SCS-C03 Domain 1: Detection (16%)
Detection is worth 16% of the AWS Certified Security – Specialty (SCS-C03) exam. It tests whether you can monitor an AWS account or organization: which logs to enable, how to centralize and analyze them, and how to fix monitoring that does not work.
Weight on the exam: 16%. It is one of the six domains of the AWS Certified Security – Specialty SCS-C03 exam. Below is a summary of its tasks and skills according to the official AWS guide.
Tasks and skills tested
Task 1.1: Design and implement monitoring and alerting solutions for an AWS account or organization
- Analyze workloads to determine monitoring requirements.
- Design and implement workload monitoring strategies (for example, by configuring resource health checks).
- Aggregate security and monitoring events.
- Create metrics, alerts, and dashboards to detect anomalous data and events (for example, Amazon GuardDuty, Amazon Security Lake, AWS Security Hub, Amazon Macie).
- Create and manage automations to perform regular assessments and investigations (for example, by deploying AWS Config conformance packs, Security Hub, AWS Systems Manager State Manager).
Task 1.2: Design and implement logging solutions
- Identify sources for log ingestion and storage based on requirements.
- Configure logging for AWS services and applications (for example, an AWS CloudTrail trail for an organization, a dedicated Amazon CloudWatch logging account, the Amazon CloudWatch Logs agent).
- Implement log storage and log data lakes (for example, Security Lake) and integrate with third-party security tools.
- Use AWS services to analyze logs (for example, CloudWatch Logs Insights, Amazon Athena, Security Hub findings).
- Use AWS services to normalize, parse, and correlate logs (for example, Amazon OpenSearch Service, AWS Lambda, Amazon Managed Grafana).
- Determine and configure appropriate log sources based on network design, threats, and attacks (for example, VPC Flow Logs, transit gateway flow logs, Amazon Route 53 Resolver logs).
Task 1.3: Troubleshoot security monitoring, logging, and alerting solutions
- Analyze the functionality, permissions, and configuration of resources (for example, Lambda function logging, Amazon API Gateway logging, health checks, Amazon CloudFront logging).
- Remediate misconfiguration of resources (for example, by troubleshooting CloudWatch Agent configurations, troubleshooting missing logs).
Services and tools to master
- Amazon GuardDuty
- AWS Security Hub
- Amazon Macie
- Amazon Security Lake
- AWS CloudTrail
- Amazon CloudWatch Logs
- Amazon Athena
- Amazon OpenSearch Service
- AWS Config
- VPC Flow Logs
- Route 53 Resolver
Key facts for domain 1
Short summaries; each links to the study topic with the full note and its official source.
- Log file integrity validation — CloudTrail log file integrity validation uses SHA-256 for hashing and SHA-256 with RSA for signing.
- Enabling is not validating — Enabling validation only makes CloudTrail deliver the digest files; it does NOT validate anything by itself.
- Foundational data sources — GuardDuty analyzes on its own CloudTrail management events, VPC Flow Logs and Route 53 Resolver DNS query logs.
- Third-party DNS isn't analyzed — If your instances use a DNS resolver other than AWS's (OpenDNS, Google DNS or your own), GuardDuty cannot process that data.
- Enable it in every Region — AWS recommends enabling GuardDuty in all Regions, even where you have no resources: an attacker can use global services (IAM, STS, CloudFront) to create resources in Regions you don't watch.
Practice Domain 1
Answer practice questions, read the explanation and review your mistakes with spaced repetition.