The New AWS Certified Security Specialty exam (beta) – tough but fair

The new AWS specialty certifications—Security, Advanced Networking, and Big Data—are each three-hour exams that require your full attention and respect. I recently sat the AWS Certified Security Specialty exam (beta) at 7 a.m. on day one of this year’s re:Invent in Las Vegas. In this post, I’ll be sharing my overall impressions, as well as some notes for preparing for this exam.

AWS Certified Security Specialty exam (beta): First impressions

My overall impression of the AWS Certified Security – Specialty (beta) exam is that it was a tough but fair examination of your security knowledge. I’ll confess: I felt pretty drained by the end of the three hours. The exam left few security stones left unturned, so to speak. As you would expect with any professional level certification, the scenarios were complex, and you had to evaluate each question scenario quickly in order to answer all of the questions in the time allotted.

In short, to pass this exam, you will need to dedicate a significant amount of time for preparation.
Here at Cloud Academy, our AWS team is busy creating learning paths for these new specialty certifications. Our learning path for Security will be live in March when the exam becomes available.

Preparing for the AWS Certified Security Specialty exam

If you are a security specialist or an architect looking to advance your security skills, you should plan to sit this exam. However, before starting the Specialist Security Learning Path, I would highly recommend completing the Solution Architect Associate for AWS and Solution Architect Professional for AWS learning paths first.
If you’re looking ahead to taking the AWS Certified Security Specialty exam, I’d like to share some tips that could be helpful in your preparation. While the content will likely change before the exam is made generally available, I think that these rough notes (made for our team working on the associated learning path) will still be useful for you.

Security groups and network access control lists. It is really important that students know how to recognize and explain the differences between security groups and network access control lists (ACLs), and when and how to use either. The security group operates at the instance level, so it is your first layer of defense. The network ACL operates at the subnet level, so it acts as a second layer of defense.

Security groups only support ALLOW rules. Network ACLs support allow rules and deny rules. The Security group is STATEFUL and return traffic is automatically allowed, regardless of any other rules. The network ACL is STATELESS, so return traffic must be explicitly allowed by your rules. Security groups are evaluated before deciding whether to allow traffic.

In network ACLs, rules are processed in numerical order. With the security group, it applies to an instance only if someone specifies the security group when launching that instance, or when that security group is associated with an instance once it has already been launched. Using network ACL, this is automatically applied to all instances in the associated subnet, so it acts as a backup layer of defense. You can only set ALLOW rules for security groups, allowing an IP address or range of IP addresses to access your VPC using a specified service port to a defined IP destination. You cannot use a security group to set a DENY rule. Start here.

Network ACLs can be used to provide a temporary attack mitigation strategy, e.g. for blocking an attack site’s IP address or IP address ranges. Again, this is only temporary. If you want to implement a scalable solution for blocking unwanted traffic, you need to consider WAF or ideally, you will want to implement an IDS/IPS solution. Remember that Intrusion detection and Intrusion prevention have unique requirements and may be provided by separate services.

AWS Shared Security. Students need to be able to recognize and explain the practical aspects of the AWS shared security model. Students will need a working knowledge of the types of compliance questions that are common in RFPs and security/audit questionnaires. For example, you need to know when and how customer data is wiped from an EBS volume, how long it takes to disable a user or temporary credentials from a role if a system is compromised.

Compliance. Recognize and explain what security reports and services can be used when applying for or managing compliance audits. View the reports and procedures listed in the AWS Compliance portal.
Recognize and explain how to go about achieving certification and compliance, know the various monitoring services and when to use them for compliance reporting. AWS CloudWatch monitors service activity, and AWS CloudTrail monitors API calls and requests. AWS Config monitors and reports on changes to your environment and users (very useful for PCI, SOC, and HIPPA compliance reports). VPC flow logs are an additional feature that helps with compliance reporting as it allows you to monitor all changes within the VPC.

Support services. Recognize and explain the AWS support services available and which services/tasks would be covered by Enterprise or Business level support.

Attacks and intrusion detection. Be able to recognize the common attack patterns and mitigation strategies discussed on the AWS security blog and outlined in AWS security whitepapers.

Be able to recognize and explain DDOS attack prevention strategies in AWS and the steps you can implement to reduce the impact of a DDOS attack on your VPC. Understand and identify the benefits of ELB and WAF in mitigating DDOS-type attacks. Understand how AWS CloudWatch alarms and AWS CloudTrail logs can help identify and mitigate network attacks, e.g. how you might dynamically add IP addresses from cloudtrail logs,  TOR exit points, etc. to a white or black list using Lambda functions.
Recognize and explain how to reduce attack surface area and implement network layer defense to mitigate “man in the middle” attacks. Know the core aspects of the AWS Security Whitepaper.

