Keyword reflexes
Lesson 2 of 4 in Exam Readiness.
At 2 minutes 37 seconds a question, recognition is the resource you are short of. A keyword reflex is a drilled association between a phrase the exam uses and the service or feature that owns it — "centrally aggregate findings" to Security Hub, "discover PII at rest" to Macie, "no SSH keys or bastion" to Session Manager. It is a hypothesis, not an answer: you still check the qualifier and the constraints before committing. But arriving at the options with a hypothesis already formed is the difference between finishing with twenty minutes spare and finishing in a panic.
Three tables follow, grouped the way the exam groups its domains. Build them into flashcards or cover the right column and read down the left. The phrasings are drawn from the exam guide's own wording, because the guide's vocabulary is the vocabulary the items use.
| If the stem says… | Reach for | Because |
|---|---|---|
“centrally aggregate findings across accounts” | AWS Security Hub, delegated administrator | Aggregation plus standards and scoring is its defining job; the delegated admin keeps it out of the management account. |
“detect compromised credentials / crypto-mining / unusual API activity” | Amazon GuardDuty | Behavioural threat detection from account and network telemetry. |
“detect threats without building a log pipeline” | Amazon GuardDuty | It reads CloudTrail management events, VPC flow and DNS data itself — you do not have to enable or store them. |
“malware on an attached volume” / “runtime behaviour inside containers” | GuardDuty Malware Protection / Runtime Monitoring | The GuardDuty family extends into EBS scanning and EC2, ECS and EKS runtimes. |
“discover and classify sensitive data at rest in S3” | Amazon Macie | Managed and custom data identifiers look inside the objects. It reports; it never redacts. |
“known CVEs in instances, container images, or Lambda functions” | Amazon Inspector | Continuous vulnerability management as inventory changes, including ECR images and Lambda layers. |
“who called this API, from where, and when” | AWS CloudTrail | The authoritative record of API activity with the caller identity attached. |
“a trail member accounts cannot stop or delete” | Organization trail to a dedicated log-archive account, protected by an SCP | Structural separation of duties: the people who could tamper with the logs cannot reach them. |
“query years of API history, managed, with SQL” | AWS CloudTrail Lake | Managed event data stores with queryable retention — no pipeline to build. |
“normalise AWS, on-premises and third-party logs into one schema” | Amazon Security Lake (OCSF) | Purpose-built security data lake; OCSF is the schema C03 added to the guide. |
“interactive queries over logs” / “SQL over logs in S3” | CloudWatch Logs Insights / Amazon Athena | Insights for log groups, Athena for data already in S3. |
“correlate across sources and visualise for the SOC” | Amazon OpenSearch Service / Amazon Managed Grafana | The guide names both where it asks you to normalise, parse and correlate logs. |
“establish the scope, impact and root cause of a finding” | Amazon Detective | “Root cause” is close to a guaranteed signal for Detective. |
“traffic accepted and rejected between instances” | VPC Flow Logs (and transit gateway flow logs for traffic crossing a TGW) | Network-level evidence the stem usually names when a security group is suspected. |
“which domains did the workload resolve” | Route 53 Resolver query logging | The DNS evidence for exfiltration investigations; DNS Firewall is the preventive half. |
“contain the instance now, without losing evidence” | Isolation security group first, then snapshot the volumes | Contain, then collect, then eradicate — the order an ordering item will test. |
“remediate automatically when a finding appears” | EventBridge → Systems Manager Automation (or Step Functions, or Lambda) | The guide names exactly these for automatic incident remediation. |
“collect forensic artefacts automatically” / “test the response plan” | Automated Forensics Orchestrator for Amazon EC2 / AWS Fault Injection Service | Both are named in the incident-response domain and both are easy marks if you recognise the name. |
Next, the two heaviest domains together: Identity and Access Management at 20% and Data Protection at 18% — nineteen of the fifty scored questions between them. If you drill only one of these three tables, drill this one.
| If the stem says… | Reach for | Because |
|---|---|---|
“employees must sign in to many accounts” | IAM Identity Center with permission sets, federated to your IdP | Workforce access at scale. IAM users per account is the distractor. |
“our application’s own end users sign up and sign in” | Amazon Cognito user pools (identity pools when they also need AWS credentials) | Customer identity, not workforce identity. |
“no long-lived credentials” / “short-lived access” | AWS STS role sessions; IAM Roles Anywhere for on-premises workloads | Certificates replace stored access keys outside AWS. |
“one-off access to a single object for someone with no AWS account” | S3 presigned URL with a short expiry | It carries the signer’s permissions and can never exceed them — a favourite trap. |
“prevent member accounts from doing X at all” | Service control policy (SCP) | A ceiling on principals. It never grants, and it does not apply to the management account. |
“restrict access to a resource regardless of who asks” | Resource control policy (RCP) | A ceiling on what the resource will accept, organization-wide, above any resource policy. |
“developers may create roles, but never ones more powerful than…” | Permission boundary | Caps the effective permissions of the principals you attach it to — the delegation control. |
“narrow this one role assumption further” | Session policy passed on the AssumeRole call | Scopes a single session without changing the role. |
“access based on tags or attributes” | ABAC with | Scales without writing a policy per team — and depends on controlling who may set tags. |
“which permissions has this role actually used?” | IAM Access Analyzer unused-access findings; policy generation from CloudTrail | Right-sizing from observed activity rather than guesswork. |
“is this resource shared outside the organization?” | IAM Access Analyzer external-access findings | Policy reasoning, not traffic analysis. |
“would this policy change break access?” | IAM policy simulator (plus Access Analyzer policy validation) | The guide names both where it asks you to analyse authorization failures. |
