Apply AuthN/AuthZ with IAM roles/policies, SGs, PrivateLink, S3 Access Points; manage creds with Secrets Manager/Parameter Store
Encrypt at rest and in transit; use KMS; implement masking/anonymization and cross-account encryption
Centralize and audit logs with CloudTrail, CloudWatch Logs, CloudTrail Lake; analyze with Athena/OpenSearch
Enforce privacy/governance: protect PII (Macie + Lake Formation), control data sharing (Redshift), manage regional restrictions and config drift (Config)
Out of Scope for the Exam
Performing AI/ML tasks
Language-specific syntax expertise
Drawing business conclusions from data
How to Prepare
Study the official exam guide and domain task statements
Build pipelines end-to-end with Kinesis/MSK, Glue/EMR/Spark, Redshift, and Step Functions/MWAA
Practice cataloging and lifecycle policies with Glue Data Catalog and S3 Lifecycle
Drill security/governance: IAM policies/roles, KMS encryption, Macie, Lake Formation, CloudTrail/CloudWatch
Use Athena/QuickSight for analysis; validate data quality with DataBrew and queries