Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS CCP > 14. Security Compliance > Flashcards

14. Security Compliance Flashcards

1
Q

What is the AWS Shared Responsibility Model?

A

A model where AWS is responsible for ‘Security of the Cloud,’ and customers are responsible for ‘Security in the Cloud.’

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

True or False: AWS is responsible for the security of the guest OS on EC2 instances.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is AWS responsible for in the AWS Shared Responsibility Model?

A

Security of the Cloud, including infrastructure, hardware, software, and networking for AWS services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What type of encryption should customers manage for their data in the cloud?

A

Data encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Name a shared control between AWS and customers in the Shared Responsibility Model.

A

Patch Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Who manages encryption for S3 buckets?

A

The customer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which AWS service offers free DDoS protection for all customers?

A

AWS Shield Standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What does AWS Shield Advanced offer beyond AWS Shield Standard?

A

Premium DDoS protection with 24/7 support from AWS DDoS Response Team (DRP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which AWS service provides firewall protection for HTTP layer attacks?

A

AWS WAF (Web Application Firewall)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

True or False: AWS WAF protects applications from Layer 7 attacks.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which AWS service offers rule-based web access control lists (ACLs)?

A

AWS WAF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What does AWS Network Firewall protect?

A

Amazon VPCs from Layer 3 to Layer 7 attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Fill in the blank: AWS Network Firewall can inspect traffic from ______ to ______.

A

VPC to VPC, internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the primary function of AWS Firewall Manager?

A

To manage security rules across all accounts in an AWS Organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the purpose of AWS Security Hub?

A

To centralize security findings from multiple AWS services and accounts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which AWS service integrates with AWS Config for security compliance checks?

A

AWS Security Hub

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Fill in the blank: AWS Security Hub aggregates findings from services like ______, ______, and ______.

A

GuardDuty, Inspector, Macie

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the purpose of AWS GuardDuty?

A

To provide intelligent threat detection using machine learning and anomaly detection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What does Amazon Inspector evaluate?

A

EC2 instances, container images, and Lambda functions for vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

True or False: Amazon Inspector performs continuous vulnerability scanning.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is AWS Macie used for?

A

Discovering and protecting sensitive data such as PII in Amazon S3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Which AWS service allows you to create, manage, and deploy SSL/TLS certificates?

A

AWS Certificate Manager (ACM)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

True or False: AWS Certificate Manager charges for public TLS certificates.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Fill in the blank: CloudTrail is used to track ______ made by users within an AWS account.

A

API calls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is Amazon Detective used for?

A

To analyze and identify the root cause of security issues or suspicious activities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Which service provides compliance documentation access like PCI and ISO reports?

A

AWS Artifact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is an IAM Access Analyzer used for?

A

To find resources that are shared externally from an AWS account

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

True or False: The root user can be used for everyday administrative tasks.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Name one privilege exclusive to the root user in an AWS account.

A

Changing account settings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Which AWS service is primarily for storing sensitive data and secrets?

A

AWS Secrets Manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What AWS service helps track configuration changes over time?

A

AWS Config

32
Q

Which encryption method is automatically enabled for S3 Glacier?

A

AWS-managed encryption with KMS

33
Q

Fill in the blank: ______ helps identify misconfigurations in security groups and other resources.

A

AWS Config

34
Q

True or False: AWS CloudHSM allows AWS to manage the encryption keys.

A

False

35
Q

What is the difference between AWS KMS and CloudHSM?

A

KMS is software-managed by AWS; CloudHSM uses dedicated hardware managed by the customer.

36
Q

What is a common use for AWS KMS?

A

Encryption of data at rest in various AWS services

37
Q

Fill in the blank: In the AWS Shared Responsibility Model, customers are responsible for managing ______.

A

Security in the Cloud

38
Q

Who should configure IAM roles for S3 access?

A

The customer

39
Q

What AWS service should you use to protect web applications from SQL injection?

A

AWS WAF

40
Q

Fill in the blank: To store compliance-related documents like ISO certifications, use ______.

