AWS SCS-C03 Cheat Sheet: IAM, Detection, and Data Protection

Use this cheat sheet for AWS Certified Security - Specialty (SCS-C03) after you know the basics but before you start a timed practice block. The goal is not to memorize a vendor catalog; the goal is to classify the scenario and reject attractive wrong answers quickly.

SCS-C03 is a control-chain exam. The best answer usually combines identity evaluation, data protection, detection, incident response, and governance evidence. If an option fixes only one layer while ignoring the named risk, key boundary, log source, or organization guardrail, keep looking.

Quick facts (SCS-C03)

I verified these current AWS exam facts on May 24, 2026.

Domain weights and review priority

IAM is the largest single domain, but the exam rarely isolates IAM from data protection, logging, and governance. Expect long scenarios where the correct answer combines policy evaluation, evidence, and containment.

Security proof stack

SCS-C03 questions usually ask whether a control actually reduces the named risk and leaves enough evidence to prove it. Keep this stack in mind before choosing a service:

1. Identify the protected asset: account, identity, workload, network path, key, secret, data set, log stream, or organization boundary.
2. Find the control plane: IAM, Organizations, SCPs, resource policies, KMS key policies, service control settings, and delegated admin decide who can change security.
3. Find the data plane: S3 objects, databases, queues, streams, APIs, network flows, certificates, secrets, and backups decide what can be read, written, encrypted, retained, or exfiltrated.
4. Add detection evidence: CloudTrail, GuardDuty, Security Hub, Config, VPC Flow Logs, Macie, Inspector, Detective, Security Lake, and CloudWatch must show what happened.
5. Contain safely: isolate resources, revoke sessions, rotate credentials, block paths, quarantine data, or stop traffic without destroying forensic evidence unless availability is explicitly the priority.
6. Prove governance: centralize logs, aggregate findings, enforce guardrails, preserve audit trails, and show that the control works across accounts and Regions where required.

If an answer fixes access but ignores the KMS key, fixes encryption but ignores logs, or remediates an incident while destroying evidence, it is usually incomplete.

Official task compression

First-pass question triage

1. Name the tested lane before reading the answer choices.
2. Underline the constraint: security, cost, reliability, latency, governance, implementation effort, or evidence.
3. Reject answers that solve a neighboring problem but not the stated requirement.
4. Prefer the smallest correct control, service, workflow, or command that satisfies the constraint.
5. Look for proof: logs, tests, metrics, policy evidence, deployment status, evaluation results, or user-visible recovery.

Question-type traps

Unanswered questions are incorrect and there is no penalty for guessing. Ordering and matching items are all-or-nothing, so slow down when the answer depends on sequence or exact service purpose.

Control-chain model

    flowchart LR
	  T["Threat, audit finding, or access request"] --> I["Identity and policy boundary"]
	  I --> D["Data, key, secret, or certificate boundary"]
	  D --> N["Network, edge, workload, or AI app boundary"]
	  N --> L["Logs, findings, metrics, and evidence"]
	  L --> R["Contain, remediate, recover, and prove compliance"]

Use this model before reading the options. A security answer that adds GuardDuty but ignores missing CloudTrail, adds KMS but ignores key policy, or adds WAF but leaves the real path uninspected is incomplete.

Security triage flow

Use this when the question mixes identity, encryption, logging, and incident response.

    flowchart TD
	  D["Security scenario"] --> I["Identity and access"]
	  I --> K["KMS / encryption / key policy"]
	  K --> L["Logging / detection / evidence"]
	  L --> R["Contain, isolate, and remediate"]

SCS-C03 answer sequence

Use this when the stem mixes identity, keys, logs, and response actions.

    flowchart TD
	  S["Scenario"] --> I["Identity and authorization"]
	  I --> K["Encryption and key policy"]
	  K --> L["Logs, findings, and evidence"]
	  L --> R["Contain and remediate"]
	  R --> V["Verify recovery and preserve audit trail"]

What to know cold

Scenario eliminations

SCS-C03 distractors often name the right security service but at the wrong layer. Keep the answer only if it fits the control plane, data plane, identity boundary, and evidence requirement named in the stem.

Final answer stack

When two answer choices both sound secure, keep the one that satisfies the full security loop:

1. Start with the stated risk. Is the stem about unauthorized access, sensitive data exposure, threat detection, incident containment, network exposure, key custody, or audit evidence?
2. Evaluate every authorization layer. Explicit deny, SCP, permission boundary, session policy, identity policy, resource policy, endpoint policy, and KMS key policy can all decide the result.
3. Choose the control at the layer that sees the threat. Use WAF for HTTP patterns, Network Firewall for routed inspection, IAM/SCPs for permissions, KMS for key use, Macie for S3 sensitive-data discovery, and GuardDuty for threat findings.
4. Preserve evidence before destructive cleanup. Snapshot, isolate, log, and record timeline when investigation matters; rotate or revoke credentials when identity is compromised.
5. Prefer central enforceable governance. For multi-account requirements, choose Organizations, Control Tower, delegated admin, Config aggregators, Security Hub, Firewall Manager, or SCPs instead of account-by-account manual controls.
6. Avoid out-of-scope depth. The exam is not asking you to design cryptographic algorithms, analyze packet payloads manually, architect all cloud deployments, manage end-user devices, or train ML models.

Detection and evidence chooser

Security service chooser

Infrastructure security chooser

IAM and KMS evaluation order

    flowchart TD
	  R["Request"] --> D["Explicit deny?"]
	  D --> S["SCP or org guardrail?"]
	  S --> B["Permission boundary or session policy?"]
	  B --> I["Identity policy allows?"]
	  I --> P["Resource policy allows?"]
	  P --> K["KMS key policy/grant allows?"]
	  K --> A["Access succeeds only if every required layer permits it"]

What to notice:

• one allow is not enough when another layer denies or omits access
• organization guardrails can include SCPs, resource control policies, AI service opt-out policies, and other central policy layers depending on the scenario
• KMS-encrypted resources add a separate key-authorization decision
• cross-account access usually needs both caller-side permissions and resource-side trust

Data protection chooser

Incident response order

    flowchart LR
	  D["Detect finding"] --> E["Preserve evidence"]
	  E --> C["Contain blast radius"]
	  C --> R["Revoke or rotate credentials"]
	  R --> M["Remediate root cause"]
	  M --> V["Validate recovery"]
	  V --> L["Update runbook and controls"]

Do not pick answers that destroy forensic evidence before capture unless the stem explicitly prioritizes immediate availability over investigation. Security Specialty questions usually expect containment plus evidence preservation.

Governance and compliance chooser

Common traps and better instincts

Final 15-minute review

Practice fit

Use IT Mastery for the exact product route, practice status, spaced review when available, and close-answer explanation practice as coverage expands.

Decision order

Security Specialty answers usually combine identity evaluation, data protection, telemetry, containment, and proof.