SCS-C02: AWS Certified Security - Specialty

Name: SCS-C02: AWS Certified Security - Specialty
Rating: 4.9 (9 reviews)

Certifiacte exam peparation course

Created byStone River eLearning

Last updated 11/2023

English

What you'll learn

Prepare for potential security incidents and establish an incident response plan.
Design and Implement Logging Solutions
Implement security controls to protect infrastructure components.
Establish secure identity and access management mechanisms.
Design and implement data encryption for data at rest and in transit.
Implement security monitoring to detect and respond to events.
Implement security operations automation using AWS services.

Course content

7 sections • 51 lectures • 18h 18m total length

Course Overview6:12
Discover the AWS certified security – specialty course overview with module-based exam prep, console demos, and practice questions, while clarifying target audiences and prerequisites in cloud security and CompTIA fundamentals.
Introduction26:02
Explore the AWS certified security specialty exam prerequisites, Bloom's taxonomy apply analyze evaluate, and the six pillars of the well-architected framework, with scaffolding and practice questions.
Host Security Overview16:13
Explore host security in AWS by examining how to protect EC2 instances, containers, and serverless resources across data in transit, data at rest, and access controls.
Host Security Configurations29:55
Explore host security configurations for AWS EC2, including hardening instances with IAM roles, patch management, memory and EBS encryption, and secure access via SSM agent, key pairs, and security groups.
Host Security Services25:09
Explore host security services with security groups and Amazon Inspector, including stateful filtering, design and reuse of groups, and vulnerability scanning across EC2, Lambda, and ECR.
Troubleshoot Host Security19:51
Learn to troubleshoot host security for EC2 by using auto-scaling, elastic load balancing, cross-zone failover, automated backups with EBS snapshots and Data Lifecycle Manager, and CloudWatch monitoring.
Network Security Overview22:04
Explore how AWS network security uses VPCs and IAM-based identity controls to protect networks, edge spaces, and APIs, including ALB and NLB load balancers.
Network Design for Security24:23
Design secure AWS networks with private link and VPC endpoints, comparing interface and gateway endpoints, gateway load balancer endpoints, and Route 53 split-horizon DNS to keep traffic private.
Securing Segments18:30
Explore VPC security mechanisms for network segmentation, compare security groups and network ACLs, and learn firewall manager usage for centralized and distributed protection with strict inbound rules.
Traffic Monitoring17:14
Explore how AWS traffic monitoring uses VPC flow logs, traffic mirroring, and reachability and network access analyzers to diagnose issues and route logs to CloudWatch, S3, or Kinesis for analysis.
Securing Network Connections17:24
Explore securing network connections in hybrid deployments, including client and site-to-site VPNs, Direct Connect with encryption options, and VPC peering to keep on-prem and cloud traffic secure and efficient.
Troubleshooting Network Security21:49
Learn to troubleshoot network security with reachability and network access analyzers in AWS, understanding connectivity versus isolation and their limitations. Build security posture with firewall manager and shield features.
Edge Security Overview23:24
Explore edge security in AWS by examining edge locations, edge devices, and CloudFront, and learn how to reduce attack surfaces with Origin Access Control and encrypted data.
Edge Security Services25:32
Explore edge security services in AWS, learning how to build layered defenses with TLS, DDoS protection, WAF, DNS health checks, and data residency for edge and hybrid deployments.
Using WAF19:31
Learn how AWS WAF protects web apps via web ACLs, managed and custom rules, and edge security for CloudFront and related services, plus rule components and WCUs.
Troubleshooting Edge Security21:36
Troubleshoot edge security with DDoS protection, Shield Advanced, CloudFront, ELB, and WAF, then apply private subnets and explicit allow rules to reduce the attack surface.

