SCS-C03 · Domain 5 of 6

SCS-C03 Domain 5: Data Protection

Domain 5 covers protecting data in every state: enforcing encryption and private paths in transit, choosing encryption, integrity and retention controls at rest, and managing secrets, keys, certificates and sensitive values.

Exam weight
18%
Official task statements
3
Estimated questions estimate
~9
Suggested study time estimate
16–20 hrs

About 12 min read Reviewed October 2026

Overview

Data Protection has three task statements. Task 5.1 covers data in transit: requiring TLS through Elastic Load Balancing security policies and service settings, private access with PrivateLink, VPC endpoints, Client VPN and Verified Access, and encryption between nodes in EMR, EKS and SageMaker AI and on Nitro instances. Task 5.2 covers data at rest: choosing AWS KMS or AWS CloudHSM and client-side or server-side encryption, protecting integrity with Object Lock, Glacier Vault Lock, versioning and code signing, lifecycle and retention policies, and secure replication and backup with AWS Backup, Data Lifecycle Manager and DataSync.

Task 5.3 covers secrets and keys: rotating secrets in Secrets Manager, managing imported key material and external key stores, contrasting imported and AWS generated material, masking data in CloudWatch Logs and SNS, and multi-Region keys and certificates with AWS Private CA.

How it's tested

Domain 5 scenarios state a regulatory, residency, integrity or recovery requirement and ask which encryption, key, retention or backup option meets it with the least operational work. The wording about who controls keys and who can delete data usually decides the answer.

  • Who controls the key

    Requirements about key custody, FIPS validation or keeping material outside AWS lead you to pick KMS, imported material, an external key store or CloudHSM.

  • Make data immutable

    Records must be kept unchanged for a set period, and you choose Object Lock mode, Vault Lock, versioning or AWS Backup Vault Lock.

  • Encrypt or keep private in transit

    Traffic must use TLS, avoid the internet or be encrypted between nodes, and you choose listener policies, endpoints or service encryption settings.

Reasoning it through

An auditor requires that trading records in S3 cannot be altered or deleted by anyone for seven years, including administrators. Governance mode lets users with a special permission bypass retention, so it fails the requirement. Object Lock in compliance mode with a seven-year default retention, on a versioned bucket, meets it, because not even the root user can shorten the period.

Task statements 3

Official task statements from the Amazon Web Services outline, in outline order.

