Free Cloud Security Engineer Roadmap
Secure what runs in AWS and Azure. Security+ and the cloud foundations first, then cloud identity, AWS security, DevSecOps and detection in the cloud, with CCSP for the senior step.
8 steps · 34 free videos · 5 free reads
Create your free account to open all 2,396 free items
The 39 free items on this page — and every other free lesson, video and guide — open once you have a free StationX account. No card, no trial.
Before you start
Read these first
The free roadmap
8 steps, in order
The 🔒 rows show what the full roadmap adds at each step. StationX Membership opens every course and its labs: $299 / year ($24.92/mo billed annually). Infrastructure Labs labs are a separate add-on.
Start here →
Step 1 — Security foundation
The baseline every cloud security role lists.
Follow the free CompTIA Security+ (SY0-701) roadmap.
🔒 The full roadmap adds here: 6 full courses · hands-on labs 1–148 of 318 (courses in Membership · 71 labs in Membership · 77 labs in Infrastructure Labs)
- Course · CompTIA Security+ Certification (SY0-701): The Total Course · 🔒 Membership
- Course · Security+ (SY0-701) - Self-paced Course! · 🔒 Membership
- Course · CompTIA Security+ SY0-701: General Security Concepts · 🔒 Membership
- Course · CompTIA Security+: Viruses, Threats and Compromise Indicators · 🔒 Membership
- Course · CompTIA Security+ Labs · 🔒 Membership
- Course · Security+ Just Labs: The Ultimate Hands-On Bootcamp · 🔒 Membership
- Lab 1 of 318 · Additional Scanning Options · 🔒 Membership
- Lab 2 of 318 · Basics of Metasploit · 🔒 Membership
- Lab 3 of 318 · BCP DRP and Test Planning · 🔒 Membership
- Lab 4 of 318 · BitLocker Setup · 🔒 Membership
- Lab 5 of 318 · Block Incoming Traffic on Known Port · 🔒 Membership
- Lab 6 of 318 · Comparing Controls · 🔒 Membership
- Lab 7 of 318 · Creating a List of Installed Programs, Services and User Accounts from a WIN2K12 Server · 🔒 Membership
- Lab 8 of 318 · Creation of BCP and DRP · 🔒 Membership
- Lab 9 of 318 · Data Backup to Prep for Recovery · 🔒 Membership
- Lab 10 of 318 · Event Log · 🔒 Membership
- Lab 11 of 318 · Host Data Integrity Baselining · 🔒 Membership
- Lab 12 of 318 · Installing Patches and Testing Software · 🔒 Membership
- Lab 13 of 318 · MITRE - Attack · 🔒 Membership
- Lab 14 of 318 · MITRE - Defend · 🔒 Membership
- Lab 15 of 318 · Network Discovery · 🔒 Membership
- Lab 16 of 318 · Network Segmentation (FW/DMZ/WAN/LAN) · 🔒 Membership
- Lab 17 of 318 · Network Topology Generation · 🔒 Membership
- Lab 18 of 318 · Open Source Collection · 🔒 Membership
- Lab 19 of 318 · Open Source Password Cracking · 🔒 Membership
- Lab 20 of 318 · Scanning From Windows · 🔒 Membership
- Lab 21 of 318 · Windows Event Log Manipulation via Windows Event Viewer · 🔒 Membership
- Lab 22 of 318 · Wireshark · 🔒 Membership
- Lab 23 of 318 · Manage Users and Groups in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 24 of 318 · Manage Users and Groups in Windows [Guided] · 🔒 Infrastructure Labs
- Lab 25 of 318 · Can You Manage Users and Groups in Windows and Linux? [Advanced] · 🔒 Infrastructure Labs
- Lab 26 of 318 · Configure Password Management in Windows [Guided] · 🔒 Infrastructure Labs
- Lab 27 of 318 · Configure Password Management in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 28 of 318 · Can You Manage Password Requirements in Windows and Linux? [Advanced] · 🔒 Infrastructure Labs
- Lab 29 of 318 · Configure Standard Linux Permissions [Guided] · 🔒 Infrastructure Labs
- Lab 30 of 318 · Configure Standard Windows Permissions [Guided] · 🔒 Infrastructure Labs
- Lab 31 of 318 · Can You Configure Standard Linux and Windows Permissions? [Advanced] · 🔒 Infrastructure Labs
- Lab 32 of 318 · Can You Manage Access in Linux and Windows? [Expert] · 🔒 Infrastructure Labs
- Lab 33 of 318 · Can You Harden the SSH Service on a Linux Server? [Advanced} · 🔒 Infrastructure Labs
- Lab 34 of 318 · Force Users to Change Password Upon First Sign In [Guided] · 🔒 Infrastructure Labs
- Lab 35 of 318 · Remove a User Account [Guided] · 🔒 Infrastructure Labs
- Lab 36 of 318 · Can You Add Server Access for a Group? [Advanced] · 🔒 Infrastructure Labs
- Lab 37 of 318 · Examine Log Files to Block Bad Actors [Guided] · 🔒 Infrastructure Labs
- Lab 38 of 318 · Harden a Server by Limiting Access to a Single Subnet [Guided] · 🔒 Infrastructure Labs
- Lab 39 of 318 · Can You Harden a Server by Restricting Access per Protocol? [Advanced] · 🔒 Infrastructure Labs
- Lab 40 of 318 · Can You Harden a Linux Web Server? [Expert] · 🔒 Infrastructure Labs
- Lab 41 of 318 · Deploy a Private Certificate Authority [Guided] · 🔒 Infrastructure Labs
