- [Seph] Most application architectures are likely going to be multi-tiered. And when I said that security should be considered for all levels, that included zooming out to the tiers, as well as zooming into the data. And when studying about securing application tiers, you'll want to pay significant attention to the use and functionality of security groups and network ACLs. These will provide a lot of management over traffic-control requirements, and can greatly enable granularity in the rules, restrictions, and allowances that you need. Understand how they work, both together and individually. Also, understand how to build their rules, pitfalls to avoid, rule-processing logic, and methods to employ for better combined functionality. Network segmentation will also be important for you to dive into. Understand the strategies behind when to use public and private subnets, what differentiates a public from a private subnet, and common practices around the use of these subnets. And your subnet focus doesn't end there. You'll also need to understand routing mechanisms within a VPC. Yes, this will involve the implementation, use, and features of the route tables, but this will also require you to know how to appropriately select and deploy other components, such as the AWS service endpoints, VPN connections, and other network connection tools and methods that are commonly used with deployed VPCs. Of course, deployment and use will be important topics, but this domain is about security. How do you build in security to these networking tiers? How do you secure application use across these tiers? And what does management of those security components look like? And consider that it will be difficult to study any of these topics as a standalone subject. Understanding the use of security groups and network ACLs requires understanding the use of public and private subnets. To comprehend the public and private subnets, you need to know about the routing mechanisms and how to utilize them with the subnets. For example, if you needed to allow specific types of traffic to access your application servers, but the traffic was going to be coming from your on-premises location, traversing a VPN, and your application servers were in a private subnet, how would you set that up? What could you do to make sure the application servers were safe from access coming from the public internet, but that there wouldn't be any issues that the VPC, subnet, or instance levels of the requests coming from the on premises, connected via VPN. What may be considered as a simple request requires understanding of everything I've mentioned so far, and the exam items you encounter will require you to have studied the individual components, as well as their interactions. The last topic I want to mention here is selecting appropriate AWS services to protect applications from external threats. Essentially, what services could be used to mitigate and prevent the various types of attacks that might be targeted at your application? What managed options do you have? What controls do the security services provide for the types of traffic that might be allowed? At which point in traffic flow towards your application would the services be placed? What would operate at the edge locations versus within your VPCs? General understandings of these services will be crucial to knowing how they'd be deployed in the scenarios you will encounter on the exam. Well, I think that's enough from me for now. Keep studying about security at every level. And remember that it's all connected. Goodbye for now.