Students taking the AWS Certified Security Specialty exam need to recognize and know how to implement common strategies/steps used to implement intrusion detection systems at scale and be familiar with some of the partner solutions available in the AWS Marketplace. This may have cost and performance implications. All security design considerations should be made based on business priorities and constraints for cost and time. IDS/IPS services can be expensive for sites with a large number of servers.
Key management support. Recognize and implement key management in AWS. Know the various types of KMS support available. Have a working knowledge of AWS CloudHSM in order to understand what is required to provision it and how to estimate what it would cost on a monthly basis.
Recognize and explain key management and key management options in AWS.  Know how to migrate, set up, and manage KMS in AWS. Try it out in the console to make sure that you understand all of the required steps in this process. Start here.

CloudHSM. Recognize and explain how to configure AWS CloudHSM and understand the AWS CloudHSM architecture/integration options (e.g. that CloudHSM uses Safenet Luna appliances).
Recognize and explain which key properties may not be able to be exported/transferred from a hardware appliance to KMS or CloudHSM. Ideally, try exporting a key to AWS to understand which values cannot be exported if migrating from onprem storage to KMS or CloudHSM.
S3 bucket policies. Understand Amazon S3 bucket policies and have a good understanding of when to use Amazon S3 resource level policies over AWS IAM access level permissions.
AWS IAM policies. To recognize and implement AWS IAM policies you will need to know the syntax for denying and allowing access to resources and be able to recognize syntax errors in an IAM policy.
VPN.  Recognize and implement all aspects of a VPN in the VPC.

Recognize the difference between VPN and AWS Direct Connect. Understand that a VPN uses IPSEC and Direct Connect as a physical connection from a partner-implemented endpoint that is not dependent on an internet connection. AWS Direct Connect needs to be implemented by an AWS Partner, and because it involves configuring ports, etc., it can take time to implement. While it’s inevitable that AWS Direct Connect may use some common routing/networking components, it is effectively a dedicated connection, i.e. AWS Direct Connect does not “share” the public internet.

That’s all for now. Next up, I’ll be sharing my thoughts and recommendations on the Network and Big Data certification exams. Stay tuned!

 

Avatar

Written by

Andrew Larkin

Andrew is an AWS certified professional who is passionate about helping others learn how to use and gain benefit from AWS technologies. Andrew has worked for AWS and for AWS technology partners Ooyala and Adobe. His favorite Amazon leadership principle is "Customer Obsession" as everything AWS starts with the customer. Passions around work are cycling and surfing, and having a laugh about the lessons learnt trying to launch two daughters and a few start ups.


Related Posts

Alisha Reyes
Alisha Reyes
— July 2, 2020

New Content: AWS, Azure, Typescript, Java, Docker, 13 New Labs, and Much More

This month, our Content Team released a whopping 13 new labs in real cloud environments! If you haven't tried out our labs, you might not understand why we think that number is so impressive. Our labs are not “simulated” experiences — they are real cloud environments using accounts on A...

Read more
  • AWS
  • Azure
  • DevOps
  • Google Cloud Platform
  • Machine Learning
  • programming
Joe Nemer
Joe Nemer
— June 19, 2020

Kickstart Your Tech Training With a Free Week on Cloud Academy

Are you looking to make a jump in your technical career? Want to get trained or certified on AWS, Azure, Google Cloud Platform, DevOps, Kubernetes, Python, or another in-demand skill?Then you'll want to mark your calendar. Starting Monday, June 22 at 12:00 a.m. PDT (3:00 a.m. EDT), ...

Read more
  • AWS
  • Azure
  • cloud academy content
  • complimentary access
  • GCP
  • on the house
Alisha Reyes
Alisha Reyes
— June 11, 2020

New Content: AZ-500 and AZ-400 Updates, 3 Google Professional Exam Preps, Practical ML Learning Path, C# Programming, and More

This month, our Content Team released tons of new content and labs in real cloud environments. Not only that, but we introduced our very first highly interactive "Office Hours" webinar. This webinar, Acing the AWS Solutions Architect Associate Certification, started with a quick overvie...

Read more
  • AWS
  • Azure
  • DevOps
  • Google Cloud Platform
  • Machine Learning
  • programming
Rebecca Willis
Rebecca Willis
— June 3, 2020

Azure vs. AWS: Which Certification Provides the Brighter Future?

