Passed the Security exam – tips

After sitting on the fence for a number of weeks, I finally decided to take the Security Specialty exam. Even though I was happy to see the "Congratulations…" message at the end, I was mentally prepared to accept failure before I clicked on the "exit" button. I thought it was a really challenging exam and I used the entire 170 minutes on this one.

I went through both the LA and the ACG courses. I personally think that the LA course is more up to date (sorry Ryan) – however, both courses cover the key topics pretty well.

I would say around 60% of the questions were around KMS (heavy focus on S3 – SSE-C, SSE-KMS, default encryption, bucket policies, object ACL), IAM, VPC, and Logging and monitoring (CloudTrail, CloudWatch, Config, Inspector, Trusted Advisor, GuardDuty) with a very very big emphasis on troubleshooting.

It’s really important to understand the difference between CloudTrail, Cloudwatch logs, Cloudwaatch metric filter, Cloudwatch events and how they integrate with SNS and Lambda for automated remediation.

For example, say you have setup a CloudWatch Metric Filter to send a SNS notification, why aren’t you getting notified? How can you recover data if you deleted a CMK (do you have access to the backing key used to create this CMK?)

The rest of the questions were on topics such as Athena (how to analyze logs), Cognito (identity pools), AWS Secrets Manager (and how it integrates with KMS), how to handle cases where your EC2/IAM key pair get leaked, host based IDS, Glacier Vault Lock (remember that you have 24 hours to validate your vault lock), federated authentication (mainly around Active Directory), when to use DirectConnect and/or VPN, Macie for PII data, etc.

Know when to use AWS Conifg vs Inspector vs GaurdDuty vs Trusted Advisor.

I had a couple of questions around AWS Organization and Service Control Policies, know when to create OUs and apply SCP. Understand the outcome of merging SCP + Permission Boundaries + IAM Policy + Inline Policy + Bucket Policy.

Don’t expect to see too many one line questions. Almost all the questions were scenario based where you will have more than one possible answers and some answers involve combination of more than one service.

Basically, if you don’t work with KMS, VPC, IAM, Cloudtrail, and Cloudwatch on a regular basis, you will need to study and practice hard. And more importantly, I suggest you create multiple AWS accounts and invest time building out VPCs, working with IAM, resource and key policies, practicing how to setup organizations and cross account access, etc. Just viewing the lectures and reading FAQs will probably not be enough.

I have compiled a list of online resources that I used to prepare for this cert, hope it helps. Invest lots of time on whitepapers, reInvent videos on Youtube and FAQs.

As for me, I am going to try and take the SA Pro exam in the next few months. Wish me luck 🙂

https://acloud.guru/forums/aws-certified-security-specialty/discussion/-LOUWLmsqOXtUw1Jr_Hn/atempted_the_cert_yesterday

https://daviseford.com/blog/2018/08/17/aws-security-specialty-exam-tips.html

https://www.youtube.com/watch?v=tzJmE_Jlas0&feature=youtu.be

https://www.linkedin.com/pulse/how-prepare-aws-certified-security-speciality-kalyan-janaki/

https://aws.amazon.com/blogs/security/how-to-use-bucket-policies-and-apply-defense-in-depth-to-help-secure-your-amazon-s3-data/

https://interactive.linuxacademy.com/diagrams/SecuritySpecialtyRunbook.html

https://s3-us-west-1.amazonaws.com/johnzsecurityspecialityexam/Study_Guide/AWS+Security+Specialty+Notes.pdf

https://acloud.guru/forums/aws-certified-security-specialty/discussion/-L4P2Sy49kes8HGFwUnB/i

https://github.com/JuiceTheJiraffe/Jacob-Johnson/tree/master/Notes/AWS-Security-Cert-Study-Material

https://acloud.guru/forums/aws-certified-security-specialty/discussion/-L6cr21tC78ItoXVZVxZ/more_examples_using_key_polici

https://linuxacademy.com/blog/amazon-web-services-2/my-experience-with-the-aws-certified-security-specialty-beta-exam/

https://pajdzik.com/2018/02/11/my-impressions-after-taking-the-aws-certified-security-speciality-beta-exam/

https://acloud.guru/forums/aws-certified-security-specialty/discussion/-LVEfH1XQMc66pQul_Fq/my_tips_to_security_specialty

https://acloud.guru/forums/aws-certified-security-specialty/discussion/-LI36VM0hAevqbXzjiOj/passed_exam_july_2018

https://acloud.guru/forums/aws-certified-security-specialty/discussion/-LG38oJ7NIUNo-3U7C6C/Passed%20Security

https://acloud.guru/forums/aws-certified-security-specialty/discussion/-LC_OZ_mq0pZN5bxjhpr/passed_security_-_specialty_to

https://acloud.guru/forums/aws-certified-security-specialty/discussion/-LCg4TdR6ybtGbXYjJ5V/passed_security_cert_today

https://acloud.guru/forums/aws-certified-security-specialty/discussion/-LNpf8aSMleRnaY0oeXJ/passed_the_aws_security_specia

https://acloud.guru/forums/aws-certified-security-specialty/discussion/-LTi0wTOGz0h5WfTw4uq/passed_the_exam_yesterady

https://acloud.guru/forums/aws-certified-security-specialty/discussion/-LDlnCwCJKg0o_2FoKlo/passed_the_security_exam_today

https://www.linkedin.com/pulse/passing-aws-certified-security-specialty-exam-madoc-batters/

https://acloud.guru/forums/aws-certified-security-specialty/discussion/-LGMjQVdFIchFfqQTpVM/passing_the_certified_security

https://acloud.guru/forums/aws-certified-security-specialty/discussion/-LDNrEyo2ARBPWW4ot3D/took_exam

https://acloud.guru/forums/aws-certified-security-specialty/discussion/-LP84VDecPxz05fSGt9P/took_the_security_specialty_ex

https://acloud.guru/forums/aws-certified-security-specialty/discussion/-LRWgDUR4g_QZYhfvCOq/what_i_studied_on_top_of_acg_t