• Determine cross-account authentication and access strategy for complex organizations
• Determine how to design networks for complex organizations
• Determine how to design a multi-account AWS environment for complex organizations

• Determine security requirements and controls when designing and implementing a solution
• Determine a solution design and implementation strategy to meet reliability requirements.
• Determine a solution design to ensure business continuity.
• Determine a solution design to meet performance objectives
• Determine a deployment strategy to meet business requirements when designing and implementing a solution.

• Select existing workloads and processes for potential migration to the cloud.
• Select migration tools and/or services for new and migrated solutions based on detailed AWS knowledge.
• Determine a new cloud architecture for an existing solution.
• Determine a strategy for migrating existing on-premises workloads to the cloud.

• Select a cost-effective pricing model for a solution.
• Determine which controls to design and implement that will ensure cost optimization.
• Identify opportunities to reduce cost in an existing solution.

• Troubleshoot solution architectures.
• Determine a strategy to improve an existing solution for operational excellence.
• Determine a strategy to improve the reliability of an existing solution.
• Determine a strategy to improve the performance of an existing solution.
• Determine a strategy to improve the security of an existing solution.
• Determine how to improve the deployment of an existing solution.

• Elastic Compute Cloud
• Light Sail
• Elastic Beanstalk
• Lambda
• Overview of Other Compute Services

• Simple Storage Service (AWS S3)
• S3 Glacier storage
• Elastic Block Storage (EBS) Volumes
• Elastic File System (EFS)
• AWS FSx
• AWS Storage Gateway
• AWS Snowball

• Relational Database Service (RDS)
• Dynamo DB
• Elasticache
• Other database services

• AWS Server Migration Service
• AWS Database Migration Service

• Virtual Private Cloud (VPC)
• CloudFront CDN
• Global Accelerator
• Route 53 DNS

• AWS Organizations
• CloudWatch Monitoring
• Auto Scaling
• Cloud Trail
• Cloud Formation
• Overview of Other Services

• Identity access management (IAM)
• AWS Certificate Manager
• AWS Directory Services
• AWS Organizations
• AWS WAF & Shield
• DDoS Mitigation Strategies & Penetration Testing
• AWS KMS & Cloud HSM
• AWS Cognito
• AWS Trusted Advisor
• Overview of Other Services

• SNS
• SQS
• SWF

• Workspaces
• Appstream
• Workdocs

• AWS SQS
• AWS SNS
• Kinesis

• 1st pillar: Operational Excellence
• 2nd pillar: Security
• 3rd pillar: Reliability
• 4th pillar: Performance Efficiency
• 5th pillar: Cost optimization

Cloud Security Introduction
Cloud Security fundamentals
AWS security model
Shared Responsibility
Exam Outline.

Evaluate the suspected compromised instance
Incident response planning
Mitigation actions
AWS Incident Response Strategy
Open access keys
How to Check corrupted EC2 instances
Assess automated alerts and address security events and developing concerns.
AWS Guard Duty
Penetration Testing.

Create security alerts.
Create a logging system.
Monitoring Security Continuously.
Risk Analysis:
AWS Inspector
AWS Inspector Assessment targets
AWS EC2 systems manager
AWS Config
CloudWatch:
VPC Flow Logs
CloudWatch Events
AWS Cloud Trail
AWS Macie
AWS Detective
AWS Security Hub
S3 Event notifications

Expert advice:
Monitor and notify security.
Logging solutions.

Create an Edge security using AWS.
AWS Organizations
Managing OUs
CloudFront
AWS CloudFront Custom SSL
Firewalls
Security groups
Network ACLs
IPS/IDS concepts in cloud
AWS Web Application Firewall (WAF)
AWS Shield concepts
DDoS Mitigation
Network Segmentation
Bastion Hosts
Virtual Private Cloud (VPC)
VPC Endpoints
EC2 Tenancy
Compliance Frameworks
AWS lambda fundamentals
AWS Simple Email Service
AWS Route53 DNS
Troubleshoot a secure network infrastructure.

