SCS-C03 Cheat Sheet: Security Specialty Quick Reference

SCS-C03 rewards knowing which control detects, prevents, or responds — and the exact service mechanics. This sheet groups the highest-frequency distinctions.

Detection services

• GuardDuty — threat detection from CloudTrail/VPC Flow/DNS logs + malware scans; findings, not prevention
• Security Hub — findings aggregator (ASFF format) + standards checks (CIS, FSBP)
• Inspector — vulnerability scanning for EC2/ECR/Lambda; ECR scan-on-push + continuous
• Macie — sensitive data (PII) discovery in S3
• Detective — behavior-graph investigation over findings/flow logs/CloudTrail
• Config — resource config history + compliance rules; CloudTrail — API audit trail

Incident response

• Isolate EC2: swap SG → forensics SG, then snapshot EBS + capture memory — never terminate/stop first
• Compromised credentials: deactivate key → rotate → review CloudTrail for abuse → SCP boundary if needed
• Automate: EventBridge on findings → SSM Automation/Lambda runbooks
• Artifact service for legal/compliance agreements; Abuse team contact for reporting

Infrastructure security

• SGs are stateful (responses auto-allowed); NACLs are stateless (need ephemeral-port rules)
• ALB = L7; NLB = L4 + static IP; endpoint services = PrivateLink
• WAF — L7 rules (SQLi/XSS/rate/geo/managed); Shield Standard free auto DDoS; Shield Advanced = DRT + cost protection
• Network Firewall — stateful VPC boundary inspection; Route 53 Resolver DNS Firewall — domain filtering

IAM deep-dive

• Evaluation order: explicit Deny → SCP → resource policy → session policy → permission boundary → identity policy
• Permission boundaries cap what delegated admins can grant (aws:PermissionsBoundary condition)
• Roles for cross-account/federation; access analyzer for external access + unused access findings
• OIDC federation for GitHub/CI workloads — no long-lived keys

Data protection

• KMS: symmetric for data encryption, envelope encryption via data keys; automatic yearly rotation on CMKs
• SSE-S3 / SSE-KMS / SSE-C / client-side — know who manages the keys in each
• CloudHSM — dedicated single-tenant HSM when you must control key material
• Secrets Manager — auto-rotation + cross-service creds; Parameter Store — free, no rotation
• Certificate Manager — free public TLS certs, auto-renewal, ALB/CloudFront integration

Governance

• SCPs set permission ceilings per OU/account — they never grant
• Control Tower guardrails: preventive=SCPs, detective=Config rules, proactive=CFN hooks
• Organization CloudTrail → single log-archive account; Config aggregator for fleet compliance
• Service Catalog / account vending for approved, guardrailed products