Security World 4 · Edge Shields · Stage 4

Hardened Hosts

A short list the exam loves: IMDSv2 and a hop limit, a profile instead of keys, Session Manager instead of port 22, a built image, a scanner, a patch schedule and a runtime signal.

IMDSv2
Instance profiles
Session Manager
EC2 Image Builder
Amazon Inspector
Patch Manager
GuardDuty Runtime Monitoring

Domain: Security
World: Security World 4: Edge Shields (Specialty)
Game type: Solution board: Drop services into each row's slots, then run records through them.
Time: About 35 minutes on a first attempt (estimated)
Exam guides: SAA-C03Task 1.2: Design secure workloads and applications
SOA-C03Skill 4.2.5: Configure reports and remediate findings from AWS services (for example, AWS Security Hub, Amazon GuardDuty, AWS Config, Amazon Inspector, AWS Security Agent)
SCS-C03Skill 3.2.1: Design and implement hardened Amazon EC2 AMIs and container images to secure compute workloads and embed security controls (for example, Systems Manager, EC2 Image Builder); Skill 3.2.2: Apply instance profiles, service roles, and execution roles appropriately to authorize compute workloads; Skill 3.2.3: Scan compute resources for known vulnerabilities (for example, scan container images and Lambda functions by using Amazon Inspector, monitor compute runtimes by using GuardDuty); Skill 3.2.4: Deploy patches across compute resources to maintain secure and compliant environments by automating update processes and by integrating continuous validation (for example, Systems Manager Patch Manager, Amazon Inspector); Skill 3.2.5: Configure secure administrative access to compute resources (for example, Systems Manager Session Manager, EC2 Instance Connect); Skill 3.2.6: Configure security tools to discover and remediate vulnerabilities within a pipeline (for example, Amazon Q Developer, Amazon CodeGuru Security); Skill 3.2.7: Implement protections and guardrails for generative AI applications (for example, by applying GenAI OWASP Top 10 for LLM Applications protections)
AIF-C01Task 5.1: Explain methods to secure AI systems
MLA-C02Skill 4.3.1: Secure continuous integration and continuous delivery (CI/CD) pipelines by checking for code and image vulnerabilities (for example, by using Amazon CodeGuru, Amazon Inspector)