What it covers
The official exam guide breaks this domain into 3 objectives:
- Design secure access to AWS resources
- Design secure workloads and applications
- Determine appropriate data security controls
Practice this domain
A drill pulls every published question in this domain and grades each one as you go. Flashcards skip the grading entirely — read the stem, flip when you're ready, move on.
A sample question
A company wants a single place to aggregate security findings from GuardDuty, Inspector, and Macie and to check accounts against standards such as CIS and AWS Foundational Security Best Practices. Which service provides this?
- AAmazon Detective, which builds graphs to investigate specific findings.
- BAWS Security Hub, which aggregates findings and runs compliance standards.
- CAWS Config, which records resource configuration changes across accounts.
- DAmazon CloudWatch, which stores metrics, logs, and alarms for the account.
Security Hub centralizes findings from multiple security services and continuously checks accounts against security standards. Detective is for investigation, Config records configuration, and CloudWatch handles metrics and logs.
A team needs to capture metadata about accepted and rejected IP traffic to and from network interfaces in a VPC for troubleshooting and forensics. What should they enable?
- AAWS CloudTrail data events captured for the VPC's resources and APIs.
- BAWS Config recording enabled for the VPC's subnets and interfaces.
- CAmazon GuardDuty DNS logging turned on for the VPC's outbound queries.
- DVPC Flow Logs delivered to CloudWatch Logs or Amazon S3 for analysis.
VPC Flow Logs capture metadata about accepted and rejected traffic on network interfaces and can be sent to CloudWatch Logs or S3. CloudTrail records API calls, Config records configuration, and GuardDuty DNS logging covers only DNS queries.
Unofficial study aid. Not affiliated with, endorsed by, or sponsored by Amazon Web Services.