CertiName the finding
- GuardDuty a threat
- Inspector a vulnerable package
- Macie sensitive data in S3
- Security Hub the inbox
Study guide · Flashcards & memory notes
AWS Security Flashcards & Memory Notes
50 recall cards for the distinctions SCS-C03 keeps testing: which service owns the finding, which control contains the resource, and which policy only sets a ceiling.
How to use these cards: Say the answer out loud before you flip the card, and mark it honestly. Revisit the cards you missed tomorrow rather than rereading them right away. Progress is kept only while this page is open. For the full explanations behind each card, see the core notes.
Study mode
Choose a deck, flip each card, and mark what you already know.
You marked every card in this deck as known. Shuffle and run through it again, or choose another deck.
All flashcards
Select a question to reveal its answer.
Deck 1 · Detection
Threats, logs, and the alarm that pages.
1.1What does Amazon GuardDuty detect?
Threats such as an unusual API call. Inspector finds a vulnerable package. Macie finds sensitive data in S3.
1.2What does Amazon Macie find?
Sensitive data in S3. GuardDuty finds threats. Detective investigates a finding you already have.
1.3What does AWS Security Hub aggregate?
Findings and standards checks. Security Lake is the log data lake. A dashboard is not a finding standard.
1.4What does Amazon Security Lake store?
Normalized security logs. It is not the finding inbox. Security Hub is.
1.5What turns a log pattern into a number you can alarm on?
A CloudWatch metric filter. Logs Insights only queries until you publish a metric or start a workflow.
1.6Which trail can a member account not turn off?
An organization CloudTrail trail. A trail the member owns can be stopped by that account.
1.7What do VPC Flow Logs record?
Accepted and rejected traffic metadata. They do not capture packet payloads.
1.8What queries logs that already landed in S3?
Amazon Athena. A dashboard does not search the bucket.
Deck 2 · Incident response
Evidence, containment, and the exposed key.
2.1What should you capture before you terminate a suspect instance?
Forensic logs and a snapshot. Terminating first destroys the evidence.
2.2What investigates the scope of a GuardDuty finding?
Amazon Detective. A new AMI does not explain the event.
2.3What contains a compromised instance on the network?
A security group or network ACL that stops its traffic, plus revoked credentials. Deleting the CloudTrail trail hides the activity.
2.4What tests an incident plan without deleting production?
AWS Fault Injection Service. A planned experiment is the test. Deleting a production database is not.
2.5What owns a multi-step remediation with a catch?
AWS Step Functions. A single graph does not retry and branch.
2.6What is the first step when an access key is exposed?
Disable the key, then review CloudTrail. Deleting the trail hides what the key already did.
2.7What does Shield Advanced add?
DDoS response support and protections you configure. Shield Standard is the automatic baseline.
2.8What does OpsCenter track?
The operational item and the runbooks related to it. A CPU alarm is not the incident record.
Deck 3 · Infrastructure
The layer that matches the threat.
3.1What filters an HTTP request pattern?
AWS WAF. Shield is DDoS protection. Network Firewall sits on the VPC path.
3.2How does a security group differ from a network ACL?
A security group is stateful. A network ACL is stateless. The ACL needs an explicit allow for return traffic.
3.3What gives a shell without opening port 22?
Systems Manager Session Manager. EC2 Instance Connect still uses SSH.
3.4What finds a vulnerable package on an image?
Amazon Inspector. GuardDuty watches for threats. It does not install the missing patch.
3.5What builds a hardened AMI on a schedule?
EC2 Image Builder. Read the password at launch. Do not bake it into the image.
3.6What applies patches from a baseline?
Systems Manager Patch Manager. Inspector reports the CVE. It does not install the patch by itself.
3.7What is north-south traffic?
Traffic that enters or leaves the VPC. East-west traffic moves between workloads inside.
3.8What reaches an internal app without putting the user on the network?
AWS Verified Access. Client VPN places the user on the network.
3.9Is Direct Connect encrypted by default?
No. Add MACsec or a VPN when the traffic must be encrypted. A private circuit is not the same thing as encryption.
Deck 4 · Identity
Who it is, then only what the task needs.
4.1What issues temporary credentials for a role?
AWS STS. A long-term access key in a repository is not temporary.
4.2What is workforce sign-in across accounts?
IAM Identity Center. Cognito is for your application's users.
4.3What does a permissions boundary limit?
The maximum permissions of one IAM principal. It does not grant access. An SCP limits member accounts.
4.4Does an SCP grant access?
No. It sets a maximum for member-account principals. An IAM allow still has to exist.
4.5What flags a bucket shared outside the zone you trust?
IAM Access Analyzer. A CPU alarm does not read the bucket policy.
4.6What lets a workload outside AWS assume a role?
IAM Roles Anywhere, with a certificate you trust. A root key copied onto that server is not the design.
4.7What is attribute-based access control?
