Failed AWS Security Specialty? Here's Your Recovery Plan

Pro tip: You can take a practice exam for $20 to gauge readiness before retaking.

• Treating an IAM policy as sufficient to grant access to a KMS-encrypted resource, and ignoring the key policy.
  Learn the rule that a KMS key policy must explicitly allow access before an IAM policy can grant it, including the standard statement that delegates to IAM in the key's own account. Practise revoking access to a key purely through the key policy while leaving the IAM administrator policy untouched.
• Choosing network ACLs when the scenario calls for security groups, or the reverse, because the stateful and stateless distinction was memorised as a phrase rather than tested.
  Build a subnet where the network ACL allows inbound traffic but blocks the ephemeral return port range, then observe the connection failing. Once you have seen a stateless rule break a working connection, the exam scenarios become mechanical.
• Assuming CloudTrail records everything, then choosing it as the answer for S3 object-level or Lambda invocation visibility without enabling data events.
  Enable CloudTrail data events for a specific S3 bucket prefix and a Lambda function and look at the cost and volume difference. Remember that management events are logged by default and data events are not.
• Spending the bulk of study time on IAM because it feels like the core of AWS security, when it is only 16 percent of scored content.
  Weight study hours to the published blueprint: Infrastructure Security at 20 percent, Logging and Monitoring and Data Protection at 18 percent each. IAM knowledge still pays off because policy reasoning appears inside the other domains, but dedicated IAM revision should not dominate the schedule.
• Isolating a compromised EC2 instance by terminating it or detaching its volumes before capturing evidence.
  Follow the sequence in the AWS Security Incident Response Guide: snapshot the EBS volumes, capture a memory dump if required, replace the security group with a deny-all group, and move the instance into an isolated forensic account. Termination destroys the evidence the exam scenario usually wants preserved.
• Confusing AWS Shield Advanced, AWS WAF and Amazon CloudFront responsibilities when a DDoS question appears.
  Fix the layers in your head: Shield handles volumetric and protocol attacks at layers three and four with Shield Advanced adding cost protection and the AWS Shield Response Team, WAF handles layer seven rules, and CloudFront absorbs traffic at the edge. Exam answers usually combine two of the three.
• Answering multi-account governance questions with IAM policies applied account by account instead of service control policies.
  Whenever a scenario says the control must apply across an organization, across all future accounts, or must not be removable by an account administrator, reach for a service control policy or an AWS Control Tower control. Practise writing an SCP that denies a region and confirm an account admin cannot override it.
• Running out of time because the 65 questions include long multi-paragraph scenarios and candidates re-read them from the start.
  At 170 minutes for 65 questions the budget is roughly 2.6 minutes each. Read the final sentence of the scenario first to find the actual requirement, then read the body once with that requirement in mind. Flag anything over four minutes and return to it.
• Studying services listed as out of scope in the exam guide appendix, such as AWS Database Migration Service or the AWS Elemental media services.
  Read the appendix of the SCS-C02 exam guide before week one and delete out-of-scope services from your revision list. The in-scope list is short enough to cover properly, and it names Amazon Detective, AWS Audit Manager and AWS Firewall Manager, which many candidates skip.

• Deep knowledge of IAM, KMS, and CloudTrail required
• Study incident response and logging strategies
• Master VPC security and network ACLs
• Understand encryption at rest and in transit
• Focus on AWS security best practices whitepapers