No matching guide sections
Change the search or section filter.
Study Guide preview
Unlock Pro for every AWS Security Specialty flashcard-note lesson.
Preview the beginning of Section 1. Pro includes the complete Study Guide by section, plus Course Notes, guided course access, and Pro downloads.
Unlock with Pro
Opens the AWS Security Specialty Practice Test purchase options.
Section 1
Design centralized security logging
Preview
Preview: 1. Detection (16%)
Preview includes- 4 of 6 lesson topics
- 1 overview segment
- 3 core concepts
- 2 exam tips
Lesson Topics
- Organization-wide log collection
- Dedicated log archive account
- CloudTrail integrity validation
- S3 immutability and retention
Overview
Design centralized security logging so investigators and detection systems can correlate activity across accounts while workloads cannot easily alter their own evidence.
Core Concepts
- Use organization-level or centrally managed collection where possible so security-relevant logs from multiple accounts arrive in a dedicated security or log-archive account.
- Protect stored logs with restrictive S3 and KMS permissions, separation of administrative duties, and retention controls appropriate to the investigation or compliance requirement.
- CloudTrail log file integrity validation produces digest files that can be used to determine whether delivered CloudTrail log files were changed or deleted after delivery.
Exam Tips
- When the scenario says administrators of a compromised workload account must not be able to destroy evidence, move ownership of the log repository to a separate account.
- Map each requirement to a control: collection, confidentiality, integrity verification, immutability, retention, and analysis are distinct.
Section 1 continues in Pro.Unlock Pro to read the full Design centralized security logging lesson plus every remaining AWS Security Specialty Study Guide section.
Unlock with Pro
Section 2
Select AWS threat-detection services
Pro
Select AWS threat-detection services unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 3
Build actionable alerting
Pro
Build actionable alerting unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 4
Protect audit evidence
Pro
Protect audit evidence unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 5
Contain compromised credentials
Pro
Contain compromised credentials unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 6
Automate repeatable incident response
Pro
Automate repeatable incident response unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 7
Preserve forensic evidence
Pro
Preserve forensic evidence unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 8
Perform root-cause and impact analysis
Pro
Perform root-cause and impact analysis unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 9
Segment VPC workloads
Pro
Segment VPC workloads unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 10
Protect internet-facing applications
Pro
Protect internet-facing applications unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 11
Use private service connectivity
Pro
Use private service connectivity unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 12
Control hybrid network security
Pro
Control hybrid network security unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 13
Apply least privilege with IAM policies
Pro
Apply least privilege with IAM policies unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 14
Use roles and temporary credentials
Pro
Use roles and temporary credentials unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 15
Manage identity across accounts
Pro
Manage identity across accounts unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 16
Enforce preventive account guardrails
Pro
Enforce preventive account guardrails unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 17
Troubleshoot explicit and implicit denies
Pro
Troubleshoot explicit and implicit denies unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 18
Select encryption for data at rest
Pro
Select encryption for data at rest unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 19
Protect data in transit
Pro
Protect data in transit unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 20
Design AWS KMS key policies and grants
Pro
Design AWS KMS key policies and grants unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 21
Store and rotate secrets securely
Pro
Store and rotate secrets securely unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 22
Classify and discover sensitive data
Pro
Classify and discover sensitive data unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 23
Apply the AWS shared responsibility model
Pro
Apply the AWS shared responsibility model unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 24
Govern multiple accounts
Pro
Govern multiple accounts unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 25
Manage vulnerabilities and software supply-chain risk
Pro
Manage vulnerabilities and software supply-chain risk unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 26
Collect audit and compliance evidence
Pro
Collect audit and compliance evidence unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro