The New AWS Certified Security Specialty exam (beta) – tough but fair

The new AWS specialty certifications—Security, Advanced Networking, and Big Data—are each three-hour exams that require your full attention and respect. I recently sat the AWS Certified Security Specialty exam (beta) at 7 a.m. on day one of this year’s re:Invent in Las Vegas. In this post, I’ll be sharing my overall impressions, as well as some notes for preparing for this exam.

AWS Certified Security Specialty exam (beta): First impressions

My overall impression of the AWS Certified Security – Specialty (beta) exam is that it was a tough but fair examination of your security knowledge. I’ll confess: I felt pretty drained by the end of the three hours. The exam left few security stones left unturned, so to speak. As you would expect with any professional level certification, the scenarios were complex, and you had to evaluate each question scenario quickly in order to answer all of the questions in the time allotted.

In short, to pass this exam, you will need to dedicate a significant amount of time for preparation.
Here at Cloud Academy, our AWS team is busy creating learning paths for these new specialty certifications. Our learning path for Security will be live in March when the exam becomes available.

Preparing for the AWS Certified Security Specialty exam

If you are a security specialist or an architect looking to advance your security skills, you should plan to sit this exam. However, before starting the Specialist Security Learning Path, I would highly recommend completing the Solution Architect Associate for AWS and Solution Architect Professional for AWS learning paths first.
If you’re looking ahead to taking the AWS Certified Security Specialty exam, I’d like to share some tips that could be helpful in your preparation. While the content will likely change before the exam is made generally available, I think that these rough notes (made for our team working on the associated learning path) will still be useful for you.

Security groups and network access control lists. It is really important that students know how to recognize and explain the differences between security groups and network access control lists (ACLs), and when and how to use either. The security group operates at the instance level, so it is your first layer of defense. The network ACL operates at the subnet level, so it acts as a second layer of defense.

Security groups only support ALLOW rules. Network ACLs support allow rules and deny rules. The Security group is STATEFUL and return traffic is automatically allowed, regardless of any other rules. The network ACL is STATELESS, so return traffic must be explicitly allowed by your rules. Security groups are evaluated before deciding whether to allow traffic.

In network ACLs, rules are processed in numerical order. With the security group, it applies to an instance only if someone specifies the security group when launching that instance, or when that security group is associated with an instance once it has already been launched. Using network ACL, this is automatically applied to all instances in the associated subnet, so it acts as a backup layer of defense. You can only set ALLOW rules for security groups, allowing an IP address or range of IP addresses to access your VPC using a specified service port to a defined IP destination. You cannot use a security group to set a DENY rule. Start here.

Network ACLs can be used to provide a temporary attack mitigation strategy, e.g. for blocking an attack site’s IP address or IP address ranges. Again, this is only temporary. If you want to implement a scalable solution for blocking unwanted traffic, you need to consider WAF or ideally, you will want to implement an IDS/IPS solution. Remember that Intrusion detection and Intrusion prevention have unique requirements and may be provided by separate services.

AWS Shared Security. Students need to be able to recognize and explain the practical aspects of the AWS shared security model. Students will need a working knowledge of the types of compliance questions that are common in RFPs and security/audit questionnaires. For example, you need to know when and how customer data is wiped from an EBS volume, how long it takes to disable a user or temporary credentials from a role if a system is compromised.

Compliance. Recognize and explain what security reports and services can be used when applying for or managing compliance audits. View the reports and procedures listed in the AWS Compliance portal.
Recognize and explain how to go about achieving certification and compliance, know the various monitoring services and when to use them for compliance reporting. AWS CloudWatch monitors service activity, and AWS CloudTrail monitors API calls and requests. AWS Config monitors and reports on changes to your environment and users (very useful for PCI, SOC, and HIPPA compliance reports). VPC flow logs are an additional feature that helps with compliance reporting as it allows you to monitor all changes within the VPC.

Support services. Recognize and explain the AWS support services available and which services/tasks would be covered by Enterprise or Business level support.

Attacks and intrusion detection. Be able to recognize the common attack patterns and mitigation strategies discussed on the AWS security blog and outlined in AWS security whitepapers.

Be able to recognize and explain DDOS attack prevention strategies in AWS and the steps you can implement to reduce the impact of a DDOS attack on your VPC. Understand and identify the benefits of ELB and WAF in mitigating DDOS-type attacks. Understand how AWS CloudWatch alarms and AWS CloudTrail logs can help identify and mitigate network attacks, e.g. how you might dynamically add IP addresses from cloudtrail logs,  TOR exit points, etc. to a white or black list using Lambda functions.
Recognize and explain how to reduce attack surface area and implement network layer defense to mitigate “man in the middle” attacks. Know the core aspects of the AWS Security Whitepaper.

Students taking the AWS Certified Security Specialty exam need to recognize and know how to implement common strategies/steps used to implement intrusion detection systems at scale and be familiar with some of the partner solutions available in the AWS Marketplace. This may have cost and performance implications. All security design considerations should be made based on business priorities and constraints for cost and time. IDS/IPS services can be expensive for sites with a large number of servers.
Key management support. Recognize and implement key management in AWS. Know the various types of KMS support available. Have a working knowledge of AWS CloudHSM in order to understand what is required to provision it and how to estimate what it would cost on a monthly basis.
Recognize and explain key management and key management options in AWS.  Know how to migrate, set up, and manage KMS in AWS. Try it out in the console to make sure that you understand all of the required steps in this process. Start here.

CloudHSM. Recognize and explain how to configure AWS CloudHSM and understand the AWS CloudHSM architecture/integration options (e.g. that CloudHSM uses Safenet Luna appliances).
Recognize and explain which key properties may not be able to be exported/transferred from a hardware appliance to KMS or CloudHSM. Ideally, try exporting a key to AWS to understand which values cannot be exported if migrating from onprem storage to KMS or CloudHSM.
S3 bucket policies. Understand Amazon S3 bucket policies and have a good understanding of when to use Amazon S3 resource level policies over AWS IAM access level permissions.
AWS IAM policies. To recognize and implement AWS IAM policies you will need to know the syntax for denying and allowing access to resources and be able to recognize syntax errors in an IAM policy.
VPN.  Recognize and implement all aspects of a VPN in the VPC.

Recognize the difference between VPN and AWS Direct Connect. Understand that a VPN uses IPSEC and Direct Connect as a physical connection from a partner-implemented endpoint that is not dependent on an internet connection. AWS Direct Connect needs to be implemented by an AWS Partner, and because it involves configuring ports, etc., it can take time to implement. While it’s inevitable that AWS Direct Connect may use some common routing/networking components, it is effectively a dedicated connection, i.e. AWS Direct Connect does not “share” the public internet.

That’s all for now. Next up, I’ll be sharing my thoughts and recommendations on the Network and Big Data certification exams. Stay tuned!

 

Avatar

Written by

Andrew Larkin

Andrew is an AWS certified professional who is passionate about helping others learn how to use and gain benefit from AWS technologies. Andrew has worked for AWS and for AWS technology partners Ooyala and Adobe. His favorite Amazon leadership principle is "Customer Obsession" as everything AWS starts with the customer. Passions around work are cycling and surfing, and having a laugh about the lessons learnt trying to launch two daughters and a few start ups.


Related Posts

Joe Nemer
Joe Nemer
— September 15, 2020

New Content: Azure DP-100 Certification, Alibaba Cloud Certified Associate Prep, 13 Security Labs, and Much More

This past month our Content Team served up a heaping spoonful of new and updated content. Not only did our experts release the brand new Azure DP-100 Certification Learning Path, but they also created 18 new hands-on labs — and so much more! New content on Cloud Academy At any time, y...

Read more
  • AWS
  • Azure
  • DevOps
  • Google Cloud Platform
  • Machine Learning
  • programming
Joe Nemer
Joe Nemer
— August 28, 2020

AWS Certification Practice Exam: What to Expect from Test Questions

If you’re building applications on the AWS cloud or looking to get started in cloud computing, certification is a way to build deep knowledge in key services unique to the AWS platform. AWS currently offers 12 certifications that cover major cloud roles including Solutions Architect, De...

Read more
  • AWS
  • AWS Certifications
Patrick Navarro
Patrick Navarro
— August 25, 2020

Overcoming Unprecedented Business Challenges with AWS

From auto-scaling applications with high availability to video conferencing that’s used by everyone, every day —  cloud technology has never been more popular or in-demand. But what does this mean for experienced cloud professionals and the challenges they face as they carve out a new p...

Read more
  • AWS
  • Cloud Adoption
  • digital transformation
Avatar
Andrew Larkin
— August 18, 2020

Constant Content: Cloud Academy’s Q3 2020 Roadmap

Hello —  Andy Larkin here, VP of Content at Cloud Academy. I am pleased to release our roadmap for the next three months of 2020 — August through October. Let me walk you through the content we have planned for you and how this content can help you gain skills, get certified, and...

