Chapter 3 of 6 · AWS SCS-C03
Infrastructure Security
Edge services, compute workloads, VPC design, network inspection and connectivity troubleshooting.
- 7topics
- 40 minfast track
- 4diagrams and exhibits
- 18%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1CloudFront Edge SecuritySecure content delivery with CloudFront origin access control, signed URLs and cookies, TLS settings, geo restriction and locked…Diagram5 min
- 2WAF, Shield and Firewall ManagerProtect web apps with AWS WAF web ACLs, defend against DDoS with Shield Standard and Advanced, and manage policies across…5 min
- 3Load Balancer, API and DNS SecuritySecure entry points with ALB and NLB TLS listeners, API Gateway authorizers and resource policies, mutual TLS, private APIs and…5 min
- 4EC2 Instance Hardening and PatchingHarden EC2 with golden AMIs from Image Builder, Session Manager access, Patch Manager, IMDSv2, instance profiles, EBS encryption…5 min
- 5Container and Serverless SecuritySecure containers and serverless code with ECR scanning, ECS task roles, EKS pod identity, Lambda execution roles, code signing…Diagram8 min
- 6VPC Segmentation and EndpointsDesign VPC network security with subnet tiers, security groups versus network ACLs, route tables, gateway and interface endpoints…Diagram6 min
- 7Network Firewall and TroubleshootingUse Network Firewall, DNS Firewall, Gateway Load Balancer and Transit Gateway inspection, and troubleshoot connectivity with…Diagram6 min
About this chapter
What this chapter covers
Infrastructure security protects the networks and compute that run your workloads.
The chapter has three parts that follow the exam outline.
The first is network edge services, such as CloudFront, AWS WAF, AWS Shield, load balancers, API Gateway and Route 53. The second is compute workloads, which means EC2 instances, containers and Lambda functions. The third is network security controls inside and between VPCs, including inspection and troubleshooting.
The chapter follows the Infrastructure Security domain of the AWS Certified Security Specialty SCS-C03 exam. Seven pages cover its three outline topics.
How the topics fit together
Traffic arrives at the edge, passes the network layers, and finally reaches the compute that is hardened to receive it.
- Edge services filter and absorb internet traffic before it reaches your VPC.
- Entry points authenticate callers and encrypt connections.
- VPC controls segment tiers and keep AWS service traffic private.
- Inspection looks at domains, signatures and DNS, and central designs use Transit Gateway.
- Compute hardening limits what a compromised workload can do.
Many questions ask for the control closest to the problem, so decide whether the fault is at the edge, in the network, or on the workload before choosing a service.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and example commands.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Pay special attention to the comparison tables, such as security groups against network ACLs and gateway against interface endpoints, because the exam often builds a question around one difference.
Ready for more practice?
The full AWS SCS-C03 question bank has 858 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.