Security and Compliance
What to know
Master the identity pillar: authentication vs authorization, least privilege, role-based access control, federation, and multi-factor authentication. Understand encryption at rest and in transit, key management (customer-managed vs provider-managed keys), and the lifecycle of secrets. Know the categories of controls - preventive, detective, corrective - and where each fits (e.g., a security group is preventive; audit logging is detective). Compliance concepts matter: data residency, retention, audit trails, and the difference between a certification (provider holds it) and customer attestation. Familiarize yourself with defense in depth: network segmentation, least privilege, logging, and monitoring layered together.
Traps
A frequent trap is treating encryption as sufficient without access control - encrypted data is still exposed if permissions are broad. Another is confusing identity-based policies (attached to a principal) with resource-based policies (attached to a resource); cross-account access often needs both. Questions may ask which control detects an event - logging and alerting, not blocking. Beware answers that grant "admin" to simplify operations; least privilege is almost always the intended answer. Also distinguish secrets management (rotating credentials) from configuration management (non-sensitive settings).
Worked example
An auditor asks how to prove no one accessed a bucket in the last 90 days. The answer is not "encrypt the bucket" but "enable access logging and retain logs for the compliance window, then review." Rule of thumb: if the question asks to prove, detect, or investigate, choose a detective control; if it asks to prevent, choose a preventive control.