5.1 Design and implement controls for data in transitEnforcing TLS, private connectivity and inter-node encryption.
What it means
This task statement covers designing mechanisms that require encryption when connecting to resources (ELB security policies, enforced TLS settings), mechanisms for secure and private access (PrivateLink, VPC endpoints, Client VPN, Verified Access), and inter-resource encryption such as inter-node settings for Amazon EMR, Amazon EKS and SageMaker AI and Nitro-based encryption between instances.
What to understand
Enforce TLS at the listener with an HTTPS listener and a modern ELB security policy, and at the resource with conditions such as aws:SecureTransport in S3 bucket policies or require-SSL parameters on databases. Gateway endpoints serve S3 and DynamoDB; interface endpoints use PrivateLink for most other services and partner endpoints. Endpoint policies and aws:SourceVpce conditions keep data on private paths. EMR security configurations, SageMaker AI inter-container encryption and Nitro instance types provide encryption between nodes.
How it shows up
Expect a requirement that traffic never crosses the internet or must always use TLS, and pick the endpoint or policy condition that enforces it.
Common confusion
Thinking a VPC endpoint encrypts data by itself; it keeps traffic private, and TLS still handles encryption.
5.2 Design and implement controls for data at restEncryption choices, integrity, lifecycle and retention, and secure backup and replication.
What it means
This task statement covers designing data encryption at rest by choosing a key service such as CloudHSM or KMS and an encryption type such as client-side or server-side, protecting data integrity with S3 Object Lock, Glacier Vault Lock, versioning, code signing and file validation, designing lifecycle and retention with S3 Lifecycle, Object Lock, EFS Lifecycle and FSx for Lustre backup policies, and building secure replication and backup with Data Lifecycle Manager, AWS Backup, ransomware protection and DataSync.
What to understand
SSE-S3 needs no key management, SSE-KMS adds key policies, audit trails and separation of duties, DSSE-KMS adds a second layer, and client-side encryption keeps plaintext out of AWS. CloudHSM gives single-tenant FIPS-validated HSMs that you manage. Object Lock compliance mode cannot be bypassed; governance mode can with s3:BypassGovernanceRetention. AWS Backup Vault Lock, cross-account copies and logically air-gapped vaults defend backups against ransomware. CloudTrail log file validation proves logs were not changed.
How it shows up
Watch for who must not be able to delete or read data; that phrase separates governance from compliance mode and KMS from client-side encryption.
Common confusion
Treating versioning as immutability; versions can still be deleted unless Object Lock or MFA Delete protects them.
5.3 Design and implement controls to protect confidential data, credentials, secrets, and cryptographic key materialsSecrets rotation, imported and external keys, masking, and multi-Region keys and certificates.
What it means
This task statement covers designing management and rotation of credentials and secrets with Secrets Manager, managing and rotating imported key material and external key stores, describing how imported key material differs from AWS generated material, masking sensitive data with CloudWatch Logs data protection policies and SNS message data protection, and creating encryption keys and certificates in one or many Regions with customer managed KMS keys and AWS Private CA.
What to understand
Secrets Manager rotates database and custom secrets with Lambda on a schedule; Parameter Store is cheaper but lacks built-in rotation. Imported key material gives you custody and an optional expiry, but AWS cannot recover it and automatic rotation does not apply; you rotate by importing new material or creating a new key. External key stores keep keys in your own HSM outside AWS. Multi-Region keys share key material across Regions for replicated data. CloudWatch Logs and SNS data protection policies detect and mask sensitive values.
How it shows up
Expect a question on key custody or rotation limits; know which key types support automatic rotation and which require manual steps.
Common confusion
Assuming deleted imported key material can be restored by AWS; you must reimport the identical material yourself.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • SSE-S3 vs. SSE-KMS vs. client-side

    AWS-managed keys, KMS keys with policy control, or encryption before upload.

    Remember
    Client-side keeps plaintext out of AWS.
    Tested as
    Encryption choice questions.
    Trap
    Picking SSE-S3 when key access must be audited.

  • KMS key policy

    Resource policy that controls who can use and manage a KMS key.

    Remember
    Must allow access; IAM alone is not enough without it.
    Tested as
    Access denied on encrypted data.
    Trap
    Forgetting kms:Decrypt for readers.

  • AWS CloudHSM

    Dedicated single-tenant HSM cluster you manage.

    Remember
    You control users and keys; AWS cannot access them.
    Tested as
    Strict custody requirements.
    Trap
    Choosing it when KMS meets the need with less effort.

  • Imported key material

    Key material you generate and import into KMS.

    Remember
    No automatic rotation; can set expiry; AWS cannot recover it.
    Tested as
    New SCS-C03 skill 5.3.3.
    Trap
    Expecting automatic yearly rotation.

  • External key store

    KMS keys backed by an HSM outside AWS.

    Remember
    Keys never leave your HSM.
    Tested as
    Sovereignty requirements.
    Trap
    Confusing it with a CloudHSM key store.

  • Multi-Region keys

    Related KMS keys with the same material in several Regions.

    Remember
    Decrypt in another Region without re-encrypting.
    Tested as
    Global data and DR.
    Trap
    Assuming normal keys work across Regions.

  • S3 Object Lock modes

    Compliance mode cannot be bypassed; governance mode can by permitted users.

    Remember
    Requires versioning.
    Tested as
    Immutability questions.
    Trap
    Choosing governance for legal holds no one may override.

