The new AWS specialty certifications—Security, Advanced Networking, and Big Data—are each three-hour exams that require your full attention and respect. I recently sat the AWS Certified Security Specialty exam (beta) at 7 a.m. on day one of this year’s re:Invent in Las Vegas. In this post, I’ll be sharing my overall impressions, as well as some notes for preparing for this exam.
AWS Certified Security Specialty exam (beta): First impressions
My overall impression of the AWS Certified Security – Specialty (beta) exam is that it was a tough but fair examination of your security knowledge. I’ll confess: I felt pretty drained by the end of the three hours. The exam left few security stones left unturned, so to speak. As you would expect with any professional level certification, the scenarios were complex, and you had to evaluate each question scenario quickly in order to answer all of the questions in the time allotted.
In short, to pass this exam, you will need to dedicate a significant amount of time for preparation.
Here at Cloud Academy, our AWS team is busy creating learning paths for these new specialty certifications. Our learning path for Security will be live in March when the exam becomes available.
Preparing for the AWS Certified Security Specialty exam
If you are a security specialist or an architect looking to advance your security skills, you should plan to sit this exam. However, before starting the Specialist Security Learning Path, I would highly recommend completing the Solution Architect Associate for AWS and Solution Architect Professional for AWS learning paths first.
If you’re looking ahead to taking the AWS Certified Security Specialty exam, I’d like to share some tips that could be helpful in your preparation. While the content will likely change before the exam is made generally available, I think that these rough notes (made for our team working on the associated learning path) will still be useful for you.
Security groups and network access control lists. It is really important that students know how to recognize and explain the differences between security groups and network access control lists (ACLs), and when and how to use either. The security group operates at the instance level, so it is your first layer of defense. The network ACL operates at the subnet level, so it acts as a second layer of defense.
Security groups only support ALLOW rules. Network ACLs support allow rules and deny rules. The Security group is STATEFUL and return traffic is automatically allowed, regardless of any other rules. The network ACL is STATELESS, so return traffic must be explicitly allowed by your rules. Security groups are evaluated before deciding whether to allow traffic.
In network ACLs, rules are processed in numerical order. With the security group, it applies to an instance only if someone specifies the security group when launching that instance, or when that security group is associated with an instance once it has already been launched. Using network ACL, this is automatically applied to all instances in the associated subnet, so it acts as a backup layer of defense. You can only set ALLOW rules for security groups, allowing an IP address or range of IP addresses to access your VPC using a specified service port to a defined IP destination. You cannot use a security group to set a DENY rule. Start here.
Network ACLs can be used to provide a temporary attack mitigation strategy, e.g. for blocking an attack site’s IP address or IP address ranges. Again, this is only temporary. If you want to implement a scalable solution for blocking unwanted traffic, you need to consider WAF or ideally, you will want to implement an IDS/IPS solution. Remember that Intrusion detection and Intrusion prevention have unique requirements and may be provided by separate services.
AWS Shared Security. Students need to be able to recognize and explain the practical aspects of the AWS shared security model. Students will need a working knowledge of the types of compliance questions that are common in RFPs and security/audit questionnaires. For example, you need to know when and how customer data is wiped from an EBS volume, how long it takes to disable a user or temporary credentials from a role if a system is compromised.
Compliance. Recognize and explain what security reports and services can be used when applying for or managing compliance audits. View the reports and procedures listed in the AWS Compliance portal.
Recognize and explain how to go about achieving certification and compliance, know the various monitoring services and when to use them for compliance reporting. AWS CloudWatch monitors service activity, and AWS CloudTrail monitors API calls and requests. AWS Config monitors and reports on changes to your environment and users (very useful for PCI, SOC, and HIPPA compliance reports). VPC flow logs are an additional feature that helps with compliance reporting as it allows you to monitor all changes within the VPC.
Support services. Recognize and explain the AWS support services available and which services/tasks would be covered by Enterprise or Business level support.
Attacks and intrusion detection. Be able to recognize the common attack patterns and mitigation strategies discussed on the AWS security blog and outlined in AWS security whitepapers.
Be able to recognize and explain DDOS attack prevention strategies in AWS and the steps you can implement to reduce the impact of a DDOS attack on your VPC. Understand and identify the benefits of ELB and WAF in mitigating DDOS-type attacks. Understand how AWS CloudWatch alarms and AWS CloudTrail logs can help identify and mitigate network attacks, e.g. how you might dynamically add IP addresses from cloudtrail logs, TOR exit points, etc. to a white or black list using Lambda functions.
Recognize and explain how to reduce attack surface area and implement network layer defense to mitigate “man in the middle” attacks. Know the core aspects of the AWS Security Whitepaper.
Students taking the AWS Certified Security Specialty exam need to recognize and know how to implement common strategies/steps used to implement intrusion detection systems at scale and be familiar with some of the partner solutions available in the AWS Marketplace. This may have cost and performance implications. All security design considerations should be made based on business priorities and constraints for cost and time. IDS/IPS services can be expensive for sites with a large number of servers.
Key management support. Recognize and implement key management in AWS. Know the various types of KMS support available. Have a working knowledge of AWS CloudHSM in order to understand what is required to provision it and how to estimate what it would cost on a monthly basis.
