Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Solutions Architect > AWS Security & Monitoring > Flashcards

AWS Security & Monitoring Flashcards

1
Q

What type of keys do AWS services integrated with KMS use, symmetric or asymmetric?

A

Symmetric (AES-256)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

How do asymmetric keys work?

A

A public key encrypts the data and a private key decrypts the data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

True or false: The same KMS key can live in two regions

A

False. We can however, use KMS Multi-Region Keys, which creates replicas in different regions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

We would like global client-side encryption for our AWS Service/s implemented. What could we use?

A

KMS Multi-Region keys. We can use the same encryption/decryption across regions because we are using replica keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

True or False: Unencrypted objects and objects encrypted with SSE-S3 are replicated by default

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which service allows you to force rotation of secrets every X days, Secrets Manager or Parameter Store?

A

Secrets Manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which service allows seamless integration with RDS: Secrets Manager or Parameter Store?

A

Secrets Manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

We want to protect our application from DDoS attacks? What service can we use?

A

AWS Shield

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a metric and dimension in CloudWatch?

A

A metric is a time-ordered series of data points. Could be the CPU usage of EC2 or IO of EBS

A dimension is a name/value pair that is part of the identity of a metric. For example, we can use the InstanceId dimension to filter down to specific instance metrics in EC2, or the timestamp of the data point

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How long can CloudWatch log data take to be available for export?

A

Up to 12 hours

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

We want to stream logs from CloudWatch logs to other services, what can we use?

A

CloudWatch subscriptions. We create the receiving resource and then define a CloudWatch subscription filter to filter which logs get delivered

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

We want to log to CloudWatch from EC2. What do we need?

A

CloudWatch Unified Agent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the difference between the CloudWatch Logs Agent and the Unified Agent?

A

The Unified Agent can collect more details on the system it runs on, such as CPU, memory, processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the three main targets of CloudWatch alarms?

A

EC2, ASG and SNS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

We want to monitor multiple CloudWatch alarms. What can we use?

A

CloudWatch Composite Alarms. CloudWatch Alarms are on a single metric

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

True or False: CloudWatch Alarms can trigger an EC2 restart?

A

True. We can define what actions to take for an EC2 instance when we define the alarm like stop, recover, reboot or terminate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

We want to schedule a service action (Lambda function) every hour. What service can we use?

A

EventBridge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the EventBridge schema registry?

A

The schema registry defines default and custom schemas for events that allow services receiving events to understand the event structure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

We want to collect logs to send to CloudWatch from container services. What can we use?

A

CloudWatch Container Insights

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How does the CloudWatch Container Insights work?

A

CloudWatch uses a containerized version of the CloudWatch Agent to discover containers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

We want to see which AWS services are impacting system performance the most. What can we use?

A

CloudWatch Contributor Insights. They use the standard CloudWatch logs to understand usage by different services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

We want to figure out which AWS services are the heaviest network users. What can we use?

A

CloudWatch Contributor Insights

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

We want to monitor history of events and API calls made within an AWS Account. What can we use?

A

AWS CloudTrail

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

True or False: A CloudTrail trail can only be used within a single region

A

False. It can be all regions or a single

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

We want to detect unusual activity in our AWS account/s. What can we use?

A

CloudTrail Insights

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

How long are events stored in CloudTrail?

A

90 days

27
Q

What is AWS Config?

A

AWS Config will track the configurations of all your AWS services over its history. From creation to any changes that were made

28
Q

True or False: We can use AWS Config to prevent AWS resource actions from happening

A

False. We can create rules to trigger actions, but not prevent them

29
Q

We want to automatically revoke unused IAM user credentials after a certain period of time. What AWS resource can we use?

A

AWS Config remediation rules

30
Q

For an Elastic Load Balancer, we want to ensure that an SSL certificate is always assigned to the Load Balancer. What service can we use?

A

AWS Config

31
Q

We want to monitor ELB incoming connection metrics, would we use CloudWatch or CloudTrail?

A

CloudWatch

32
Q

We want to see who made changes to our ELB with terminal commands, what AWS service can we use?

A

AWS CloudTrail

33
Q

You have an RDS DB instance that’s configured to push its database logs to CloudWatch. You want to create a CloudWatch alarm if there’s an Error found in the logs. How would you do that?

A

Create a CloudWatch Logs Metric Filter that filter the logs for the keyword Error, then create a CloudWatch Alarm based on that Metric Filter

34
Q

We want to set a CloudWatch alarm for only a certain grouping of metrics. What can we use to do this?

A

We can create a CloudWatch Logs metric filter

35
Q

How would you monitor your EC2 instance memory usage in CloudWatch?

A

Use the Unified CloudWatch Agent to push memory usage as a custom metric to CloudWatch

36
Q

You have made a configuration change and would like to evaluate the impact of it on the performance of your application. Which AWS service should you use, CloudWatch or CloudTrail?

A

CloudWatch. We want to measure performance change, not who made the change or when, which we would use CloudTrail for

37
Q

Someone has terminated an EC2 instance in your AWS account last week, which was hosting a critical database that contains sensitive data. Which AWS service helps you find who did that and when?

A

CloudTrail

38
Q

You have CloudTrail enabled for your AWS Account in all AWS Regions. What should you use to detect unusual activity in your AWS Account?

