AWS · Domain
Security
Identity, organizations, keys and secrets, the edge, and detection. 6 worlds, 36 stages, about 18.5 hours to complete.
FeedsSAA-C03SOA-C03DEA-C01SAP-C02DOP-C02SCS-C03AIF-C01MLA-C02AIP-C01
Security World 1 · Associate
Who Can Do What
Policy evaluation as a gate trace: who asked, which policy decided, and why an Allow never beats a Deny.
- 1Deny WinsFreeThe adjusters hold an Allow and are refused on every claim file. Find the statement that decides.
- 2Trust Both WaysTwo accounts, two policies, one answer: both must allow. And the vendor's role must know which customer is asking.
- 3Tag Says SoThree teams, one statement: the tag on the principal must match the tag on the resource, and a missing key is a no.
- 4Inside the BoundaryA boundary never grants, a session policy only subtracts, and PassRole is how a developer borrows production's power.
- 5Who Are YouSix populations, six doors: pick the identity service each one needs, then fix the permission set the adjusters sign in with.
- 6Access Denied, Why?Five tickets about access. Read the error message, run the simulator, open Access Analyzer, and only then change a policy.
Security World 2 · Professional
Guardrails Above
The organization as the first gate: what SCPs, RCPs, declarative policies and Control Tower decide before any account policy is read.
- 1Fence the OrgA fence around every account: SCPs inherited down the tree, never granting, and two accounts they do not touch.
- 2Resource SideThe same fence on the other side: an RCP caps what anyone, inside or out, may do with the organization's resources, and declarative policies set defaults without reading a request.
- 3Landing ZoneThree kinds of control, one administrator per security service, and root credentials nobody needs to hold.
- 4Same EverywhereDeploy once, everywhere: the same baseline in every account and Region, checked before it ships, and shared instead of copied.
- 5Prove ItResources run through rules: which ones are flagged, when, what fixes them, and who sees the whole organization.
- 6Guardrail DetectiveFive tickets caused by guardrails: what was denied, what was never logged, what should have been impossible, and what drifted.
Security World 3 · Professional
Lock and Key
Key policy before IAM, grants for the moment, the right key material for the requirement, and data that cannot be deleted.
- 1Key Policy FirstIAM says yes and the key says no. The key policy is the primary authority; grants and conditions are how services and moments are let in.
- 2Whose Key Is ItFour workloads, four kinds of key: who generated the material, where it lives, in how many Regions, and how it rotates.
- 3At Rest EverywhereEncryption at rest is mostly a default you must not undo, and three rules the exam loves: the header, the shared snapshot, and the database you cannot encrypt later.
- 4On the WireTLS where connections terminate: the listener, the certificate, the bucket, the private path, and the links between nodes.
- 5Secrets and MasksSecrets that rotate themselves, a secret shared across accounts under the right key, and personal data that never reaches the wrong screen.
- 6Hold the LineObjects as tokens under delete and overwrite attempts: which protection holds, for how long, and against whom.
Security World 4 · Specialty
Edge Shields
The attacker as the sample request: it stops at the edge rule, the origin policy, the metadata service or the zero-trust door, and the trace says which.
- 1Front DoorEvery request should enter through CloudFront: the bucket must refuse everyone else, the load balancer must know who is calling, and the document link must carry a signature.
- 2Rule OrderRules read in priority order and stop at the first terminating action. Count stops nothing, the window and the key decide the flood, and the logs must land somewhere.
- 3Weather the StormStandard is on and free; Advanced is a subscription with people, credits and automation behind it. The exam asks which, when.
- 4Hardened HostsA short list the exam loves: IMDSv2 and a hop limit, a profile instead of keys, Session Manager instead of port 22, a built image, a scanner, a patch schedule and a runtime signal.
- 5Zero Trust DoorAn internal application reached without a VPN: who you are and what device you are on, checked on every request; and the way out checked by name.
- 6Breach PathSix tickets at the edge and on the hosts. The logs and the findings say where the control was missing.
Security World 5 · Specialty
Eyes Everywhere
From the event to the page: which log holds the fact, how a finding becomes an alert, and why a log is missing.
- 1Log What MattersEvery question has one log. Events as tokens landing in the right store, or nowhere.
- 2Finding RunA night's findings as tokens: which were never generated, which were archived, which a pattern dropped, and which paged someone within minutes.
- 3One PaneEvery finding in one pane, from every account and Region, in the order your rules say, with a button that hands one to a human.
- 4Lake of LogsWhere the logs rest and who reads them: a normalised lake, a query service, a log explorer, a correlation engine, a dashboard, and a seat for the SIEM.
- 5Threshold AlarmAn alarm is arithmetic: events per period against a threshold, M datapoints of N, and what to do when a period is empty.
- 6Missing LogsFive tickets about logs that never arrived. Every cause is ordinary: a permission, an account setting, a bucket policy, a configuration file.
Security World 6 · Specialty
Incident Command
Order matters: what is lost when steps run in the wrong sequence, what must be prepared before the alarm, and how the root cause is proven.
- 1Before It HappensEverything the first responder reaches for at 02:14 must already exist: the runbook, the account, the tooling, the protections and the proof the plan works.
- 2Contain the InstanceAcquire and preserve, then contain, then recover; terminate last, if at all.
- 3Exposed KeyKnow what the key did, make it unusable reversibly, clean up, then recover.
- 4Automatic ResponseThe finding runs the fix: a rule, a target, a guard against loops, and a human's button for the steps that need one.
- 5Trace the RootProve the cause and the scope before acting: the graph, the SQL and the finding checked against the resource.
- 6Recover the BucketObjects deleted and overwritten overnight: scope it, close the bucket, remove what was added, restore, and set the protection that makes the next one a non-event.