AWS Security Specialty Flashcards (SCS-C02)
Most SCS-C02 questions are not asking whether you know a service exists. They describe a situation and offer four real AWS services, all of which are genuinely security services, and only one of which answers the question being asked. The failure mode is picking a plausible service from the right domain that does the wrong job.
Three ideas carry more weight than the rest, and it’s worth having them straight before you start the deck.
Permission evaluation is a pipeline with a fixed order, and an explicit Deny at any stage ends it. An SCP never grants anything, it only lowers the ceiling. And a KMS key policy is the root of trust for that key, which means it can deny an account administrator who has full IAM access, and it’s also how people lock themselves out of their own data permanently.
The deck is weighted the way the exam is, so Domain 3 has the most cards and Domains 1 and 6 the fewest. Cards with a code snippet are the ones where the exam expects you to recognise a specific policy shape or CLI flag rather than just the concept.
All cards in this deck70 cards
Listed for reference and for searching. Use the deck above to study; recall works better than reading.
GuardDuty, Security Hub, Detective: which does what?
GuardDuty detects threats by analysing CloudTrail, VPC Flow Logs and DNS logs, and produces findings. Security Hub aggregates findings from GuardDuty, Inspector, Macie and third parties, and scores them against standards like CIS and AWS Foundational Security Best Practices. Detective takes a finding and builds a graph of the related activity so you can investigate it. Detect, aggregate, investigate.
Does GuardDuty require you to enable CloudTrail or VPC Flow Logs first?
No. GuardDuty reads those log sources directly through an internal channel, independently of whether you have a trail or flow logs configured, and you are not billed for the log delivery. This is a common exam trap: enabling GuardDuty does not require any logging prerequisite, though you still want your own trail for investigation and retention.
What does Macie actually find?
Sensitive data inside S3 objects. It samples and classifies objects to report personally identifiable information, credentials, financial data and health data, and it also reports bucket-level posture such as public access or missing encryption. It only works on S3, so any question about finding PII in RDS or DynamoDB is not Macie.
An EC2 instance is confirmed compromised. What is the correct order of actions?
Preserve evidence first, then contain. Snapshot the EBS volumes, capture memory if you can, then isolate the instance by replacing its security group with one that allows nothing, and revoke the instance role session. Terminating the instance first destroys the investigation, which is why "terminate immediately" is nearly always the wrong answer.
How do you revoke credentials that a compromised instance already obtained from its role?
You cannot invalidate an already-issued temporary credential directly. Attach an inline policy to the role that denies everything where `aws:TokenIssueTime` is earlier than now. IAM Console offers this as "Revoke active sessions". The existing credentials remain technically valid until expiry but every call they make is denied.
{ "Effect": "Deny", "Action": "*", "Resource": "*", "Condition": { "DateLessThan": {"aws:TokenIssueTime": "2026-11-03T10:00:00Z"} } }What is the standard pattern for automated response to a GuardDuty finding?
GuardDuty publishes findings to EventBridge. An EventBridge rule matches on finding type or severity and invokes a Lambda function or an SSM Automation runbook, which performs the containment action. Every incident-response question about automation is describing this chain.
A GuardDuty finding says CryptoCurrency:EC2/BitcoinTool.B!DNS. What does the !DNS suffix mean?
The detection came from DNS query analysis rather than from VPC Flow Logs or CloudTrail. It matters operationally: DNS-based findings only appear when the instance uses the VPC-provided DNS resolver. An instance configured with an external resolver such as 8.8.8.8 will not generate them, which is a real detection gap.
Can GuardDuty findings be centralised across an organisation?
Yes. Designate a delegated administrator account through AWS Organizations, and member accounts publish their findings to it automatically, including new accounts if auto-enable is on. Same model for Security Hub, Macie, Inspector and Detective, and it is the expected answer to any multi-account visibility question.
What does Security Hub do that GuardDuty does not?
