Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Cloud Practitioner (Digital Cloud) > AWS Security > Flashcards

AWS Security Flashcards

1
Q

What are the benefits of AWS Security?

A

Keep Your Data Safe – the AWS infrastructure puts strong safeguards in place to help.

Protect your privacy – All data is stored in highly secure AWS data centers.

Meet Compliance Requirements – AWS manages dozens of compliance programs in its infrastructure. This means that segments of your compliance have already been completed.

Save Money – cut costs by using AWS data centers. Maintain the highest standard of s security without having to manage your own facility.

Scale Quickly – security scales with your AWS Cloud usage. No matter the size of your business, the AWS infrastructure is designed to keep your data safe.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is AWS Cloud Compliance?

A

AWS Cloud Compliance enables you to understand the robust controls in place at AWS to maintain security and data protection in the cloud.

As systems are built on top of AWS Cloud infrastructure, compliance responsibilities will be shared.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are compliance programs are in AWS Security?

A

Compliance programs include:

Certifications / attestations.
Laws, regulations, and privacy.
Alignments / frameworks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is AWS Artifact?

A

AWS Artifact is your go-to, central resource for compliance-related information that matters to you.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What reports are available in AWS Artifact?

A

Reports available in AWS Artifact include:

  • Service Organization Control (SOC) reports
  • Payment Card Industry (PCI) reports
  • Certifications from accreditation bodies across geographies and compliance verticals that validate the implementation and operating effectiveness of AWS security controls.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What agreements are available in AWS Artifact?

A

Agreements available in AWS Artifact include the Business Associate Addendum (BAA) and the Nondisclosure Agreement (NDA).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is Amazon GuardDuty?

A

Amazon GuardDuty offers threat detection and continuous security monitoring for malicious or unauthorized behavior to help you protect your AWS accounts and workloads.

Intelligent threat detection service.

Detects account compromise, instance compromise, malicious reconnaissance, and bucket compromise.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What services can GuardDuty monitor?

A

Continuous monitoring for events across:

AWS CloudTrail Management Events.
AWS CloudTrail S3 Data Events.
Amazon VPC Flow Logs.
DNS Logs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is AWS WAF?

A

AWS WAF is a web application firewall.

Protects against common exploits that could compromise application availability, compromise security, or consume excessive resources.

WAF lets you create rules to filter web traffic based on conditions that include IP addresses, HTTP headers and body, or custom URIs.

WAF makes it easy to create rules that block common web exploits like SQL injection and cross site scripting.

The rules are known as Web ACLs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is AWS Shield?

A

AWS Shield is a managed Distributed Denial of Service (DDoS) protection service.

Safeguards web application running on AWS with always-on detection and automatic inline mitigations.

Helps to minimize application downtime and latency.

Two tiers – Standard and Advanced.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is AWS Key Management Service (AWS KMS)?

A

AWS Key Management Service gives you centralized control over the encryption keys used to protect your data.

You can create, import, rotate, disable, delete, define usage policies for, and audit the use of encryption keys used to encrypt your data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What integrations does KMS have with other services?

A

AWS Key Management Service is integrated with most other AWS services making it easy to encrypt the data you store in these services with encryption keys you control.

AWS KMS is integrated with AWS CloudTrail which provides you the ability to audit who used which keys, on which resources, and when.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What can AWS KMS allow developers to easily do?

A

AWS KMS enables developers to easily encrypt data, whether through 1-click encryption in the AWS Management Console or using the AWS SDK to easily add encryption in their application code.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is AWS CloudHSM?

A

AWS CloudHSM is a cloud-based hardware security module (HSM) that enables you to easily generate and use your own encryption keys on the AWS Cloud.

With CloudHSM, you can manage your own encryption keys using FIPS 140-2 Level 3 validated HSMs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What library integrations does CloudHSM have?

A

CloudHSM offers you the flexibility to integrate with your applications using industry-standard APIs, such as PKCS#11, Java Cryptography Extensions (JCE), and Microsoft CryptoNG (CNG) libraries.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is AWS Certificate Manager?

A

AWS Certificate Manager is a service that lets you easily provision, manage, and deploy public and private Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificates for use with AWS services and your internal connected resources.

17
Q

What is SSL/TLS certificates in AWS Certificate Manager?

A

SSL/TLS certificates are used to secure network communications and establish the identity of websites over the Internet as well as resources on private networks.

18
Q

What time consuming process does AWS Certificate Manager remove?

A

AWS Certificate Manager removes the time-consuming manual process of purchasing, uploading, and renewing SSL/TLS certificates.

19
Q

What is AWS Inspector?

A

Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS.

Inspector automatically assesses applications for vulnerabilities or deviations from best practices.

Uses an agent installed on EC2 instances.

Instances must be tagged.

20
Q

What is AWS Trusted Advisor?

A

Trusted Advisor is an online resource that helps to reduce cost, increase performance, and improve security by optimizing your AWS environment.

Trusted Advisor scans infrastructure and provides real time guidance to help you provision your resources following best practices.

21
Q

What categories does Trusted Advisor compare your infrastructure to?

A

Trusted Advisor scans your AWS infrastructure and compares is to AWS best practices in five categories:

  • Cost Optimization.
  • Performance.
  • Security.
  • Fault Tolerance.
  • Service Limits.
22
Q

What two versions does Trusted Advisor come in?

A

Core Checks and Recommendations (free)

Full Trusted Advisor Benefits (business and enterprise support plans)

23
Q

What is “Core Checks and Recommendations” version in Trusted Advisor?

A

Core Checks and Recommendations (free):

Access to the 7 core checks to help increase security and performance.
Checks include S3 bucket permissions, Security Groups, IAM use, MFA on root account, EBS public snapshots, RDS public snapshots.

24
Q

What is “Full Trusted Advisor Benefits” version in Trusted Advisor?

A

Full Trusted Advisor Benefits (business and enterprise support plans):

Full set of checks to help optimize your entire AWS infrastructure.
Advises on security, performance, cost, fault tolerance and service limits.
Additional benefits include weekly update notifications, alerts, automated actions with CloudWatch and programmatic access using the AWS Support API.

25
Q

What is Penetration Testing?

A

Penetration testing is the practice of testing one’s own application’s security for vulnerabilities by simulating an attack.

26
Q

Which resources does AWS allow penetration testing to be performed?

A 
Amazon EC2 instances, NAT Gateways, and Elastic Load Balancers.
Amazon RDS.
Amazon CloudFront.
Amazon Aurora.
Amazon API Gateways.
AWS Lambda and Lambda Edge functions.
Amazon LightSail resources.
Amazon Elastic Beanstalk environments.
27
Q

What does AWS recommend in case account is compromised?

A

Change your AWS root account password.
Change all IAM user’s passwords.
Delete or rotate all programmatic (API) access keys.
Delete any resources in your account that you did not create.
Respond to any notifications you received from AWS through the AWS Support Center and/or contact AWS Support to open a support case.

28
Q

What is AWS Single Sign-On (AWS SSO)?

A

AWS Single Sign-On is a cloud-based single sign-on (SSO) service that makes it easy to centrally manage SSO access and user permissions to all your AWS accounts and cloud applications.

AWS SSO also helps you manage access and permissions to commonly used third-party software as a service (SaaS) applications, AWS SSO-integrated applications as well as custom applications that support Security Assertion Markup Language (SAML) 2.0.

29
Q

Where can end user find their accessible resources in AWS SSO?

A

AWS SSO includes a user portal where your end-users can find and access all their assigned AWS accounts, cloud applications, and custom applications in one place.

30
Q

What is Amazon Cognito?

A

Amazon Cognito lets you add user sign-up, sign-in, and access control to your web and mobile apps quickly and easily.

Amazon Cognito scales to millions of users and supports sign-in with social identity providers, such as Apple, Facebook, Google, and Amazon, and enterprise identity providers via SAML 2.0 and OpenID Connect.

31
Q

What are the two main components of AWS Cognito?

A

User pools are user directories that provide sign-up and sign-in options for your app users.

Identity pools enable you to grant your users access to other AWS services.

You can use identity pools and user pools separately or together.

32
Q

What directory types does AWS Directory Services offer?

A

Active Directory Service for Microsoft Active Directory
.
Simple AD.

AD Connector.

33
Q

What is AWS Directory Service for Microsoft Active Directory?

A

AWS-managed full Microsoft AD running on Windows Server 2012 R2

Use case: Enterprises that want hosted Microsoft AD or you need LDAP for Linux apps

34
Q

What is AD Connector in AWS Directory Service?

A

Allows on-premises users to log into AWS services with their existing AD credentials. Also allows EC2 instances to join AD domain

Use case: Single sign-on for on-premises employees and for adding EC2 instances to the domain

35
Q

What is Simple AD in AWS Directory Services?

A

Low scale, low cost, AD implementation based on Samba

Use case: Simple user directory, or you need LDAP compatibility

36
Q

What is AWS Systems Manager Parameter Store?

A

Provides secure, hierarchical storage for configuration data management and secrets management.

37
Q

What type of data can you store in Parameter Store?

A

You can store data such as passwords, database strings, and license codes as parameter values.

You can store values as plaintext (unencrypted data) or ciphertext (encrypted data).

You can then reference values by using the unique name that you specified when you created the parameter.

38
Q

AWS Secrets Manager

A

Similar to Parameter Store

Allows native and automatic rotation of keys.

Fine-grained permissions.

Central auditing for secret rotation.

AWS Cloud Practitioner (Digital Cloud) (19 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions