Infrastructure Security

Edge, compute, and network controls — WAF, Inspector, firewalls — 18%

• Protecting the Edge — The first hit lands here: choosing edge controls from the threat you actually expect, CloudFront as a security boundary with Origin Access Control and signed URLs, WAF web ACLs engineered rule by rule with priority and labels, and Shield Standard versus Shield Advanced for DDoS resilience. (4 lessons, 65 min)
• Securing Compute Workloads — Everything that runs your code: golden AMIs and hardened container images built by pipeline, the three role shapes that authorize a workload, IMDSv2, Inspector versus GuardDuty Runtime Monitoring, Patch Manager against immutable rebuilds, Session Manager instead of SSH keys, and guardrails for pipelines and generative-AI applications. (6 lessons, 70 min)
• Network Security Controls — The most-tested network facts on the exam: stateful security groups against stateless NACLs and their ephemeral ports, AWS Network Firewall with stateless, stateful and Suricata rules, segmentation for north/south and east/west traffic, and the tools that prove nobody needs the access you granted. (4 lessons, 60 min)
• Hybrid and Private Connectivity — Stitching AWS to everything else without losing the encryption argument: Site-to-Site VPN tunnels, Direct Connect virtual interfaces and MACsec, Client VPN against Verified Access for user access, and Route 53 Resolver DNS Firewall for the attack surface everyone forgets. (3 lessons, 50 min)