AWS Security Specialty Exam Syllabus Topics:
| Section | Objectives |
|---|---|
Incident Response - 12% | |
| Given an AWS abuse notice, evaluate the suspected compromised instance or exposed access keys. | - Given an AWS Abuse report about an EC2 instance, securely isolate the instance as part of a forensic investigation. - Analyze logs relevant to a reported instance to verify a breach, and collect relevant data. - Capture a memory dump from a suspected instance for later deep analysis or for legal compliance reasons. |
| Verify that the Incident Response plan includes relevant AWS services. | - Determine if changes to baseline security configuration have been made. - Determine if list omits services, processes, or procedures which facilitate Incident Response. - Recommend services, processes, procedures to remediate gaps. |
| Evaluate the configuration of automated alerting, and execute possible remediation of security related incidents and emerging issues. | - Automate evaluation of conformance with rules for new/changed/removed resources. - Apply rule-based alerts for common infrastructure misconfigurations. - Review previous security incidents and recommend improvements to existing systems. |
Logging and Monitoring - 20% | |
| Design and implement security monitoring and alerting. | - Analyze architecture and identify monitoring requirements and sources for monitoring statistics. - Analyze architecture to determine which AWS services can be used to automate monitoring and alerting. - Analyze the requirements for custom application monitoring, and determine how this could be achieved. - Set up automated tools/scripts to perform regular audits. |
| Troubleshoot security monitoring and alerting. | - Given an occurrence of a known event without the expected alerting, analyze the service functionality and configuration and remediate. - Given an occurrence of a known event without the expected alerting, analyze the permissions and remediate. - Given a custom application which is not reporting its statistics, analyze the configuration and remediate. - Review audit trails of system and user activity. |
| Design and implement a logging solution. | - Analyze architecture and identify logging requirements and sources for log ingestion. - Analyze requirements and implement durable and secure log storage according to AWS best practices. - Analyze architecture to determine which AWS services can be used to automate log ingestion and analysis. |
| Troubleshoot logging solutions. | - Given the absence of logs, determine the incorrect configuration and define remediation steps. - Analyze logging access permissions to determine incorrect configuration and define remediation steps. - Based on the security policy requirements, determine the correct log level, type, and sources. |
Infrastructure Security - 26% | |
| Design edge security on AWS. | - For a given workload, assess and limit the attack surface. - Reduce blast radius (e.g. by distributing applications across accounts and regions). - Choose appropriate AWS and/or third-party edge services such as WAF, CloudFront and Route 53 to protect against DDoS or filter application-level attacks. - Given a set of edge protection requirements for an application, evaluate the mechanisms to prevent and detect intrusions for compliance and recommend required changes. - Test WAF rules to ensure they block malicious traffic. |
| Design and implement a secure network infrastructure. | - Disable any unnecessary network ports and protocols. - Given a set of edge protection requirements, evaluate the security groups and NACLs of an application for compliance and recommend required changes. - Given security requirements, decide on network segmentation (e.g. security groups and NACLs) that allow the minimum ingress/egress access required. - Determine the use case for VPN or Direct Connect. - Determine the use case for enabling VPC Flow Logs. - Given a description of the network infrastructure for a VPC, analyze the use of subnets and gateways for secure operation. |
| Troubleshoot a secure network infrastructure. | - Determine where network traffic flow is being denied. - Given a configuration, confirm security groups and NACLs have been implemented correctly. |
| Design and implement host-based security. | - Given security requirements, install and configure host-based protections including Inspector, SSM. - Decide when to use host-based firewall like iptables. - Recommend methods for host hardening and monitoring. |
Identity and Access Management - 20% | |
| Design and implement a scalable authorization and authentication system to access AWS resources. | - Given a description of a workload, analyze the access control configuration for AWS services and make recommendations that reduce risk. - Given a description how an organization manages their AWS accounts, verify security of their root user. - Given your organization’s compliance requirements, determine when to apply user policies and resource policies. - Within an organization’s policy, determine when to federate a directory services to IAM. - Design a scalable authorization model that includes users, groups, roles, and policies. - Identify and restrict individual users of data and AWS resources. - Review policies to establish that users/systems are restricted from performing functions beyond their responsibility, and also enforce proper separation of duties. |
| Troubleshoot an authorization and authentication system to access AWS resources. | - Investigate a user’s inability to access S3 bucket contents. - Investigate a user’s inability to switch roles to a different account. - Investigate an Amazon EC2 instance’s inability to access a given AWS resource. |
Data Protection - 22% | |
| Design and implement key management and use. | - Analyze a given scenario to determine an appropriate key management solution. - Given a set of data protection requirements, evaluate key usage and recommend required changes. - Determine and control the blast radius of a key compromise event and design a solution to contain the same. |
| Troubleshoot key management. | - Break down the difference between a KMS key grant and IAM policy. - Deduce the precedence given different conflicting policies for a given key. - Determine when and how to revoke permissions for a user or service in the event of a compromise. |
| Design and implement a data encryption solution for data at rest and data in transit. | - Given a set of data protection requirements, evaluate the security of the data at rest in a workload and recommend required changes. - Verify policy on a key such that it can only be used by specific AWS services. - Distinguish the compliance state of data through tag-based data classifications and automate remediation. - Evaluate a number of transport encryption techniques and select the appropriate method (i.e. TLS, IPsec, client-side KMS encryption). |
Great social recognitions
Our SCS-C01日本語 dumps PDF have gained social recognitions in international level around the world and build harmonious relationship with customers around the world for the excellent quality and accuracy of them over ten years. We gain the honor for our longtime pursuit and high quality of SCS-C01日本語 exam guide, which is proven to be useful by clients who passed the Amazon SCS-C01日本語 test simulate questions exam with passing rate up to 95 to 100 percent! So our products with great usefulness speak louder than any other kinds of advertising. The clients and former users who buy our SCS-C01日本語 exam cram recommend it to people around them voluntarily. All these actions are due to the fact that we reach the expectation and help them more than they imagined before. We also encourage customers about second purchase about other needs of various areas we offering. All the SCS-C01日本語 test dumps are helpful, so our reputation derives from quality.