A

AWS Artifact

41
Q

True or False: AWS Shield Standard is included at no additional cost.

A

True

42
Q

Name one activity prohibited during penetration testing on AWS.

A

DDoS attacks

43
Q

Which AWS service enables data encryption for RDS databases?

A

AWS KMS

44
Q

What kind of logs does Amazon GuardDuty analyze?

A

CloudTrail logs, VPC Flow Logs, and DNS logs

45
Q

Fill in the blank: AWS ______ provides managed, secure key storage for encryption.

A

KMS (Key Management Service)

46
Q

Which service is used for real-time data inspection of S3 buckets?

A

Amazon Macie

47
Q

What is Amazon Detective’s primary purpose?

A

To provide in-depth investigation of security issues

48
Q

True or False: AWS Config is a global service.

A

False; AWS Config is a per-region service

49
Q

Fill in the blank: ______ is used to manage security rules across all accounts in an organization.

A

AWS Firewall Manager

50
Q

What AWS service should you use to centrally manage compliance and security alerts?

A

AWS Security Hub

51
Q

What type of data is Amazon Macie designed to detect?

A

Sensitive data such as PII

52
Q

Fill in the blank: ______ helps in protecting applications from DDoS attacks.

A

AWS Shield

53
Q

Which service helps monitor for suspicious activity based on VPC, DNS, and CloudTrail logs?

A

Amazon GuardDuty

54
Q

What is the AWS Abuse team responsible for?

A

Investigating reports of AWS resources used for abusive or illegal purposes

55
Q

Which AWS service evaluates EC2 instances for vulnerabilities?

A

Amazon Inspector

56
Q

Fill in the blank: The AWS root user has full ______ to all AWS services and resources.

A

access

57
Q

Name one security report available in AWS Artifact.

A

PCI DSS compliance report

58
Q

True or False: Only AWS manages encryption keys in CloudHSM.

A

False; customers manage their own keys in CloudHSM.

59
Q

What is AWS Secrets Manager primarily used for?

A

Storing and managing secrets with optional rotation

60
Q

Fill in the blank: AWS KMS allows customers to ______ their encryption keys.

A

manage

61
Q

Name a type of attack AWS Shield Standard helps mitigate.

A

SYN flood attacks

62
Q

Which AWS service allows scanning of container images for vulnerabilities?

A

Amazon Inspector

63
Q

Fill in the blank: Data in motion is also known as data ______.

A

in transit

64
Q

What is the difference between AWS Managed Key and Customer Managed Key?

A

AWS Managed Keys are managed by AWS for customer use; Customer Managed Keys are created and managed by the customer.

65
Q

What is the purpose of a Web ACL in AWS WAF?

A

To control access based on specified rules, protecting from attacks like SQL injection

66
Q

Which AWS service provides tamper-resistant hardware for key storage?

A

AWS CloudHSM

67
Q

True or False: AWS Macie is designed for monitoring access to EC2 instances.

A

False; it’s designed for data discovery and classification in S3.

68
Q

Which service should be enabled to track all API calls in an AWS account?

A

AWS CloudTrail

69
Q

What can AWS Config be used to verify about S3 buckets?

A

Whether any bucket has public access

70
Q

Which encryption service is FIPS 140-2 Level 3 compliant?

A

AWS CloudHSM

71
Q

True or False: Amazon Detective collects events from GuardDuty for analysis.

A

True

72
Q

Fill in the blank: To report spam or abuse, contact the ______ team.

A

AWS Abuse team

73
Q

Which AWS service uses machine learning to discover sensitive data?

A

Amazon Macie

74
Q

What does AWS Firewall Manager automate?

A

The enforcement of security policies across accounts in an AWS Organization

75
Q

Which service helps protect against unauthorized access attempts?

A

AWS GuardDuty

76
Q

Name a prohibited activity for penetration testing in AWS.

A

Simulated DDoS attacks

AWS CCP (19 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions