Study SCS-C03 controls for TLS, private access, inter-resource encryption, and secure connectivity.
SCS-C03 in-transit questions are about protecting the path, not just flipping on “encryption.” The exam usually wants you to choose how a client, workload, or service should connect, whether the path should stay private, and where TLS enforcement or inter-node encryption belongs.
The current AWS domain page points to three recurring in-transit patterns:
That means a good answer often combines protocol enforcement with path control.
| Requirement | Strongest first fit | Why |
|---|---|---|
| Enforce secure client connections to a public endpoint | TLS policies and protocol enforcement at the edge or load balancer | The connection policy must reject weak transport |
| Keep service access private without public internet traversal | PrivateLink, VPC endpoints, or another private path | Removes unnecessary public exposure |
| Give remote users private access to internal resources | Client VPN or a controlled zero-trust style access path | Access path design is the control surface |
| Encrypt traffic between clustered or distributed components | Inter-node or inter-resource encryption where the service supports it | Internal service paths still matter |
If the question mentions “require encrypted connections” or “enforce secure protocols,” it is usually not enough to say that the service supports HTTPS. AWS is testing whether the architecture actively enforces the required protocol and rejects weaker choices.
That is why load balancer security policies, service endpoint settings, and client-connection requirements matter.
This is a frequent trap. A public HTTPS path can be encrypted, but it is not the same thing as private access.
If the requirement is:
then a private-connectivity answer is usually stronger than “just use TLS.”
SCS-C03 also cares about internal data movement:
If the scenario is about internal workloads rather than end-user clients, the strongest answer may focus on inter-resource encryption and private network placement instead of external TLS settings.
When the problem is how data moves, start with the path. Decide whether the traffic should be public or private, whether TLS must be enforced, and whether internal nodes also need encryption. Only after that move to keys or permissions.