A

CloudTrail Insights. Insights help identify and respond to unusual activity associated with API calls and API error rates by analyzing CloudTrail management events

39
Q

One of your teammates terminated an EC2 instance 4 months ago which has critical data. You don’t know who made this so you are going to review all API calls within this period using CloudTrail. You already have CloudTrail set up and configured to send logs to the S3 bucket. What should you do to find out who made this?

A

Analyze CloudTrail logs in S3 bucket using Amazon Athena. CloudTrail records delete after 90 days, so we must go to the S3 bucket to analyze the logs

40
Q

You have enabled AWS Config to monitor Security Groups if there’s unrestricted SSH access to any of your EC2 instances. Which AWS Config feature can you use to automatically re-configure your Security Groups to their correct state?

A

AWS Config Remediations

41
Q

You are running a critical website on a set of EC2 instances with a tightened Security Group that has restricted SSH access. You have enabled AWS Config in your AWS Region and you want to be notified via email when someone modified your EC2 instances’ Security Group. Which AWS Config feature helps you do this?

A

AWS Config Notifications

42
Q

A DevOps engineer is working for a company and managing its infrastructure and resources on AWS. There was a sudden spike in traffic for the main application for the company which was not normal in this period of the year. The application is hosted on a couple of EC2 instances in private subnets and is fronted by an Application Load Balancer in a public subnet. To detect if this is normal traffic or an attack, the DevOps engineer enabled the VPC Flow Logs for the subnets and stored those logs in CloudWatch Log Group. The DevOps wants to analyze those logs and find out the top IP addresses making requests against the website to check if there is an attack. Which of the following can help the DevOps engineer to analyze those logs?

A

CloudWatch Contributor Insights

43
Q

A company has a running Serverless application on AWS which uses EventBridge as an inter-communication channel between different services within the application. There is a requirement to use the events in the prod environment in the dev environment to make some tests. The tests will be done every 6 months, so the events need to be stored and used later on. What is the most efficient and cost-effective way to store EventBridge events and use them later?

A

Use EventBridge Archive and Replay feature

44
Q

How can we audit our usage of AWS Key usage?

A

CloudTrail

45
Q

What are data keys in KMS?

A

Data keys are symmetric keys that you use to encrypt and decrypt data outside of KMS

You request data keys from KMS, and receive encrypted (that you can keep) data keys and plain text (that you use to encrypt/decrypt) data keys

46
Q

What is the automatic key rotation duration for AWS managed KMS keys?

A

1 year

47
Q

We want to control who can access our KMS keys. What can we use?

A

A Custom KMS Key Policy

48
Q

We want to authorize cross-account access to an EBS snapshot encrypted with a KMS key. What do we need?

A

Attach a custom KMS Key Policy that allows cross-account access

49
Q

True or False: if you import a TSL certificate outside ACM and import it, ACM will automatically renew the certificate for you.

A

False. We must renew the certificate ourselves. ACM will notify us of the expiration however through EventBridge

50
Q

What can we deploy AWS WAF to?

A

ALB, API Gateway, CloudFront, AppSync GraphQL API, Cognito User Pool

51
Q

True or False: WAF can be put on a Network Load Balancer

A

False

52
Q

You want to manage common sets of security rules across all your accounts, what can you use?

A

Firewall Manager. Rules are automatically applied to new resources as they are created across your organization

53
Q

What is AWS GuardDuty

A

GuardDuty runs ML algorithims to detect potential security threats inside your AWS accounts and workloads

Cannot also specifically protect against CryptoCurrency attacks with a dedicated finding

54
Q

What is AWS Inspector?

A

Allows you to run automated security assessment on EC2 instances, ECR and Lambda Functions

Can be used to scan package vulnerabilities

55
Q

What is Amazon Macie?

A

Uses machine learning and pattern maching to find sensitive data in S3 buckets and emits notifications

56
Q

True or False: You need to create KMS Keys in AWS KMS before you are able to use the encryption features for EBS, S3, RDS

A

False. you can use the AWS Managed Service keys in KMS

57
Q

When you enable Automatic Rotation on your KMS Key, the backing key is rotated every

A

Year

58
Q

You have an AMI that has an encrypted EBS snapshot using KMS CMK. You want to share this AMI with another AWS account. You have shared the AMI with the desired AWS account, but the other AWS account still can’t use it. How would you solve this problem?

A

You need to share the KMS CMK used to encrypt the AMI with the other AWS accound

59
Q

What should you use to control access to your KMS CMKs?

A

KMS Key Policies

60
Q

You have a secret value that you use for encryption purposes, and you want to store and track the values of this secret over time. Which AWS service should you use?

A

SSM Parameter Store; SSM PS has built-in tracking capability; each time you edit the value of a parameter, SSM PS creates a new version of the parameter and retains the previous version

61
Q

Your user-facing website is a high-risk target for DDoS attacks and you would like to get 24/7 support in case they happen and AWS bill reimbursement for the incurred costs during the attack. What AWS service should you use?

A

AWS Shield Advanced

62
Q

True or False: AWS GuardDuty monitors CloudWatch logs

A

False, it will look through CloutTrail event logs, VPC Flow Logs, DNS logs and Kubernetes Audit Logs

63
Q

Which AWS service allows you to centrally manage EC2 Security Groups and AWS Shield Advanced across all AWS accounts in your AWS Organization?

A

AWS Firewall Manager

AWS Solutions Architect (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions