AWS Certified Security - Specialty

Published weight 16%. Designing and implementing threat detection, monitoring, and analysis using AWS security services (GuardDuty, Security Hub, Detective, Inspector, Macie).

• Design and implement threat detection and monitoring (GuardDuty, Security Hub, Detective, Inspector)

Published weight 14%. Designing and implementing incident response: playbooks, automated remediation, forensics, and containment.

• Design and implement incident response (playbooks, automation, forensics, containment/remediation)

Published weight 18%. Designing edge and network security (WAF, Shield, VPC design, firewalls, endpoints) and securing compute (EC2, containers, patching, hardening).

• Design edge and network security (WAF, Shield, VPC, security groups/NACLs, endpoints)
• Secure compute workloads (EC2, containers, patching, hardening, host protection)

Published weight 20%. Designing authentication and access (IAM, IAM Identity Center, federation, STS) and troubleshooting/analyzing authorization (policies, permission boundaries, SCPs, access analyzer).

• Design authentication and access (IAM, IAM Identity Center, federation, STS, roles)
• Troubleshoot and analyze authorization (policies, permission boundaries, SCPs, IAM Access Analyzer)

Published weight 18%. Designing encryption and key management (KMS, CloudHSM, ACM, Secrets Manager) and protecting data at rest and in transit including sensitive data (Macie, S3 controls).

• Design encryption and key management (KMS, CloudHSM, ACM, Secrets Manager)
• Protect data at rest and in transit and sensitive data (Macie, S3 controls, tokenization)

Published weight 14%. Implementing security governance and compliance across accounts (Organizations, SCPs, Config, Control Tower, Audit Manager, cost/logging).

• Implement security governance and compliance (Organizations, Config, Control Tower, Audit Manager)