Connecting the Six Exam Domains

The AWS Certified Security Specialty (SCS-C02) exam is organized into six domains. Mastering how they connect is more valuable than memorizing services in isolation.

• Threat Detection & Incident Response
• Security Logging & Monitoring
• Infrastructure Security
• Identity & Access Management
• Data Protection
• Management & Security Governance

Threat Detection and Incident Response covers spotting and reacting to threats.

• GuardDuty detects, Security Hub aggregates, Detective investigates.
• Playbooks and automated remediation contain incidents.

This is where alerts turn into action.

Security Logging and Monitoring is about visibility and audit trails.

• CloudTrail records API calls; CloudWatch watches metrics and logs.
• VPC Flow Logs and Config add network and configuration history.

You cannot secure what you cannot see.

Infrastructure Security protects the network and edge.

• VPC design, security groups, and NACLs segment traffic.
• WAF, Shield, and Network Firewall defend the edge and inspect traffic.

Defense in depth applies layer by layer.

Identity and Access Management is the largest, most tested domain.

• IAM users, roles, and policies; STS temporary credentials.
• Identity Center, federation, SCPs, and permission boundaries.

Least privilege is the recurring theme.

Data Protection secures data at rest and in transit.

• KMS manages keys; envelope encryption scales it.
• ACM for TLS, Secrets Manager for credentials, Macie for discovery.

Encryption plus key control is the heart of this domain.

Management and Security Governance scales security across many accounts.

• Organizations, Control Tower, SCPs, and conformance packs.
• Trusted Advisor and Audit Manager for posture and compliance.

This domain ties everything to organization-wide policy.

The domains are not silos. A single incident touches all six:

• Detection (D1) reads logs (D2), the attacker crossed the network (D3) using credentials (D4) to reach data (D5), under your governance posture (D6).

Scenario questions weave several domains together.

Some services appear across many domains:

• CloudTrail underpins detection, monitoring, and forensics.
• IAM and KMS control access and data everywhere.
• Config supports monitoring and governance.

Know these deeply; they recur constantly.

The domains are not weighted equally on the exam.

• Identity and Access Management and Infrastructure Security carry the largest share of questions.
• Logging, detection, data protection, and governance fill the rest.

Invest your study time proportionally, giving identity and network the most attention.

Rather than flashcards per service, study by workflow: how a finding flows from GuardDuty to remediation, or how a request is encrypted from KMS to disk.

The exam rewards understanding how pieces combine to solve a real problem.

Map a service to its domain.

You connected the six SCS-C02 domains.

• Detection/IR, Logging, Infrastructure, Identity, Data, and Governance.
• They interlock: real incidents span several at once.
• Cross-cutting services like CloudTrail, IAM, KMS, and Config recur everywhere.