Data Encryption Overview20:58
Explore data encryption across the data lifecycle, from encryption at rest and in transit to key management with KMS, IAM, and ACM, while designing S3 lifecycle and AWS backup policies.
Data Classification22:31
Master data classification and tagging in AWS, applying best practices and multi-account tagging strategies to protect sensitive data. Inventory data, assign nuanced classifications, and monitor access with automated controls.
Encrypting Data at Rest27:21
Explore how to protect data at rest by encrypting storage across AWS services, including EBS volumes, S3 objects, and RDS data, using KMS keys and default encryption. Apply best practices for key management, least privilege access, and tokenization, and follow practical steps for encrypting data at rest across EC2, S3, databases, and archives.
Encrypting Data in Transit17:35
Explore how to protect data in transit across AWS with TLS concepts, VPN concepts, and certificate management. Apply CloudFront options with ACM, OAC, and SSL termination across ALB and origins.
Key Management Design19:36
Explore key management design with AWS KMS and CloudHSM, learning envelope encryption, data keys, symmetric and asymmetric keys, rotation, policies, and when to use each service for encryption at rest.
Evaluating Key Management21:40
Explore evaluating AWS KMS key management, comparing key policies, IAM policies, and grants, including customer-provided key material, encryption, rotation, ABAC, encryption context, and monitoring.
Troubleshooting Data Encryption16:48
Learn to troubleshoot data encryption by selecting encryption techniques based on business requirements and identifying sensitive data with Macie, while managing KMS keys and S3 encryption settings.

Logging Overview22:48
Explore the fundamentals of logging in the cloud, including why logs matter for compliance, troubleshooting, and incident response, and learn key AWS logging services like CloudTrail, CloudWatch, and GuardDuty.
Logging System Design21:14
Design a robust logging system with CloudTrail capturing API calls, configure trails and encryption, and integrate with CloudWatch, EventBridge, and SNS for end-to-end monitoring.
Log Storage18:40
Master log storage and lifecycle management using CloudTrail and S3, encryption options, log validation, best practices, and centralized logging with CloudWatch Logs.
Log Analysis19:07
Master log analysis for security events by querying CloudWatch logs, correlating data with OpenSearch, Athena, and Glue, and automating responses with EventBridge.
Troubleshooting Logs18:02
Troubleshoot logs by identifying misconfigurations and remediation steps for absent permissions, verify log capture and delivery, and implement IAM roles and KMS access for CloudTrail and CloudWatch.
Monitoring and Alerting Overview20:23
Explore how logging and monitoring work together to detect security events, set metrics and thresholds, and automate alerts using AWS services like CloudTrail, CloudWatch, and GuardDuty.
Monitoring System Design31:15
Design robust monitoring systems for AWS security by mastering anomaly and correlation techniques, centralized security findings, and monitoring requirements across environments and workloads using CloudWatch and related services.
Monitoring Services27:04
Explore how AWS monitoring and security services like Security Hub, GuardDuty, Inspector, Detective, Config, Audit Manager, and CloudFormation centralize findings, automate responses with EventBridge and Lambda, and ensure secure environments.
Custom Monitoring17:48
Learn to implement custom monitoring in AWS by generating metrics with the CloudWatch agent and SSM State Manager, then visualize anomalies with dashboards and metric filters to detect activity.
Auditing14:09
Explore auditing in AWS by setting up automated tools and scripts for regular audits, and collecting evidence with AWS Audit Manager and Security Hub to support compliance frameworks.
Troubleshooting Monitoring and Alerting22:54
Explore troubleshooting, monitoring, and alerting practices to diagnose failed events. Analyze permissions and configurations, and use logs, metrics, traces, and X-ray service maps to improve performance and security.

Compliance and Incident Response Overview16:58
Explore AWS compliance and incident response fundamentals. Learn shared responsibility, artifact reports, abuse complaints, and planning for cloud incidents and compromised resources.
Incident Response Planning26:37
Plan AWS incident response with playbooks and runbooks, guided by the security incident response guide, and perform root cause analysis and forensics to recover services.
Automated Alerting18:37
Explore automated alerts in AWS using Security Hub, GuardDuty, Macie, Config, and CloudWatch to monitor findings and events, then trigger responses with Lambda, Step Functions, and Systems Manager.
Incident Response Actions23:54
Apply incident response actions by isolating AWS resources, automating remediation with AWS services, and using GuardDuty findings and IOCs to drive containment and recovery.

