- [Seph] When considering security at every level, the protection of data is one of the most important areas of focus. Whether the data is in transit or at rest, its security needs to be evaluated. That's actually one of the areas you should be focusing on. What methods are available within AWS to secure your data, both at rest and when in transit? Of course, a lot of that is going to depend on what tools and services you're using, but look into those scenarios. For example, what would data protection look like when using a VPN over the internet; a private connection through AWS Direct Connect; connections between VPCs; transfer between services, such as Amazon Simple Storage Service, and your VPC; and protecting data in transit when reaching end users over the public internet? Also, how do the various data-management and storage services handle data protection? As an example, how would that differ when looking at S3 versus Elastic Block Store, and does the use of those protections change the performance of the services? And when you're thinking about these security topics, it's natural to look at encryption, and then encryption leads you to key management. Both of these areas are important for the exam. For encryption, look at what options you have. How will networking services handle encryption for data in transit, and what options do you have for the various services? For example, what will that encryption look like across the different types of load balancers within AWS, and how would certificates be handled? How do the storage services handle encryption? Does this differ between services like S3, EBS, and the various options within those services? And when considering encryption, how will the keys be handled? Studying this will involve both studying how the services handle keys, how key management services operate, and how a service like S3 will interact with a service like AWS Key Management Service. Consider a scenario where data is being generated on an instance, which is using an EBS volume, and the data needs to be protected, while maintaining durability. Would you want to store the data on encrypted EBS volumes, or transfer the data to an encrypted S3 bucket? Will the use of encryption affect performance? And if so, how? How would you handle the root keys, and will that method differ for your data keys? Are there any managed services that can help you secure, evaluate, and audit the security of your data? Understanding your data security options will require understanding how the services operate their security options, and how the services will interact. The last thing I want to bring to your attention is protecting based on access patterns. Certain services, such as S3, allow you to not only manage security for entire buckets, but also to control based on specific paths or objects. You should be able to know which services provide this level of granularity, read and build policies based on different access patterns and needs, and understand how those policies are evaluated by the service backend. As I said earlier, data security will be extremely important when approaching the exam, as the best solution will often be the most-secure solution. When enabling security at every level, data protection will be crucial to the design and implementation of your solutions on both the exam and in the real world. Prioritize security at every layer, study with security in mind, and evaluate how protection can be added in both original designs, as well as reinforcing existing deployments. That's it from me for now. I'll talk to you later.