Two things. It normalises findings from many sources into the AWS Security Finding Format so they are comparable, and it runs continuous compliance checks against security standards, giving you a per-control pass or fail rather than an event. GuardDuty tells you something happened; Security Hub tells you something is misconfigured.
What is the difference between a CloudTrail management event and a data event?
Management events record control-plane operations: creating a bucket, changing a policy, launching an instance. They are logged by default. Data events record data-plane operations: S3 object GET and PUT, Lambda invocations, DynamoDB item access. They are off by default, billed separately, and much higher volume.
"We have CloudTrail enabled but cannot see who downloaded the object." Why?
S3 object-level access is a data event, and data events are not logged by default. You need to enable S3 data events on the trail for that bucket, or turn on S3 server access logging. This is one of the most reliably tested facts in Domain 2.
How do you make a CloudTrail log file tamper-evident?
Enable log file validation. CloudTrail writes a signed digest file every hour containing hashes of the log files delivered in that period, signed with a private key. `aws cloudtrail validate-logs` verifies both the digest signature and the file hashes, so any modification or deletion is detectable.
aws cloudtrail update-trail --name org-trail --enable-log-file-validation aws cloudtrail validate-logs --trail-arn <arn> --start-time 2026-11-01T00:00:00ZHow do you stop an administrator from deleting CloudTrail logs in the S3 bucket?
Use a separate log-archive account that no one has standing access to, plus S3 Object Lock in compliance mode with a retention period. Compliance mode cannot be shortened or disabled by anyone, including the account root user. An SCP denying `s3:DeleteObject` on that bucket adds a second layer.
What do VPC Flow Logs contain, and what do they not contain?
They contain packet metadata: source and destination IP and port, protocol, packet and byte counts, action taken (ACCEPT or REJECT), and which interface. They do not contain payload. Any question about inspecting packet contents is Traffic Mirroring, not Flow Logs.
Flow logs show ACCEPT for the inbound request but nothing for the response. Why?
Security groups are stateful, so the return traffic of an allowed inbound flow is implicitly allowed and appears as part of the same flow. If you see an inbound ACCEPT and an outbound REJECT for the response, the cause is a NACL, because NACLs are stateless and need an explicit outbound rule covering the ephemeral port range.
What is AWS Config for, as distinct from CloudTrail?
CloudTrail records the API call that changed something. Config records the resulting configuration state over time, and evaluates it against rules. "Who changed this security group" is CloudTrail. "Which security groups currently allow 0.0.0.0/0 on port 22, and when did that start" is Config.
What is a Config conformance pack?
A collection of Config rules and remediation actions packaged as a single YAML template you can deploy to an account or across an organisation. AWS publishes packs mapped to frameworks such as CIS, PCI DSS and NIST 800-53, which makes it the fast answer to "how do we check compliance against framework X".
How do you get a Config rule to fix the violation instead of only reporting it?
Attach a remediation action to the rule, which invokes an SSM Automation document. Set it to automatic for hands-off correction, and specify a retry count. The common example is a rule detecting an unencrypted S3 bucket and a remediation document enabling default encryption.
What does Audit Manager add over Config?
It collects evidence continuously and assembles it into an audit-ready report mapped to a framework control. Config tells you whether a control passes right now; Audit Manager builds the paper trail an external auditor asks for, including the underlying CloudTrail events and Config snapshots as evidence.
How do you detect a specific pattern in CloudWatch Logs and alarm on it?
Create a metric filter on the log group that matches the pattern and publishes to a custom CloudWatch metric, then create an alarm on that metric. The canonical exam example is alarming on root account usage or on repeated failed console logins.
aws logs put-metric-filter \ --log-group-name aws-cloudtrail-logs \ --filter-name root-usage \ --filter-pattern '{ $.userIdentity.type = "Root" }' \ --metric-transformations metricName=RootUsage,metricNamespace=Security,metricValue=1What is CloudTrail Lake?
A managed data store that keeps CloudTrail events for up to ten years and lets you query them with SQL, without setting up Athena over an S3 bucket. When a question asks for long-term retention plus ad-hoc querying with the least operational overhead, this is the intended answer.
Security group versus network ACL: state every difference.
Security group: attached to an ENI, stateful, allow rules only, all rules evaluated together, supports referencing another security group as a source. NACL: attached to a subnet, stateless, allow and deny rules, evaluated in rule-number order with the first match winning, CIDR only.
Why does a NACL need ephemeral ports open?
Because it is stateless. It evaluates the outbound response as an independent packet, and that packet leaves from a high-numbered source port. Without an outbound allow rule covering roughly 1024 to 65535, the response is dropped even though the request was allowed.
Can a security group reference another security group?
Yes, and it is the preferred pattern. Allowing port 5432 from `sg-app` rather than from a CIDR means the rule keeps working as instances are replaced and IPs change. This works within a VPC and across peered VPCs in the same region, but not across regions.
WAF, Shield, Shield Advanced, Network Firewall: which layer does each work at?
WAF is layer 7, inspecting HTTP requests for SQL injection, cross-site scripting, bad bots and rate limits. Shield Standard is automatic layers 3 and 4 DDoS protection at no cost. Shield Advanced adds higher-layer DDoS detection, cost protection and the response team. Network Firewall is a stateful VPC-level firewall with IPS rules, inspecting traffic at a subnet route level.
Where can a WAF web ACL be attached?
CloudFront, Application Load Balancer, API Gateway, AppSync, Cognito user pools, App Runner and Verified Access. Not on a Network Load Balancer, because an NLB works at layer 4 and WAF needs the HTTP layer. That last point is regularly tested.
What does Shield Advanced give you that Shield Standard does not?
Detection of application-layer DDoS, 24/7 access to the Shield Response Team, cost protection that refunds scaling charges caused by an attack, and WAF at no extra cost for protected resources. It has a monthly commitment, which is why the answer depends on whether the question mentions cost protection or the response team.
How do you patch EC2 instances that have no internet access and no SSH?
Systems Manager Patch Manager, with the SSM Agent reaching the service through VPC interface endpoints for ssm, ssmmessages and ec2messages. No inbound ports, no bastion, no SSH key. Any question mentioning "no inbound access" plus patching or shell access is pointing at Systems Manager.
What is Session Manager and why is it preferred over a bastion host?
It gives an interactive shell through the SSM API, so there is no inbound port, no SSH key to manage and no bastion to patch. Every session is authorised through IAM and can be logged to CloudWatch Logs or S3, which gives you an auditable record of what was typed.
What does Amazon Inspector scan?
EC2 instances, container images in ECR, and Lambda functions, for known CVEs and for unintended network exposure. It is continuous and agentless for EC2 through SSM. It does not scan for misconfiguration of AWS resources; that is Config and Security Hub.
What is a VPC endpoint policy, and why does it matter for security?
A resource policy on the endpoint itself that restricts which resources can be reached through it. On an S3 gateway endpoint you can allow access only to your own buckets, which prevents data exfiltration to an attacker-controlled bucket even by a principal whose IAM policy is broad.
{ "Effect": "Allow", "Principal": "*", "Action": "s3:*", "Resource": ["arn:aws:s3:::my-bucket", "arn:aws:s3:::my-bucket/*"] }How do you inspect the actual packet contents of traffic in a VPC?
VPC Traffic Mirroring. It copies packets from an ENI to a monitoring appliance for deep inspection by an IDS. Flow Logs give you metadata only, so any question about payload inspection, protocol analysis or signature matching on raw traffic is Traffic Mirroring.
What is the order a packet meets network controls on the way in?
Shield, then WAF at CloudFront or the ALB, then routing which may send it through Network Firewall or a Gateway Load Balancer appliance, then the subnet NACL, then the instance security group, then any host firewall. Knowing the order tells you which control to inspect when traffic is unexpectedly dropped.