Recognize and explain key management and key management options in AWS. Know how to migrate, set up, and manage KMS in AWS. Try it out in the console to make sure that you understand all of the required steps in this process. Start here.
CloudHSM. Recognize and explain how to configure AWS CloudHSM and understand the AWS CloudHSM architecture/integration options (e.g. that CloudHSM uses Safenet Luna appliances).
Recognize and explain which key properties may not be able to be exported/transferred from a hardware appliance to KMS or CloudHSM. Ideally, try exporting a key to AWS to understand which values cannot be exported if migrating from onprem storage to KMS or CloudHSM.
S3 bucket policies. Understand Amazon S3 bucket policies and have a good understanding of when to use Amazon S3 resource level policies over AWS IAM access level permissions.
AWS IAM policies. To recognize and implement AWS IAM policies you will need to know the syntax for denying and allowing access to resources and be able to recognize syntax errors in an IAM policy.
VPN. Recognize and implement all aspects of a VPN in the VPC.
Recognize the difference between VPN and AWS Direct Connect. Understand that a VPN uses IPSEC and Direct Connect as a physical connection from a partner-implemented endpoint that is not dependent on an internet connection. AWS Direct Connect needs to be implemented by an AWS Partner, and because it involves configuring ports, etc., it can take time to implement. While it’s inevitable that AWS Direct Connect may use some common routing/networking components, it is effectively a dedicated connection, i.e. AWS Direct Connect does not “share” the public internet.
That’s all for now. Next up, I’ll be sharing my thoughts and recommendations on the Network and Big Data certification exams. Stay tuned!
Top 13 Amazon Virtual Private Cloud (VPC) Best Practices
Amazon Virtual Private Cloud (VPC) brings a host of advantages to the table, including static private IP addresses, Elastic Network Interfaces, secure bastion host setup, DHCP options, Advanced Network Access Control, predictable internal IP ranges, VPN connectivity, movement of interna...
Big Changes to the AWS Certification Exams
With AWS re:Invent 2019 just around the corner, we can expect some early announcements to trickle through with upcoming features and services. However, AWS has just announced some big changes to their certification exams. So what’s changing and what’s new? There is a brand NEW ...
New on Cloud Academy: ITIL® 4, Microsoft 365 Tenant, Jenkins, TOGAF® 9.1, and more
At Cloud Academy, we're always striving to make improvements to our training platform. Based on your feedback, we released some new features to help make it easier for you to continue studying. These new features allow you to: Remove content from “Continue Studying” section Disc...
AWS Security Groups: Instance Level Security
Instance security requires that you fully understand AWS security groups, along with patching responsibility, key pairs, and various tenancy options. As a precursor to this post, you should have a thorough understanding of the AWS Shared Responsibility Model before moving onto discussi...
Cloud Migration Risks & Benefits
If you’re like most businesses, you already have at least one workload running in the cloud. However, that doesn’t mean that cloud migration is right for everyone. While cloud environments are generally scalable, reliable, and highly available, those won’t be the only considerations dri...
Real-Time Application Monitoring with Amazon Kinesis
Amazon Kinesis is a real-time data streaming service that makes it easy to collect, process, and analyze data so you can get quick insights and react as fast as possible to new information. With Amazon Kinesis you can ingest real-time data such as application logs, website clickstre...
Google Cloud Functions vs. AWS Lambda: The Fight for Serverless Cloud Domination
Serverless computing: What is it and why is it important? A quick background The general concept of serverless computing was introduced to the market by Amazon Web Services (AWS) around 2014 with the release of AWS Lambda. As we know, cloud computing has made it possible for users to ...
Google Vision vs. Amazon Rekognition: A Vendor-Neutral Comparison
Google Cloud Vision and Amazon Rekognition offer a broad spectrum of solutions, some of which are comparable in terms of functional details, quality, performance, and costs. This post is a fact-based comparative analysis on Google Vision vs. Amazon Rekognition and will focus on the tech...
New on Cloud Academy: CISSP, AWS, Azure, & DevOps Labs, Python for Beginners, and more…
As Hurricane Dorian intensifies, it looks like Floridians across the entire state might have to hunker down for another big one. If you've gone through a hurricane, you know that preparing for one is no joke. You'll need a survival kit with plenty of water, flashlights, batteries, and n...
Amazon Route 53: Why You Should Consider DNS Migration
What Amazon Route 53 brings to the DNS table Amazon Route 53 is a highly available and scalable Domain Name System (DNS) service offered by AWS. It is named by the TCP or UDP port 53, which is where DNS server requests are addressed. Like any DNS service, Route 53 handles domain regist...
How to Unlock Complimentary Access to Cloud Academy
Are you looking to get trained or certified on AWS, Azure, Google Cloud Platform, DevOps, Cloud Security, Python, Java, or another technical skill? Then you'll want to mark your calendars for August 23, 2019. Starting Friday at 12:00 a.m. PDT (3:00 a.m. EDT), Cloud Academy is offering c...
What Exactly Is a Cloud Architect and How Do You Become One?
One of the buzzwords surrounding the cloud that I'm sure you've heard is "Cloud Architect." In this article, I will outline my understanding of what a cloud architect does and I'll analyze the skills and certifications necessary to become one. I will also list some of the types of jobs ...