The New AWS Certified Security Specialty exam (beta) – tough but fair

The new AWS specialty certifications—Security, Advanced Networking, and Big Data—are each three-hour exams that require your full attention and respect. I recently sat the AWS Certified Security Specialty exam (beta) at 7 a.m. on day one of this year’s re:Invent in Las Vegas. In this post, I’ll be sharing my overall impressions, as well as some notes for preparing for this exam.

AWS Certified Security Specialty exam (beta): First impressions

My overall impression of the AWS Certified Security – Specialty (beta) exam is that it was a tough but fair examination of your security knowledge. I’ll confess: I felt pretty drained by the end of the three hours. The exam left few security stones left unturned, so to speak. As you would expect with any professional level certification, the scenarios were complex, and you had to evaluate each question scenario quickly in order to answer all of the questions in the time allotted.

In short, to pass this exam, you will need to dedicate a significant amount of time for preparation.
Here at Cloud Academy, our AWS team is busy creating learning paths for these new specialty certifications. Our learning path for Security will be live in March when the exam becomes available.

Preparing for the AWS Certified Security Specialty exam

If you are a security specialist or an architect looking to advance your security skills, you should plan to sit this exam. However, before starting the Specialist Security Learning Path, I would highly recommend completing the Solution Architect Associate for AWS and Solution Architect Professional for AWS learning paths first.
If you’re looking ahead to taking the AWS Certified Security Specialty exam, I’d like to share some tips that could be helpful in your preparation. While the content will likely change before the exam is made generally available, I think that these rough notes (made for our team working on the associated learning path) will still be useful for you.

Security groups and network access control lists. It is really important that students know how to recognize and explain the differences between security groups and network access control lists (ACLs), and when and how to use either. The security group operates at the instance level, so it is your first layer of defense. The network ACL operates at the subnet level, so it acts as a second layer of defense.

Security groups only support ALLOW rules. Network ACLs support allow rules and deny rules. The Security group is STATEFUL and return traffic is automatically allowed, regardless of any other rules. The network ACL is STATELESS, so return traffic must be explicitly allowed by your rules. Security groups are evaluated before deciding whether to allow traffic.

In network ACLs, rules are processed in numerical order. With the security group, it applies to an instance only if someone specifies the security group when launching that instance, or when that security group is associated with an instance once it has already been launched. Using network ACL, this is automatically applied to all instances in the associated subnet, so it acts as a backup layer of defense. You can only set ALLOW rules for security groups, allowing an IP address or range of IP addresses to access your VPC using a specified service port to a defined IP destination. You cannot use a security group to set a DENY rule. Start here.

Network ACLs can be used to provide a temporary attack mitigation strategy, e.g. for blocking an attack site’s IP address or IP address ranges. Again, this is only temporary. If you want to implement a scalable solution for blocking unwanted traffic, you need to consider WAF or ideally, you will want to implement an IDS/IPS solution. Remember that Intrusion detection and Intrusion prevention have unique requirements and may be provided by separate services.

AWS Shared Security. Students need to be able to recognize and explain the practical aspects of the AWS shared security model. Students will need a working knowledge of the types of compliance questions that are common in RFPs and security/audit questionnaires. For example, you need to know when and how customer data is wiped from an EBS volume, how long it takes to disable a user or temporary credentials from a role if a system is compromised.

Compliance. Recognize and explain what security reports and services can be used when applying for or managing compliance audits. View the reports and procedures listed in the AWS Compliance portal.
Recognize and explain how to go about achieving certification and compliance, know the various monitoring services and when to use them for compliance reporting. AWS CloudWatch monitors service activity, and AWS CloudTrail monitors API calls and requests. AWS Config monitors and reports on changes to your environment and users (very useful for PCI, SOC, and HIPPA compliance reports). VPC flow logs are an additional feature that helps with compliance reporting as it allows you to monitor all changes within the VPC.

Support services. Recognize and explain the AWS support services available and which services/tasks would be covered by Enterprise or Business level support.