More and more companies are using cloud services, prompting more and more people to switch their current IT position to something cloud-related. The problem is most people only have that much time after work to learn new technologies, and there are plenty of cloud services that you can ...

Read more
  • AWS
  • Azure
  • certification
Alisha Reyes
Alisha Reyes
— June 2, 2020

Blog Digest: 5 Reasons to Get AWS Certified, OWASP Top 10, Getting Started with VPCs, Top 10 Soft Skills, and More

Thank you for being a valued member of our community! We recently sent out a short survey to understand what type of content you would like us to add to Cloud Academy, and we want to thank everyone who gave us their input. If you would like to complete the survey, it's not too late. It ...

Read more
  • AWS
  • Azure
  • blog digest
  • Certifications
  • Cloud Academy
  • OWASP
  • OWASP Top 10
  • Security
  • VPCs
Alisha Reyes
Alisha Reyes
— May 11, 2020

New Content: Alibaba, Azure Cert Prep: AI-100, AZ-104, AZ-204 & AZ-400, Amazon Athena Playground, Google Cloud Developer Challenge, and much more

This month, our Content Team released 8 new learning paths, 4 courses, 7 labs in real cloud environments, and 4 new knowledge check assessments. Not only that, but we introduced our very first course on Alibaba Cloud, and our expert instructors are working 'round the clock to create 6 n...

Read more
  • alibaba
  • AWS
  • Azure
  • gitops
  • Google Cloud Platform
  • lab playground
  • programming
Avatar
Rhonda Martinez
— May 4, 2020

Top 5 Reasons to Get AWS Certified Right Now

Cloud computing trends are on the rise and have been for some time already. Fortunately, it’s never too late to start learning cloud computing. Skills like AWS and others associated with cloud computing are in high demand because cloud technologies have become crucial for many businesse...

Read more
  • Amazon Elastic Book Store
  • Amazon Elastic Compute Cloud (EC2)
  • AWS
  • AWS Certifications
  • Glacier
Alisha Reyes
Alisha Reyes
— May 1, 2020

Introducing Our Newest Lab Environments: Lab Playgrounds

Want to train in a real cloud environment, but feel slowed down by spinning up your own deployments? When you consider security or pricing costs, it can be costly and challenging to get up to speed quickly for self-training. To solve this problem, Cloud Academy created a new suite of la...

Read more
  • AWS
  • Azure
  • Docker
  • Google Cloud Platform
  • Java
  • lab playgrounds
  • Python
Alisha Reyes
Alisha Reyes
— April 30, 2020

Blog Digest: AWS Breaking News, Azure DevOps, AWS Study Guide, 8 Ways to Prevent a Ransomware Attack, and More

  New articles by topicAWS Azure Data Science Google Cloud  Cloud Adoption Platform Updates & New Content Security Women in TechAWSBreaking News: All AWS Certification Exams Now Available Online As an Advanced AWS Technology Partner, C...

Read more
  • AWS
  • Azure
  • blog digest
  • Certifications
  • Cloud Academy
  • programming
  • Security
Avatar
Stuart Scott
— April 27, 2020

AWS Certified Solutions Architect Associate: A Study Guide

Want to take a really impactful step in your technical career? Explore the AWS Solutions Architect Associate certificate. Its new version (SAA-C02) was released on March 23, 2020, though you can still take SAA-C01 through July 1, 2020. This post will focus on version SAA-C02.The AWS...

Read more
  • AWS
  • AWS Certifications
  • AWS Certified Solutions Architect Associate
Alisha Reyes
Alisha Reyes
— April 9, 2020

New on Cloud Academy: AWS Solutions Architect Exam Prep, Azure Courses, GCP Engineer Exam Prep, Programming, and More

Free content on Cloud Academy More and more customers are relying on our technology and content to keep upskilling their people in these months, and we are doing our best to keep supporting them. While the world fights the COVID-19 pandemic, we wanted to make a small contribution to he...

Read more
  • AWS
  • Azure
  • Google Cloud Platform
  • programming
Joe Nemer
Joe Nemer
— April 3, 2020

Breaking News: All AWS Certification Exams Now Available Online

Remote proctoring for all AWS certifications Cloud Academy is an Advanced AWS Technology Partner, and we are happy to announce all AWS certification exams are available online!  What does this mean for you? You can stay focused on your certification goal. Or you can start a certifica...

Read more
  • AWS
  • AWS certification
  • AWS Certifications