SCS-C03 · Domain 3 of 6

SCS-C03 Domain 3: Infrastructure Security

Domain 3 covers protecting the infrastructure itself: edge services against web and DDoS attacks, compute workloads from build to runtime, generative AI applications, and the network paths between VPCs, on-premises sites and other clouds.

Exam weight
18%
Official task statements
3
Estimated questions estimate
~9
Suggested study time estimate
16–20 hrs

About 12 min read Reviewed October 2026

Overview

Infrastructure Security has three task statements. Task 3.1 covers edge controls: choosing strategies for expected threats, CloudFront headers, AWS WAF rules against OWASP Top 10 risks, rate limiting, geographic and client fingerprint rules, AWS IoT policies, S3 CORS, Shield Advanced, OCSF integration and third-party WAF rule groups. Task 3.2 covers compute: hardened AMIs and container images with EC2 Image Builder, instance profiles and execution roles, Amazon Inspector scanning, GuardDuty runtime monitoring, Patch Manager, Session Manager and EC2 Instance Connect, pipeline scanning with Amazon Q Developer and CodeGuru Security, and guardrails for generative AI applications.

Task 3.3 covers network controls: security groups, network ACLs, Network Firewall, Site-to-Site VPN, Direct Connect with MACsec, Verified Access, segmentation and finding unnecessary access with Network Access Analyzer.

How it's tested

Domain 3 scenarios describe an attack path, a compliance need or a connectivity design and ask which control, at which layer, solves it with the least exposure and effort. Expect several plausible services in the options, separated by layer and scope.

  • Place the control

    An attack such as SQL injection, bot scraping, DDoS or lateral movement is described, and you choose the layer and service that stops it.

  • Harden the workload

    An image, container or function must be built, scanned, patched and accessed securely, and you choose the pipeline or Systems Manager feature.

  • Design the network path

    Hybrid or multi-VPC connectivity must be encrypted, segmented or reduced, and you choose VPN, Direct Connect with MACsec, Verified Access or Network Firewall.

Reasoning it through

An API behind CloudFront and an Application Load Balancer is being scraped by many IP addresses at high request rates. Security groups cannot filter by request rate, and network ACLs cannot scale to thousands of addresses. An AWS WAF web ACL on the CloudFront distribution with a rate-based rule, plus Bot Control if needed, stops the abuse at the edge before traffic reaches the origin.

Task statements 3

Official task statements from the Amazon Web Services outline, in outline order.

