Content Domain 1: Detection - AWS Certification
Task 1.1: Design and implement monitoring and alerting solutions for an AWS account or organizationTask 1.2: Design and implement logging solutionsTask 1.3: Troubleshoot security monitoring, logging, and alerting solutions

Content Domain 1: Detection

Task 1.1: Design and implement monitoring and alerting solutions for an AWS account or organization

Skills in:

  • Skill 1.1.1: Analyze workloads to determine monitoring requirements.

  • Skill 1.1.2: Design and implement workload monitoring strategies (for example, by configuring resource health checks).

  • Skill 1.1.3: Aggregate security and monitoring events.

  • Skill 1.1.4: Create metrics, alerts, and dashboards to detect anomalous data and events (for example, Amazon GuardDuty, Amazon Security Lake, AWS Security Hub, Amazon Macie).

  • Skill 1.1.5: Create and manage automations to perform regular assessments and investigations (for example, by deploying AWS Config conformance packs, Security Hub, AWS Systems Manager State Manager).

Task 1.2: Design and implement logging solutions

Skills in:

  • Skill 1.2.1: Identify sources for log ingestion and storage based on requirements.

  • Skill 1.2.2: Configure logging for AWS services and applications (for example, by configuring an AWS CloudTrail trail for an organization, by creating a dedicated Amazon CloudWatch logging account, by configuring the Amazon CloudWatch Logs agent).

  • Skill 1.2.3: Implement log storage and log data lakes (for example, Security Lake) and integrate with third-party security tools.

  • Skill 1.2.4: Use AWS services to analyze logs (for example, CloudWatch Logs Insights, Amazon Athena, Security Hub findings).

  • Skill 1.2.5: Use AWS services to normalize, parse, and correlate logs (for example, Amazon OpenSearch Service, AWS Lambda, Amazon Managed Grafana).

  • Skill 1.2.6: Determine and configure appropriate log sources based on network design, threats, and attacks (for example, VPC Flow Logs, transit gateway flow logs, Amazon Route 53 Resolver logs).

Task 1.3: Troubleshoot security monitoring, logging, and alerting solutions

Skills in:

  • Skill 1.3.1: Analyze the functionality, permissions, and configuration of resources (for example, Lambda function logging, Amazon API Gateway logging, health checks, Amazon CloudFront logging).

  • Skill 1.3.2: Remediate misconfiguration of resources (for example, by troubleshooting CloudWatch Agent configurations, troubleshooting missing logs).