Security Services and Data Protection
This topic covers AWS security services, encryption, key management, secrets, threat detection, DDoS protection, vulnerability awareness, and data protection.
How to study for AWS Cloud Practitioner
Treat each question as a service-selection or responsibility decision: identify the business need, AWS responsibility, customer configuration, and best-fit service.
Core concepts
Concept 1
AWS security services help protect identities, data, networks, workloads, and accounts, but customers still configure them appropriately.
Exam cue: Use KMS for managed encryption keys.
Concept 2
Data protection includes encryption at rest, encryption in transit, key management, access control, backup, and lifecycle choices.
Exam cue: Use threat detection services for suspicious account or workload activity.
Concept 3
Threat detection and protection services provide findings or safeguards that must be reviewed and acted on.
Exam cue: Choose service-native controls before inventing custom protection.
Risk pitfalls and guardrails
Encrypting data but leaving broad public access.
Guardrail: Avoid answers that ignore customer configuration, choose unmanaged services when managed services fit, or use billing reports when proactive alerts are required.
Treating findings as fixed just because a service reported them.
Guardrail: Avoid answers that ignore customer configuration, choose unmanaged services when managed services fit, or use billing reports when proactive alerts are required.
Using hard-coded secrets in application code.
Guardrail: Avoid answers that ignore customer configuration, choose unmanaged services when managed services fit, or use billing reports when proactive alerts are required.
Memory anchors
AWS KMS
AWS Key Management Service creates and controls cryptographic keys for supported services and applications.
CloudHSM
AWS CloudHSM provides dedicated hardware security modules for customer-managed cryptographic workloads.
Secrets Manager
AWS Secrets Manager stores and rotates secrets such as database credentials.
GuardDuty
Amazon GuardDuty detects potential threats from logs, DNS, network, and account activity.
Inspector
Amazon Inspector helps identify software vulnerabilities and unintended network exposure.
Shield
AWS Shield helps protect against distributed denial of service attacks.
WAF
AWS WAF helps protect web applications from common web exploits.
Macie
Amazon Macie discovers and helps protect sensitive data such as personally identifiable information in S3.
Encryption at Rest
Encryption at rest protects stored data.
Encryption in Transit
Encryption in transit protects data moving across a network.
Checkpoint rule
Do the check-up only after you can summarize each concept in one sentence and identify one dangerous pitfall from memory.
Knowledge Check (after reading)
Short check-up to confirm understanding of this module.
Check-up Questions
A company needs to create and control encryption keys used by supported AWS services. Which service should it use?
A public website must encrypt browser connections with TLS, and the team wants AWS to provision and renew the certificate. Which service fits?
Answer all questions to submit.
Next step personalized recommendations
Continue learning
Move forward only after this module is stable.
What is Pass Harbor?
Completely free exam prep for 317 U.S. exams.
- Practice questions
- Flashcards
- Study guides
- Mock exams
- No registration
- No paywall
- Start instantly
“No more expensive exam prep. Quality study tools should be accessible to everyone.”