AWS Security Certification

• Evaluate compromised instances/exposed
  access keys in AWS abuse notice
   Securely isolate instance as part from EC2 instance
   Verify breach in logs relevant to the reported instance
   Capture a memory dump from a suspected instance.

• Verify relevant AWS services in Incident
  Response Plan
   Determine changes in baseline security configuration
   Determine omitted services by list
   Services to remediate gaps

• Evaluate configuration of automated alerting
   Automate evaluation of conformance with rules
   Rule-based alerts for common infrastructure
  misconfigurations
   Review previous security incidents

• Implement security monitoring and alerting
   Analyze architecture and identify monitoring needs
   AWS services to automate monitoring and alerting
   Custom application monitoring
   Set up automated tools for audits

• Troubleshoot security monitoring and alerting
   Analyze the service functionality and configuration of an event
  without alerting
   Analyze the permissions and remediate
   Analyze the configuration of a custom application and remediate
   Review audit trails of the system and user activity

• Design and Implement a Logging Solution
   Analyze architecture and identify logging requirements and
  sources
   Log ingestion
   Implement secure log storage
   Automate log ingestion by analyzing architecture

• Troubleshoot logging solutions
   Determine the incorrect configuration in absence of logs
   Define remediation steps
   Analyze logging access permission
   Determine incorrect configuration and remediate
   Determine the correct log level, type, and sources

• Design edge security on AWS
   Assess and limit the attack surface for a workload
   Reduce blast radius
   AWS edge services to protect against DDoS/filter
  app-level attacks
   WAF, CloudFront, Route 53
   Evaluate the mechanisms to prevent and detect
  intrusions
   Test WAF rules to block malicious traffic
• Design and implement secure network
  infrastructure

 Disable any unnecessary network ports and protocols
 Evaluate the security groups for a set of edge protection
requirements
 Evaluate NACLs of an application for compliance
 Recommend required changes
 Decide on network segmentation (e.g. security groups
and NACLs) allowing minimum ingress/egress access
 Determine the use case for VPN or Direct Connect
 Determine the use case for enabling VPC Flow Logs
 Analyze the use of subnets given a network infrastructure
for a VPC
 Analyze gateways for secure operation

• Troubleshoot a secure network infrastructure

 Determine where network traffic flow is being denied
 confirm security groups and NACLs in a configuration
 Design and implement host-based security
 Install and configure host-based protections (Inspector,
SSM)
 Using host-based firewalls like iptables
 Methods for host hardening and monitoring

• Scalable authorization/authentication system
  to access AWS resources

 Analyze the access control configuration for AWS
services workload
 Reduce risk
 verify security of root users in an organization
 Determine when to apply user policies and resource
policies
 Federate directory services to IAM within the
organization’s policy
 Design a scalable authorization model (users,
groups, roles, and policies)
 Restrict individual users of data and AWS resources
 Enforce proper separation of duties

• Troubleshoot an authorization and
  authentication system to access AWS
  resources

 Investigate a user’s inability to access S3 bucket
contents
 Investigate a user’s inability to switch roles to a
different account
 Investigate an Amazon EC2 instance’s inability to
access a given AWS resource

• Design and implement key management and use
   Determine an appropriate key management solution
   evaluate key usage for data protection
   Control the blast radius of a key compromise event
   Design a solution

• Troubleshoot key management
   Difference between a KMS key grant and IAM policy
   Deduce the precedence given different conflicting
  policies for a key
   Revoke permissions for a user or service in the event of
  a compromise