Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cloud computing > Lecture 14: Secuirty and Compliance > Flashcards

Lecture 14: Secuirty and Compliance Flashcards

1
Q

The security of the cloud and protecting the infrastructure that runs all the AWS services and your responsible for everything you do in the cloud

A

AWS responsibility is what?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

It’s when your server is overload with a lot of bots sending request to your server to shut down your service

A

What is a DDOS attack (distributed denial of service)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

____________ protects against DDOS attack for your website and applications, for all customers at no additional costs

A

AWS shield standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

____________ is a 24/7 premium DDOS protection

A

AWS shield advanced

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

_________ filter specific request based on rules

A

AWS WAF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

__________ available protection using global edge network and combined with AWS shriek, provides attack mitigation at the edge

A

Cloudfront and Route 53

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

AWS Auto scaling

A

If your scaling and under a DDOS attack then can use __________

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

_________ is a free service that is activated for every AWS customer and provides protection from attack such as SYN/UDP floods, reflection attacks and other layer 3/ layer 4 attack

A

AWS shield standard (activated by default for every customer)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

_________ optional DDOS mitigation service (3k per month per organization) and it protects against more sophisticated attacks on other AWS services and it has 24/7 access to AWS DDOD response team

A

AWS shield Advanced

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

____________ protects your web applications from common web exploits (layer 7) and layer 7 is HTTP

A

AWS WAF (Web application firewall)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Application load balancer, API gateway, and cloudfront

A

With AWS WAF you can deploy on ___________________

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Web ACL (web access control list) such as :
1. Rules can include IP address, HTTP headers, HTTP body, or URI strings

  1. Protects from common attack-SQL injection and cross site scripting (XSS)
  2. Size constraints, geo-match (block countries)
  3. Rate based rules (to count occurrences of events) for DDOS protection
A

With WAF you can define what?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How would you protect your VPC entirely?

A

Using a AWS network firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

_________ manage security rules in all accounts of an AWS organization

A

AWS Firewall Manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the common set of security rules made with AWS firewall manager?

A
  • VPC Security groups for EC2, applications load balancer, etc
  • WAF rules
  • AWA Shield advance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

new resources

A

With AWS Firewall Manager, rules are applied to __________ as they are created across all and future accounts in your organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

With __________ AWS customers are welcomed to carry out security assessments or ____________ against their AWS infrastructure without prior approval for 8 services

A

Penetration testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Prohibited activities (anything that looks like an attack)

A

With penetration testing you can’t do what _______________

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What does data at rest mean?

A

At rest data is stored or Archie bed on a device (like on a hard disk, etc)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What does data in transit mean?

A

Data being moved from one location to another (transfer from on premises to AWS, EC2, DynamoDB, etc. (the data is transferred on the network)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Encryption keys

A

By using _____________ you can encrypt both data at rest and transit data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Anytime you hear encryption for an AWS service it’s most likely _______

A

KMS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is KMS?

A

AWS manages the encryption keys for you

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

With ________ AWS provisions the hardware security module but you manage the encryption keys yourself

A

CloudHSM (Hardware security module)

25
Q
  1. Customer managed keys
  2. AWS managed key (AWS/ -if you see tht)
  3. AWS owned keys
  4. CloudHSM keys
A

What are the types of KMS keys?

26
Q

__________ let’s you easily provision,manage, and deploy SSL/TLS certificates and is used to provide in flight encryption for websites (HTTPS)

A

AWS certificate manager (ACM)

27
Q

__________ is meant to store secrets and has the capability to force rotation of secrets every X days and has an integration with AMAZON RDS

A

AWS secret Manager

28
Q

________ is a portal that provides customers with on demand access to AWS compliances documentation and AWS agreements and can be used to support internal audit or compliance

A

AWS artifact

29
Q

___________ helps you do intelligent threat discovery to protected your AWS account and it does it my using machine learning algorithms, anomaly detection and 3rd party

A

Amazon GaurdDuty

30
Q
  • CloudTrail event logs
  • VPC flow logs
  • DNS Logs
  • Optional features
A

What are the different input data the Amazon gaurduty looks at?

