Exam Overview
Exam Details
- Duration: 170 minutes
- Questions: 65
- Passing Score: 750/1000
- Format: Multiple choice & multiple response
- Cost: ~$150-300 USD
- Validity: 3 years
Exam Domains
| Domain | Weight |
|---|---|
| Threat Detection & Incident Response | 14% |
| Security Logging & Monitoring | 18% |
| Infrastructure Security | 20% |
| Identity & Access Management | 16% |
| Data Protection | 18% |
| Security Governance | 14% |
Threat Detection Services
| Service | What It Detects | Data Sources |
|---|---|---|
| GuardDuty | Threats: crypto-mining, credential theft, C2 comms, port scans | VPC Flow Logs, DNS logs, CloudTrail events |
| Security Hub | Aggregates findings from all security services; compliance scores | GuardDuty, Inspector, Macie, Config, partners |
| Inspector | Vulnerabilities in EC2 OS, Lambda, ECR images | SSM Agent, ECR scans, Lambda code |
| Macie | Sensitive data (PII, credit cards) in S3 | S3 object metadata & content |
| Detective | Root cause analysis; investigate security findings | VPC Flow Logs, CloudTrail, GuardDuty findings |
IAM & Access Control Deep Dive
Policy Types
| Policy Type | Attached To | Purpose |
|---|---|---|
| Identity Policy | Users, Groups, Roles | What the identity can do |
| Resource Policy | S3, KMS, SQS, Lambda... | Who can access the resource |
| SCP | AWS Org OU/Account | Max permissions guardrail (never grants) |
| Permission Boundary | Users, Roles | Max permissions an admin can grant |
| Session Policy | AssumeRole calls | Further restrict a temporary session |
Data Encryption
KMS Key Types
| Key Type | Control | Cost |
|---|---|---|
| AWS Managed Keys (aws/s3, aws/rds) | Minimal | Free |
| Customer Managed Keys (CMK) | Full (key policy, grants, rotation) | $1/month + API calls |
| Customer-Provided (SSE-C) | Complete (you store key) | No KMS cost |
| CloudHSM | Dedicated HSM hardware | High |
S3 Encryption Options
- SSE-S3 — AWS manages keys; AES-256; default for new buckets
- SSE-KMS — CMK; audit via CloudTrail; possible KMS throttling
- SSE-C — customer provides key per request; HTTPS only
- Client-Side — encrypt before upload; AWS never sees plaintext
Secrets Manager vs Parameter Store
Secrets Manager
- Built-in automatic rotation (Lambda)
- Native RDS/Redshift integration
- $0.40/secret/month
- Cross-account sharing via resource policy
Parameter Store
- Standard tier: free; Advanced: $0.05/param/month
- SecureString uses KMS encryption
- Hierarchical naming (/app/db/password)
- No automatic rotation (use Lambda + EventBridge)
Network Security
- AWS WAF — Layer 7; block SQLi, XSS, rate limiting; attach to ALB, CloudFront, API Gateway
- AWS Shield Standard — free; automatic DDoS protection Layer 3/4
- AWS Shield Advanced — $3,000/month; DRT team; cost protection
- Firewall Manager — centrally manage WAF, Shield, Security Groups across org
- Network Firewall — stateful managed firewall in VPC; deep packet inspection; IDS/IPS
- VPC Traffic Mirroring — copy traffic from ENIs to intrusion detection appliances
📋 Study Checklist
Progress0%
- Know all threat detection services: GuardDuty, Inspector, Macie, Security Hub, Detective
- Explain all IAM policy types and evaluation logic
- Configure S3 security: Block Public Access, bucket policies, pre-signed URLs, WORM
- Know KMS key types: AWS-managed, CMK, SSE-C, CloudHSM
- Explain S3 encryption: SSE-S3, SSE-KMS, SSE-C, client-side
- Know when to use Secrets Manager vs Parameter Store
- Understand automatic secret rotation with Secrets Manager
- Configure WAF rules: SQLi, XSS, rate limiting, IP reputation
- Know Shield Standard vs Advanced differences
- Understand Firewall Manager centralized policy management
- Configure Network Firewall for deep packet inspection
- Enable CloudTrail in all regions with log file integrity validation
- Configure S3 Access Analyzer and IAM Access Analyzer
- Understand KMS key policies and grants for cross-account access
- Use Config Conformance Packs for compliance standards
- Design incident response playbooks with EventBridge + Lambda
- Know ACM: public vs private CAs
- Know Cognito User Pools vs Identity Pools security implications
- Configure GuardDuty with automated remediation
- Understand VPC Traffic Mirroring for intrusion detection