- Lab 42 of 318 · Configure Custom Certificate Templates and Deployment Options [Guided] · 🔒 Infrastructure Labs
- Lab 43 of 318 · Manually Request a PKI Certificate [Guided] · 🔒 Infrastructure Labs
- Lab 44 of 318 · Can You Deploy a Certificate Authority and Issue Certificates? [Advanced] · 🔒 Infrastructure Labs
- Lab 45 of 318 · Enable DNSSEC [Guided] · 🔒 Infrastructure Labs
- Lab 46 of 318 · Use EFS To Encrypt Files on NTFS Volumes [Guided] · 🔒 Infrastructure Labs
- Lab 47 of 318 · Can You Secure DNS Resource Records and Windows NTFS Volume File Objects? [Advanced] · 🔒 Infrastructure Labs
- Lab 48 of 318 · Enable SSL/TLS on a Website [Guided] · 🔒 Infrastructure Labs
- Lab 49 of 318 · Enable Client SSL/TLS [Guided] · 🔒 Infrastructure Labs
- Lab 50 of 318 · Can You Secure a Website with an SSL/TLS Certificate? [Advanced] · 🔒 Infrastructure Labs
- Lab 51 of 318 · Can You Use PKI to Secure a Network Environment? [Expert] · 🔒 Infrastructure Labs
- Lab 52 of 318 · Cryptography: Attacking Classic Ciphers · 🔒 Membership
- Lab 53 of 318 · Cryptography: Breaking Repeated Key XOR Cipher · 🔒 Membership
- Lab 54 of 318 · Cryptography: Breaking Weak RSA Keys · 🔒 Membership
- Lab 55 of 318 · Cryptography: Decrypting Files With a Dictionary Attack · 🔒 Membership
- Lab 56 of 318 · Cryptography: Forging Digital Signatures · 🔒 Membership
- Lab 57 of 318 · Cryptography: Forging MACs With Side Channels · 🔒 Membership
- Lab 58 of 318 · Cryptography: Hidden Veracrypt Containers · 🔒 Membership
- Lab 59 of 318 · Cryptography: Man In the Middle Attack · 🔒 Membership
- Lab 60 of 318 · Cryptography: Password Cracking · 🔒 Membership
- Lab 61 of 318 · Cryptography: Setting Up HTTPS in Windows and Linux · 🔒 Membership
- Lab 62 of 318 · Cryptography: Setting Up Two Factor Authentication · 🔒 Membership
- Lab 63 of 318 · Cryptography: Steganography · 🔒 Membership
- Lab 64 of 318 · Cryptography: Using GPG for Encryption and Key Management · 🔒 Membership
- Lab 65 of 318 · Cryptography: Using the OpenSSL CLI Tool · 🔒 Membership
- Lab 66 of 318 · Getting Started with Security Concepts in Windows and Linux Environments [Getting Started] · 🔒 Infrastructure Labs
- Lab 67 of 318 · Configure Windows Firewall ACL Rules [Guided] · 🔒 Infrastructure Labs
- Lab 68 of 318 · Configure Linux Firewall ACL Rules [Guided] · 🔒 Infrastructure Labs
- Lab 69 of 318 · Configure Security Settings by Using Microsoft Group Policy [Guided] · 🔒 Infrastructure Labs
- Lab 70 of 318 · Identify Non-secure Network Traffic [Guided] · 🔒 Infrastructure Labs
- Lab 71 of 318 · Can You Secure Host Settings Through Firewall Settings and Group Policy? [Advanced] · 🔒 Infrastructure Labs
- Lab 72 of 318 · Configure IPSec [Guided] · 🔒 Infrastructure Labs
- Lab 73 of 318 · Configure a Windows PPTP VPN [Guided] · 🔒 Infrastructure Labs
- Lab 74 of 318 · Can You Secure Network Access? [Advanced] · 🔒 Infrastructure Labs
- Lab 75 of 318 · Can You Harden Windows Hosts? [Expert] · 🔒 Infrastructure Labs
- Lab 76 of 318 · Back Up and Restore Data in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 77 of 318 · Back Up and Restore Data in Windows [Guided] · 🔒 Infrastructure Labs
- Lab 78 of 318 · Can You Back Up and Restore Data in Windows and Linux? [Advanced] · 🔒 Infrastructure Labs
- Lab 79 of 318 · Configure and Test the Firewall in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 80 of 318 · Configure and Test the Firewall in Windows [Guided] · 🔒 Infrastructure Labs
- Lab 81 of 318 · Can You Configure the Firewall in Linux and Windows? [Advanced] · 🔒 Infrastructure Labs
- Lab 82 of 318 · Configure Patch Management in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 83 of 318 · Configure Update Management in Windows [Guided] · 🔒 Infrastructure Labs
- Lab 84 of 318 · Can You Configure Update Management in Linux and Windows? [Advanced] · 🔒 Infrastructure Labs
- Lab 85 of 318 · Can You Manage Windows and Linux Systems? [Expert] · 🔒 Infrastructure Labs
- Lab 86 of 318 · Applying Filters to TCPDump and Wireshark · 🔒 Membership
- Lab 87 of 318 · DNS as a Remote Shell · 🔒 Membership
- Lab 88 of 318 · Firewall Setup and Configuration · 🔒 Membership
- Lab 89 of 318 · Gap Analysis of Firewall Rules · 🔒 Membership
- Lab 90 of 318 · Implementing Least-Privilege on Windows · 🔒 Membership
- Lab 91 of 318 · Setting Up Zones in a Firewall · 🔒 Membership
- Lab 92 of 318 · Snorby Setup and Operation · 🔒 Membership
- Lab 93 of 318 · TCPDump · 🔒 Membership
- Lab 94 of 318 · Tweaking Firewall Rules for Detection · 🔒 Membership
- Lab 95 of 318 · Using Snort and Wireshark to Analyze Traffic · 🔒 Membership