“keys we control, with rotation, audit, and a key policy” | KMS customer managed key | The default right answer. AWS managed keys give you no key policy of your own. |
“we must hold custody / single-tenant FIPS hardware” | AWS CloudHSM (or a KMS custom key store backed by it) | Only when single-tenant hardware custody is explicitly demanded — otherwise it is an over-engineered distractor. |
“we must generate the key material ourselves” | KMS imported key material, or an external key store | C03 adds this: imported material has no automatic rotation, can be set to expire, and must be re-imported if deleted. |
“one key usable by workloads in several Regions” | KMS multi-Region keys | Replicas share key material so ciphertext is portable — another C03 addition. |
“rotate the database password automatically” | AWS Secrets Manager managed rotation | Parameter Store has no rotation; the word “rotate” decides the pair. |
“cheap storage for configuration values, no rotation needed” | Systems Manager Parameter Store | The cost-sensitive half of the same pair. |
“WORM” / “cannot be deleted even by the root user” | S3 Object Lock in compliance mode (or S3 Glacier Vault Lock) | Governance mode is the distractor: a bypass permission exists. Compliance mode cannot be shortened by anyone. |
“ransomware-resilient backups” | AWS Backup with vault lock, in a separate account | Immutability plus account separation; a backup an attacker can delete is not a backup. |
“encrypt traffic between the nodes of the cluster” | Inter-node encryption in transit for EMR, EKS or SageMaker AI (and Nitro-based encryption) | New in C03: client-to-service TLS is not the same requirement. |
“requests must always use TLS” | Bucket-policy deny on | Enforced by policy and configuration, not by hoping clients behave. |
“mask sensitive data in logs or notifications” | CloudWatch Logs data protection policies; Amazon SNS message data protection | Also new in C03, and distinct from blocking or encrypting. |
Interactive sorting exercise: Five policy types, one requirement each. This is the IAM drill that pays best: the exam asks it in a dozen disguises.
Last table: Infrastructure Security at 18% and Security Foundations and Governance at 14% — sixteen scored questions, and the governance half is the one candidates skip. Note how many governance answers are simply the central form of something you already know.
| If the stem says… | Reach for | Because |
|---|---|---|
“SQL injection” / “bad bots” / “rate limit by IP” / “OWASP Top 10” | AWS WAF with managed rule groups and rate-based rules | Layer-7 request filtering on CloudFront, ALB, API Gateway or AppSync. |
“large volumetric DDoS, with AWS engagement and cost protection” | AWS Shield Advanced, subscribed and applied to the resources | Standard Shield is automatic; Advanced is not — you must protect resources explicitly. |
“restrict by country” / “client fingerprinting” | CloudFront geo restriction or a WAF geo match; WAF Bot Control for fingerprinting | Named under edge controls based on geography and rate limiting. |
“ingest third-party security data at the edge in a common schema” | OCSF ingestion (Security Lake) and third-party WAF rule groups | The C03 addition to edge integrations. |
“block one IP address for an entire subnet” | Network ACL deny rule | NACLs are the subnet-level, stateless filter — and the only place a deny rule exists in VPC filtering. |
“allow traffic from another group of instances” | Security group referencing the other security group | Stateful, instance level, allow-only — and group references beat CIDR lists. |
“inspect east-west traffic” / “IPS rules between VPCs” | AWS Network Firewall in an inspection VPC | Stateful managed inspection with Suricata-compatible rules. |
“data is leaving over DNS” | Route 53 Resolver DNS Firewall to block, plus Resolver query logs to see it | The preventive and detective halves of the same problem. |
“the same firewall policy in every account, enforced” | AWS Firewall Manager | Central management of WAF, Shield Advanced, Network Firewall and DNS Firewall policies. |
“administer instances with no SSH keys and no bastion host” | Systems Manager Session Manager | No inbound ports, IAM-authorised, logged to CloudTrail and optionally S3 or CloudWatch Logs. |
“patch thousands of instances on a schedule, with compliance reporting” | Systems Manager Patch Manager (plus Inspector to verify) | Patch baselines and maintenance windows; Inspector is how you prove it worked. |
“hardened base images, rebuilt on a pipeline” | EC2 Image Builder | Golden AMIs and container images with the hardening baked in, not applied afterwards. |
“find vulnerabilities in our code before it ships” | Amazon CodeGuru Security / Amazon Q Developer | Both are named in the compute-security task for pipeline-stage discovery and remediation. |
“guardrails for our generative AI application” | Amazon Bedrock guardrails, framed by the OWASP Top 10 for LLM Applications | New in C03 — securing a GenAI application is now in scope for this exam. |
“find network paths that should not exist” | Network Access Analyzer (and Inspector network reachability findings) | Reachability, not an attack in progress. |
“new accounts must be governed from the moment they exist” | AWS Control Tower landing zone with managed controls on OUs | Account factory plus controls; hand-rolled SCPs are the lower-automation distractor. |
“deploy the same security stack to every account and Region” | CloudFormation StackSets | The central form of a stack. Running a template per account is the rejected answer. |
“check infrastructure templates against policy before deployment” | CloudFormation Guard / cfn-lint in the pipeline | Policy as code, named in the secure-deployment task. |
“share subnets, a transit gateway, or a private CA across accounts” | AWS RAM | Share rather than duplicate; Service Catalog is for approved products teams self-serve. |
“prove our controls to an auditor, continuously” | AWS Audit Manager for your controls; AWS Artifact for AWS’s; Well-Architected Tool to review the architecture | Three different auditor questions, three different services. |
“centralise root access for member accounts / design break-glass” | AWS Organizations root access management, with MFA and an audited break-glass procedure | Named in the governance domain and commonly under-studied. |
Key terms: Keyword reflex, Overlap trap, WORM (write once, read many), Preventive control, Detective control