How to study the Amazon SCS-C01: AWS Certified Security - Specialty Exam
A broad range of scs-c01 exam dumps pdf for AWS certified security-specialty Certification have been recognized for certification issues. The reality that students need to prepare attentively does not make certificates easy. It also takes a long time to learn from AWS certified security-specialty. Every exam includes answers and questions that help students pass their final test. You will pass the test after you have taken and learned our modules. But it doesn't end there; thanks to our full guides, you will still be good in your career. You will produce your goods in the future. To plan any material for you, we have an advanced method. In the development of and commodity, we have used the latest details.
Scs-c01 practice test are easy to use, so that anyone can appreciate them. In such dynamic areas, where qualification requires a lot of studies, planning, and focus, no one likes loss. An effort is so hard that even the students' nerves can be shattered. Our waste management systems are so legitimate and best that you have no pain to pass your AWS accredited Developer Professional.
AWS SCS-C01 Exam Certification Details:
| Sample Questions | AWS SCS-C01 Sample Questions |
| Passing Score | 750 / 1000 |
| Exam Code | SCS-C01 |
| Exam Name | AWS Certified Security - Specialty (Security Specialty) |
| Duration | 170 minutes |
| Exam Price | $300 USD |
| Recommended Training / Books | AWS Security Fundamentals (Second Edition) Security Engineering on AWS Exam Readiness - AWS Certified Security - Specialty |
| Schedule Exam | PEARSON VUE |
| Number of Questions | 65 |
Reference: https://aws.amazon.com/certification/certified-security-specialty/
Dear customers, nice to meet you. We all pursue speed of development in every aspect in the high-efficient society. This kind of standard is popular and widespread ranging from national strength beyond the other countries to achievements of individuals. How to make yourself stand out? The answer is obvious: to prove yourself by different meaningful and useful certificates. That is to say passing the tests such as SCS-C01日本語 dumps PDF is of great importance, and we are here to provide SCS-C01日本語 exam guide for your best choice. To get a deeper understanding of the SCS-C01日本語 test simulate, let me give you an explicit introduction of the questions firstly.
Delighted performance you can get
The Amazon SCS-C01日本語 dumps PDF of our company have come a long way since ten years ago and gain impressive success around the world. The quality of our questions speaks louder than our publicity. Because you can stand out by using our SCS-C01日本語 exam guide and realize your dreams such as double or triple your salary, get promotion and play an indispensable role in your working environment, be trusted by boss and colleagues around you. We can prove the usefulness of the SCS-C01日本語 test simulate questions with delighted outcomes rather than well-turned words. Once you place the order on our website, you will believe what we promised here.
After purchase, Instant Download: Upon successful payment, Our systems will automatically send the product you have purchased to your mailbox by email. (If not received within 12 hours, please contact us. Note: don't forget to check your spam.)
Reasonable price with sufficient contents
After realizing about the usefulness of the SCS-C01日本語 dumps PDF, you may a little worry about price of our excellent questions, will they be expensive? The answer is not! All our products are described by users as excellent quality and reasonable price, which is exciting. So you do not need to splurge large amount of money on our Amazon SCS-C01日本語 exam guide, and we even give discounts back to you as small gift, so you do not worry about squandering money or time, because is impossible. Our SCS-C01日本語 test simulate questions are of great importance with inexpensive prices, there are constantly feedbacks we received from exam candidates, which inspired us to do better in the future. We never satisfy the achievements at present, and just like you, we never stop the forward steps.
