SOA-C03 · Domain 4 of 5

SOA-C03 Domain 4: Security and Compliance

This domain covers operating AWS securely: managing identity and access, enforcing compliance, and protecting data and infrastructure with encryption, secrets management and network protection.

Exam weight
16%
Official task statements
2
Estimated questions estimate
~8
Suggested study time estimate
15–20 hrs

About 9 min read Reviewed October 2026

Overview

Security and Compliance covers operating workloads securely day to day. It has two task statements. Managing security and compliance policies covers IAM users, roles and policies, least privilege, AWS Organizations and service control policies, enforcing compliance requirements such as allowed Regions and services, and auditing with CloudTrail and AWS Config. Protecting data and infrastructure covers encryption at rest and in transit with KMS, Secrets Manager and Parameter Store for secrets, certificate management, and network protection services such as WAF and Shield.

At 16%, this domain applies security from an operator's standpoint: enforcing guardrails across accounts, rotating secrets, and verifying encryption. It builds on the shared responsibility model and uses the auditing tools from Domain 1. The operational angle is enforcing and verifying controls, not designing an entire security architecture.

How it's tested

SOA-C03 questions describe an access, compliance or data-protection need and ask how to enforce or verify it. This domain rewards least privilege, account guardrails with Organizations, and managed secret and encryption services over manual or over-broad approaches. Read the requirement before choosing.

  • Enforce least privilege

    An access need is described, and you choose scoped IAM roles and policies over broad permissions.

  • Apply account guardrails

    A multi-account compliance need is described, and you choose Organizations and service control policies.

  • Protect the data

    A data-protection need is described, and you choose KMS encryption or Secrets Manager with rotation.

Reasoning it through

An organization must prevent any account in an organizational unit from using Regions outside an approved list, regardless of individual user permissions. An IAM policy applies to identities and could be bypassed account by account. A service control policy attached to the organizational unit sets a permission guardrail that no identity in those accounts can exceed, which enforces the Region restriction centrally, so an SCP is the correct control.

Task statements 2

Official task statements from the Amazon Web Services outline, in outline order.

4.1 Implement and manage security and compliance policiesIAM, Organizations and SCPs, compliance enforcement, and auditing.
What it means
This covers IAM users, groups, roles and policies, least privilege, AWS Organizations and service control policies for account guardrails, enforcing compliance requirements such as approved Regions and services, permission boundaries, and auditing with CloudTrail and AWS Config.
What to understand
IAM policies grant permissions to identities, while service control policies set the maximum permissions for accounts in an organization, acting as guardrails that no identity can exceed. Least privilege limits each identity to what it needs. Organizations centralizes governance, and CloudTrail and Config provide the audit trail.
How it shows up
An access or compliance requirement is described, and you must choose IAM, an SCP, a permission boundary or an auditing tool.
Common confusion
Confusing service control policies with IAM policies; SCPs cap what accounts can do, while IAM policies grant permissions to identities.
4.2 Implement strategies to protect data and infrastructureKMS encryption, Secrets Manager, certificates and network protection.
What it means
This covers encryption at rest and in transit with AWS KMS, Secrets Manager and Parameter Store for storing and rotating secrets, AWS Certificate Manager for TLS certificates, and network protection services such as AWS WAF and AWS Shield, along with security group and network ACL configuration.
What to understand
KMS manages encryption keys, with customer managed keys giving control over rotation and policy. Secrets Manager stores and automatically rotates secrets, removing hard-coded credentials. Certificate Manager provisions and renews TLS certificates. WAF protects web applications and Shield protects against DDoS.
How it shows up
A data or infrastructure protection need is described, and you must choose KMS, Secrets Manager, Certificate Manager or a network protection service.
Common confusion
Hard-coding secrets or managing them in Parameter Store without rotation when Secrets Manager offers built-in rotation.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • IAM least privilege

    Granting only the permissions an identity needs.

    Remember
    A core operational security practice.
    Tested as
    Access questions.
    Trap
    Granting broad permissions.

  • IAM roles vs. users

    Roles give temporary credentials; users have long-lived ones.

    Remember
    Prefer roles for services and automation.
    Tested as
    Access questions.
    Trap
    Using long-lived keys where roles fit.

  • Service control policies

    Account-level guardrails capping permissions in an organization.

    Remember
    No identity can exceed them.
    Tested as
    Compliance questions.
    Trap
    Confusing them with IAM policies.

  • AWS Organizations

    Central multi-account management and governance.

    Remember
    It applies SCPs across accounts.
    Tested as
    Compliance questions.
    Trap
    Managing accounts individually.

  • Permission boundaries

    Limits on the maximum permissions an IAM entity can have.

    Remember
    They cap delegated permissions.
    Tested as
    Access questions.
    Trap
    Confusing them with SCPs.

  • KMS

    Managed encryption key service.

    Remember
    Customer managed keys give control over rotation.
    Tested as
    Encryption questions.
    Trap
    Using AWS managed keys where control is needed.

  • Secrets Manager

    Stores and automatically rotates secrets.

    Remember
    Built-in rotation removes hard-coded credentials.
    Tested as
    Secret questions.
    Trap
    Hard-coding secrets.

  • Certificate Manager

    Provisions and renews TLS certificates.

    Remember
    Automates certificate lifecycle.
    Tested as
    TLS questions.
    Trap
    Managing certificates manually.

  • WAF and Shield

    Web application firewall and DDoS protection.

    Remember
    WAF is layer 7; Shield protects availability.
    Tested as
    Protection questions.
    Trap
    Using a security group for web attacks.

  • CloudTrail and Config for audit

    API activity and configuration history for auditing.