- Lab 96 of 318 · Getting Started with Cybersecurity Defensive Tools [Getting Started] · 🔒 Infrastructure Labs
- Lab 97 of 318 · Managing Log Files on a Windows Server [Guided] · 🔒 Infrastructure Labs
- Lab 98 of 318 · Configure Windows Defender on a Windows System [Guided] · 🔒 Infrastructure Labs
- Lab 99 of 318 · Configure a Local Security Policy on Server 2016 [Guided] · 🔒 Infrastructure Labs
- Lab 100 of 318 · Can You Use the Sysinternals Suite to Review Permissions on a Windows System? [Advanced] · 🔒 Infrastructure Labs
- Lab 101 of 318 · Using Encryption to Secure Information [Guided] · 🔒 Infrastructure Labs
- Lab 102 of 318 · Can You Configure Drive Encryption by Using LUKS and BitLocker? [Advanced] · 🔒 Infrastructure Labs
- Lab 103 of 318 · Can You Configure Remote Administration by Using PuTTY and SSH? [Expert] · 🔒 Infrastructure Labs
- Lab 104 of 318 · Use a Password Cracking Utility in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 105 of 318 · Can You Use PowerShell to Gather Computer Information in Windows? [Advanced] · 🔒 Infrastructure Labs
- Lab 106 of 318 · Escalate Privileges in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 107 of 318 · Can You Enumerate Network Services by Using Port Scanning in Linux? [Advanced] · 🔒 Infrastructure Labs
- Lab 108 of 318 · Auditing Service Accounts and Setting Up Automated Log Collection · 🔒 Membership
- Lab 109 of 318 · Centralized Monitoring · 🔒 Membership
- Lab 110 of 318 · CIRP Creation and Disaster · 🔒 Membership
- Lab 111 of 318 · Creation of Standard Operating Procedures for Recovery · 🔒 Membership
- Lab 112 of 318 · Data Downloads and Validation · 🔒 Membership
- Lab 113 of 318 · Force Point: DLP Email Overview · 🔒 Membership
- Lab 114 of 318 · Force Point: DLP Network Overview · 🔒 Membership
- Lab 115 of 318 · Identifying Key Assets · 🔒 Membership
- Lab 116 of 318 · Leveraging Internal Intelligence Resources · 🔒 Membership
- Lab 117 of 318 · Log Correlation & Analysis to Identify Potential IOC · 🔒 Membership
- Lab 118 of 318 · Monitoring and Verifying Management Systems · 🔒 Membership
- Lab 119 of 318 · Open and Close Ports on Windows 7 · 🔒 Membership
- Lab 120 of 318 · Phishing · 🔒 Membership
- Lab 121 of 318 · Post Incident Service Restoration · 🔒 Membership
- Lab 122 of 318 · Ransomware · 🔒 Membership
- Lab 123 of 318 · Recover from SQL Injection Attack · 🔒 Membership
- Lab 124 of 318 · Sensitive Information Identification · 🔒 Membership
- Lab 125 of 318 · Vulnerability Identification and Remediation · 🔒 Membership
- Lab 126 of 318 · Use Git to Manage Code [Guided] · 🔒 Infrastructure Labs
- Lab 127 of 318 · Analyze Log Files for Malicious Activity [Guided] · 🔒 Infrastructure Labs
- Lab 128 of 318 · Identify and Manage Old Software [Guided] · 🔒 Infrastructure Labs
- Lab 129 of 318 · Deploy a Docker Container [Guided] · 🔒 Infrastructure Labs
- Lab 130 of 318 · Deploy a Virtual Machine [Guided] · 🔒 Infrastructure Labs
- Lab 131 of 318 · Configure a Jump Box [Guided] · 🔒 Infrastructure Labs
- Lab 132 of 318 · Manage File Redundancy for Resilience and Recovery [Guided] · 🔒 Infrastructure Labs
- Lab 133 of 318 · Manage System Restore Using Windows 11 [Guided] · 🔒 Infrastructure Labs
- Lab 134 of 318 · Use Alerting and Monitoring Tools [Guided] · 🔒 Infrastructure Labs
- Lab 135 of 318 · Digitally Sign Code To Verify Authenticity [Guided] · 🔒 Infrastructure Labs
- Lab 136 of 318 · Configure a Wireless Access Point [Guided] · 🔒 Infrastructure Labs
- Lab 137 of 318 · Sanitize Storage Disks [Guided] · 🔒 Infrastructure Labs
- Lab 138 of 318 · Enhance Security by Using SELinux [Guided] · 🔒 Infrastructure Labs
- Lab 139 of 318 · Manage Configurations by Using Ansible [Guided] · 🔒 Infrastructure Labs
- Lab 140 of 318 · Configure Devices by Using Ansible [Guided] · 🔒 Infrastructure Labs
- Lab 141 of 318 · Perform Security Audits on Linux Services [Guided] · 🔒 Infrastructure Labs
- Lab 142 of 318 · Baseline Systems in Accordance with Policy Documentation · 🔒 Membership
- Lab 143 of 318 · Conduct Baseline Comparison for Indicators of Compromise · 🔒 Membership
- Lab 144 of 318 · Creating a Baseline Using Autopsy · 🔒 Membership
- Lab 145 of 318 · Creating a Secondary Baseline and Conducting Comparison · 🔒 Membership
- Lab 146 of 318 · Manually Creating a Baseline with MD5Deep · 🔒 Membership
- Lab 147 of 318 · Recovering Data and Data Integrity Checks · 🔒 Membership
- Lab 148 of 318 · Windows Deployment Services · 🔒 Membership
Try a free cloud security lab: Left open (~4 min) → A scripted simulation in your browser. No account needed.
