The New AWS Certified Security Specialty exam (beta) – tough but fair

The new AWS specialty certifications—Security, Advanced Networking, and Big Data—are each three-hour exams that require your full attention and respect. I recently sat the AWS Certified Security Specialty exam (beta) at 7 a.m. on day one of this year’s re:Invent in Las Vegas. In this post, I’ll be sharing my overall impressions, as well as some notes for preparing for this exam.

AWS Certified Security Specialty exam (beta): First impressions

My overall impression of the AWS Certified Security – Specialty (beta) exam is that it was a tough but fair examination of your security knowledge. I’ll confess: I felt pretty drained by the end of the three hours. The exam left few security stones left unturned, so to speak. As you would expect with any professional level certification, the scenarios were complex, and you had to evaluate each question scenario quickly in order to answer all of the questions in the time allotted.

In short, to pass this exam, you will need to dedicate a significant amount of time for preparation.
Here at Cloud Academy, our AWS team is busy creating learning paths for these new specialty certifications. Our learning path for Security will be live in March when the exam becomes available.

Preparing for the AWS Certified Security Specialty exam

If you are a security specialist or an architect looking to advance your security skills, you should plan to sit this exam. However, before starting the Specialist Security Learning Path, I would highly recommend completing the Solution Architect Associate for AWS and Solution Architect Professional for AWS learning paths first.
If you’re looking ahead to taking the AWS Certified Security Specialty exam, I’d like to share some tips that could be helpful in your preparation. While the content will likely change before the exam is made generally available, I think that these rough notes (made for our team working on the associated learning path) will still be useful for you.

Security groups and network access control lists. It is really important that students know how to recognize and explain the differences between security groups and network access control lists (ACLs), and when and how to use either. The security group operates at the instance level, so it is your first layer of defense. The network ACL operates at the subnet level, so it acts as a second layer of defense.

Security groups only support ALLOW rules. Network ACLs support allow rules and deny rules. The Security group is STATEFUL and return traffic is automatically allowed, regardless of any other rules. The network ACL is STATELESS, so return traffic must be explicitly allowed by your rules. Security groups are evaluated before deciding whether to allow traffic.

In network ACLs, rules are processed in numerical order. With the security group, it applies to an instance only if someone specifies the security group when launching that instance, or when that security group is associated with an instance once it has already been launched. Using network ACL, this is automatically applied to all instances in the associated subnet, so it acts as a backup layer of defense. You can only set ALLOW rules for security groups, allowing an IP address or range of IP addresses to access your VPC using a specified service port to a defined IP destination. You cannot use a security group to set a DENY rule. Start here.

Network ACLs can be used to provide a temporary attack mitigation strategy, e.g. for blocking an attack site’s IP address or IP address ranges. Again, this is only temporary. If you want to implement a scalable solution for blocking unwanted traffic, you need to consider WAF or ideally, you will want to implement an IDS/IPS solution. Remember that Intrusion detection and Intrusion prevention have unique requirements and may be provided by separate services.

AWS Shared Security. Students need to be able to recognize and explain the practical aspects of the AWS shared security model. Students will need a working knowledge of the types of compliance questions that are common in RFPs and security/audit questionnaires. For example, you need to know when and how customer data is wiped from an EBS volume, how long it takes to disable a user or temporary credentials from a role if a system is compromised.

Compliance. Recognize and explain what security reports and services can be used when applying for or managing compliance audits. View the reports and procedures listed in the AWS Compliance portal.
Recognize and explain how to go about achieving certification and compliance, know the various monitoring services and when to use them for compliance reporting. AWS CloudWatch monitors service activity, and AWS CloudTrail monitors API calls and requests. AWS Config monitors and reports on changes to your environment and users (very useful for PCI, SOC, and HIPPA compliance reports). VPC flow logs are an additional feature that helps with compliance reporting as it allows you to monitor all changes within the VPC.

Support services. Recognize and explain the AWS support services available and which services/tasks would be covered by Enterprise or Business level support.

Attacks and intrusion detection. Be able to recognize the common attack patterns and mitigation strategies discussed on the AWS security blog and outlined in AWS security whitepapers.