Attacks and intrusion detection. Be able to recognize the common attack patterns and mitigation strategies discussed on the AWS security blog and outlined in AWS security whitepapers.

Be able to recognize and explain DDOS attack prevention strategies in AWS and the steps you can implement to reduce the impact of a DDOS attack on your VPC. Understand and identify the benefits of ELB and WAF in mitigating DDOS-type attacks. Understand how AWS CloudWatch alarms and AWS CloudTrail logs can help identify and mitigate network attacks, e.g. how you might dynamically add IP addresses from cloudtrail logs,  TOR exit points, etc. to a white or black list using Lambda functions.
Recognize and explain how to reduce attack surface area and implement network layer defense to mitigate “man in the middle” attacks. Know the core aspects of the AWS Security Whitepaper.

Students taking the AWS Certified Security Specialty exam need to recognize and know how to implement common strategies/steps used to implement intrusion detection systems at scale and be familiar with some of the partner solutions available in the AWS Marketplace. This may have cost and performance implications. All security design considerations should be made based on business priorities and constraints for cost and time. IDS/IPS services can be expensive for sites with a large number of servers.
Key management support. Recognize and implement key management in AWS. Know the various types of KMS support available. Have a working knowledge of AWS CloudHSM in order to understand what is required to provision it and how to estimate what it would cost on a monthly basis.
Recognize and explain key management and key management options in AWS.  Know how to migrate, set up, and manage KMS in AWS. Try it out in the console to make sure that you understand all of the required steps in this process. Start here.

CloudHSM. Recognize and explain how to configure AWS CloudHSM and understand the AWS CloudHSM architecture/integration options (e.g. that CloudHSM uses Safenet Luna appliances).
Recognize and explain which key properties may not be able to be exported/transferred from a hardware appliance to KMS or CloudHSM. Ideally, try exporting a key to AWS to understand which values cannot be exported if migrating from onprem storage to KMS or CloudHSM.
S3 bucket policies. Understand Amazon S3 bucket policies and have a good understanding of when to use Amazon S3 resource level policies over AWS IAM access level permissions.
AWS IAM policies. To recognize and implement AWS IAM policies you will need to know the syntax for denying and allowing access to resources and be able to recognize syntax errors in an IAM policy.
VPN.  Recognize and implement all aspects of a VPN in the VPC.

Recognize the difference between VPN and AWS Direct Connect. Understand that a VPN uses IPSEC and Direct Connect as a physical connection from a partner-implemented endpoint that is not dependent on an internet connection. AWS Direct Connect needs to be implemented by an AWS Partner, and because it involves configuring ports, etc., it can take time to implement. While it’s inevitable that AWS Direct Connect may use some common routing/networking components, it is effectively a dedicated connection, i.e. AWS Direct Connect does not “share” the public internet.

That’s all for now. Next up, I’ll be sharing my thoughts and recommendations on the Network and Big Data certification exams. Stay tuned!

 

Avatar

Written by

Andrew Larkin

Andrew is an AWS certified professional who is passionate about helping others learn how to use and gain benefit from AWS technologies. Andrew has worked for AWS and for AWS technology partners Ooyala and Adobe. His favorite Amazon leadership principle is "Customer Obsession" as everything AWS starts with the customer. Passions around work are cycling and surfing, and having a laugh about the lessons learnt trying to launch two daughters and a few start ups.

Related Posts

Avatar
John Chell
— June 13, 2019

AWS Certified Solutions Architect Associate: A Study Guide

The AWS Solutions Architect - Associate Certification (or Sol Arch Associate for short) offers some clear benefits: Increases marketability to employers Provides solid credentials in a growing industry (with projected growth of as much as 70 percent in five years) Market anal...

Read more
  • AWS
  • AWS Certifications
Chris Gambino and Joe Niemiec
Chris Gambino and Joe Niemiec
— June 11, 2019

Moving Data to S3 with Apache NiFi

Moving data to the cloud is one of the cornerstones of any cloud migration. Apache NiFi is an open source tool that enables you to easily move and process data using a graphical user interface (GUI).  In this blog post, we will examine a simple way to move data to the cloud using NiFi c...