Step 2 — AWS foundations
The AWS platform, its services and its shared-responsibility model.
This step is the AWS Certified Cloud Practitioner (CLF-C02) roadmap.
🔒 The full roadmap adds here: 2 full courses · hands-on labs 149–185 of 318 (courses in Membership · 37 labs in Infrastructure Labs)
- Course · AWS Certified Cloud Practitioner - Essentials Course · 🔒 Membership
- Course · AWS Cloud Practitioner Labs · 🔒 Membership
- Lab 149 of 318 · Monitor Activity by Using the AWS Audit Manager [Guided] · 🔒 Infrastructure Labs
- Lab 150 of 318 · Monitor AWS access by using IAM tools [Guided] · 🔒 Infrastructure Labs
- Lab 151 of 318 · Filter Traffic by Using AWS Web Application Firewall (WAF) [Guided] · 🔒 Infrastructure Labs
- Lab 152 of 318 · Implement Best Practices by Using the AWS Trusted Advisor [Guided] · 🔒 Infrastructure Labs
- Lab 153 of 318 · Create Resources by Using the Console, CLI and Cloud Formation [Guided] · 🔒 Infrastructure Labs
- Lab 154 of 318 · Implement Microservices by Using AWS Containers [Guided] · 🔒 Infrastructure Labs
- Lab 155 of 318 · Implement a CloudFront distribution for a Load Balanced Web Site [Guided] · 🔒 Infrastructure Labs
- Lab 156 of 318 · Implement AWS Analytics Services by Using Amazon Athena [Guided] · 🔒 Infrastructure Labs
- Lab 157 of 318 · Create a Message Queue by Using Amazon Simple Queue Service (SQS) [Guided] · 🔒 Infrastructure Labs
- Lab 158 of 318 · Using AWS Cloud9 [Guided] · 🔒 Infrastructure Labs
- Lab 159 of 318 · Implement Cost Management by Using the AWS Pricing Calculator [Guided] · 🔒 Infrastructure Labs
- Lab 160 of 318 · Getting Started with AWS Tech Essentials [Getting Started] · 🔒 Infrastructure Labs
- Lab 161 of 318 · Build a Network by Using the VPC Wizard [Guided] · 🔒 Infrastructure Labs
- Lab 162 of 318 · Build VPC Resources Manually [Guided] · 🔒 Infrastructure Labs
- Lab 163 of 318 · Can You Build a Network Foundation in AWS? [Advanced] · 🔒 Infrastructure Labs
- Lab 164 of 318 · Configure an S3 Bucket and Website [Guided] · 🔒 Infrastructure Labs
- Lab 165 of 318 · Configure Data Transfer and Storage Options for an S3 Bucket [Guided] · 🔒 Infrastructure Labs
- Lab 166 of 318 · Can You Build a Website by Using an Amazon S3 Bucket? [Advanced] · 🔒 Infrastructure Labs
- Lab 167 of 318 · Connect to an EC2 Instance by Using RDP [Guided] · 🔒 Infrastructure Labs
- Lab 168 of 318 · Configure Storage by Using EBS [Guided] · 🔒 Infrastructure Labs
- Lab 169 of 318 · Create a Custom AMI by Using an Existing EC2 Instance [Guided] · 🔒 Infrastructure Labs
- Lab 170 of 318 · Create a Launch Template [Guided] · 🔒 Infrastructure Labs
- Lab 171 of 318 · Can You Implement a Repeatable Compute Layer by Using EC2? [Advanced] · 🔒 Infrastructure Labs
- Lab 172 of 318 · Can You Deploy an End-to-End Solution in AWS? [Expert] · 🔒 Infrastructure Labs
- Lab 173 of 318 · Getting Started with AWS Secure Architecture Configuration [Getting Started] · 🔒 Infrastructure Labs
- Lab 174 of 318 · Implement Security by Using an IAM Role [Guided] · 🔒 Infrastructure Labs
- Lab 175 of 318 · Implement Security by Using Security Groups [Guided] · 🔒 Infrastructure Labs
- Lab 176 of 318 · Enable Network Security in AWS [Guided] · 🔒 Infrastructure Labs
- Lab 177 of 318 · Can You Implement a Multi-Layer Security Model? [Advanced] · 🔒 Infrastructure Labs
- Lab 178 of 318 · Configure a Relational Database by Using Amazon RDS [Guided] · 🔒 Infrastructure Labs
- Lab 179 of 318 · Configure a NoSQL Database by Using Amazon DynamoDB [Guided] · 🔒 Infrastructure Labs
- Lab 180 of 318 · Can You Design a Database Solution? [Advanced] · 🔒 Infrastructure Labs
- Lab 181 of 318 · Configure High Availability by Using an Elastic Load Balancer [Guided] · 🔒 Infrastructure Labs
- Lab 182 of 318 · Create a Scalable Website That Uses an Elastic Load Balancer [Guided] · 🔒 Infrastructure Labs
- Lab 183 of 318 · Monitor Applications by Using CloudWatch [Guided] · 🔒 Infrastructure Labs
- Lab 184 of 318 · Can You Design an Elastic, Highly Available Architecture in AWS? [Advanced] · 🔒 Infrastructure Labs
- Lab 185 of 318 · Can You Implement an End-to-End Solution in AWS? [Expert] · 🔒 Infrastructure Labs
Step 3 — Azure foundations
The Azure platform and how Microsoft's cloud is organised.
