Core Security Domains Covered in the Exam
The AWS Certified Security – Specialty exam tests knowledge across six security domains: identity and access management, detective controls, infrastructure protection, data protection, incident response, and governance. Each domain focuses on AWS-native services and how they integrate to create a secure environment. Understanding the purpose, configuration options, and typical use cases of key services—such as IAM, GuardDuty, Security Hub, KMS, and CloudTrail—is essential for answering scenario‑based questions.
More from this site
Keep reading the latest coverage
Identity and Access Management (IAM)
IAM is the foundation of AWS security. Candidates must know how to design least‑privilege policies, use IAM roles for cross‑account access, and implement permission boundaries. Familiarity with service‑linked roles, identity federation (SAML, OIDC), and temporary credentials from STS is also tested.
Detective Controls and Monitoring
Detective controls help identify anomalous activity. Key services include Amazon GuardDuty for threat detection, Amazon Macie for data‑loss discovery, and AWS Config for resource‑configuration compliance. Knowing how to aggregate findings in AWS Security Hub and automate remediation with EventBridge or Lambda is critical.
Infrastructure Protection
Protecting the network and compute layers involves VPC security features (security groups, network ACLs, VPC endpoints), AWS WAF for web‑application filtering, and Shield Advanced for DDoS mitigation. Understanding how to isolate workloads with private subnets and use AWS Transit Gateway for hub‑and‑spoke architectures is also required.
Data Protection
Data at rest and in transit must be encrypted. AWS Key Management Service (KMS) provides centralized key control, while AWS Certificate Manager (ACM) manages TLS certificates. Candidates should differentiate between server‑side encryption options (SSE‑S3, SSE‑KMS, SSE‑C) and client‑side encryption, and know how to enforce encryption with bucket policies and IAM conditions.
Incident Response
Effective response relies on logging, alerting, and automation. CloudTrail captures API activity, while Amazon CloudWatch Logs and Metrics enable real‑time monitoring. Building runbooks that trigger Lambda functions or Step Functions to isolate compromised resources is a common scenario.
Governance, Risk, and Compliance (GRC)
GRC questions focus on aligning AWS services with frameworks such as PCI‑DSS, HIPAA, and ISO 27001. AWS Artifact provides audit reports, and AWS Config Rules can enforce compliance. Understanding shared responsibility and how to document controls for external auditors is vital.
Comparison of Key Security Services
| Service | Primary Function | Typical Use Case |
|---|---|---|
| IAM | Identity & access control | Granular permissions for users, roles, and services |
| GuardDuty | Threat detection | Continuous monitoring for malicious activity |
| Security Hub | Security posture aggregation | Central view of findings from multiple services |
| KMS | Key management | Encrypting data at rest across services |
| WAF | Web application firewall | Blocking SQL injection, XSS, and bot traffic |
Study Strategies and Resources
Combine official AWS training (Security Specialty Exam Readiness), whitepapers (AWS Security Best Practices, Well‑Architected Framework – Security Pillar), and hands‑on labs in a sandbox account. Practice exams from reputable providers reveal gaps, especially in scenario‑based questions that require selecting the most secure design among several options.