    Remember
    They provide the compliance evidence trail.
    Tested as
    Audit questions.
    Trap
    Overlooking them for compliance.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

IAM policy vs. service control policy vs. permission boundary

ConceptMeaningKey differenceCommon trap
IAM policy Grants permissions to an identity Enables actions Confusing it with an SCP
Service control policy Caps permissions for accounts in an org Guardrail, no identity exceeds it Treating it as granting access
Permission boundary Caps an IAM entity's maximum permissions Limits delegation Confusing it with an SCP

Secrets Manager vs. Parameter Store

ConceptMeaningKey differenceCommon trap
Secrets Manager Stores and rotates secrets Built-in rotation Hard-coding secrets instead
Parameter Store Stores configuration and secrets Rotation needs more setup Expecting automatic rotation

KMS customer managed vs. AWS managed keys

ConceptMeaningKey differenceCommon trap
Customer managed key Key you control Control over rotation and policy Using it when simplicity suffices
AWS managed key Key AWS creates for a service Simple, limited control Using it where control is required

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. IAM to restrict Regions

    What candidates pick
    Use an IAM policy on each user to block disallowed Regions.
    Why it looks right
    IAM controls permissions.
    Why it's wrong
    A service control policy on the organizational unit enforces the Region guardrail that no identity can exceed.

    Clue to watch for The restriction must apply to all accounts regardless of user permissions.

  2. SCP grants access

    What candidates pick
    Attach a service control policy to grant a user new permissions.
    Why it looks right
    SCPs are permission policies.
    Why it's wrong
    SCPs only cap maximum permissions; IAM policies grant access.

    Clue to watch for The need is to grant, not to cap, permissions.

  3. Hard-coded secrets

    What candidates pick
    Store database credentials in application configuration.
    Why it looks right
    It is simple.
    Why it's wrong
    Credentials in configuration files leak through source control and never rotate, whereas Secrets Manager supplies them at runtime and can rotate them on a schedule through a rotation Lambda function.

    Clue to watch for The scenario involves storing or rotating credentials.

  4. Security group as WAF

    What candidates pick
    Use a security group to block web application attacks such as injection.
    Why it looks right
    Security groups filter traffic.
    Why it's wrong
    Security groups filter by port and address; AWS WAF protects web applications at layer 7.

    Clue to watch for The threat is a web application attack.

  5. AWS managed key for control

    What candidates pick
    Use an AWS managed KMS key where custom rotation and policy are required.
    Why it looks right
    It is simpler.
    Why it's wrong
    A customer managed key gives control over rotation schedule and key policy.

    Clue to watch for The requirement is control over key rotation or policy.

Answer framework

For any Domain 4 scenario, use these steps to find the answer SOA-C03 expects.

  1. Apply the shared responsibility model and prefer managed AWS security services for the operational control.
  2. For access, grant least-privilege IAM roles and policies, using permission boundaries to cap delegation.
  3. For multi-account compliance, enforce guardrails with AWS Organizations and service control policies rather than per-user IAM.
  4. For data, encrypt with KMS, choosing customer managed keys when control is needed, and store and rotate secrets with Secrets Manager.
  5. For infrastructure, use Certificate Manager for TLS and WAF or Shield for web and DDoS protection, and audit with CloudTrail and Config, record the change and the reasoning so the operational action is auditable and repeatable.

Practice question

A company must ensure that no account within a specific organizational unit can launch resources in Regions outside an approved list, regardless of the permissions granted to individual IAM users. What should the CloudOps engineer implement?

Want more like this? The SOA-C03 practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Approach this domain from an operator's angle: enforcing and verifying controls across accounts. Start with IAM and least privilege, then learn the control that candidates most confuse, the service control policy, which caps what accounts can do as an organization-wide guardrail, distinct from IAM policies that grant access and permission boundaries that cap one entity.

Next, learn data protection: KMS key types and when control requires a customer managed key, Secrets Manager with automatic rotation versus Parameter Store, and Certificate Manager for TLS. Add the network protection services, keeping WAF (web attacks) and Shield (DDoS) distinct from security groups.

Connect this to Domain 1's CloudTrail and Config, which provide the audit trail for compliance. Hands-on practice creating an SCP and a rotating secret cements these. Afterwards, move to Domain 5, networking and content delivery. Enable Config rules and Security Hub in a lab account to see real findings, then review missed practice questions by control type.

FAQ

How much of SOA-C03 is Domain 4?

Security and Compliance is 16% of the scored content.

What is the difference between an SCP and an IAM policy?

A service control policy caps the maximum permissions for accounts in an organization, acting as a guardrail. An IAM policy grants permissions to an identity. An SCP never grants access on its own.

How should I restrict which Regions accounts can use?

Attach a service control policy to the organizational unit that denies the disallowed Regions, which applies to all accounts regardless of individual IAM permissions.

When should I use Secrets Manager instead of Parameter Store?

When you need built-in automatic rotation of secrets. Parameter Store can hold secrets but requires more setup to rotate them.

When do I need a customer managed KMS key?

When you need control over the key's rotation schedule, policy or auditing. AWS managed keys are simpler but offer less control.

What is the difference between WAF and Shield?

AWS WAF protects web applications against layer-7 attacks such as injection. AWS Shield protects availability against distributed denial-of-service attacks.

How does Domain 4 connect to the rest of the exam?

It secures the resources the other domains provision, operate and network, using the auditing tools from the monitoring domain for compliance.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 4 knowledge

You have covered identity, compliance guardrails and data protection. Test whether you can enforce least privilege and account guardrails under exam conditions.

Take the SOA-C03 practice test Check your SOA-C03 readiness

Keep going