Tutorials Dojo Study Guide - AWS Certified Security Specialty (SCS-C02) - Exam Study Guide and Tips

Sep 20, 2026

Tutorials Dojo Study Guide provides an organized preparation roadmap for the AWS Certified Security Specialty exam (SCS-C02), covering exam details, domains, scoring, and key benefits. It outlines study materials and AWS services to focus on, then guides learners through common exam scenarios and knowledge validation methods. The guide explains practical security topics across threat detection, incident response, logging and monitoring, infrastructure security, identity and access management, data protection, and governance using AWS services and best practices.

LanguageEnglish

CategoryExam

FormatPDF

Pages37

Reading Time1 h 33 min

AccessFree to download

TABLE OF CONTENTS

INTRODUCTION

AWS CERTIFIED SECURITY SPECIALTY EXAM-STUDY GUIDE AND TIPS

AWS CERTIFIED SECURITY SPECIALTY EXAM OVERVIEW

Domain 1:Threat Detection and Incident Response

Domain 2:Security Logging and Monitoring

Domain 3:Infrastructure Security

Domain 4:Identity and Access Management

Domain 5:Data Protection

Domain 6:Management and Security Governance

JON BONSO AND CA R LO A CE BEDO Tutorials Dojo Study Guide # TABLE OF CONTENTS INTRODUCTION 56Exam Details6Exam Domains7Exam Scoring System9Exam Benefits10AWS CERTIFIED SECURITY SPECIALTY EXAM-STUDY GUIDE AND TIPS11Study Materials12AWS Services to Focus On13Common Exam Scenarios16The Old SCS-C01 vs the New SCS-C02 Exam Version21Validate Your Knowledge22Sample Practice Test Questions:23Question 123Question 22528Overview29Using AWS Config Rules for Automated Checks and Remediation30Incident Response Management using Trusted Advisor34Evaluating the Impact of an Exposed AWS Access Key38Incident Response Using Amazon GuardDuty40AWS Personal Health Dashboard45Using Amazon S3 Object Lock for Preserving Forensic Evidence47Using Amazon Inspector for Incident Management48AWS Systems Manager Patch Manager51Securing Amazon EC2 Instances That Have Compromised SSH Private Keys52AWS Artifact Security Reports and AWS Compliance-Related Information55AWS Abuse5759Overview60Logging and Monitoring Services in AWS61AWS CloudTrail64Central Logging Using AWS CloudTrail67Amazon CloudWatch Logs Agent Troubleshooting70 AWS CERTIFIED SECURITY SPECIALTY EXAM OVERVIEW Domain 1:Threat Detection and Incident Response Domain 2:Security Logging and Monitoring Central Log Collection using CloudWatch Logs72Using CloudWatch Metric Filter When Too Many Unauthorized AWS API Requests are Identified74Amazon CloudWatch Managed Policies79Real-time Logging Using Amazon Data Firehose and Amazon OpenSearch Service808283AWS WAF and AWS Firewall Manager85Blocking User Requests Based On User-Agent HTTP Header91AWS Network Firewall91Adding HTTP Security Headers on the fly in CloudFront93Securing Amazon S3 and CloudFront Web Distributions95Uploading Large Encrypted Files in a SSE-KMS enabled S3 Bucket100Protecting from DDOS Attacks through AWS Shield101Investigating AWS Resources that are Possibly Compromised103Amazon Cognito105Managing Instance Profile112Using VPN to Protect Employees Who are Connecting to AWS Resources115AWS Direct Connect118Penetration Testing in AWS119AWS Billing Permissions121Preventing Staff from Adding Rules to Security Groups without any Approval124Setting up Intrusion Prevention System(IPS)and Intrusion Detection System(IDS)Software127Connecting On-premises Active Directory to AWS Managed Microsoft Active Directory129Setting up Single Sign-On Access Between On-premises Active Directory and AWS using ADFS and IAMIdentity Center (previously known as AWS SSO)130NACL-Ephemeral Port Range133Minimize Potential Attack Surface136Using AWS Systems Manager Parameter Store and AWS Secrets Manager to Store System Credentials 138Secure String Parameter140Hardening AMls using EC2 Image Builder143Scanning vulnerabilities in container images using Amazon ECR144Amazon VPC Flows Logs145Exploring AWS Security:Network Access Analyzer in VPC146Amazon GuardDuty Multi-account Aggregation147Testing network connectivity using VPC Reachability Analyzer151Host-Based Security152Domain Whitelisting Using Proxy Servers156 ## Domain 3:Infrastructure Security Overview Certificate Management Using AWS Certificate Manager157Elastic Load Balancer Security160DynamoDB Security163165166AWS Identity Access Manager(IAM)167How AWS IAM Handles Conflicting IAM Policies Attached to a Resource172IAM Permissions Boundary174Using the iam:PassRole permission to pass an IAM Role to AWS Services188Mapping Permissions of Active Directory User Attributes to AWS Services191Using AWS Organizations to Provide Access to Third-Party AWS Accounts192Generating Credential Reports for your AWS Account Using AWS IAM195Choosing the Most Suitable AWS STS API for Authentication197Leveraging IAM Access Analyzer to grant least privilege of access204Implementing Role-Based Access Control(RBAC)and Attribute-Based Access Control(ABAC)205208Overview209AWS Key Management Service(AWS KMS)210AWS KMS API213Delegating Permissions and KMS Actions in AWS KMS216AWS KMS Key Rotation219Using Encryption Context

FAQs

What does the study guide include for the AWS Certified Security Specialty (SCS-C02) exam?

It includes exam details, domains, scoring system, benefits, study materials, and AWS services to focus on. It also provides common exam scenarios and guidance for validating knowledge.

How does the guide structure its security topics across the exam domains?

It organizes content by domains such as threat detection and incident response, security logging and monitoring, infrastructure security, identity and access management, data protection, and management/governance. Each domain groups related AWS security capabilities and tasks.

What types of practical preparation content are offered in the guide?

The guide includes sample practice test questions and explanations for key security workflows, such as using AWS Config rules, incident response with tools like GuardDuty, configuring logging with CloudTrail/CloudWatch, and hardening common AWS services.

Sep 20, 2026

Upload by Aria Callaghan