accordingly.

  15. Hello,

    What practice test is recommended for the AWS Security Specialty certification exam – Braincert or Whizlabs? Also is the Braincert practice test updated to reflect the latest exam guide for the Security Specialty?

    Appreciate your thoughts.


  16. Hi Jayendra, I just completed aws pro architect.. planning for security speciality… how much time it tentatively can take

  17. Hi Jay, Congrats and i have the following questions. Please help

    1. Are there any Labs in the Exam? or only multiple choices
    2. Do i need to have deep knowledge on Solution Architect / Assocaite level certifications to pass the Security Speciality

    1. there are no labs in AWS exams, also doing Solution Architect – Associate is recommended, Professional is surely a plus. But its not mandatory.

  18. Hi Jay ,
    Hope you doing well…
    Thanks for your material it helped lot in preparing …. I passed my SA -A recently….. Planning to take Security Specialty…. Zeal udemy course is better or Now Linux and cloud guru or same ?


    1. I went through LA one and it was good, but not completely updated. Zeal one is highest rated as well on udemy.

  19. Hi Jay,

    I have some experience on AWS and my company is demanding me to get certified. Is there a pathway i have to follow to get AWS security specialty (like Associate,Architect then Specialty) or can i directly learn from the Linux academy or others and directly appear for the exam and get certified. The sooner will be much better for me as i can later go for architect & others.

    1. yup you can get certified directly. For Professional and Specialty exams there is lot of preparation needed though. Practical experience is of great help.

  20. Hi Jayendra

    Finally I cleared security specialty. Its been 4 years following your website and it really helped me in clearing 4 AWS certifications. Many thanks for your clear insight of all topics and clear justification on helpful course and exams as well.

    Whenever I wanted to take an exam, just visit your website and follow your instructions. That’s it. No second thoughts and I come out passing the exam with flying colors.

    Appreciate your great work and keep helping us as usual!

Comments are closed.