What You'll Be Tested On
- Implement encryption at rest with KMS (CMKs, key policies, grants)
- Design encryption in transit (TLS, IPSec, client-side encryption)
- Implement secrets management with rotation and cross-account access
- Configure S3 data protection (SSE, Object Lock, Macie)
- Design key management for multi-account and multi-region workloads
Key AWS Services in This Domain
Exam Tips for Domain 5
Know KMS key policy + IAM policy evaluation for cross-account
Understand envelope encryption flow and when to use it
Practice designing key hierarchy for multi-account environments
Practice Domain 5 Questions
Test your knowledge of Data Protection with practice questions from our SCS-C02 question bank.
Start Practice Quiz →