Data Forensics

AWS is committed to protecting the value that AWS Certification(s) provide to our customers. One way we do this is by conducting statistical analyses of our exams to identify anomalies in test performance data. This is what we refer to as data forensics. The AWS Certification team conducted extensive research to identify exam performance behaviors that occur fewer than once out of every million exam deliveries. When we detect these behaviors, AWS invalidates the exam result.

Because forensic analysis is a continuous process, it is possible that an issued certification can be revoked when future analysis is done. Candidates will be notified if their exam is invalidated because of forensic analysis.

As explained in the AWS Certification Program Agreement which every candidate accepts as a condition of participating in the AWS Certification Program, we do not provide a refund or other compensation for an exam that is invalidated by forensic analysis. Additionally, candidates who have an exam result invalidated by forensic analysis are prohibited from taking future AWS Certification exams through any form of Online Test Delivery until the AWS Certification Security team (“the Security team”) notifies the candidate in writing that they may do so.

When an exam is invalidated by forensic analysis, the candidate will receive a notice explaining any action taken against the candidate’s exam and their account. Candidates have 14 calendar days from the date the notice was sent by AWS to submit a request to the AWS Training and Certification Customer Service team for additional information about the forensic invalidation. The Customer Service team must receive any subsequent candidate requests to appeal the forensic invalidation by the deadline stated in the Customer Service team’s response. If a candidate fails to respond to any communication by the stated deadline, the candidate will forfeit any opportunity to appeal the invalidation.

Candidates not Suspended From the AWS Certification Program: In appeal cases where the candidate was not prohibited from participating in the AWS Certification Program, the Security team will further investigate the forensically invalidated exam and all other AWS Certification exams the candidate has taken. The Security team will also investigate candidate account activity and whether any other policy violations occurred during any exam. If the Security team, in its sole discretion, finds past testing behavior or account activity that is linked to other forensically invalidated exams, including forensically invalidated exams taken by other candidates, or if additional statistical anomalies are detected, the appeal will be denied. Candidates will not receive a refund or other compensation when an appeal is denied. Please be aware that any past exam taken before AWS implemented the use of data forensics will be subject to forensic analysis as part of the investigative process. Any past exam determined to be anomalous by forensic analysis conducted during the appeal investigation will also be invalidated.

If the Security team’s investigation does not find additional links to forensically invalidated exams or additional statistical anomalies that support denying the appeal, AWS will not validate the result of the appealed exam. However, AWS may issue the candidate a Security Retake Voucher for the full cost of retaking the same exam. These vouchers are specific to forensic invalidation appeals. More information regarding redemption of Security Retake Vouchers can be found below.

Candidates Suspended From the AWS Certification Program: The Certification Candidate Appeals Committee (“the Appeals Committee”) is responsible for reviewing appeals when a candidate is prohibited from participating in the AWS Certification Program and the facts and claims of the appeal are substantially different from any appeal previously adjudicated by the Appeals Committee. When a candidate appeals AWS’s decision to suspend them from the AWS Certification Program, the Security team will investigate the candidate’s exam history and certification account activity and provide the candidate with results from the investigation. Candidates will have 14 calendar days from the date the Security team sends the investigation results to the candidate to respond to all questions presented by the Security team and to provide a statement and all evidence that supports why the appeal should be granted. The Security team will review and investigate any information provided by the candidate to support their appeal. If the investigation finds additional evidence to support further action against the candidate, the Security team will share those findings with the candidate and provide an opportunity for the candidate to respond.

The Security team will present their investigative findings and information received from the candidate to the Security Manager or the Security Manager’s designee for review. The Security Manager or designee, in their sole discretion, will determine whether the facts of the invalidation, investigation, appeal statement, and additional evidence are substantially similar to any prior case resolved by the Appeals Committee. If the Security Manager does find substantial similarity with any prior case resolved by the Appeals Committee, the Security Manager will decide the outcome of the appeal consistent with prior precedent established by the Appeals Committee. The decision of the Security Manager will be final. If the Security Manager does not find substantial similarity, the appeal will be presented to the Appeals Committee and the Appeals Committee’s decision to uphold, reduce, or overturn any sanctions will be final.

Security Retake Vouchers: Security Retake Vouchers are vouchers issued by the Security team for the purpose of retaking a specific exam. Security Retake Vouchers are non-transferrable and must be redeemed according to the instructions provided with the voucher. The Security team will investigate whether Security Retake Vouchers were redeemed according to the instructions. If not, the exam may be invalidated and no additional compensation will be provided. The Security team will also evaluate the exam retake for statistical anomalies and policy violations. Exam results will remain valid if no statistical anomalies or violations are found, otherwise, the Security team will contact the candidate about next steps.

Protecting the Data Forensics Process: Our data forensic analysis is designed to detect exam performance and behavior that is highly unlikely to occur by chance. To protect the mechanisms AWS uses during our data forensic process from being circumvented, we do not disclose specific details about the anomalies we detect when invalidating an exam result or denying an appeal.

Protecting Candidate Privacy: Candidate privacy is of the utmost concern and for that reason, if a candidate has an exam forensically invalidated, we will only communicate with the candidate about the invalidation and the appeals process. That means that the Security team will not discuss forensic invalidations and appeals with the candidate’s employer, manager, or other third-parties that do not support the Security team. We want to ensure candidates receive accurate information so please follow the process described here or explained by the Customer Service or Security teams.