Be able to recognize and explain DDOS attack prevention strategies in AWS and the steps you can implement to reduce the impact of a DDOS attack on your VPC. Understand and identify the benefits of ELB and WAF in mitigating DDOS-type attacks. Understand how AWS CloudWatch alarms and AWS CloudTrail logs can help identify and mitigate network attacks, e.g. how you might dynamically add IP addresses from cloudtrail logs,  TOR exit points, etc. to a white or black list using Lambda functions.
Recognize and explain how to reduce attack surface area and implement network layer defense to mitigate “man in the middle” attacks. Know the core aspects of the AWS Security Whitepaper.

Students taking the AWS Certified Security Specialty exam need to recognize and know how to implement common strategies/steps used to implement intrusion detection systems at scale and be familiar with some of the partner solutions available in the AWS Marketplace. This may have cost and performance implications. All security design considerations should be made based on business priorities and constraints for cost and time. IDS/IPS services can be expensive for sites with a large number of servers.
Key management support. Recognize and implement key management in AWS. Know the various types of KMS support available. Have a working knowledge of AWS CloudHSM in order to understand what is required to provision it and how to estimate what it would cost on a monthly basis.
Recognize and explain key management and key management options in AWS.  Know how to migrate, set up, and manage KMS in AWS. Try it out in the console to make sure that you understand all of the required steps in this process. Start here.

CloudHSM. Recognize and explain how to configure AWS CloudHSM and understand the AWS CloudHSM architecture/integration options (e.g. that CloudHSM uses Safenet Luna appliances).
Recognize and explain which key properties may not be able to be exported/transferred from a hardware appliance to KMS or CloudHSM. Ideally, try exporting a key to AWS to understand which values cannot be exported if migrating from onprem storage to KMS or CloudHSM.
S3 bucket policies. Understand Amazon S3 bucket policies and have a good understanding of when to use Amazon S3 resource level policies over AWS IAM access level permissions.
AWS IAM policies. To recognize and implement AWS IAM policies you will need to know the syntax for denying and allowing access to resources and be able to recognize syntax errors in an IAM policy.
VPN.  Recognize and implement all aspects of a VPN in the VPC.

Recognize the difference between VPN and AWS Direct Connect. Understand that a VPN uses IPSEC and Direct Connect as a physical connection from a partner-implemented endpoint that is not dependent on an internet connection. AWS Direct Connect needs to be implemented by an AWS Partner, and because it involves configuring ports, etc., it can take time to implement. While it’s inevitable that AWS Direct Connect may use some common routing/networking components, it is effectively a dedicated connection, i.e. AWS Direct Connect does not “share” the public internet.

That’s all for now. Next up, I’ll be sharing my thoughts and recommendations on the Network and Big Data certification exams. Stay tuned!

 

Avatar

Written by

Andrew Larkin

Andrew is an AWS certified professional who is passionate about helping others learn how to use and gain benefit from AWS technologies. Andrew has worked for AWS and for AWS technology partners Ooyala and Adobe. His favorite Amazon leadership principle is "Customer Obsession" as everything AWS starts with the customer. Passions around work are cycling and surfing, and having a laugh about the lessons learnt trying to launch two daughters and a few start ups.

Related Posts

Avatar
Michael Sheehy
— August 19, 2019

What Exactly Is a Cloud Architect and How Do You Become One?

One of the buzzwords surrounding the cloud that I'm sure you've heard is "Cloud Architect." In this article, I will outline my understanding of what a cloud architect does and I'll analyze the skills and certifications necessary to become one. I will also list some of the types of jobs ...

Read more
  • AWS
  • Cloud Computing
Avatar
Andrew Larkin
— August 13, 2019

Content Roadmap: AZ-500, ITIL 4, MS-100, Google Cloud Associate Engineer, and More

Last month, Cloud Academy joined forces with QA, the UK’s largest B2B skills provider, and it put us in an excellent position to solve a massive skills gap problem. As a result of this collaboration, you will see our training library grow with additions from QA’s massive catalog of 500+...

Read more
  • AWS
  • Azure
  • content roadmap
  • Google Cloud Platform
Avatar
Adam Hawkins
— August 9, 2019

DevSecOps: How to Secure DevOps Environments

Security has been a friction point when discussing DevOps. This stems from the assumption that DevOps teams move too fast to handle security concerns. This makes sense if Information Security (InfoSec) is separate from the DevOps value stream, or if development velocity exceeds the band...