What is the full IAM policy evaluation order?
An explicit Deny anywhere wins immediately. Otherwise: is it denied by an Organizations SCP, then a resource control policy, then a permission boundary, then a session policy? If any of those does not allow it, the request is denied. Only if all of them allow it does an identity or resource policy Allow take effect. Default is deny.
Does an SCP grant permissions?
Never. An SCP is a filter that defines the maximum available permissions in an account. A principal still needs an IAM policy granting the action. An SCP also applies to the account root user, which is what makes it the strongest guardrail available, and it does not apply to the management account.
What is a permission boundary, and how does it differ from an SCP?
A permission boundary is a managed policy attached to an IAM user or role that caps what that principal can do, regardless of its identity policies. An SCP applies to an entire account. Boundaries are how you safely let developers create roles: they can grant only what the boundary already permits.
What is confused deputy, and which condition keys prevent it?
A third party with permission to act on your resources is tricked by another customer into acting on theirs, or vice versa. Prevent it with `sts:ExternalId` in the role trust policy for cross-account third-party access, and with `aws:SourceArn` and `aws:SourceAccount` when an AWS service assumes a role on your behalf.
"Condition": { "StringEquals": {"sts:ExternalId": "unique-per-customer-value"} }Which wins: an identity policy Allow or a resource policy Deny?
The Deny. An explicit Deny in any applicable policy overrides every Allow. Within the same account, an Allow in either the identity policy or the resource policy is enough. Across accounts, both sides must allow it, with S3 as a notable exception where a bucket policy alone can suffice.
What does IAM Access Analyzer do?
Uses automated reasoning to find resources whose policies grant access outside your trust zone, meaning external accounts or the public. It also generates least-privilege policies from CloudTrail history and validates policies for errors. The exam distinguishes it from Config, which checks rules rather than proving reachability.
How does IAM Identity Center differ from creating IAM users?
Identity Center federates identities from an external provider or its own directory and issues short-lived credentials through permission sets, so there are no long-lived access keys and no per-account user sprawl. Any question about workforce access to many accounts wants Identity Center, not IAM users.
What is the correct way for an application on EC2 to get credentials?
An instance profile containing an IAM role. The SDK retrieves temporary credentials from the instance metadata service and rotates them automatically. Never embed access keys. Enforce IMDSv2 so the token-based request model blocks the SSRF attack that made IMDSv1 dangerous.
Why is IMDSv2 a security control rather than just a version bump?
IMDSv1 answers a plain GET, so a server-side request forgery bug in your application can be tricked into fetching role credentials. IMDSv2 requires a PUT to obtain a session token first, and sets a TTL of 1 on the response so it cannot cross a network hop. Enforce it with `HttpTokens=required`.
aws ec2 modify-instance-metadata-options \ --instance-id i-0abc123 \ --http-tokens required --http-put-response-hop-limit 1How do you let an application in account A read an S3 bucket in account B?
Either a bucket policy in B allowing the role in A, plus an identity policy in A allowing the S3 action, or a role in B that A assumes. For S3 the bucket policy route works without a role assumption. Remember that if the object is encrypted with a customer-managed KMS key, the key policy must also allow the principal.
What is an ABAC policy and when is it the right answer?
Attribute-based access control matches tags on the principal against tags on the resource, so one policy scales to any number of teams. Use `aws:PrincipalTag` and `aws:ResourceTag` with a condition requiring them to be equal. It is the answer when a question asks for access control that does not need a new policy per team.
"Condition": { "StringEquals": {"aws:ResourceTag/team": "${aws:PrincipalTag/team}"} }What does aws:PrincipalOrgID do?
Restricts access to principals inside your AWS Organization, without listing every account ID. Put it in a resource policy condition and new accounts are covered automatically as they join. It is the clean answer to "allow all our accounts, and only ours".
What is a KMS key policy, and why can it override IAM?