IAM Overview29:44
Master identity and access management in AWS with cross-account roles and boundaries. Explore identity-based and resource-based policies, service control policies, and external ID for secure third-party access.
Organizational Account Design27:49
Design organizational accounts with AWS organizations, using management accounts, OUs, and SCPs for centralized control and consolidated billing. Secure root and route users with MFA and guardrails via control tower.
Policy Types28:42
Explore how resource-based and identity-based policies interact, apply permissions boundaries and SCPs, and master policy evaluation and explicit denial in AWS IAM.
Workload Access Control29:10
Explore workload access control, including IAM roles, ABAC and RBAC strategies, federated and temporary access, cross-account sharing with RAM, and Cognito for authentication and authorization.
Federation and SSO21:12
Explore federation and SSO, leveraging STS to issue temporary credentials for IAM roles, while comparing Secrets Manager and parameter store for securely storing credentials and configuration with identity provider options.
Troubleshooting IAM23:26
Diagnose authentication and authorization issues in IAM, implement least privilege, and rotate compromised credentials. Use Access Analyzer and policy simulator to validate permissions, and revoke active sessions for compromised roles.

Securing AWS Services Overview20:33
Discover how the AWS well-architected framework and its security tool identify security gaps, apply zero-trust principles, and guide secure design across compute, storage, and other services.
Securing Compute Services17:50
Explore securing compute services across instances, containers, and functions, including host-based security, instance metadata, container image scanning, and network controls.
Securing Storage Services25:48
Explore secure storage in AWS by controlling data access with S3 access points and VPC endpoints, protect data with object lock and versioning, and use pre-signed URLs for time-limited access.
Securing Database Services12:41
Learn to secure database services with encryption at rest using Cloud HSM, and leverage RDS proxy to improve security and scalability for relational and serverless databases.
Securing Code Development Services21:49
Learn how to secure code development services by standardizing AWS portfolios with Service Catalog and Proton, and enforce configurations with AWS Config rules to detect noncompliant resources.

Exam Objectives Overview14:10
Explore the AWS certified security specialty exam objectives (SCS-C02), the six domains, new governance content, Bloom's taxonomy levels, and how to use the objectives to study and fill gaps.
Study and Exam Strategies24:55
Master study and exam strategies for the AWS certified security specialty exam. Explore exam format, question types, time management, and ai-assisted prep.

Requirements

Candidates preparing for the AWS Certified Security - Specialty exam are expected to have a strong understanding of AWS services, cloud computing concepts, and general security principles. It's recommended that candidates have experience with AWS services related to security, and some prior experience working with AWS environments.

Description

The AWS Certified Security - Specialty (SCS-C02) certification is a designation offered by Amazon Web Services (AWS) that validates a candidate's expertise in designing and implementing secure applications and infrastructures on the AWS platform. This certification is intended for individuals who work with AWS services and have a strong focus on security aspects.

The main objective of this certification is to validate your skills and knowledge in building and deploying security solutions in the AWS Cloud. Furthermore, this certification also confirms that you understand the specialized data classifications and AWS data protection mechanisms, data-encryption techniques and how to implement them using AWS mechanisms, as well as secure internet protocols and how to implement them using AWS mechanisms. Overall, taking this exam will help you demonstrate your expertise in the field of AWS security, which is essential for any IT professional working on AWS infrastructure.

The AWS Certified Security - Specialty course is designed to equip IT professionals and security specialists with the knowledge and skills needed to design and implement secure applications and infrastructures on the Amazon Web Services (AWS) platform.

This certification is intended for individuals who want to demonstrate their expertise in securing AWS environments and applying best practices for maintaining a secure cloud infrastructure.

Who this course is for:

Security Specialists, Security Engineers, Security Architects, Security Consultants
Cloud Architects, Cloud Security Managers
Network Security Engineers
Compliance Officers
Penetration Testers and Ethical Hackers
Information Security Officers
Risk Management Professionals

SCS-C02: AWS Certified Security - Specialty

What you'll learn

Explore related topics

Course content

Securing Hosts, Network, and the Edge in AWS16 lectures • 5hr 35min

Protecting Data with Encryption in AWS7 lectures • 2hr 26min

Implementing Logging, Monitoring & Alerting in AWS11 lectures • 3hr 53min

Managing Incident Response in AWS4 lectures • 1hr 26min

Implementing IAM Security in AWS6 lectures • 2hr 40min

Securing AWS Services5 lectures • 1hr 39min

Exam Objectives2 lectures • 39min

Requirements

Description

Who this course is for: