Browse AWS Certification Guides

SOA-C03 Security and Compliance Guide

AWS SOA-C03 security guide covering IAM, auditing, encryption, secrets, and compliance decisions.

Security on SOA-C03 stays operational. AWS is not asking a CloudOps engineer to invent the organization’s security policy from scratch. It is asking whether you can implement identity controls, audit and troubleshoot access, apply multi-account guardrails, protect data correctly, and remediate findings without confusing these day-two tasks with pure security-architecture design.

I verified the current SOA-C03 Domain 4 task split against the AWS exam guide on May 11, 2026. AWS currently breaks this domain into two operational abilities:

  1. implement and manage security and compliance tools and policies
  2. implement strategies to protect data and infrastructure

Current weight in the exam guide

AWS currently weights Security and Compliance at 16% of scored content.

What this domain is really testing

AWS wants you to prove that you can:

  • choose the right control to grant, constrain, audit, or explain access
  • separate workforce identity from workload identity
  • implement multi-account guardrails that reduce blast radius
  • keep data classification, encryption, secrets, and findings remediation in the correct lanes
  • treat security findings as ongoing operations work instead of one-time setup

Work this domain in order

Lesson Official task fit Why it matters
4.1 IAM, Auditing & Multi-Account Security Task 4.1 This is the access-governance lane: IAM features, audit tools, Trusted Advisor, multi-account security, and compliance boundaries.
4.2 Encryption, Secrets & Findings Task 4.2 This is the protection lane: data classification, encryption at rest and in transit, secrets storage, and findings/report remediation.

Fast routing inside this chapter

If the stem is really about… Go first to… What to look for
IAM, MFA, federation, roles, policy conditions, resource policies, CloudTrail, Access Analyzer, policy simulator, Trusted Advisor, SCPs, permissions boundaries, or Region/service restrictions 4.1 IAM, Auditing & Multi-Account Security access path, audit source, org guardrail, compliance enforcement
data classification, KMS, ACM, TLS, secrets storage, Security Hub, GuardDuty, Config, Inspector, or remediation of findings 4.2 Encryption, Secrets & Findings data sensitivity, protection layer, finding type, remediation workflow

Common domain traps

Trap Better thinking
“CloudTrail is a control.” CloudTrail explains what happened; it does not grant or restrict access.
“Access Analyzer fixes exposure.” It reveals broad or external access paths, but another control must enforce the fix.
“Encryption, certificates, and secrets are all the same topic.” Keys, TLS certificates, and stored secret values are related but distinct control lanes.
“Security findings are review-only.” SOA-C03 expects CloudOps teams to route and remediate findings operationally.

How strong SOA-C03 answers usually work

  1. Decide whether the problem is mainly access control, audit/explanation, org guardrail, data protection, or finding remediation.
  2. Choose the narrowest control or evidence source that actually solves that problem.
  3. Keep audit and enforcement separate.
  4. Keep workforce identity, workload identity, encryption, and secrets separate.
  5. Prefer repeatable remediation and guardrail logic over manual after-the-fact cleanup.

In this section

Revised on Monday, June 15, 2026
3. Provisioning & Automation
5. Networking & Delivery