  • AWS Backup Vault Lock

    WORM protection for backup vaults.

    Remember
    Compliance mode becomes immutable after the grace period.
    Tested as
    Ransomware protection.
    Trap
    Relying on IAM alone to protect backups.

  • Secrets Manager rotation

    Scheduled rotation of secrets through Lambda.

    Remember
    Built-in support for RDS and other databases.
    Tested as
    Credential management questions.
    Trap
    Choosing Parameter Store when rotation is required.

  • aws:SecureTransport

    Condition key that is false for non-TLS requests.

    Remember
    Deny when false to require HTTPS.
    Tested as
    Enforce encryption in transit.
    Trap
    Writing an allow instead of a deny.

  • VPC endpoints

    Private access to AWS services without internet gateways.

    Remember
    Gateway for S3 and DynamoDB; interface for most others.
    Tested as
    Private access questions.
    Trap
    Assuming endpoints encrypt traffic.

  • Data masking policies

    CloudWatch Logs and SNS policies that detect and mask sensitive data.

    Remember
    New SCS-C03 skill 5.3.4.
    Tested as
    PII in logs and messages.
    Trap
    Using Macie to mask log events.

  • AWS Private CA

    Managed private certificate authority for internal TLS.

    Remember
    Issues private certificates; ACM public certs are separate.
    Tested as
    Internal mTLS and certificates.
    Trap
    Expecting public trust for private certificates.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Key custody options

ConceptMeaningKey differenceCommon trap
KMS with AWS generated material Fully managed keys Automatic rotation available Thinking you can export the key
KMS with imported material Your material inside KMS Manual rotation, optional expiry Expecting AWS to restore it
External key store Keys stay in your external HSM Material never in AWS Ignoring availability dependency
CloudHSM Dedicated HSMs you manage Single tenant, full control Choosing it for simple needs

Immutability controls

ConceptMeaningKey differenceCommon trap
Versioning Keeps prior object versions Versions can still be deleted Calling it WORM
Object Lock governance Retention that permitted users can bypass Flexible for testing Using it for strict regulation
Object Lock compliance Retention no one can bypass Strict WORM Setting an overly long retention by mistake
Backup Vault Lock WORM for AWS Backup vaults Protects backups Confusing it with Glacier Vault Lock

Secret storage

ConceptMeaningKey differenceCommon trap
Secrets Manager Managed secrets with rotation Built-in rotation and cross-Region replication Overlooking cost for simple config
Parameter Store SecureString Encrypted parameters No built-in rotation Choosing it when rotation is required

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Governance for strict retention

    What candidates pick
    Enable Object Lock governance mode for regulatory records.
    Why it looks right
    It still prevents most deletions.
    Why it's wrong
    Users with bypass permission can remove governance retention; only compliance mode blocks everyone, including root.

    Clue to watch for No one, including administrators, may delete.

  2. SSE-S3 for audited key use

    What candidates pick
    Use SSE-S3 because it encrypts everything automatically.
    Why it looks right
    It is simple and free.
    Why it's wrong
    SSE-S3 does not give a key policy or CloudTrail record of key use per request; SSE-KMS does.

    Clue to watch for Separation of duties or auditable key use.

  3. Rotation of imported material

    What candidates pick
    Enable automatic rotation on a KMS key with imported material.
    Why it looks right
    Automatic rotation is the usual answer.
    Why it's wrong
    Automatic rotation is not supported for imported material; rotate on demand by importing new material into the same key (supported since 2025) or use a new key and alias.

    Clue to watch for The key uses imported or external material.

  4. Parameter Store for rotation

    What candidates pick
    Store database passwords in Parameter Store and rotate them automatically.
    Why it looks right
    It stores secrets cheaply.
    Why it's wrong
    Parameter Store has no built-in rotation; Secrets Manager provides scheduled Lambda rotation for databases.

    Clue to watch for Automatic credential rotation is required.