Access that depends on tags or attributes. Role-based access assigns permissions to a role.
4.8What tests a policy without changing it?
IAM Policy Simulator. Access Analyzer looks at resource policies that already exist.
4.9What is a presigned URL?
Temporary access to one object, using the signer's permissions. It is not an instance profile.
Deck 5 · Data protection
The key owner, the lock, and the secret.
5.1What rotates a database password?
AWS Secrets Manager. An AMI freezes the password, and a public object exposes it.
5.2When do you choose CloudHSM over a standard KMS key?
When you must operate a dedicated HSM. KMS is the managed key service for most encryption.
5.3What is different about imported key material?
You supply it, and AWS cannot recover it if you delete it. AWS-generated material can rotate automatically under the same key ID.
5.4Which Object Lock mode holds an object even from root?
Compliance mode. Governance mode can be bypassed by a principal you allow.
5.5What masks a card number in a log event?
A CloudWatch Logs data protection policy. A bucket policy does not rewrite the log line.
5.6What reaches S3 from a private subnet without a NAT gateway?
A gateway VPC endpoint. A public bucket is the opposite of that path.
5.7What decrypts in a second Region under a related key?
A multi-Region KMS key. A snapshot of the console is not a replica key.
5.8What issues private certificates for internal names?
AWS Private CA. A public ACM certificate is for a name the public internet should trust.
Deck 6 · Governance
Prevent the API, then prove it.
6.1What vends a new account with guardrails?
AWS Control Tower. A checklist after production leaves a gap.
6.2What deploys one template to many accounts?
CloudFormation StackSets. AWS RAM shares a resource. It does not deploy the template.
6.3What deploys WAF rules across accounts?
AWS Firewall Manager. A rule in one account does not cover the organization.
6.4What collects your audit evidence?
AWS Audit Manager. AWS Artifact is where you download AWS compliance reports.
6.5What blocks an API before the resource exists?
An SCP deny. A Config rule reports the resource after it exists.
6.6Where should break-glass root access live?
A controlled procedure with MFA, not a shared password. Centralize member-account root credentials.
6.7What shares a subnet with another account?
AWS RAM. A bucket policy does not share a subnet.
6.8What records a review against the security pillar?
The AWS Well-Architected Tool. It does not deploy the missing control for you.
Memory notes
Groupings that make the highest-yield SCS-C03 distinctions easier to recall.
Preserve, then contain
Keep the log and the snapshot. Isolate the instance and revoke the credential. Disable an exposed key before you read CloudTrail. Detective explains scope. It does not replace the detector.
Pick the layer
WAF filters HTTP. Shield is DDoS. A security group is stateful. A network ACL is stateless. Network Firewall sits on the VPC path. Session Manager avoids inbound SSH. Direct Connect is not encrypted until you add MACsec or a VPN.
Allow versus ceiling
IAM can allow. A boundary limits one principal. A session policy limits one session. An SCP limits member accounts. None of those ceilings grant access. Access Analyzer reads the share you already published.
Who holds the key
KMS is the managed key. CloudHSM is the HSM you operate. Imported material is yours to destroy. Secrets Manager rotates the password. Compliance-mode Object Lock holds the object, including from root.
Prevent, then prove
An SCP denies the API before the resource exists. Config reports it afterward. StackSets lands the same template. Firewall Manager lands the same WAF rule. Audit Manager collects your evidence. Artifact holds AWS reports.
Continue the AWS Security study path
Test what you have learned with a timed practice exam.
Overview
Exam format, the 750 passing score, domain weights, and a study plan.
Core Notes
Reference notes for detection, response, infrastructure, identity, data protection, and governance.
Flashcards & Memory Notes
50 recall cards in six decks, plus memory notes for findings, containment, ceilings, and keys.
Practice Exams
200 original questions with custom exams, explanations, and a score report by domain.
Related Tools
Useful companions while you study.
Password Generator
Generate strong random passwords with custom length, characters, symbols, and security options.
Base64 Converter
Encode text and files to Base64 or decode Base64 data with UTF-8 support.
JSON YAML Converter
Convert structured data between JSON and YAML with formatting and validation.
Diff Checker
Compare two text blocks and highlight added, removed, and changed content.
Legal Disclaimer
Certicab provides general informational, educational, and convenience resources. Calculations, conversions, estimates, and learning materials may contain errors or become outdated. Financial, tax, medical, legal, and travel information is not professional advice. Verify important results and current requirements with qualified professionals or authoritative sources. Protect sensitive files and personal information, review each tool’s privacy limitations, and use only content you are authorized to process. You are responsible for how you use and share results. Study resources are independent and do not guarantee exam success or imply certification-provider endorsement. Amazon Web Services, AWS, and related marks are trademarks of Amazon.com, Inc. or its affiliates. Certicab is not affiliated with, endorsed by, or sponsored by Amazon.