AWS Security Specialty Readiness
Signature Course No. 504 — A Signature AI Socratic Coaching Course.
No experience needed — your coach starts where you are.
A New Kind of Learning
Socratic coaching, delivered by an agentic AI coach.
Not a course you watch. An AI coach you work with.
The Lighthouse Coach begins by discovering how you think about the subject, teaches what is missing, and gives you realistic practice before asking you to prove that you can use it. You may test out of concepts you already understand, while capstones turn the learning into a practical plan, decision, conversation, or other real-world result.
The curriculum is deliberately authored; the AI delivers it through coaching. It is not an AI randomly generating lessons.
A coach that teaches by asking — not by lecturing
The Lighthouse Coach is an AI Socratic coach built on Cognosco Learning's AWS Security Specialty Readiness course, in the Risk, Safety & Compliance category. It does not play videos at you. It holds a conversation: it asks you a question, listens to your answer, names the misconception it hears, affirms what you got right, and asks the next question — the way a great coach works in the room.
Securing workloads on the AWS platform itself — that phrase is the whole course. The AWS Certified Security – Specialty examination does not test whether you can recite service features; AWS publishes those itself. It tests whether, inside a described estate with described constraints, you choose the control that actually governs the risk — and reject the three controls that sound right, are genuinely AWS services, and would fail on the facts given. If a move cannot be named as an AWS service, an AWS policy element, or an AWS operational practice, it does not govern any exercise in this course.
It starts with identity. In AWS, the perimeter is not a place. It is a set of identity decisions, evaluated millions of times a day — so the course first teaches you to name the principal precisely, read a trust policy before you admire a permissions policy, and run the platform's evaluation order in your head: explicit deny, ceilings, both-sides allows, conditions.
It works in two movements. First, Module 1 — Who and What Connects: Identity, Perimeter, and Detection — work through Concepts 1–9, finishing with The New Workload Security Pack; then, Module 2 — Protect, Prove, Respond: Data, Governance, and the Exam — work through Concepts 10–18, finishing with The Incident-and-Governance Pack.
Both capstones produce real artifacts — a security design and detection pack for Calverra Health System's new patient-facing reminder workload, the course's running case: identity laid role by role, the broadest grants evaluated and rewritten, every traffic path drawn, detection and logging proven with numbers, and the first month of triage designed; and an incident-and-governance pack for the week that estate is tested: the response run in doctrine order, data and keys settled, the delivery path governed, the estate changed once at the right levels, and the evidence file assembled for the auditors. Each capstone also runs on your own ground — a workload and an estate you are actually responsible for.
The honesty standard is part of the course. Readiness is not a guarantee: this course prepares judgment for the examination and does not promise that you will pass — any course that does promise it is selling you something it does not control. No examination item is reproduced here; every scenario was written for this course, close in shape to the examination because that shape is what readiness means. And version-specific claims are fenced: the durable judgment changes slowly, so the perishable detail — current domain weightings, service names at the margin, eligibility and scheduling facts — is collected in the course book's Appendix, to be checked against AWS's own published examination guide before you book your sitting.
The course is self-paced and always on — roughly 30 minutes per concept, about 9 hours in full, taken in as many sittings as you like. You can type your answers, or talk out loud: the Voice Coach speaks its questions and listens to your spoken replies. Learners who already know the material can test out concept by concept.
AWS Security Specialty Readiness is part of The Lighthouse Signature Series — the online counterpart to the one-day, in-person learning Cognosco Learning delivers.
Course Facts
One full concept, coached end to end — free: verify your email and we’ll send you a link to start.
Already enrolled? Enter the course →
Diagnose → Learn & Practice → Prove → Capstone
Every learner moves through the same discipline a Cognosco instructor would insist on in the room.
Diagnose
The Coach starts where the course starts: with your own estate's identity. Say whether you can enumerate every long-lived access key you hold and name the reason each one exists — and where you hesitate; pick the most powerful role you know and say who, exactly, at principal level can assume it, and whether you learned that from its trust policy or from habit; and state your break-glass path if your federation provider were unavailable for a day. Every concept opens with three questions that locate where you actually stand, and your answers shape how deeply the Coach works the concept with you. Everyone begins with Module 1 — no skipping the foundations you only think you have.
Learn & Practice
Work each concept in conversation with the Coach — spoken or written — then practice it against realistic situations until it holds up.
Prove
Every concept ends in proof: answer the check cold and demonstrate the skill. Know it already? Test out and take credit immediately.
Capstone
Finish with two capstones — The New Workload Security Pack for Module 1 and The Incident-and-Governance Pack for Module 2 — that pull the whole course together, and earn the certificate.
What You'll Learn
Read an identity before you trust it; evaluate a policy the way the platform does. Every concept in this course is one of the deciding moves the examination samples, practiced on fresh situations until you can make the move without help and explain why the neighboring moves fail: name the principal, run the evaluation in order, draw the path before you name the control, prove the control rather than assert it.
Module 1 builds the estate's front half. How an AWS Organization should be shaped so identity has somewhere sane to live; how the platform actually evaluates a policy; how workforce federation changes — and does not change — that evaluation; how network controls divide into stateful and stateless, private and inspected; how the edge absorbs what the internet sends; how workloads are hardened so a single flaw does not become a principal; and how detection, logging, and triage turn an estate into a place where things are noticed, recorded, and acted on in the right order.
Module 2 protects, proves, and responds. Encryption governed as an identity problem; data protected where it actually rests, including the copies nobody remembers making; secrets evicted from the places they hide; the delivery pipeline secured as a principal; an incident run inside the estate in doctrine order; forty-two accounts governed as one system; audit evidence produced from services rather than memory; recovery an attacker cannot spend; and, finally, a method for the examination questions themselves.
And it holds its boundary throughout. This is an AWS-platform book, and an examination-shaped one. It does not teach vendor-neutral cloud security theory as if it belonged to every cloud at once — that ground belongs to the vendor-neutral courses on this shelf — and it does not teach general governance program management as if an exam never existed. Where a framework would name a principle, this course names the AWS instrument.
What you will learn
- Design identity in an AWS Organization: accounts, roles, trust policies, and permission boundaries that hold at scale
- Write and evaluate least-privilege policies, predicting the platform's allow-or-deny decision before you deploy
- Federate workforce identity correctly, and separate human access from workload access in every design
- Design the network perimeter on AWS: VPC structure, stateful and stateless controls, private connectivity, and inspection that matches the traffic path
- Protect the edge and the workload: web application firewall rules, distributed denial-of-service layers, instance and container hardening
- Build detection and logging you can prove: organisation-wide detectors, a log architecture with integrity, and triage that spends human attention in the right order
- Govern encryption and data protection: key policies, grants, storage-layer controls, and discovery of data you did not know you held
- Remove secrets and insecure delivery from the estate: managed secrets, pipeline guardrails, and drift detection
- Respond to an incident inside a cloud estate and govern the whole estate afterward: containment, forensics, service control policies, audit evidence, and tested recovery
- Sit the specialty examination with a method: parse the constraint, name the governing domain, eliminate by mechanism, and choose under trade-offs without guessing
Everything in the course
- All 18 concepts of AWS Security Specialty Readiness, in 2 modules
- A starting-point check first — the Coach finds where you actually stand before teaching
- Learn, Practice, Prove for every concept — no passive video watching
- A test-out on every concept: prove you know it and move on
- The Voice Coach: talk with the Coach out loud — it speaks, listens, and replies
- A personal Learner Record of your work across the course
- Two capstone exercises: The New Workload Security Pack and The Incident-and-Governance Pack
- A printable session summary whenever you pause
- The Lighthouse Coach completion certificate (Signature Series)
- Your progress is saved as you go — stop anytime, resume where you left off
Built for the engineers who secure AWS estates
Cloud security engineers and architects working in AWS estates — who hold, or could pass, an associate-level AWS credential and now need the specialty rung: deeper identity, deeper data protection, and examination-shaped judgment; and security operations practitioners whose daily work — findings, logs, incidents — runs on AWS services, and who want that work examined to a standard rather than merely experienced.
Platform and infrastructure engineers — who design VPCs, delivery pipelines, and account structures, and who are accountable for the security consequences of those designs.
Candidates four to ten weeks from a booked sitting — who have already read the documentation and discovered, usually through practice questions, that reading and judging are different skills. This course assumes you can already launch and connect basic AWS workloads, read a JSON policy document without flinching, and tell a security group from a route table; it does not assume specialty depth in any domain — that depth is what it builds.
Prefer to learn live and in person? The same material anchors Cognosco's one-day programs — browse the in-person catalog.
Start with Identity Architecture
$195 — introductory price. One payment. No subscription, no password to manage.
Here is exactly what happens when you enroll:
- Pay securely with Stripe — you are taken straight into the course
- Create your learner profile and begin the Module 1 starting-point check
- Save the access key you are given — it restores your enrollment on any device
- Learn at your pace; your progress is stored in your browser on your device
For the full voice experience, use Chrome and allow the microphone when asked. Typing your answers works everywhere, all the time. Questions before you enroll? Email hello@cognoscolearning.com.
Before you enroll
What is a Socratic coaching session?
A conversation, not a video. Your coach asks a question; you answer — out loud by voice, or by typing — and the coach responds to what you said: naming the misconception it hears, affirming what you got right, and asking the next question. You advance only when you have mastered each concept, so a finished course means the learning held.
How long does it take — and how long do I have?
About 30 minutes per concept. Learn in sittings of any length; your progress is saved as you go. You have a full year from purchase to finish, and you can revisit and retake within that year.
What does the certificate verify?
That you completed every concept and both capstones of this course. Anyone can confirm a Cognosco certificate online — enter its certificate ID on our verification page.
What if it isn't for me — what are the refunds?
If you have not started, cancel for a full refund within seven days of purchase. Once you have started, there is no cash refund — stop before finishing and we credit the full amount you paid toward any other course in the library (credit valid one year from your original purchase). Once you complete the course, no refund or credit applies.
More Signature Courses are coming
AWS Security Specialty Readiness is Signature Course No. 504. Leave your email and we'll send you news of future Signature Courses and Lighthouse updates as they are announced — nothing else.