8.4. Phase 8 Reflection Checkpoint

Key Takeaways:

1. Time management: 2 minutes per question first pass, reserve 40 minutes for review
2. Decompose scenarios into goal + constraints + principle, then evaluate ALL answers against ALL requirements
3. AWS always favors automated, managed, least-privilege solutions over manual, custom, over-permissive ones
4. Continue learning through AWS Security Blog, re:Invent, and hands-on practice

Final Self-Check: Can you answer these across all domains?

• Design a detection architecture that spans 200 accounts and 4 Regions
• Sequence the steps to respond to a compromised EC2 instance
• Explain why Bedrock Guardrails addresses prompt injection but WAF doesn't
• Trace the IAM policy evaluation order from SCP through session policy
• Design an encryption strategy using multi-Region KMS keys for disaster recovery
• Implement organization-wide governance using SCPs, RCPs, and declarative policies

End of Study Guide — AWS Certified Security - Specialty (SCS-C03)