AWS Security and Compliance Flashcards
1
Q
AWS Security and Compliance shared responsibility
A
- AWS: Security of the Cloud
- Customer: Security in the Cloud
- Shared: Patch management, Configuration management, Awareness and Training
2
Q
What is AWS DDOS protection?
A
- AWS Shield Standard (no cost)
- AWS Shield Premium
- AWS WAF
- Cloudfront and Route 53
- with Shield, provides attack mitigation at the edge
3
Q
What are the Shield levels ?
A
- Standard: Free, provides basic level for command attacks
- Shield Advanced: $3000/mo, access to DDOS team, protects against higher level attachs
- Ec2, Elastic Load Balancing (ELB), CloudFront, Route 53, AWS Global Accelerator.
4
Q
AWS WAF protection?
A
- Protects at http layer 7 for web apps
- WAF cannot be deployed on EC2 instances. Application Load Balancer should be configured in front of EC2 instances to deploy WAF
- Uses Web ACL:
- rules for IP addresses, SQL injection and XSS, geo match
- Deploy on CloudFront, Application Load Balancer, API Gateway, AppSync
5
Q
AWS Pen testing ?
A
- Customers can pen test 8 services without approval
- Prohibited to stage test DDOS attack, DNS attach, others
6
Q
What is KMS? Which products are auto encrypted?
A
- Key Management Service for encryption
- Amazon managed encryption keys
- Encryption automatically enabled for: S3 Glacier, Storage Gateway (on-premise bridge to S3), CloudTrail Logs
- Other services (RDS, S3, …) are opt in
7
Q
What is CloudHSM?
A
- Cloud Hardware Security Module
- Device at AWS for customer to manage their keys
8
Q
Types of KMS Keys?
A
- Customer managed / Customer created
- AWS managed / AWS created. Customer can use
- CloudHSM Keys
9
Q
What is AWS Secrets Manager ?
A
- Encrypted ‘secrets’ integrated with RDS (MySQL, Postgresql, Aurora)
10
Q
What is Artifact?
A
- Access to AWS compliance documentation for audit and compliance purposes
11
Q
What is GuardDuty?
A
- Service that examines logs using machine learning to detect ‘anomalies’
- AWS CloudTrail event logs, VPC Flow Logs, and DNS logs
- Can be notified of findings by CloudWatch events
12
Q
What is Inspector?
A
- Inspects running EC2 instances for vulnerabilities and reports findings (vulnerabilities, network access, security assessment)
13
Q
What is Config?
A
- feature that helps with auditing and reporting of your AWS resource compliance
- records configurations and changes over time
- can determine if there are certain security issues with configurations
14
Q
What is Macie?
A
- Finds and Protects
Uses machine learning to determine of sensitive data (ex. PII) exists in your S3 buckets - Also protects data
15
Q
What is AWS Security Hub?
A
- Manage security across several AWS accounts.
- Dashboard based on AWS security products
- Automate security checks
