Domain 5 · 18% of Exam

Data Protection

Design and implement data encryption, key management, secrets management, and data classification solutions.

What You'll Be Tested On

  • Implement encryption at rest with KMS (CMKs, key policies, grants)
  • Design encryption in transit (TLS, IPSec, client-side encryption)
  • Implement secrets management with rotation and cross-account access
  • Configure S3 data protection (SSE, Object Lock, Macie)
  • Design key management for multi-account and multi-region workloads

Key AWS Services in This Domain

Exam Tips for Domain 5

💡

Know KMS key policy + IAM policy evaluation for cross-account

💡

Understand envelope encryption flow and when to use it

💡

Practice designing key hierarchy for multi-account environments

Practice Domain 5 Questions

Test your knowledge of Data Protection with practice questions from our SCS-C02 question bank.

Start Practice Quiz →

Other SCS-C02 Domains