Every KMS key has a resource policy, and it is the primary authority for that key. Unlike most services, IAM permissions alone are not sufficient: the key policy must allow the principal, either directly or by delegating to IAM with a statement allowing the account root with `kms:*`. A Deny in the key policy blocks even a full administrator.
How can you lock yourself out of a KMS key permanently?
By writing a key policy that does not allow any principal you still control to call `kms:PutKeyPolicy`. There is no override, no support escalation, and the encrypted data becomes unrecoverable. This is why the default policy delegates to the account root, and why you should keep that statement.
AWS managed key, customer managed key, AWS owned key: what is the practical difference?
AWS owned keys are invisible to you and shared across customers. AWS managed keys appear as aws/service, rotate yearly, are free, and you cannot edit their policy. Customer managed keys cost about a dollar a month, let you write the key policy, control rotation, add grants, and are required for cross-account access and for automatic rotation control.
What is envelope encryption?
KMS generates a data key, returns it in plaintext and encrypted form, your client encrypts the data locally with the plaintext key and stores the encrypted key alongside the ciphertext, then discards the plaintext. It means large objects never traverse KMS, and it is why the 4KB KMS payload limit is not a practical constraint.
What is a KMS grant, and when do you use one instead of a key policy?
A grant is a temporary, programmatic delegation of specific key operations to a principal, optionally scoped by encryption context. Use it for short-lived or per-request access, such as a service needing to decrypt on your behalf for one operation. It avoids editing the key policy for a transient need.
What is encryption context and what is it for?
A set of non-secret key-value pairs bound cryptographically to the ciphertext as additional authenticated data. Decryption fails unless the same context is supplied, so it prevents a ciphertext being replayed in a different context. It also appears in CloudTrail, which makes KMS usage auditable at a per-object level.
aws kms encrypt --key-id alias/app \ --plaintext fileb://secret.txt \ --encryption-context tenant=acme,purpose=backupSSE-S3, SSE-KMS, SSE-C, DSSE-KMS: how do they differ?
SSE-S3 uses keys S3 manages, free, no audit trail per object. SSE-KMS uses a KMS key, giving you a key policy and CloudTrail visibility, and is the usual answer. SSE-C means you supply the key on every request and AWS stores nothing, so losing it loses the data. DSSE-KMS applies two layers of encryption for regulatory requirements.
What is an S3 Bucket Key and why enable it?
It caches a bucket-level data key so S3 makes far fewer KMS calls, cutting KMS request costs by up to 99% for high-volume workloads. It changes nothing about the security model, so it is the correct answer whenever a question pairs SSE-KMS with a cost concern.
How do you enforce that every object uploaded to a bucket is encrypted with a specific KMS key?
A bucket policy denying `s3:PutObject` when `s3:x-amz-server-side-encryption-aws-kms-key-id` does not equal your key ARN. Default bucket encryption alone is not enforcement: it fills in a missing header but does not reject an explicit request for a different key.
{ "Effect": "Deny", "Action": "s3:PutObject", "Resource": "arn:aws:s3:::my-bucket/*", "Condition": { "StringNotEquals": { "s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:...:key/abc" } } }Secrets Manager or Parameter Store?
Secrets Manager for anything needing automatic rotation, cross-region replication, or a resource policy for cross-account sharing, at roughly 40 cents per secret per month. Parameter Store SecureString for configuration and simple secrets, free at standard tier, no built-in rotation. Rotation in the question means Secrets Manager.
How does Secrets Manager rotation actually work?
A Lambda function implements four steps: createSecret makes a new value with the AWSPENDING label, setSecret applies it to the service, testSecret verifies it works, finishSecret moves the AWSCURRENT label. Because the old value stays as AWSPREVIOUS during the switch, running clients do not break mid-rotation.
Can you rotate a KMS key and still decrypt old data?
Yes. Automatic rotation creates new key material for the same key ID and retains all previous material. New encryptions use the current material, and decryption automatically selects the material the ciphertext was created with. The key ARN never changes, so nothing in your application needs updating.