Read more
  • alibaba
  • AWS
  • Azure
  • content roadmap
  • Content updates
  • DevOps
  • GCP
  • Google Cloud
  • New content
Alisha Reyes
Alisha Reyes
— August 5, 2020

New Content: Alibaba, Azure AZ-303 and AZ-304, Site Reliability Engineering (SRE) Foundation, Python 3 Programming, 16 Hands-on Labs, and Much More

This month our Content Team did an amazing job at publishing and updating a ton of new content. Not only did our experts release the brand new AZ-303 and AZ-304 Certification Learning Paths, but they also created 16 new hands-on labs — and so much more! New content on Cloud Academy At...

Read more
  • AWS
  • Azure
  • DevOps
  • Google Cloud Platform
  • Machine Learning
  • programming
Alisha Reyes
Alisha Reyes
— July 16, 2020

Blog Digest: Which Certifications Should I Get?, The 12 Microsoft Azure Certifications, 6 Ways to Prevent a Data Breach, and More

This month, we were excited to announce that Cloud Academy was recognized in the G2 Summer 2020 reports! These reports highlight the top-rated solutions in the industry, as chosen by the source that matters most: customers. We're grateful to have been nominated as a High Performer in se...

Read more
  • AWS
  • Azure
  • blog digest
  • Certifications
  • Cloud Academy
  • OWASP
  • OWASP Top 10
  • Security
  • VPCs
Avatar
Cloud Academy Team
— July 9, 2020

Which Certifications Should I Get?

The old AWS slogan, “Cloud is the new normal” is indeed a reality today. Really, cloud has been the new normal for a while now and getting credentials has become an increasingly effective way to quickly showcase your abilities to recruiters and companies. With all that in mind, the s...

Read more
  • AWS
  • Azure
  • Certifications
  • Cloud Computing
  • Google Cloud Platform
Alisha Reyes
Alisha Reyes
— July 2, 2020

New Content: AWS, Azure, Typescript, Java, Docker, 13 New Labs, and Much More

This month, our Content Team released a whopping 13 new labs in real cloud environments! If you haven't tried out our labs, you might not understand why we think that number is so impressive. Our labs are not “simulated” experiences — they are real cloud environments using accounts on A...

Read more
  • AWS
  • Azure
  • DevOps
  • Google Cloud Platform
  • Machine Learning
  • programming
Joe Nemer
Joe Nemer
— June 19, 2020

Kickstart Your Tech Training With a Free Week on Cloud Academy

Are you looking to make a jump in your technical career? Want to get trained or certified on AWS, Azure, Google Cloud Platform, DevOps, Kubernetes, Python, or another in-demand skill? Then you'll want to mark your calendar. Starting Monday, June 22 at 12:00 a.m. PDT (3:00 a.m. EDT), ...

Read more
  • AWS
  • Azure
  • cloud academy content
  • complimentary access
  • GCP
  • on the house
Alisha Reyes
Alisha Reyes
— June 11, 2020

New Content: AZ-500 and AZ-400 Updates, 3 Google Professional Exam Preps, Practical ML Learning Path, C# Programming, and More

This month, our Content Team released tons of new content and labs in real cloud environments. Not only that, but we introduced our very first highly interactive "Office Hours" webinar. This webinar, Acing the AWS Solutions Architect Associate Certification, started with a quick overvie...

Read more
  • AWS
  • Azure
  • DevOps
  • Google Cloud Platform
  • Machine Learning
  • programming
Rebecca Willis
Rebecca Willis
— June 3, 2020

Azure vs. AWS: Which Certification Provides the Brighter Future?

More and more companies are using cloud services, prompting more and more people to switch their current IT position to something cloud-related. The problem is most people only have that much time after work to learn new technologies, and there are plenty of cloud services that you can ...

Read more
  • AWS
  • Azure
  • certification
Alisha Reyes
Alisha Reyes
— June 2, 2020

Blog Digest: 5 Reasons to Get AWS Certified, OWASP Top 10, Getting Started with VPCs, Top 10 Soft Skills, and More

Thank you for being a valued member of our community! We recently sent out a short survey to understand what type of content you would like us to add to Cloud Academy, and we want to thank everyone who gave us their input. If you would like to complete the survey, it's not too late. It ...

Read more
  • AWS
  • Azure
  • blog digest
  • Certifications
  • Cloud Academy
  • OWASP
  • OWASP Top 10
  • Security
  • VPCs