3.1 Design, implement, and troubleshoot security controls for network edge servicesEdge strategy, AWS WAF, Shield Advanced, CloudFront, CORS and third-party edge integration.
What it means
This task statement covers choosing edge strategies for expected threats, implementing protections such as CloudFront headers, AWS WAF, IoT policies, OWASP Top 10 defenses, S3 CORS and Shield Advanced, building edge rules for geography, geolocation, rate limiting and client fingerprinting, and integrating edge services with third-party tools, including OCSF ingestion and third-party WAF rules.
What to understand
AWS WAF attaches to CloudFront, ALB, API Gateway, AppSync and Cognito user pools. Managed rule groups cover common OWASP risks, rate-based rules limit floods per client, geographic match rules block or allow countries, and JA3 or JA4 fingerprints identify clients behind changing IPs. CloudFront origin access control and a custom header checked at the origin stop direct-to-origin bypass. Shield Standard is automatic; Shield Advanced adds the response team, cost protection and automatic application-layer mitigation. Marketplace rule groups add vendor signatures.
How it shows up
Expect to choose the edge resource where WAF attaches and the rule type that matches the abuse pattern described.
Common confusion
Expecting a security group to block SQL injection; only a layer 7 control such as AWS WAF inspects request content.
3.2 Design, implement, and troubleshoot security controls for compute workloadsHardened images, workload roles, vulnerability scanning, patching, admin access, pipeline scanning and GenAI guardrails.
What it means
This task statement covers building hardened EC2 AMIs and container images with Systems Manager and EC2 Image Builder, applying instance profiles, service roles and execution roles, scanning for vulnerabilities with Amazon Inspector and monitoring runtimes with GuardDuty, automating patching with Patch Manager, securing admin access with Session Manager and EC2 Instance Connect, scanning code in pipelines with Amazon Q Developer and CodeGuru Security, and protecting generative AI applications.
What to understand
Bake controls into a golden image with Image Builder and rebuild rather than patching snowflakes. Give workloads credentials only through roles: instance profiles for EC2, task roles for ECS, execution roles for Lambda, and IMDSv2 to protect instance metadata. Inspector scans EC2, ECR images and Lambda functions continuously. Session Manager removes inbound SSH, bastion hosts and key handling, and logs sessions. For GenAI apps, apply prompt-injection defenses, output filtering and Amazon Bedrock Guardrails in line with the OWASP Top 10 for LLM Applications.
How it shows up
Look for wording such as no inbound ports, no long-term keys or continuous scanning; each maps to a specific managed feature.
Common confusion
Storing access keys on an instance when an instance profile role provides rotating temporary credentials automatically.
3.3 Design and troubleshoot network security controlsTraffic filtering, hybrid connectivity, Verified Access, segmentation and finding unnecessary access.
What it means
This task statement covers designing and troubleshooting controls that permit or block traffic (security groups, network ACLs, Network Firewall), designing secure hybrid and multi-cloud connectivity (Site-to-Site VPN, Direct Connect, MACsec), setting security requirements for hybrid communication with Verified Access, segmenting networks for north-south and east-west protection, and identifying unnecessary access with Verified Access, Network Access Analyzer and Inspector network reachability findings.
What to understand
Security groups are stateful allow lists attached to network interfaces; network ACLs are stateless subnet rules with allow and deny, evaluated by rule number, so return traffic on ephemeral ports must be allowed. Network Firewall adds stateful inspection, domain filtering and Suricata rules, often in an inspection VPC behind Transit Gateway. Direct Connect is private but unencrypted unless you add MACsec or run VPN over it. Verified Access grants application access by identity and device posture without a VPN. Network Access Analyzer finds paths that break your intended segmentation.
How it shows up
Expect a blocked or overly open path; check statefulness, rule order and which layer filters before choosing a fix.
Common confusion
Believing Direct Connect encrypts traffic by default; it needs MACsec or an IPsec VPN on top.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • AWS WAF rate-based rule

    Blocks clients that exceed a request rate in a time window.

    Remember
    Key by IP, header or other aggregate.
    Tested as
    Scraping and HTTP flood scenarios.
    Trap
    Using network ACLs to block thousands of IPs.

  • Shield Advanced

    Paid DDoS protection with response team, cost protection and automatic L7 mitigation.

    Remember
    Protects specific resources you enroll.
    Tested as
    DDoS design questions.
    Trap
    Assuming Shield Standard covers application-layer floods fully.

  • Origin access control

    Lets only CloudFront read a private S3 origin.

    Remember
    Replaces origin access identity.
    Tested as
    Bypass prevention.
    Trap
    Leaving the bucket public behind CloudFront.

  • EC2 Image Builder

    Automates building, hardening and testing images.

    Remember
    Golden images and container images.
    Tested as
    Hardening questions.
    Trap
    Patching long-lived instances by hand.

  • Amazon Inspector

    Continuous vulnerability scanning for EC2, ECR images and Lambda.

    Remember
    Also gives network reachability findings.
    Tested as
    Vulnerability questions.
    Trap
    Confusing it with GuardDuty threat detection.

  • Session Manager

    Shell access through Systems Manager without inbound ports or keys.

    Remember
    Sessions can be logged to S3 or CloudWatch.
    Tested as
    Admin access questions.
    Trap
    Opening port 22 to a bastion.

  • IMDSv2

    Session-based instance metadata access.

    Remember
    Mitigates SSRF credential theft.
    Tested as
    Instance role protection.
    Trap
    Leaving IMDSv1 enabled.

  • Security group vs. network ACL

    Stateful ENI allow list versus stateless subnet allow and deny list.

    Remember
    Only NACLs can deny explicitly.
    Tested as
    Traffic troubleshooting.
    Trap
    Forgetting NACL ephemeral return ports.

  • AWS Network Firewall

    Managed stateful firewall with IPS rules and domain filtering.

    Remember
    Deployed in firewall subnets with route changes.
    Tested as
    East-west and egress inspection.
    Trap
    Expecting it without route table updates.

  • MACsec on Direct Connect

    Layer 2 encryption on dedicated connections.

    Remember
    Direct Connect alone is not encrypted.
    Tested as
    Hybrid encryption questions.
    Trap
    Assuming private equals encrypted.

  • AWS Verified Access

    Zero trust application access based on identity and device posture.

    Remember
    No VPN needed for users.
    Tested as
    Remote access design.
    Trap
    Choosing Client VPN for per-app access policy.

  • Network Access Analyzer

    Finds network paths that violate intended access.

    Remember
    Checks segmentation at scale.
    Tested as
    Unnecessary access questions.
    Trap
    Confusing it with IAM Access Analyzer.

  • OWASP Top 10 for LLM Applications

    Risk list for GenAI apps such as prompt injection and sensitive data disclosure.

    Remember
    New in SCS-C03 skill 3.2.7.
    Tested as
    GenAI guardrail questions.
    Trap
    Treating GenAI risks as only a WAF problem.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Traffic controls by layer

ConceptMeaningKey differenceCommon trap
Security group Stateful allow rules on an interface No deny rules Trying to block one IP with it
Network ACL Stateless subnet rules with allow and deny Ordered by rule number Missing ephemeral return ports
AWS Network Firewall Stateful inspection and IPS for VPC traffic Domain and signature filtering Forgetting routing changes
AWS WAF Layer 7 HTTP inspection Blocks injection and bots Attaching it to an NLB

Remote and hybrid access

ConceptMeaningKey differenceCommon trap
Site-to-Site VPN IPsec tunnel over the internet Encrypted by default Expecting dedicated bandwidth
Direct Connect Private dedicated link Not encrypted by default Calling it encrypted
Client VPN User VPN into the VPC Network-level access Using it for per-app posture checks
Verified Access Per-application zero trust access Identity and device aware Expecting network-wide access

Compute access and scanning

ConceptMeaningKey differenceCommon trap
Session Manager Agent-based shell access No inbound ports Still opening SSH
EC2 Instance Connect Short-lived SSH keys pushed per session Uses SSH with IAM control Thinking it needs no network path
Amazon Inspector Vulnerability scanning Finds CVEs and exposure Using it for runtime threats

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. NACL for application attacks

    What candidates pick
    Add network ACL deny rules for attacker IPs sending SQL injection.
    Why it looks right
    NACLs can deny traffic.
    Why it's wrong
    Attackers rotate addresses and NACLs have rule limits; AWS WAF inspects the request and blocks the pattern itself.

    Clue to watch for Payload or request content is the problem.

  2. Direct Connect is enough

    What candidates pick
    Use Direct Connect to meet an encryption-in-transit requirement.
    Why it looks right
    It is private and dedicated.
    Why it's wrong
    Direct Connect does not encrypt by default; MACsec or an IPsec VPN over it is required.

    Clue to watch for The requirement says encrypted, not just private.

  3. Bastion host for admin access

    What candidates pick
    Deploy a hardened bastion with SSH open to the office IP.
    Why it looks right
    Bastions are a known pattern.
    Why it's wrong
    Session Manager removes inbound ports and key management and logs sessions centrally, which is more secure with less effort.

    Clue to watch for No inbound ports or auditable sessions are required.

  4. Inspector for runtime threats

    What candidates pick
    Use Amazon Inspector to detect a container running a crypto miner.
    Why it looks right
    Inspector scans containers.
    Why it's wrong
    Inspector finds known vulnerabilities; active malicious behavior at runtime is detected by GuardDuty Runtime Monitoring.

    Clue to watch for The scenario describes behavior, not a CVE.

  5. Origin bypass

    What candidates pick
    Add AWS WAF to CloudFront and stop there.
    Why it looks right
    WAF now filters requests.
    Why it's wrong
    Attackers can hit the origin directly unless origin access control or a secret header check restricts it to CloudFront.

    Clue to watch for The origin has a public endpoint.

  6. Client VPN for per-app access

    What candidates pick
    Give contractors Client VPN to reach one internal app.
    Why it looks right
    VPN is familiar.
    Why it's wrong
    Client VPN grants network access; Verified Access allows only the specific application with identity and device posture checks.

    Clue to watch for Least access to a single application is required.

Answer framework

Use these steps for Domain 3 questions about edge, compute or network controls.

  1. Identify the attack or requirement and the layer it lives at: HTTP content, volumetric traffic, network flow, host or identity, so the control matches the threat.
  2. Choose the control built for that layer, such as WAF for requests, Shield for DDoS, Network Firewall or security groups for flows.
  3. For compute, prefer hardened images, role-based credentials, continuous Inspector scanning and Session Manager over manual fixes.
  4. For connectivity, confirm whether encryption is required and add MACsec or VPN where links are private but unencrypted, such as Direct Connect.
  5. Check for bypass paths and unnecessary access using origin restrictions, Network Access Analyzer and reachability findings before finalizing the design.

Practice question

A company runs a public web application on EC2 behind an Application Load Balancer. Security wants to block SQL injection attempts, limit any single client to 2,000 requests in five minutes and avoid managing extra servers. Which solution meets these requirements?

Want more like this? The SCS-C03 practice test has questions for every domain.

Checklist

0 of 14

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Split your study into the three layers the task statements use: edge, compute and network. For the edge, set up a CloudFront distribution in front of an ALB, add an AWS WAF web ACL with a managed core rule set and a rate-based rule, and test what happens when you call the ALB directly. Then lock the origin so only CloudFront can reach it.

For compute, build one hardened image pipeline with EC2 Image Builder, launch an instance with an instance profile and IMDSv2 required, enable Inspector and connect with Session Manager instead of SSH. Read the OWASP Top 10 for LLM Applications and match each risk to a control, such as Bedrock Guardrails for harmful output or input validation for prompt injection.

For networking, draw a hub-and-spoke design with a Network Firewall inspection VPC and write the route tables yourself. Memorize the security group and network ACL differences, including ephemeral ports. Finish with the hybrid options: VPN, Direct Connect with MACsec, Client VPN and Verified Access. Practice questions should focus on choosing the layer before choosing the service.

FAQ

How much of SCS-C03 is Domain 3?

Infrastructure Security is 18% of scored content, roughly nine of the fifty scored questions, across three task statements for edge, compute and network controls.

Why did this domain's weight drop from 20%?

The SCS-C03 comparison appendix removed host firewall hardening details, TCP/IP fundamentals and Reachability Analyzer troubleshooting, while adding GenAI protections and third-party edge integration.

Is generative AI security tested?

Yes. Skill 3.2.7 asks you to implement protections and guardrails for generative AI applications, for example by applying the OWASP Top 10 for LLM Applications.

When should I pick Network Firewall over a security group?

Pick Network Firewall when you need stateful inspection across VPCs, domain filtering, intrusion prevention signatures or centralized egress control. Security groups only allow traffic per interface.

What is the difference between Inspector and GuardDuty for compute?

Inspector finds known software vulnerabilities and network exposure. GuardDuty detects malicious behavior, including runtime monitoring for EC2, EKS and ECS.

Do I need to know OCSF for this domain?

Skill 3.1.4 mentions ingesting edge data in OCSF format for third-party integration. Know that OCSF is a shared schema, usually through Security Lake.

Is Direct Connect considered encrypted?

No. It is a private link but not encrypted by default. Use MACsec on supported dedicated connections or an IPsec VPN over Direct Connect.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 3 knowledge

You have covered edge protection, compute hardening, GenAI guardrails and network controls. Test whether you can pick the right layer and service quickly.

Take the SCS-C03 practice test Check your SCS-C03 readiness

Keep going