Read more
  • AWS
  • S3
Avatar
Chandan Patra
— June 11, 2019

Amazon DynamoDB: 10 Things You Should Know

Amazon DynamoDB is a managed NoSQL service with strong consistency and predictable performance that shields users from the complexities of manual setup.Whether or not you've actually used a NoSQL data store yourself, it's probably a good idea to make sure you fully understand the key ...

Read more
  • AWS
  • DynamoDB
Avatar
Andrew Larkin
— June 6, 2019

The 11 AWS Certifications: Which is Right for You and Your Team?

As companies increasingly shift workloads to the public cloud, cloud computing has moved from a nice-to-have to a core competency in the enterprise. This shift requires a new set of skills to design, deploy, and manage applications in cloud computing.As the market leader and most ma...

Read more
  • AWS
  • AWS Certifications
Sam Ghardashem
Sam Ghardashem
— May 15, 2019

Aviatrix Integration of a NextGen Firewall in AWS Transit Gateway

Learn how Aviatrix’s intelligent orchestration and control eliminates unwanted tradeoffs encountered when deploying Palo Alto Networks VM-Series Firewalls with AWS Transit Gateway.Deploying any next generation firewall in a public cloud environment is challenging, not because of the f...

Read more
  • AWS
Joe Nemer
Joe Nemer
— May 3, 2019

AWS Config Best Practices for Compliance

Use AWS Config the Right Way for Successful ComplianceIt’s well-known that AWS Config is a powerful service for monitoring all changes across your resources. As AWS Config has constantly evolved and improved over the years, it has transformed into a true powerhouse for monitoring your...

Read more
  • AWS
  • Compliance
Avatar
Francesca Vigliani
— April 30, 2019

Cloud Academy is Coming to the AWS Summits in Atlanta, London, and Chicago

Cloud Academy is a proud sponsor of the 2019 AWS Summits in Atlanta, London, and Chicago. We hope you plan to attend these free events that bring the cloud computing community together to connect, collaborate, and learn about AWS. These events are all about learning. You can learn how t...

Read more
  • AWS
  • AWS Summits
Paul Hortop
Paul Hortop
— April 2, 2019

How to Monitor Your AWS Infrastructure

The AWS cloud platform has made it easier than ever to be flexible, efficient, and cost-effective. However, monitoring your AWS infrastructure is the key to getting all of these benefits. Realizing these benefits requires that you follow AWS best practices which constantly change as AWS...

Read more
  • AWS
  • Monitoring
Joe Nemer
Joe Nemer
— April 1, 2019

AWS EC2 Instance Types Explained

Amazon Web Services’ resource offerings are constantly changing, and staying on top of their evolution can be a challenge. Elastic Cloud Compute (EC2) instances are one of their core resource offerings, and they form the backbone of most cloud deployments. EC2 instances provide you with...

Read more
  • AWS
  • EC2
Avatar
Nitheesh Poojary
— March 26, 2019

How DNS Works – the Domain Name System (Part One)

Before migrating domains to Amazon's Route53, we should first make sure we properly understand how DNS worksWhile we'll get to AWS's Route53 Domain Name System (DNS) service in the second part of this series, I thought it would be helpful to first make sure that we properly understand...

Read more
  • AWS
Avatar
Stuart Scott
— March 14, 2019

Multiple AWS Account Management using AWS Organizations

As businesses expand their footprint on AWS and utilize more services to build and deploy their applications, it becomes apparent that multiple AWS accounts are required to manage the environment and infrastructure.  A multi-account strategy is beneficial for a number of reasons as ...

Read more
  • AWS
  • Identity Access Management
Avatar
Sanket Dangi
— February 11, 2019

WaitCondition Controls the Pace of AWS CloudFormation Templates

AWS's WaitCondition can be used with CloudFormation templates to ensure required resources are running.As you may already be aware, AWS CloudFormation is used for infrastructure automation by allowing you to write JSON templates to automatically install, configure, and bootstrap your ...

Read more
  • AWS
  • CloudFormation