Can I bring notes into the AWS Security Specialty exam?

No. It is a proctored exam with no notes allowed, at a test centre or online. Use this sheet for final revision beforehand. During the exam, AWS provides a reference list of service short names.

AWS Security Specialty Cheat Sheet: Services, KMS, IAM Logic

A quick-revision summary for AWS Certified Security - Specialty (SCS-C03). Use it in the final days before the exam to check recall - it is a study aid, not a substitute for hands-on depth.

Which security service answers which question?

You need to…	Service
Detect threats from logs (accounts, instances, S3, EKS)	Amazon GuardDuty
Aggregate findings + run standards checks	AWS Security Hub
Investigate a finding’s root cause	Amazon Detective
Scan for software vulnerabilities (EC2, ECR, Lambda)	Amazon Inspector
Record API activity	AWS CloudTrail
Track resource configuration changes / drift	AWS Config
Find sensitive data in S3	Amazon Macie
Filter web traffic at layer 7	AWS WAF
Absorb DDoS attacks	AWS Shield
Inspect/filter VPC traffic at scale	AWS Network Firewall
Manage encryption keys	AWS KMS
Issue public TLS certificates	AWS Certificate Manager (ACM)
Run an internal/private PKI	AWS Private CA
Store + auto-rotate secrets	AWS Secrets Manager
Shell access without open ports	Systems Manager Session Manager
Download compliance reports	AWS Artifact

IAM policy evaluation in one breath

Explicit deny anywhere → denied. Nothing overrides it.
Otherwise, the request needs an allow from every applicable layer: SCPs (Organizations), resource-based policy or identity-based policy, within any permissions boundary and session policy limits.
No allow → implicit deny (the default).
Cross-account access needs an allow on both sides: the caller’s identity policy and the target’s resource-based policy (or an assumed role in the target account).
SCPs and permissions boundaries never grant - they only set the outer limit of what could be granted.

KMS keys at a glance

Key type	You control	Typical use
AWS managed key	Nothing (AWS rotates + manages policy)	Default service encryption, zero admin
Customer managed key (CMK)	Key policy, rotation, grants, deletion	Compliance, cross-account access, audit control
CMK with imported key material	Key material origin + expiry	”Bring your own key” requirements
Multi-Region key	Replicated key with same key ID material	Encrypt in one Region, decrypt in another; DR

Remember: key policies are the primary access control on a key; IAM policies alone are not enough unless the key policy delegates to IAM. Envelope encryption: data is encrypted with a data key; KMS encrypts the data key.

Encryption and data protection quick hits

Need	Answer
S3 encryption with per-key audit trail	SSE-KMS with a customer managed key (CloudTrail logs key use)
S3 encryption, no key admin	SSE-S3 (AWS managed, no key-level audit)
Rotate database credentials automatically	Secrets Manager rotation
Free config storage, no native rotation	Parameter Store (SecureString)
Mask sensitive fields in logs	CloudWatch Logs data protection policies
TLS between internal services	Private CA-issued certificates

Security group vs network ACL

	Security group	Network ACL
Level	ENI / instance	Subnet
State	Stateful (return traffic auto-allowed)	Stateless (allow both directions explicitly)
Rules	Allow only	Allow and deny, evaluated by number
Default	Deny all inbound, allow all outbound	Default NACL allows all

Incident response order (compromised EC2 instance)

Contain - isolate with a restrictive security group / remove from load balancer; do not terminate.
Preserve - snapshot EBS volumes, protect logs, consider memory capture before any reboot.
Revoke - rotate exposed credentials, revoke role sessions.
Investigate - CloudTrail, VPC Flow Logs, GuardDuty findings, Detective.
Eradicate + recover - rebuild from clean images, restore service.
Learn - update playbooks and automation.

Must-know acronyms

Acronym	Meaning
SCP	Service Control Policy (Organizations guardrail)
STS	Security Token Service (temporary credentials)
CMK	Customer Managed Key (KMS)
ACM	AWS Certificate Manager
OCSF	Open Cybersecurity Schema Framework (normalised findings format)
IMDS	Instance Metadata Service (v2 requires session tokens)
SSE	Server-Side Encryption (S3: SSE-S3 / SSE-KMS)
VPC	Virtual Private Cloud
NACL	Network Access Control List
IR	Incident Response

Exam-day mechanics to remember

65 questions (50 scored + 15 unscored pretest), 170 minutes, pass at a scaled 750/1000.
Compensatory scoring: overall score decides, no per-domain pass line.
Matching items only score when every pairing is correct; unanswered questions count as wrong - answer everything.

AWS Security Specialty (SCS-C03) Cheat Sheet