AWS Certified Security - Specialty

This is a scenario exam, not a memorization exam. Almost every question is a paragraph describing a real production situation - a compromised IAM user, a leaked S3 bucket, an EC2 instance making unexpected outbound calls. Read the scenario for what is being asked; the right answer is the AWS-prescribed response, which is rarely the most obvious one.

Master the IAM policy evaluation flow: explicit deny > SCP > resource policy > identity policy > permission boundary > session policy. Half the IAM questions hinge on which layer wins. Practice reading JSON policies with NotPrincipal, NotAction, and condition keys (aws:PrincipalOrgID, aws:SourceVpce, aws:SourceIp).

KMS questions are deceptively hard. Know the difference between key policy, IAM policy, and grants - and that a key policy is mandatory (no implicit allow). Cross-account KMS scenarios are a favorite: the requester's account, the key owner's account, and the resource (S3 bucket, EBS volume) account all need correct policies.

Detection-tier services overlap heavily. GuardDuty = threat detection from CloudTrail/VPC/DNS logs. Security Hub = aggregator + standards (CIS, PCI). Detective = visualizes the same data for investigation. Macie = S3-only PII discovery. Inspector = CVE scanning for EC2/ECR/Lambda. The wrong-tool-for-the-job distractor appears constantly.

Incident response questions follow a pattern: contain, eradicate, recover. For a compromised IAM user the order is rotate credentials, deny session via STS, then audit. For a compromised EC2 instance: snapshot the volume, isolate via SG change to deny-all, then forensics. Memorize these flows.

VPC endpoint policies and S3 bucket policies are how you prove data did not leave a private boundary. Expect questions testing aws:SourceVpce conditions and how they combine with bucket policies to prevent exfiltration.

Logging questions test depth. Know that CloudTrail data events are off by default (S3, Lambda, DynamoDB), that organization trails apply across all accounts, and that log-file integrity validation is opt-in. CloudTrail Lake exists as a SQL-queryable alternative to S3+Athena, but AWS announced it will close to new customers in May 2026 - existing exam questions may still feature it.

Do not over-study Cognito or Directory Service - they appear but are not the IAM core. Do over-study IAM Identity Center (formerly AWS SSO) and Organizations - both are core to multi-account scenarios.

Expect ~5-8 questions you have never seen the topic for - those are the 15 unscored questions sprinkled in. Do not panic; flag and move on. The 50 scored questions are well within the published blueprint.

Aim for 80%+ consistently on AWS Skill Builder Official Practice Question Sets and Tutorials Dojo timed exams before booking. The real exam is closer to TD difficulty than the official sample questions, which are easier.