  5. Endpoint equals encryption

    What candidates pick
    Add an S3 gateway endpoint to satisfy an encryption-in-transit rule.
    Why it looks right
    Traffic no longer uses the internet.
    Why it's wrong
    Endpoints change routing, not encryption; enforce TLS with an aws:SecureTransport deny condition.

    Clue to watch for The requirement says encrypted, not private.

  6. Macie to mask logs

    What candidates pick
    Use Macie to remove card numbers from CloudWatch log events.
    Why it looks right
    Macie finds sensitive data.
    Why it's wrong
    Macie scans S3 objects; CloudWatch Logs data protection policies mask sensitive values in log events.

    Clue to watch for Sensitive data appears in logs or SNS messages.

Answer framework

Use these steps for Domain 5 questions about encryption, integrity, retention, backup or secrets.

  1. Identify the data state involved, in transit, at rest or in use as a secret or key, and the exact requirement wording.
  2. Determine who must control or be excluded from the key, then choose AWS generated KMS, imported material, external key store, CloudHSM or client-side encryption.
  3. For integrity and retention, decide whether anyone may override it, then choose versioning, governance mode or compliance mode accordingly.
  4. For transit, enforce TLS with listener policies and deny conditions, and add endpoints or PrivateLink where traffic must stay private.
  5. Protect backups and secrets with Vault Lock, cross-account copies, Secrets Manager rotation and masking policies for logs and messages.

Practice question

A healthcare company stores patient files in S3 encrypted with SSE-KMS. A new compliance rule says the company must generate its own key material, be able to remove it from AWS immediately, and keep using KMS integrations. What should the company use?

Want more like this? The SCS-C03 practice test has questions for every domain.

Checklist

0 of 13

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Organize your study by data state. For data in transit, practice one bucket policy that denies requests without TLS, one ALB HTTPS listener with a current security policy, and one interface endpoint with an endpoint policy. Read the inter-node encryption settings for EMR and SageMaker AI so you recognize them in a question.

For data at rest, build a comparison table of SSE-S3, SSE-KMS, DSSE-KMS, client-side encryption, imported material, external key stores and CloudHSM, with columns for who holds the key, rotation and audit. Create a versioned bucket with Object Lock and test governance mode with and without the bypass permission. Configure an AWS Backup plan with a locked vault and a cross-account copy.

For secrets and keys, rotate an RDS secret with Secrets Manager, create a multi-Region key and replicate it, and apply a CloudWatch Logs data protection policy to a log group that receives test card numbers. Finish each session with scenario questions, underlining the phrase that names who must control or be excluded from the data.

FAQ

How much of SCS-C03 is Domain 5?

Data Protection is 18% of scored content, about nine of the fifty scored questions, spread over three task statements for data in transit, data at rest and secrets and keys.

What is new in this domain for SCS-C03?

The comparison appendix adds inter-node encryption in transit, imported versus AWS generated key material, data masking for CloudWatch Logs and SNS, and keys and certificates across multiple Regions.

When is CloudHSM the right answer?

When the requirement calls for single-tenant HSMs under your exclusive control or specific FIPS validation levels that KMS does not meet. Otherwise KMS is usually simpler.

Can AWS recover deleted imported key material?

No. AWS keeps no copy. You must reimport the same material to decrypt data protected by that key, so keep a secure copy yourself.

What is the difference between Object Lock modes?

Governance mode can be bypassed by users granted s3:BypassGovernanceRetention. Compliance mode cannot be shortened or removed by anyone, including the root user, until retention ends.

How do I protect backups from ransomware?

Use AWS Backup with Vault Lock, cross-account and cross-Region copies, and restrictive vault access policies so attackers in one account cannot delete recovery points.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 5 knowledge

You have covered encryption in transit and at rest, integrity, retention, backups, secrets and key management. See whether you can spot the deciding requirement in each scenario.

Take the SCS-C03 practice test Check your SCS-C03 readiness

Keep going