Create a scalable Amazon Authorization&authentication system.
Principle of Least Privilege.
IAM Policies
IAM JSON Policy Elements
IAM Roles
IAM Permission boundaries
Evaluating effective permissions
Understanding Delegation
Cross account policies & roles
Understanding Federation
AWS Directory services
AWS Organizations
Single Sign-On
SAML Overview Concepts
S3 Security
Cross Account S3 access
S3 Versioning
S3 MFA delete
AWS License manager
Fix an Amazon resource authorisation and authentication mechanism.

Implement critical management
Cryptography basics
Cloud Hardware Security Module (HSM)
AWS Key Management Service (KMS)
Envelope Encryption
KMS Authentication and Access Control
CloudTrail and Encryption
EBS Architecture and Secure Data Wiping
S3 Encryption
AWS Certificate Manager
ELB- ALB and NLB
Docker and container security fundamentals
AWS Glacier
Troubleshoot key management.
Encrypt data at rest and in transit.

• Conflicting International Legislation
• Evaluation of Legal Risks Specific to Cloud Computing
• Legal Framework and Guidelines
• EDiscovery (e.g., International Organization for Standardization/ International Electro technicalCommission (ISO/IEC) 27050, Cloud Security Alliance (CSA) Guidance)
• Forensics Requirements

• Difference between Contractual and Regulated Private Data (e. g., Protected Health
• Information (PHI), Personally Identifiable Information (PII))
• Country-Specific Legislation Related to Private Data (e.g., Protected Health
• Information (PHI), Personally Identifiable Information (PII))
• Jurisdictional Differences in Data Privacy
• Standard Privacy Requirements (e.g., International Organization for Standardization /International ElectrotechnicalCommission (ISO/IEC) 27018, Generally Accepted
• Privacy Principles (GAPP), General Data Protection Regulation (GDPR))

• Internal and External Audit Controls
• Impact of Audit Requirements
• Identify Assurance Challenges of Virtualization and Cloud
• Types of Audit Reports (e.g., Statement on Standards for Attestation Engagements
• (SSAE), Service Organization Control (SOC), International Standard on Assurance Engagements (ISAE))
• Restrictions of Audit Scope Statements (e.g., Statement on Standards for Attestation Engagements (SSAE), International Standard on Assurance Engagements (ISAE))
• Gap Analysis
• Audit Planning
• Internal Information Security Management System (ISMS)
• Internal Information Security Controls System
• Policies (e.g., organizational, functional, cloud computing)
• Identification and Involvement of Relevant Stakeholders
• Specialized Compliance Requirements for Highly-Regulated Industries (e.g., North American Electric Reliability Corporation/ Critical Infra structure Protection (NERC/CIP), Health Insurance Portability and Accountability Act (HIPAA), Payment Card Industry (PCI))
• Impact of Distributed Information Technology (IT) Model (e.g., diverse geographical locations and crossing over legal jurisdictions)

• Assess Providers Risk Management
• Programs (e.g., controls, methodologies, policies)
• Difference between Data Owner/Controller vs. Data Custodian/Processor (e.g., risk profile, risk appetite, responsibility)
• Regulatory Transparency Requirements (e.g., breach notification, Sarbanes-Oxley (SOX), General Data Protection Regulation (GDPR))
• Risk Treatment (i.e., avoid, modify, share, retain)
• Different Risk Frameworks
• Metrics for Risk Management
• Assessment of Risk Environment (e.g., service, vendor, infrastructure)

• Business Requirements (e.g., Service Level Agreement (SLA), M aster Service Agreement (MSA), Statement of Work (SOW))
• Vendor Management
• Contract Management (e.g., right to audit, metrics, definitions, termination, litigation, assurance, compliance, access to cloud/data, cyber risk insurance)
• Supply-Chain Management (e.g., International Organization for Standardization/
• International Electro technical Commission (ISO/IEC) 27036)