31
Q

Can also setup _______ with Amazon gaurduty to be notified in case of findings

A

EventBridge rules (can target AWS lambda or SNS)

32
Q

Amazon GuardDuty can protect against _______________ attacks (has a dedicated “finding” for it)

A

CryptoCurrency attacks

33
Q

__________ is a service that allows you to run automated servility assessments

A

Amazon inspector

34
Q
  • Leverges the AWS system manager (SSM) agent
  • Analyze against unintended network accessibility
  • Analyze the running OS against known vulnerabilities
A

With EC2 instance what does Amazon inspector do?

35
Q

Lambda functions and for container images push to Amazon ECR

A

Amazon inspector is also use for what?

36
Q

Only EC2 instances, container images & lambda functions

A

What does Amazon inspector evaluate?

37
Q

________ helps with auditing and recording compliance of your AWS resources and helps record configurations and changes overtime

A

AWS config

38
Q

_________ is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS

A

Amazon Maice

38
Q
A
38
Q
A
39
Q

Macie helps identify and alert you to sensitive information data, such as ______________

A

Personally identifiable information (PII)

40
Q

__________ is a central security tool to manage security across several AWS accounts and automate security checks

A

AWS security Hub

41
Q

_________ analyze, investigates, and quickly identifies the root cause of security issues or suspicious activities (using ML and graphs)

A

Amazon Detective

42
Q

automatically collects and processes events

A

Amazon Detective also _____________ from VPC flow logs, CloudTrail, guarduty, and create a unified view

43
Q

_________ is when you report suspected AWS resources are being used for abusive or illegal purposes

A

AWS abuse

44
Q
  1. Spam
  2. Port scanning
  3. DDOs attacks
  4. Intrusion attempts
  5. Hosting objectionable or copyrighted content
  6. Distributing malware
A

What are some abusive & prohibited behaviors?

45
Q

What is a root user?

A

The account owner (created when the account is created), has complete access to all AWS services)

46
Q

What must you do with your root user account?

A

Lock away your root user access keys

47
Q
  1. Change account settings
  2. Close your AWS account
  3. Change or cancel your AWS support plan
  4. Register as a seller in the reserved instance marketplace
A

What actions can be performed only by the root user?

48
Q

____________ used to find out which resources are shared externally (like S3 buckets, IAM roles, KMS keys, etc)

A

IAM access analyzer

49
Q

With IAM access analyzer, you have to define ____________ which corresponds to your AWS account or organization, and anything outside of it is considered your findings

A

Zone of trust

50
Q

____________ is a security service that uses machine learning to automatically discover, classify, and protect sensitive data in AWS, such as personally identifiable information (PII) or intellectual property.

A

Amazon Macie

51
Q

___________ is your go-to, central resource for compliance-related information that matters to you.

A

AWS Artifact

52
Q

Penetration Testing is allowed without prior approval on ___________. DDoS, port flooding and protocol flooding are examples of prohibited activities.

A

8 services

53
Q

___________ is a service that lets you easily provision, manage, and deploy public and private Secure Sockets Layer/Transport Layer Security (SSL/ TLS) certificates for use with AWS services and your internal connected resources.

A

AWS Certificate Manager

54
Q

infrastructure, OS and applications

A

AWS is responsible for patching and fixing flaws within the __________, but customers are responsible for patching their guest ____________. Shared Controls also includes Configuration Management, and Awareness and Training.

55
Q

___________ is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS. It helps you test the network accessibility of your Amazon EC2 instances and the security state of your applications running on the instances.

A

Amazon Inspector

56
Q

hardware

A

AWS is responsible for protecting __________. AWS is responsible for “Security OF the Cloud”. AWS is also responsible for the infrastructure that runs all services in the AWS Cloud, etc.

57
Q

continuously monitors

A

Amazon GuardDuty is a threat detection service that _____________ for malicious activity and unauthorized behavior to protect your AWS accounts and workloads.

Cloud computing (43 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions