AWS Security Specialty study plan
AWS Security Specialty · Give each week a clear focus.
8 weeks · About 7 hours per week
Infrastructure Security
Design a segmented VPC with public, private, and isolated subnets, then justify each route and gateway choice.
Configure security groups and NACLs to enforce least-privilege traffic flows between tiers.
Deploy AWS WAF rules on an ALB and test blocked versus allowed requests.
Harden an EC2 instance using IMDSv2, Systems Manager Session Manager, and restrictive instance profiles.
Your checkpoint
A written lab report containing a VPC diagram, five enforced network controls, and test evidence showing allowed and denied traffic paths.
Security Logging and Monitoring & Infrastructure Security
Configure an organization-wide CloudTrail trail with log file validation and centralized S3 storage.
Enable VPC Flow Logs, S3 server access logging, and DNS query logging for a test account.
Turn on GuardDuty and generate at least three sample findings to observe detection behavior.
Build a CloudWatch Logs metric filter and alarm for a suspicious API action.
Your checkpoint
A detection coverage matrix mapping five threat scenarios to the specific log source and alerting mechanism that would catch each one.
Data Protection & Security Logging and Monitoring
Create KMS customer managed keys with restrictive key policies and test grant versus policy access.
Enable default encryption on S3 and EBS, then verify encryption state across resources with a script or CLI query.
Store and rotate a database credential in Secrets Manager and retrieve it from an application role.
Run Macie on a sample bucket and classify at least two sensitive data findings.
Your checkpoint
An encryption and secrets inventory listing ten resources, their encryption method, key ownership, and rotation status.
Identity and Access Management
Write IAM policies that enforce least privilege for a multi-role application and validate them with IAM Policy Simulator.
Apply a permissions boundary and an SCP to prevent privilege escalation in a test organization.
Configure cross-account role trust policies with external ID and condition keys.
Troubleshoot three access-denied scenarios and document the exact policy element that caused each denial.
Your checkpoint
A policy review packet with four policies, simulator results, and a before-and-after least-privilege comparison.
Threat Detection and Incident Response & Security Logging and Monitoring
Build an incident response runbook for a compromised EC2 instance that preserves forensic evidence.
Isolate an instance using security groups and snapshot its volumes without terminating it.
Reconstruct an attacker timeline from CloudTrail, VPC Flow Logs, and GuardDuty findings.
Automate one containment step with an EventBridge rule and a Lambda function.
Your checkpoint
A completed tabletop exercise write-up with timeline, containment actions, evidence artifacts, and lessons learned.
Management and Security Governance & Identity and Access Management
Enable AWS Config rules and a conformance pack to detect five common misconfigurations.
Aggregate Security Hub findings across accounts and rank them by severity.
Define an account baseline covering root access, MFA, and password policy using AWS Organizations.
Document a break-glass access procedure with approval and audit logging.
Your checkpoint
A compliance dashboard screenshot set plus a one-page control mapping for five governance controls.
Threat Detection and Incident Response & Security Logging and Monitoring & Infrastructure Security & Data Protection
Run an end-to-end incident simulation that spans detection, containment, and recovery.
Tune two noisy detections by suppressing expected findings and adding context.
Validate that encryption, network segmentation, and logging controls still work after simulated drift.
Complete a timed 65-question practice exam and review every incorrect answer.
Your checkpoint
A timed practice exam score of at least 75 percent with a written review of each missed question.
Threat Detection and Incident Response & Security Logging and Monitoring & Infrastructure Security & Identity and Access Management & Data Protection & Management and Security Governance
Re-test the two weakest domains based on practice exam results.
Recite from memory the default behaviors of key services such as KMS, IAM evaluation logic, and CloudTrail scope.
Review all personal notes and convert gaps into a final flash-card set.
Retake a full-length practice exam and compare scores against week 7.
Your checkpoint
A final readiness checklist showing every domain above 80 percent on practice questions and no unresolved review items.
Milestones
Week 2: Detection coverage matrix is complete and at least three GuardDuty findings were generated and explained.
Week 4: Four policies pass simulator validation and three access-denied scenarios are resolved with documented root causes.
Week 6: Five Config rules and one conformance pack are evaluating resources, with findings visible in Security Hub.
Week 8: Full-length practice exam retake scores at least 80 percent overall with every domain at or above 75 percent.