AWS Security Specialty — Lab Notes

12 hands-on CLI labs run in a real AWS Organizations sandbox, rewritten as review notes: the idea, what actually happened (surprises included), exam notes, and quiz questions with hidden answers.

Start with Lab 01 Random quiz Cheat sheet

8 / 12labs done

66quiz questions

6exam domains

≈ $0.08total AWS cost

Labs

• 01 KMS + S3 data protection

  ---

  Key policy vs IAM, kms:ViaService, grants, encryption context, SSE-KMS bucket policies.

  ✅ Done Data Protection

• 02 IAM policy evaluation

  ---

  Boundaries, session policies, ABAC, explicit deny, privilege escalation, Access Analyzer.

  ✅ Done IAM

• 03 Organizations guardrails

  ---

  SCPs vs RCPs, the management-account exemption, aws:PrincipalOrgID, delegated admin.

  ✅ Done Governance

• 04 CloudTrail deep dive

  ---

  Org trail, KMS + log file validation, data events, Athena with partition projection.

  ✅ Done Logging

• 05 GuardDuty → EventBridge → Lambda

  ---

  A real C&C finding, auto-isolation by SG swap, suppression rules, delegated admin.

  ✅ Done Detection & IR

• 06 Config + Security Hub

  ---

  Managed rules, SSM Automation remediation, FSBP controls, ASFF, automation rules.

  📝 To run Governance

• 07 VPC & network controls

  ---

  Gateway vs interface endpoints, endpoint + bucket policies, SG vs NACL, Flow Logs.

  ✅ Done Infrastructure

• 08 Edge protection (WAF, Shield)

  ---

  WAF on an ALB: IP sets, managed rules, count mode, rate limits, logs; Shield Advanced.

  📝 To run Infrastructure

• 09 Secrets & certificates

  ---

  Parameter Store vs Secrets Manager, Lambda rotation and staging labels, ACM.

  📝 To run Data Protection

• 10 Immutable data & Macie

  ---

  Block Public Access, Object Lock (governance, legal hold), Macie custom identifiers.

  📝 To run Data Protection

• 11 Incident response drill

  ---

  Leaked key (the GetSessionToken trap) and EC2 forensics: volatile data, snapshot, isolate.

  ✅ Done Detection & IR

• 12 Federation

  ---

  Identity Center ABAC, Cognito user + identity pools, the classic-flow escalation.

  ✅ Done IAM

How to use this site

Skim Key lessons and Exam notes, then answer each quiz card before you open Show answer. Placeholders: 111111111111 = management account, 222222222222 = member account.