What You'll Be Tested On
- Design secure VPC architectures with segmentation and isolation
- Implement edge security (WAF, Shield, CloudFront, Network Firewall)
- Configure secure connectivity (VPN, Direct Connect, PrivateLink)
- Implement host-based security (Inspector, SSM Patch Manager)
- Design centralized network inspection architectures
Key AWS Services in This Domain
Exam Tips for Domain 3
Know defense-in-depth layers: edge → VPC → subnet → instance
Understand Network Firewall rule evaluation and inspection VPC patterns
Practice designing centralized egress filtering with TGW + Network Firewall
Practice Domain 3 Questions
Test your knowledge of Infrastructure Security with practice questions from our SCS-C02 question bank.
Start Practice Quiz →