How I passed my AWS Certified Security (Speciality) Exam

AWS-Security-Specialty Badge

Today we operate in a environment where cyber security attacks, damages, ransom and other scary activities occur often and can absolutely cripple a business of all sizes from start-up to enterprise.

No matter your background into cloud computing, I think this certification is a MUST in the AWS certifications, it is not one of the easiest of the AWS certifications, however it will give you a good foundation and security focus when making use of the services AWS has to offer as well as design for cost-effective and fault-tolerant solutions.

Before you start

About this post:

  • 2 – 7 min average reading time
  • Suitable for beginner through to advanced

What you will gain reading this post:

  • A set of strategies to make the exam experience easier
  • A list of recommended training materials and providers
  • A mindmap to help you understand the depth of the exam
  • A template to help track your attempts

What you can do to help support:

  • Like, comment and share this article
  • Follow this blog to receive notifications of new postings

Now, let’s begin.

Strategies

On the day of the exam you can feel nervous, this is normal, but the conditions of the exam centres/online exam can also exaggerate that feeling.   

Set up yourself for success

Exam Center

When you are at the exam center there is an expectation to not wear loose clothing, as well as to keep your hands on the table for the duration of the exam. 

My recommendation as the date of the exam approaches is to put yourself in a similar environment. 

  • Try putting yourself in a quiet room, such as those you find in a library, and for the duration of the practice exam try to keep your hands on the table just moving the mouse to complete your practice exam. 

You are also provided with paper and a pencil to scribble on during the exam so feel free to use that during your practice exams, but I found the more I was able to mimic the exam environment, the less the environment added to my nerves on the day of the exam.

Online

When online you need a clean and clear environment, I suggest to remove anything that is near you in the form of paper within hands reach, this will just make the check-in process quicker and easier.

You will need to take photos of your environment as well as pass the camera you are using around your desk and room, so the cleaner the room the better.

Capture what is on your mind

As you study, you will find yourself going through multiple training providers and study materials, as you progress through a topic onto the next, sometimes while still studying the topic, you will find yourself asking yourself, what did I learn in that topic? or I have read that before why can’t I remember?  It can become overwhelming at times.

This is where a mind map can be a very useful learning aid, not only will you be able to glance back at your notes, but you will also be ensuring you capture key points, and in my opinion make it easier to retain that knowledge.

I have attached the mind map that I produced during my study across various training providers and topics, however, I highly recommend that you prepare your mind map as you go through your study agenda, why? You will find yourself retaining much more knowledge.

Managing your time

Managing your time is very important not only do you need to be aware of how long it will take you to complete the exam but also how long you will require to review your flagged questions before you do a final submission. 

The exam gives you 180 minutes when I took the exam I made sure that I left myself at least 60 minutes to review of the questions that I flagged. 

You may require more or less time to perform your review, but what is important is you understand how much time you require and ensure you leave yourself enough time.

Keywords will provide direction

As you study for the exam you will notice keywords come up that best suit certain services, an example of this is if you encounter a question about managing access across specific accounts in your organisation more often than not the answer will be referring to service control policies. 

I recommend that you keep track of these various keywords that will pop up as they will help you be confident with the answers you select as well as allow you to move rapidly through some questions helping you with your time management.

Ensure you understand the detail

This to me what the most important step, in preparing for the exam, make sure you understand the details, seriously.

There were various situations during the exam, where I understood the concept well and understood the AWS service, but the details made me unsure of which answer I should be selecting. 

For example, there was a question that had the same answer 4 times but each version of the answer was slightly extended to include more detail (this was somewhat common), and unless you understood what attributes the AWS service had, then selecting the correct version of the answer is difficult, these are the situation where you might find yourself having to make an educated guess knowing what you know about the services and patterns that AWS provide for these services. 

My recommendation is to read the AWS white papers and AWS FAQs for the different services and try to absorb as much of the details as you can.

https://aws.amazon.com/faqs/ and https://aws.amazon.com/whitepapers/

Learn what you being asked

Let’s start by looking at this question:

An organization wants to deploy a three-tier web application whereby the application servers run on Amazon EC2 instances. These EC2 instances need access to credentials that they will use to authenticate their SQL connections to an Amazon RDS DB instance. Also, AWS Lambda functions must issue queries to the RDS database by using the same database credentials.
The credentials must be stored so that the EC2 instances and the Lambda functions can access them. No other access is allowed. The access logs must record when the credentials were accessed and by whom.
What should the Security Engineer do to meet these requirements?

  • A. Store the database credentials in AWS Key Management Service (AWS KMS). Create an IAM role with access to AWS KMS by using the EC2 and Lambda service principals in the role’s trust policy. Add the role to an EC2 instance profile. Attach the instance profile to the EC2 instances. Set up Lambda to use the new role for execution.
  • B. Store the database credentials in AWS KMS. Create an IAM role with access to KMS by using the EC2 and Lambda service principals in the role’s trust policy. Add the role to an EC2 instance profile. Attach the instance profile to the EC2 instances and the Lambda function.
  • C. Store the database credentials in AWS Secrets Manager. Create an IAM role with access to Secrets Manager by using the EC2 and Lambda service principals in the role’s trust policy. Add the role to an EC2 instance profile. Attach the instance profile to the EC2 instances and the Lambda function.
  • D. Store the database credentials in AWS Secrets Manager. Create an IAM role with access to Secrets Manager by using the EC2 and Lambda service principals in the role’s trust policy. Add the role to an EC2 instance profile. Attach the instance profile to the EC2 instances. Set up Lambda to use the new role for execution.

Now let’s begin to break this down…

Question breakdown
Question Breakdown

Keep track of your progress

I have attached a template you can use if you wish, I used it to track my progress through the various training provider practise tests, it allowed me to focus on what areas I was lacking and to explore deeper, until I was able to answer questions related to that consistently.

Key Areas

At a high level, here are the areas that were quite common in the exam, and understanding the details is crucial to passing the exam.

  • IAM
  • KMS
  • SecurityHub
  • GuardDuty
  • Inspector
  • AWS Config
  • CMK
  • Policies
  • Federation
  • CloudTrail
  • CloudWatch
  • CloudFront
  • S3
  • ELB
  • Cross-account interactions

Training Providers

A Cloud Guru

A Cloud Guru was one of the main training providers that I used all the way through to taking the exam.

However with the merger of LinuxAcademy, I took the course provided below via the LinuxAcademy portal. 

With the course, I have linked below

  • You will get both a good understanding and practical experience on how the different AWS services work and integrate 

I DO recommend this course, but…

The criticisms I have with the course is I do not believe it is enough to pass the exam.

  • The content is not in depth enough
  • It lacked labs to challenge you
  • The difficulty of the practice exams were not at the standard required to prepare you for the questions that AWS provide during the exams

https://acloud.guru/learn/aws-certified-security-specialty

Whizlabs

Whizlabs was the other main training provider that I used all the way through to taking the exam. 

The practise questions do help to provide context and help you to determine where to focus, however I still think that they are to simple compared to the actual exam.

My recommendation is unless you are scoring 85% or above consistently across all the practice exams then do not take the actual exam, wait until you understand the concepts well, you can then go into the actual exam confident and provide yourself a very high chance of succeeding.  

https://www.whizlabs.com/aws-certified-security-specialty/

Tutorial Dojo

I did not use these practise exams, but if I was to do this again, I would make use of practise exams by Jon Bonso, they are quality and the difficult will be close to that of the actual exam.

The Exam

The difficulty of the questions you experience during the exam could vary greatly between individuals.

I found the questions in the exam to be quite difficult as certain parts of the answers contained details that I wasn’t aware should be studied, however based on what I did know I was able to make an educated guess. 

If you find yourself in that situation, my recommendation is to not let yourself become overwhelmed but instead focus on answering the questions as best you can, start by eliminating answer/s that you know is incorrect, ensure you read the questions a few times to grasp what they are trying to test you on and then if you are still not sure to make an educated guess and make sure you flag the question to come back later and revisit the answer you initially provided. 

It is key to just progress through the exam.

I found as the exam went on, I was able to focus better, and at the end of the exam, I went back and revisited all the answers. 

After the first pass of the questions I was not confident about passing, but after settling into the exam I became more confident, finishing the exam with 20 minutes remaining.

https://aws.amazon.com/certification/certified-security-specialty/

The Results

After a few days, you will be provided with your results via the AWS Certification Management Portal.

You will be given

  • A badge that you can share with your employers or services such as LinkedIn
  • A transcript that you can share with your employer or potential employer
  • A pdf version of the certificate
  • A score ranging between 100 and 1000 

The pass mark required is 750, my final score was 891.

Finally, enjoy and celebrate your success, you have earned it.

AWS Certified Security - Specialty

Did this help?

  • Like, comment and share this article
  • Follow this blog to receive notifications of new postings
  • View previous postings

4 thoughts on “How I passed my AWS Certified Security (Speciality) Exam

  1. Hi Robert, Congratulations.
    Was wondering if there are any tips for someone who doesnt come from tech background. I am a PM and am very interested in doing Security cert. Would appreciate some tips
    Many Thanks
    Warm Regards,
    Anu

    1. Hi Anu,

      Thank you very much for your question.

      There are a few tips I have that will make the journey not so overwhelming :).

      AWS have a prerequisite where in order to take a speciality exam you first need to have an active associate certification, i’ll assume you haven’t taken that yet

      I recommend the following certification path
      1. the Cloud Practitioner
      2. the Solution Architect – Associate
      3. the Security Speciality

      I recommend a subscription to a cloud provider training platform such as A Cloud Guru, this provides 2 benefits, the first being you will have training videos that help you learn the content and take you through the certification and secondly you will be able to practise the content and follow along the demos in the sandbox environment where you won’t incur AWS costs.

      Lastly enjoy the journey, take your time and learn the content, as you work through one certification it will create the base for the next.

      I hope that help

      Regards

      Rob

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.