Chapter 5 of 6 · AWS SCS-C03
Data Protection
Encryption in transit, KMS and key management, encryption at rest, secrets and data lifecycle.
- 7topics
- 39 minfast track
- 2diagrams and exhibits
- 18%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1TLS and Certificate ManagementManage TLS certificates with ACM and Private CA, enforce HTTPS on S3 and databases, and troubleshoot validation, renewal and…5 min
- 2Hybrid Connectivity EncryptionEncrypt traffic between on premises and AWS with Site to Site VPN, Client VPN, and Direct Connect with MACsec or VPN, plus…Diagram6 min
- 3KMS Keys, Policies and GrantsUnderstand AWS KMS key types, key policies, IAM and grants, envelope encryption, encryption context, cross account use and key…Diagram6 min
- 4Multi Region Keys, HSM and Key MaterialCompare KMS multi Region keys, imported key material, custom key stores, external key stores and CloudHSM, and plan key rotation…6 min
- 5Storage and Database EncryptionCompare S3 SSE-S3, SSE-KMS, DSSE-KMS and SSE-C, and encrypt EBS, EFS, RDS and DynamoDB at rest, including how to encrypt an…6 min
- 6Secrets Manager and Parameter StoreStore and rotate credentials with Secrets Manager and Parameter Store, compare features, control access and inject secrets into…5 min
- 7Data Classification, Backup and RetentionFind sensitive data with Macie, prevent public exposure, and protect backups and retention with Backup Vault Lock, Object Lock…5 min
About this chapter
What this chapter covers
Data protection is about keeping information confidential, intact and recoverable, wherever it is and however it moves.
The chapter has three parts that follow the exam outline.
The first is data in transit, which covers TLS, certificates and encrypted connections between sites. The second is data at rest, which covers encryption of storage and databases and the keys behind it. The third is protecting confidential data, credentials, secrets and key material.
The chapter follows the Data Protection domain of the AWS Certified Security Specialty SCS-C03 exam. Seven pages cover its three outline topics.
How the topics fit together
Keys and certificates sit underneath everything else, so the chapter starts with transit and moves to keys, storage and secrets.
- TLS and certificates protect connections, and ACM and Private CA manage the certificates.
- Hybrid links need explicit encryption, because Direct Connect alone is not encrypted.
- KMS controls who can use keys, and advanced options add multi Region keys, imported material and dedicated hardware.
- Storage encryption is mostly a choice of key model and enforcement.
- Secrets stores keep credentials out of code and rotate them.
- Classification, backup and retention finish the lifecycle.
Many questions turn on a single policy: the KMS key policy, the bucket policy or the secret resource policy. Always check who may use the key and who may read the data.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and example commands.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Read the KMS pages twice. The key policy logic, cross account sharing and the choice between key types appear in many different disguises across the exam.
Ready for more practice?
The full AWS SCS-C03 question bank has 858 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.