Read more
  • AWS
  • cloud security
  • DevOps
  • DevSecOps
  • Security
Avatar
Stefano Giacone
— August 8, 2019

Test Your Cloud Knowledge on AWS, Azure, or Google Cloud Platform

Cloud skills are in demand | In today's digital era, employers are constantly seeking skilled professionals with working knowledge of AWS, Azure, and Google Cloud Platform. According to the 2019 Trends in Cloud Transformation report by 451 Research: Business and IT transformations re...

Read more
  • AWS
  • Cloud skills
  • Google Cloud
  • Microsoft Azure
Avatar
Andrew Larkin
— August 7, 2019

Disadvantages of Cloud Computing

If you want to deliver digital services of any kind, you’ll need to estimate all types of resources, not the least of which are CPU, memory, storage, and network connectivity. Which resources you choose for your delivery —  cloud-based or local — is up to you. But you’ll definitely want...

Read more
  • AWS
  • Azure
  • Cloud Computing
  • Google Cloud Platform
Joe Nemer
Joe Nemer
— August 6, 2019

Google Cloud vs AWS: A Comparison (or can they be compared?)

The "Google Cloud vs AWS" argument used to be a common discussion among our members, but is this still really a thing? You may already know that there are three major players in the public cloud platforms arena: Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP)...

Read more
  • AWS
  • Google Cloud Platform
  • Kubernetes
Avatar
Stuart Scott
— July 29, 2019

Deployment Orchestration with AWS Elastic Beanstalk

If you're responsible for the development and deployment of web applications within your AWS environment for your organization, then it's likely you've heard of AWS Elastic Beanstalk. If you are new to this service, or simply need to know a bit more about the service and the benefits th...

Read more
  • AWS
  • elastic beanstalk
Avatar
Stuart Scott
— July 26, 2019

How to Use & Install the AWS CLI

What is the AWS CLI? | The AWS Command Line Interface (CLI) is for managing your AWS services from a terminal session on your own client, allowing you to control and configure multiple AWS services and implement a level of automation. If you’ve been using AWS for some time and feel...

Read more
  • AWS
  • AWS CLI
  • Command line interface
Alisha Reyes
Alisha Reyes
— July 22, 2019

Cloud Academy’s Blog Digest: July 2019

July has been a very exciting month for us at Cloud Academy. On July 10, we officially joined forces with QA, the UK’s largest B2B skills provider (read the announcement). Over the coming weeks, you will see additions from QA’s massive catalog of 500+ certification courses and 1500+ ins...

Read more
  • AWS
  • Azure
  • Cloud Academy
  • Cybersecurity
  • DevOps
  • Kubernetes
Avatar
Stuart Scott
— July 18, 2019

AWS Fundamentals: Understanding Compute, Storage, Database, Networking & Security

If you are just starting out on your journey toward mastering AWS cloud computing, then your first stop should be to understand the AWS fundamentals. This will enable you to get a solid foundation to then expand your knowledge across the entire AWS service catalog.   It can be both d...

Read more
  • AWS
  • Compute
  • Database
  • fundamentals
  • networking
  • Security
  • Storage
Avatar
Adam Hawkins
— July 17, 2019

How to Become a DevOps Engineer

The DevOps Handbook introduces DevOps as a framework for improving the process for converting a business hypothesis into a technology-enabled service that delivers value to the customer. This process is called the value stream. Accelerate finds that applying DevOps principles of flow, f...

Read more
  • AWS
  • AWS Certifications
  • DevOps
  • DevOps Foundation Certification
  • Engineer
  • Kubernetes
Avatar
Vineet Badola
— July 15, 2019

AWS AMI Virtualization Types: HVM vs PV (Paravirtual VS Hardware VM)

Amazon Machine Images (AWS AMI) offers two types of virtualization: Paravirtual (PV) and Hardware Virtual Machine (HVM). Each solution offers its own advantages. When we’re using AWS, it’s easy for someone — almost without thinking —  to choose which AMI flavor seems best when spinning...

Read more
  • AWS
  • Hardware Virtual Machine
  • Paravirtual
  • Virtualization