What does ACM do, and what is the one region rule to remember?
It provisions and auto-renews public TLS certificates at no cost, for use with CloudFront, ALB, API Gateway and other integrated services. The rule: a certificate for CloudFront must be issued in us-east-1, regardless of where anything else lives. ACM public certificates cannot be exported for use on your own servers.
How do you encrypt an existing unencrypted RDS instance?
You cannot enable encryption in place. Take a snapshot, copy the snapshot while specifying a KMS key, and restore from the encrypted copy. Then cut over. The same applies in reverse: you cannot remove encryption from an encrypted instance.
Which S3 encryption option leaves no way to recover the data if you lose the key?
SSE-C. You supply the key with every request over HTTPS, S3 uses it and discards it, storing only a salted HMAC to validate future requests. No key, no data, and no recovery path through AWS support.
What does Control Tower add on top of Organizations?
A prescriptive landing zone: an organisation structure with log-archive and audit accounts, a set of preventive guardrails implemented as SCPs and detective guardrails implemented as Config rules, and Account Factory for provisioning new accounts already conforming to it. Organizations is the primitive; Control Tower is the opinionated setup.
Preventive versus detective guardrail: which mechanism is each?
Preventive guardrails are SCPs, so they block the API call before it happens. Detective guardrails are Config rules, so they report a resource that is already non-compliant. If a question asks to stop an action, that is an SCP. If it asks to find existing violations, that is Config.
How do you prevent anyone in any member account from disabling CloudTrail?
An organization trail created from the management account, which member accounts cannot modify or delete, plus an SCP denying cloudtrail:StopLogging, DeleteTrail and UpdateTrail. The SCP applies to the root user of those accounts, which is the only way to make it genuinely unbypassable.
{ "Effect": "Deny", "Action": ["cloudtrail:StopLogging", "cloudtrail:DeleteTrail", "cloudtrail:UpdateTrail"], "Resource": "*" }Why should the management account not run workloads?
Because SCPs do not apply to it. Any restriction you write for the organisation is unenforceable there, so a compromise of a workload in the management account has no guardrails above it. Best practice is to keep it for billing and organisation management only.
What is the log-archive account pattern?
A dedicated account holding the S3 bucket for CloudTrail, Config and flow logs, with no standing human access, Object Lock in compliance mode for retention, and an SCP preventing deletion. It means an attacker who compromises a workload account cannot destroy the record of what they did.
What is Trusted Advisor, and how does it differ from Security Hub?
A checks service across cost, performance, security, fault tolerance and service limits. Its security checks are a small fixed set, such as open security groups and MFA on root. Security Hub runs a far broader continuous compliance assessment against named standards. Trusted Advisor is a health check, not a compliance framework.
How do you enforce a tagging standard across an organisation?
Tag policies in Organizations define the allowed values and capitalisation for a tag key, and report non-compliant resources. To actually block creation, add an SCP with a condition on `aws:RequestTag` denying the action when the required tag is missing. Tag policies alone report; the SCP prevents.
What is a resource control policy (RCP)?
An Organizations policy type that caps the maximum permissions available on resources in your accounts, the counterpart to an SCP which caps principals. An RCP can stop an S3 bucket policy from granting access to an external principal even if a bucket owner writes such a policy. It is the newer control for preventing external sharing organisation-wide.
How do you find out whether an S3 bucket is publicly accessible across 200 accounts?
IAM Access Analyzer with the organisation as the zone of trust reports every resource reachable from outside it, using policy reasoning rather than heuristics. Security Hub surfaces the same class of finding through its standards. For prevention, S3 Block Public Access at the account level, enforced by an SCP.
What is the one thing you should do to every root user in the organisation?
Enable a hardware MFA device, remove any access keys, and then stop using it. Root cannot be restricted by an SCP in the management account and has irrevocable powers such as closing the account and changing the support plan, so the control is procedural: MFA plus an alarm on any root API activity.
