What's changed: Deepened SOA-C02 Chapter 4 to Associate depth (tables, scenarios, FAQ, traps; localized figures)
4.4In-scope services for security and compliance
A roundup of in-scope SOA-C03 services for security and compliance—protection, detection, identity, and network boundaries.
4.4.1In-scope services for security and compliance
For security and compliance, focus on protection, detection, identity, and network boundaries. Protection/encryption: AWS Certificate Manager (HTTPS certs), AWS Key Management Service (keys), AWS Secrets Manager (secrets), AWS WAF (web protection), AWS Shield (DDoS), and AWS Network Firewall (L3/4 inspection). Detection/audit: Amazon GuardDuty (threat detection), AWS Security Hub (findings aggregation), Amazon Macie (data classification), and AWS IAM Access Analyzer (over-permission detection). Identity: AWS IAM Identity Center (employee SSO). Network boundaries: Amazon EC2 security groups (instance-level), Network ACLs (subnet-level), Internet gateways (VPC↔internet), plus outbound-only NAT gateways (IPv4) and Egress-only internet gateways (IPv6).
4.4.2Section summary
- Protect/detect: ACM, KMS, Secrets Manager, WAF, Shield, Network Firewall / GuardDuty, Security Hub, Macie, IAM Access Analyzer
- Identity/boundaries: IAM Identity Center / security groups, Network ACLs, Internet gateways, NAT gateways, Egress-only internet gateways
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which service uses ML to discover and classify PII in S3?
Q2. Which provides outbound-only internet access for an IPv4 private subnet?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.