Implement data protection strategies for data at rest and in transit.
This domain covers 18% of the exam. It focuses on designing and implementing data protection strategies, including encryption at rest (KMS, CloudHSM), encryption in transit, and secure data management.
5 minutes
5 Questions
Domain 5: Data Protection is a critical component of the AWS Certified Security – Specialty (SCS-C02) exam, typically accounting for approximately 22% of the exam content. This domain focuses on ensuring the confidentiality, integrity, and availability of data at rest and in transit within AWS environments.
**Data at Rest Protection:** This covers encryption mechanisms using AWS Key Management Service (KMS), CloudHSM, and AWS Certificate Manager. Candidates must understand symmetric and asymmetric encryption, key rotation policies, key policies, grants, and the differences between AWS-managed keys, customer-managed keys, and customer-provided keys. Knowledge of envelope encryption and how services like S3, EBS, RDS, DynamoDB, and Redshift integrate with KMS is essential.
**Data in Transit Protection:** This involves understanding TLS/SSL implementation, certificate management through AWS Certificate Manager (ACM), and securing data flowing between services, VPCs, and on-premises environments. Candidates should know how to enforce encryption in transit using security policies, VPN connections, and AWS PrivateLink.
**Data Lifecycle Management:** This includes strategies for data classification, retention, and secure deletion. Understanding S3 lifecycle policies, Glacier vault lock policies, and data archival strategies is important.
**Access Controls for Data:** Candidates must understand S3 bucket policies, access control lists (ACLs), S3 Block Public Access, presigned URLs, and cross-account access patterns. Knowledge of Amazon Macie for sensitive data discovery and classification is also required.
**Secrets Management:** This covers AWS Secrets Manager and Systems Manager Parameter Store for securely storing and rotating credentials, API keys, and database passwords.
**Key Exam Skills:** Candidates should be able to design data protection solutions, troubleshoot encryption issues, implement least-privilege access to data, and ensure compliance with regulatory requirements like GDPR, HIPAA, and PCI-DSS. Understanding the shared responsibility model as it applies to data protection is fundamental to mastering this domain.Domain 5: Data Protection is a critical component of the AWS Certified Security – Specialty (SCS-C02) exam, typically accounting for approximately 22% of the exam content. This domain focuses on ensuring the confidentiality, integrity, and availability of data at rest and in transit within AWS envi…