This step is the Microsoft Azure Fundamentals (AZ-900) roadmap.
🔒 The full roadmap adds here: 1 full course · hands-on labs 186–208 of 318 (course in Membership · 23 labs in Infrastructure Labs)
- Course · AZ-900: Microsoft Azure Fundamentals Certification · 🔒 Membership
- Lab 186 of 318 · Manage Azure Resource Deployment by Using an Azure Resource Manager Template [Guided] · 🔒 Infrastructure Labs
- Lab 187 of 318 · Manage Azure Resource Groups [Guided] · 🔒 Infrastructure Labs
- Lab 188 of 318 · Run Commands by Using Azure Cloud Shell [Guided] · 🔒 Infrastructure Labs
- Lab 189 of 318 · Create an Azure Function App [Guided] · 🔒 Infrastructure Labs
- Lab 190 of 318 · Create an Azure Logic App [Guided] · 🔒 Infrastructure Labs
- Lab 191 of 318 · Configure an Azure Distributed Denial of Service Protection Plan [Guided] · 🔒 Infrastructure Labs
- Lab 192 of 318 · Manage Encryption by Using an Azure Key Vault [Guided] · 🔒 Infrastructure Labs
- Lab 193 of 318 · Configure Azure Role-Based Access Control [Guided] · 🔒 Infrastructure Labs
- Lab 194 of 318 · Configure an Azure Lock [Guided] · 🔒 Infrastructure Labs
- Lab 195 of 318 · Configure Monitoring by Using Azure Monitor [Guided] · 🔒 Infrastructure Labs
- Lab 196 of 318 · Deploy an Azure Virtual Machine [Guided] · 🔒 Infrastructure Labs
- Lab 197 of 318 · View Azure Service Health Options [Guided] · 🔒 Infrastructure Labs
- Lab 198 of 318 · Manage Microsoft Entra Users and Groups [Guided] · 🔒 Infrastructure Labs
- Lab 199 of 318 · Implement a Network Security Group [Guided] · 🔒 Infrastructure Labs
- Lab 200 of 318 · Azure Cost Management [Guided] · 🔒 Infrastructure Labs
- Lab 201 of 318 · Configure Blob Storage with Public Access [Guided] · 🔒 Infrastructure Labs
- Lab 202 of 318 · Configure Blob Storage with Private Access [Guided] · 🔒 Infrastructure Labs
- Lab 203 of 318 · Can You Provision Public and Private Blob Storage for a Web App? [Advanced] · 🔒 Infrastructure Labs
- Lab 204 of 318 · Can You Provision Data Storage for a Web App? [Expert] · 🔒 Infrastructure Labs
- Lab 205 of 318 · Implement and Manage Azure Storage [Guided] · 🔒 Infrastructure Labs
- Lab 206 of 318 · Manage Access to Azure Storage [Guided] · 🔒 Infrastructure Labs
- Lab 207 of 318 · Monitor Azure Storage [Guided] · 🔒 Infrastructure Labs
- Lab 208 of 318 · Can You Implement, Manage, and Monitor Azure Storage? [Advanced] · 🔒 Infrastructure Labs
Step 4 — Identity is the perimeter
Run identity and access in the cloud with Microsoft Entra ID — the control most breaches go through.
Follow the free Microsoft Identity and Access Administrator (SC-300) roadmap.
🔒 The full roadmap adds here: 1 full course · hands-on labs 209–233 of 318 (course in Membership · 25 labs in Infrastructure Labs)
- Course · SC-300 : Microsoft Identity and Access Administrator · 🔒 Membership
- Lab 209 of 318 · Manage Users, Groups, and Administrative Units in Microsoft Entra ID [Guided] · 🔒 Infrastructure Labs
- Lab 210 of 318 · Can You Manage Users, Groups, and Administrative Units in Microsoft Entra ID? [Advanced] · 🔒 Infrastructure Labs
- Lab 211 of 318 · Configure Roles and Tenant Wide Settings in Microsoft Entra ID [Guided] · 🔒 Infrastructure Labs
- Lab 212 of 318 · Can You Configure Roles and Tenant-Wide Settings in Microsoft Entra ID? [Advanced] · 🔒 Infrastructure Labs
- Lab 213 of 318 · Can You Configure Device Registrations and Manage External Users in Microsoft Entra ID? [Advanced] · 🔒 Infrastructure Labs
- Lab 214 of 318 · Implement and Manage Hybrid Identities and Synchronization in Microsoft Entra ID [Guided] · 🔒 Infrastructure Labs
- Lab 215 of 318 · Can You Implement and Manage Hybrid Identities and Synchronization in Microsoft Entra ID? [Advanced] · 🔒 Infrastructure Labs
- Lab 216 of 318 · Configure Multi-factor Authentication in Microsoft Entra ID [Guided] · 🔒 Infrastructure Labs
- Lab 217 of 318 · Configure Self-Service Password Reset in Microsoft Entra ID [Guided] · 🔒 Infrastructure Labs
- Lab 218 of 318 · Can You Configure Multifactor Authentication and Self-service in Microsoft Entra ID? [Advanced] · 🔒 Infrastructure Labs
- Lab 219 of 318 · Can You Implement Conditional Access Policies in Microsoft Entra ID? [Advanced] · 🔒 Infrastructure Labs
- Lab 220 of 318 · Can You Manage Identity Protection in Microsoft Entra ID? [Advanced] · 🔒 Infrastructure Labs
- Lab 221 of 318 · Can You Implement Entitlement Management by Using Microsoft Entra ID? [Advanced] · 🔒 Infrastructure Labs
- Lab 222 of 318 · Can You Configure Access Reviews in Microsoft Entra ID? [Advanced] · 🔒 Infrastructure Labs
- Lab 223 of 318 · Configure Access Reviews in Microsoft Entra ID [Guided] · 🔒 Infrastructure Labs
- Lab 224 of 318 · Manage Privileged Access in Microsoft Entra ID [Guided] · 🔒 Infrastructure Labs
- Lab 225 of 318 · Can You Manage Privileged Access in Microsoft Entra ID? [Advanced] · 🔒 Infrastructure Labs
- Lab 226 of 318 · Can You Monitor Microsoft Entra ID?[Advanced] · 🔒 Infrastructure Labs
- Lab 227 of 318 · Implement Integration Between Active Directory Domain Services and Microsoft Entra ID [Guided] · 🔒 Infrastructure Labs
- Lab 228 of 318 · Create and Configure Enterprise Applications in Microsoft Entra ID [Guided] · 🔒 Infrastructure Labs
- Lab 229 of 318 · Can You Create and Configure Enterprise Applications in Microsoft Entra ID? [Advanced] · 🔒 Infrastructure Labs
- Lab 230 of 318 · Configure Application Registrations in Microsoft Entra ID [Guided] · 🔒 Infrastructure Labs
- Lab 231 of 318 · Can You Configure Application Registrations in Microsoft Entra ID? [Advanced] · 🔒 Infrastructure Labs
- Lab 232 of 318 · Can You Implement Access and Single Sign-On for Applications by Using Microsoft Entra ID? [Advanced] · 🔒 Infrastructure Labs
- Lab 233 of 318 · Microsoft Defender for Cloud Apps [Guided] · 🔒 Infrastructure Labs
Step 5 — Secure AWS
AWS's own security services, hands on.
This step is the AWS Certified Security — Specialty roadmap.
🔒 The full roadmap adds here: hands-on labs 234–268 of 318 (Infrastructure Labs)
- Lab 234 of 318 · Configure Secure Identities by Using AWS Services [Guided] · 🔒 Infrastructure Labs
- Lab 235 of 318 · Respond to Compromised AWS Resources [Guided] · 🔒 Infrastructure Labs
- Lab 236 of 318 · Use CloudWatch Alarms to Generate Alerts [Guided] · 🔒 Infrastructure Labs
- Lab 237 of 318 · Configure Logging for an EC2 Website [Guided] · 🔒 Infrastructure Labs
- Lab 238 of 318 · Detect AWS Threats and Automate Remediation [Guided] · 🔒 Infrastructure Labs
- Lab 239 of 318 · Configure AWS Network Security for EC2 Resources [Guided] · 🔒 Infrastructure Labs
- Lab 240 of 318 · Protect AWS Network Resources by Using WAF [Guided] · 🔒 Infrastructure Labs
- Lab 241 of 318 · Configure a Secure Custom AMI [Guided] · 🔒 Infrastructure Labs
- Lab 242 of 318 · Can You Deploy Secure AWS EC2 Resources? [Advanced] · 🔒 Infrastructure Labs
- Lab 243 of 318 · Implement AWS Credentials and Policies by Using IAM [Guided] · 🔒 Infrastructure Labs
- Lab 244 of 318 · Secure Remote Administration for EC2 Instances [Guided] · 🔒 Infrastructure Labs
- Lab 245 of 318 · Implement Encryption and Manage the Lifecycle of Data at Rest [Guided] · 🔒 Infrastructure Labs
- Lab 246 of 318 · Can You Provide Secure Access to AWS Data and Resources [Advanced] · 🔒 Infrastructure Labs
- Lab 247 of 318 · Can You Configure a Secure AWS Environment [Expert] · 🔒 Infrastructure Labs
- Lab 248 of 318 · Configure Security for an IAM User [Guided] · 🔒 Infrastructure Labs
- Lab 249 of 318 · Implement an IAM Policy [Guided] · 🔒 Infrastructure Labs
- Lab 250 of 318 · Implement a Security Monitoring Process [Guided] · 🔒 Infrastructure Labs
- Lab 251 of 318 · Implement Encryption at Rest [Guided] · 🔒 Infrastructure Labs
- Lab 252 of 318 · Implement Protection for Data and Infrastructure [Guided] · 🔒 Infrastructure Labs
- Lab 253 of 318 · Deploy an AWS Lambda Function [Advanced] · 🔒 Infrastructure Labs
- Lab 254 of 318 · Create an Amazon DynamoDB Table [Advanced] · 🔒 Infrastructure Labs
- Lab 255 of 318 · Access a DynamoDB Table Securely from an AWS Lambda Function [Advanced] · 🔒 Infrastructure Labs
- Lab 256 of 318 · Create a Secure API Endpoint for a Lambda Function by Using Amazon API Gateway [Advanced] · 🔒 Infrastructure Labs
- Lab 257 of 318 · Add a PUT Method to an Amazon API Gateway [Advanced] · 🔒 Infrastructure Labs
- Lab 258 of 318 · Create a Production Deployment Environment in Amazon API Gateway [Advanced] · 🔒 Infrastructure Labs
- Lab 259 of 318 · Secure Amazon API Gateway REST Methods by Using an Amazon Cognito User Pool [Advanced] · 🔒 Infrastructure Labs
- Lab 260 of 318 · Can You Create a Secure Serverless REST API in AWS? [Expert] · 🔒 Infrastructure Labs
- Lab 261 of 318 · Provision and Maintain AWS Resources by Using CloudFormation [Guided] · 🔒 Infrastructure Labs
- Lab 262 of 318 · Migrate a Load Balanced Application by Using a Blue/Green and Canary Deployment Strategy [Guided] · 🔒 Infrastructure Labs
- Lab 263 of 318 · Execute Commands and Automation Documents by Using the AWS Systems Manager Service [Guided] · 🔒 Infrastructure Labs
- Lab 264 of 318 · Configure Maintenance Windows by Using AWS Systems Manager [Guided] · 🔒 Infrastructure Labs
- Lab 265 of 318 · Configure AWS Systems Manager Patch Manager [Guided] · 🔒 Infrastructure Labs
- Lab 266 of 318 · Configure an Amazon EventBridge Rule That Sends an Automated Email by Using the Simple Notification Service [Guided] · 🔒 Infrastructure Labs
- Lab 267 of 318 · Can You Automate Processes by Using AWS Services? [Advanced] · 🔒 Infrastructure Labs
- Lab 268 of 318 · Evaluate AWS Config Rules [Guided] · 🔒 Infrastructure Labs
Step 6 — Containers, IaC and the pipeline
Docker, Terraform and CI/CD with security built in — where cloud security work increasingly lives. The labs are the two OWASP failures a pipeline exists to prevent: software supply chain, and software or data integrity.
🔒 The full roadmap adds here: 1 full course · hands-on labs 269–270 of 318 (Membership)
- Course · Ultimate DevSecOps Course - With Real Life Scenarios · 🔒 Membership
- Lab 269 of 318 · OWASP Top Ten 2025 - A03 Software Supply Chain Failures · 🔒 Membership
- Lab 270 of 318 · OWASP Top Ten 2025 - A08 Software or Data Integrity Failures · 🔒 Membership
Step 7 — Detect and respond in the cloud
Monitoring, logging and remediation in AWS: CloudTrail, Config rules and automated fixes.
🔒 The full roadmap adds here: hands-on labs 271–282 of 318 (Infrastructure Labs)
- Lab 271 of 318 · Manage AWS Logs by Using CloudTrail [Guided] · 🔒 Infrastructure Labs
- Lab 272 of 318 · Collect Metrics and Logs by Using the CloudWatch Agent [Guided] · 🔒 Infrastructure Labs
- Lab 273 of 318 · Create a CloudWatch Alarm [Guided] · 🔒 Infrastructure Labs
- Lab 274 of 318 · Create Metric Filters [Guided] · 🔒 Infrastructure Labs
- Lab 275 of 318 · Create a CloudWatch Dashboard [Guided] · 🔒 Infrastructure Labs
- Lab 276 of 318 · Configure an SNS Notification for a CloudWatch Alarm [Guided] · 🔒 Infrastructure Labs
- Lab 277 of 318 · Can You Implement Metrics, Alarms, and Filters? [Advanced] · 🔒 Infrastructure Labs
- Lab 278 of 318 · Troubleshoot an EC2 Instance by Using a CloudWatch Alarm [Guided] · 🔒 Infrastructure Labs
- Lab 279 of 318 · Configure an Amazon EventBridge Rule That Triggers an Action [Guided] · 🔒 Infrastructure Labs
- Lab 280 of 318 · Perform Automatic Remediation by Using an AWS Config Rule [Guided] · 🔒 Infrastructure Labs
- Lab 281 of 318 · Can You Remediate Issues by Using Monitoring and Availability Metrics? [Advanced] · 🔒 Infrastructure Labs
- Lab 282 of 318 · Can You Configure a Resilient Website That Uses Monitoring and Automatic Remediation? [Expert] · 🔒 Infrastructure Labs
Step 8 — Secure cloud workloads, certified
Cloud security architecture, data and application security — the vendor-neutral senior certification.
Follow the free CCSP — Certified Cloud Security Professional roadmap.
🔒 The full roadmap adds here: 6 full courses · hands-on labs 283–318 of 318 (courses in Membership · 36 labs in Infrastructure Labs)
- Course · Certified Cloud Security Professional - CCSP · 🔒 Membership
- Course · Introduction to Cloud Security with Microsoft Azure · 🔒 Membership
- Course · Business Continuity and Disaster Recovery Planning · 🔒 Membership
- Course · Generative AI Risks & Cybersecurity: LLM Security · 🔒 Membership
- Course · GRC Fundamentals - Learn Governance, Risk, and Compliance · 🔒 Membership
- Course · EU GDPR Foundations Course · 🔒 Membership
- Lab 283 of 318 · Configure Authentication for an Azure Web App [Guided] · 🔒 Infrastructure Labs
- Lab 284 of 318 · Configure Virtual Network Connectivity by Using Peering [Guided] · 🔒 Infrastructure Labs
- Lab 285 of 318 · Configure an Application Security Group [Guided] · 🔒 Infrastructure Labs
- Lab 286 of 318 · Can You Configure Network Security to Allow Application Traffic? [Advanced] · 🔒 Infrastructure Labs
- Lab 287 of 318 · Configure Azure Disk Encryption [Guided] · 🔒 Infrastructure Labs
- Lab 288 of 318 · Can You Harden Virtual Machines in Azure? [Advanced] · 🔒 Infrastructure Labs
- Lab 289 of 318 · Configure Security by Using the Azure Kubernetes Service [Guided] · 🔒 Infrastructure Labs
- Lab 290 of 318 · Create Azure Resource Locks on a Web App [Guided] · 🔒 Infrastructure Labs
- Lab 291 of 318 · Can You Configure Multi-Scope Network Security? [Advanced] · 🔒 Infrastructure Labs
- Lab 292 of 318 · Can You Configure Multi-Scope Resource Permissions? [Expert] · 🔒 Infrastructure Labs
- Lab 293 of 318 · Configure a Network Security Group in a Virtual Network [Guided] · 🔒 Infrastructure Labs
- Lab 294 of 318 · Configure Route Tables in a Virtual Network [Guided] · 🔒 Infrastructure Labs
- Lab 295 of 318 · Configure Global Virtual Network Peering [Guided] · 🔒 Infrastructure Labs
- Lab 296 of 318 · Can You Implement a Secure Azure Virtual Machine Network? [Advanced] · 🔒 Infrastructure Labs
- Lab 297 of 318 · Configure a Virtual Network Service Endpoint [Guided] · 🔒 Infrastructure Labs
- Lab 298 of 318 · Implement Security for an Azure Web App [Guided] · 🔒 Infrastructure Labs
- Lab 299 of 318 · Can You Implement Security for an Azure Web App? [Advanced] · 🔒 Infrastructure Labs
- Lab 300 of 318 · Create an API Management Instance [Guided] · 🔒 Infrastructure Labs
- Lab 301 of 318 · Can You Configure an API Management Solution? [Advanced] · 🔒 Infrastructure Labs
- Lab 302 of 318 · Can You Create a Secure Web App? [Expert] · 🔒 Infrastructure Labs
- Lab 303 of 318 · Log Virtual Machine Network Traffic by Using Network Watcher [Guided] · 🔒 Infrastructure Labs
- Lab 304 of 318 · Monitor Communication Between Virtual Machines by Using Network Watcher [Guided] · 🔒 Infrastructure Labs
- Lab 305 of 318 · Implement an Azure Function App [Guided] · 🔒 Infrastructure Labs
- Lab 306 of 318 · Configure Application Insights and App Service Logs for a Web App [Guided] · 🔒 Infrastructure Labs
- Lab 307 of 318 · Configure Security Recommendations for an Azure Virtual Machine [Guided] · 🔒 Infrastructure Labs
- Lab 308 of 318 · Can You Enable Secure Virtual Machines and Application Services? [Advanced] · 🔒 Infrastructure Labs
- Lab 309 of 318 · Enable Database Auditing for an Azure SQL Database [Guided] · 🔒 Infrastructure Labs
- Lab 310 of 318 · Enable Microsoft Defender for SQL in an Azure SQL Database [Guided] · 🔒 Infrastructure Labs
- Lab 311 of 318 · Can You Enable Security for an Azure SQL Database? [Advanced] · 🔒 Infrastructure Labs
- Lab 312 of 318 · Manage Shared Access Signature Keys [Guided] · 🔒 Infrastructure Labs
- Lab 313 of 318 · Configure Security for an Azure Cosmos DB Account [Guided] · 🔒 Infrastructure Labs
- Lab 314 of 318 · Can You Implement Security for an Azure Cosmos DB Account and a Storage Account? [Advanced] · 🔒 Infrastructure Labs
- Lab 315 of 318 · Can You Manage Security for Virtual Machines and Databases? [Expert] · 🔒 Infrastructure Labs
- Lab 316 of 318 · Configure Azure Policy to Improve Cloud Security [Guided] · 🔒 Infrastructure Labs
- Lab 317 of 318 · Can You Manage Azure Security and Compliance? [Advanced] · 🔒 Infrastructure Labs
- Lab 318 of 318 · Governance and Compliance Evidence Collection [Guided] · 🔒 Infrastructure Labs
Do it hands-on
The full Cloud Security Engineer roadmap
The same steps with every course and the hands-on labs, and your progress tracked.
The full roadmap with labs →What Membership includes · Full refund within 30 days if you haven't started a lab · cancel anytimeAdvanced
AI-Driven Security Engineering
Become the Cyber Security Expert the AI Era Needs.
StationX’s AI Master’s teaches you to create and deploy security solutions by directing AI. “No coding background required. You direct the AI; the AI does the building.”
Explore the AI Master’s →Create your free account to open all 2,396 free items
The 39 free items on this page — and every other free lesson, video and guide — open once you have a free StationX account. No card, no trial.