Meeting the SCS-C02 Exam Domains

The AWS Certified Security – Specialty exam (SCS-C02) validates securing AWS workloads. It is scenario-based, organized into six weighted domains.

Each domain has a weight telling you where to spend study time. Knowing them also helps you spot what a question is really testing under time pressure.

Domain 1: Threat Detection and Incident Response — GuardDuty, Security Hub, Detective, and playbooks. Detect malicious activity and respond fast.

Domain 2: Security Logging and Monitoring — CloudTrail, CloudWatch, VPC Flow Logs, Config. Know which log source captures which activity.

Domain 3: Infrastructure Security — VPC design, security groups, network ACLs, WAF, and Shield. Build secure networks and block web and DDoS attacks.

Domain 4: Identity and Access Management — users, roles, policies, STS, Organizations, and SCPs. Usually the highest-weighted domain, so master policy logic.

Domain 5: Data Protection — KMS, encryption at rest and in transit, ACM, Secrets Manager, and Macie. Understand envelope encryption and key policies.

Domain 6: Management and Security Governance — Control Tower, multi-account strategy, and aligning controls to standards like PCI DSS and HIPAA.

This category mirrors the six domains: detection, then logging, network, identity, data protection, and governance. A final course ties them together.

The exam is multiple choice and multiple response — no coding. Many questions are long scenarios, so practice spotting the key constraint, like "least privilege."

Knowing the domains turns this category into a roadmap. Note which one each course serves and how heavily it is weighted as you study.

Recall the exam structure.

The SCS-C02 exam has six weighted domains: detection and response, logging, infrastructure, identity (usually heaviest), data protection, and governance.