Read this the night before or on exam morning. It assumes you’ve studied the notes. It’s here to refresh, not to teach.
Exam day
- 65 questions (50 scored, 15 unscored you can’t spot) in about 170 minutes. Scaled score 100 to 1,000; you need 750. Compensatory scoring: no need to pass each domain.
- Question types: multiple choice, multiple response, ordering and matching. Ordering and matching need every item right for credit. Unanswered counts as wrong and there’s no guessing penalty, so answer everything.
- About 2.6 minutes per question. Flag and move on.
- Weights: Detection 16%, Incident response 14%, Infrastructure security 18%, Identity and access management 20%, Data protection 18%, Security foundations and governance 14%.
How to read a question
Read the last sentence first, then the constraint words.
| The question says | Pick |
|---|---|
| All accounts, including new ones | Organizations feature, delegated admin, auto-enable, SCP |
| Least operational overhead | Managed service, native integration, no custom code |
| Prevent | SCP, RCP, declarative policy, IAM deny, WAF block |
| Detect | GuardDuty, Config, Security Hub, Macie, Inspector |
| Investigate / root cause | Detective, CloudTrail Lake, Athena |
| Automatically remediate | EventBridge to SSM Automation / Lambda / Step Functions, Config remediation |
| Without exposing to the internet | VPC endpoint, PrivateLink, Session Manager, Verified Access |
| Customer must control keys | CMK, imported material, CloudHSM, XKS (more control, more burden) |
| Immutable / cannot be deleted even by root | Object Lock compliance mode, Vault Lock, Backup Vault Lock |
| Temporary access | STS, roles, presigned URL, Identity Center |
Elimination: answers that hand out long-term access keys, disable logging, make things public, delete evidence first, or require manual steps in a “most automated” question are wrong.
Policy evaluation in one breath
Default deny. Explicit deny wins. Then every limiting layer must allow: SCP, RCP, permissions boundary, session policy, VPC endpoint policy. Then an identity policy or resource policy must allow (cross-account needs both). SCPs and RCPs never grant. SCPs skip the management account and service-linked roles.
Detective services
| Service | Job |
|---|---|
| GuardDuty | Threat detection from CloudTrail, Flow Logs, DNS, plus S3, EKS, runtime, malware, RDS, Lambda plans |
| Security Hub | Aggregates findings and runs control checks against standards |
| Inspector | Vulnerabilities in EC2, ECR, Lambda; network reachability |
| Macie | Sensitive data in S3 |
| Detective | Behaviour graph and root cause analysis |
| Config | Resource configuration history and compliance rules |
| Access Analyzer | External, internal and unused access; policy checks and generation |
| Security Lake | OCSF/Parquet data lake of security logs |
| CloudTrail | API audit log; Lake for SQL queries |
| Audit Manager / Artifact | Your audit evidence / AWS compliance reports |
Key facts
| Thing | Fact |
|---|---|
| CloudTrail event history | 90 days, management events |
| CloudTrail data events, Insights | Off by default |
| Log file validation | SHA-256 digests, hourly |
| KMS direct Encrypt limit | 4 KB |
| KMS key deletion wait | 7 to 30 days |
| KMS automatic rotation | Customer managed symmetric; configurable 90 to 2,560 days; key ID unchanged |
| Imported key material | No automatic rotation; can delete material immediately |
| AWS managed key | Can’t be used cross-account |
| RDS encryption | Only at creation (snapshot, copy encrypted, restore) |
| Object Lock | Needs versioning; governance can be overridden, compliance cannot |
| Role chaining session | 1 hour maximum |
| Security group vs NACL | Stateful allow-only vs stateless ordered allow/deny |
| CloudFront certificate | ACM in us-east-1 |
| WAF actions | Allow, Block, Count, CAPTCHA, Challenge |
| Shield Advanced extras | SRT, cost protection, layer 7 auto-mitigation |
| Direct Connect | Private, not encrypted; add MACsec or VPN |
| EC2 Instance Connect key life | 60 seconds |
| Detective data | Needs GuardDuty on about 48 hours first |
| Secrets Manager rotation | Lambda, labels AWSCURRENT / AWSPENDING / AWSPREVIOUS |
Containment order
- Isolate (empty security group plus NACL deny, keep instance running).
- Preserve: memory, EBS snapshots, logs, metadata, in a forensics account with Object Lock.
- Revoke: deactivate keys, revoke role sessions, remove instance profile.
- Investigate from a copy in an isolated VPC with Detective, CloudTrail, Athena.
- Eradicate: remove persistence, rotate secrets, patch.
- Recover from clean AMIs, IaC, tested backups; then review and improve.
Pairs people mix up
| A | B | The difference |
|---|---|---|
| SCP | RCP | Caps principals / caps access to resources |
| SCP | Permission boundary | Whole account or OU / one user or role |
| Permission boundary | Session policy | Standing cap on an identity / cap on one session |
| Security Hub | Security Lake | Findings and scores / raw normalised logs |
| GuardDuty Runtime | Inspector | Active behaviour / known vulnerabilities |
| Network Access Analyzer | Reachability Analyzer | Find unwanted paths / test one path |
| Audit Manager | Artifact | Your evidence / AWS’s reports |
| Cognito user pool | Identity pool | Sign-in tokens / AWS credentials |
| Secrets Manager | Parameter Store | Built-in rotation / configuration values |
| Session Manager | EC2 Instance Connect | No ports, IAM + SSM Agent / temporary SSH key, port 22 |
| Verified Access | Client VPN | Per-request zero trust / network-level VPN |
| FIS | Resilience Hub | Inject failures / assess resilience |
| Metric filter | Subscription filter | Logs to metric / logs to a stream |
| Object Lock governance mode | Object Lock compliance mode | Privileged override possible / no one can override |
| Tag policy | SCP with RequestTag |
Standardise tags / block untagged creation |
Defaults that are usually right
- Organization trail into a log archive account with Object Lock.
- Delegated admin plus auto-enable for GuardDuty, Security Hub, Macie, Inspector, Detective.
- Roles and temporary credentials; Identity Center for people.
- Session Manager instead of SSH; Patch Manager with maintenance windows.
- CloudFront plus WAF plus Shield in front of public apps; origin locked down.
- Customer managed KMS keys when sharing across accounts; Bucket Keys for S3 cost.
- Config with remediation, and SCPs for what must never happen.