Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Solutions Architect Professional > AWS Security Services > Flashcards

AWS Security Services Flashcards

1
Q

Assign True or False to the following statements:
- Amazon GuardDuty is a service that uses ML to detect anomalies such as suspect API calls or unauthorized deployments
-Amazon GuardDuty is compatible with CloudTrail event logs, VPC flow logs, DNS logs and others
-Has a target functionality to detect crypto mining attacks
-Can setup EventBridge rules targeting Lambda, SNS or SQS in case of findings
- A management account of an organization can determine an organization account to be a GuardDuty Delegated Administrator, having full GuardDuty permissions for all accounts on the organization, with the exception of the organization account

A

-True
-True
-True
-False, can’t target SQS
-False, has unlimited permissions for all accounts of the organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Explain the service AWS Trusted Advisor

A

Trusted Advisor is an AWS service that inspects an AWS Account and makes recommendations to it based on best practices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Trusted Advisor can generate recommendations for what areas?

A

-Cost Optimization
-Performance
-Service Limits
-Security
-Operational Excelence
-Fault Tolerance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What advantages does the Full Trusted Advisor offer compared to the standard one?

A
  • Allows you to set alarms for service limits
  • Grants Programmatic Access using AWS Support API
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Assign True or False to the following statements:
- Trusted Advisor can check if a bucket and any individual object inside it are public
- AWS limits can only be monitored in Trusted advisor, not changed

A
  • False, Trusted Advisro can check if a Bucket is public, but not its objects. To do that you must use EventBridge/S3 events/AWS Config
    -True
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the kinds of existing flow logs?

A
  • VPC FLow Logs
  • Subnet Flow Logs
  • ENI (Elastic Network Interface) Flow Logs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the possible destinations for Flow Logs?

A

-S3
-Kinesis
-Cloudwatch Logs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Assign True or False to the following statements:
- You can query Flow Logs on Athena or CloudWatch Logs Insights
- Flow logs can be use to evaluate information such as destination IP, source IP, account id, destination id and action taken
- If you have a NAT Gateway inside a VPC ant the VPC tries to receive inbound traffic, since the NAT Gateway automatically drops inbound traffic, the action on the log will be REJECT

A

-True
-True
-False, the VPC can ACCEPT the action, the one that will drop it is the NAT Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is AWS Security Hub?

A

It’s a service that allows you to manage security and automate security checks accross multiple AWS accounts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is AWS Config?

A

AWS Config is a compliance monitoring service. It is able to record the configuration of your AWS resources and configurations over time for auditing reasons.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Assign True or False to the following statements:
-AWS Config Rules allow you to set conditions to be followed by your resources, with any non-compliant action being denied
-AWS Config allows you to send SNS noticiations for any changes performed
-AWS Config allows you to create custom rules using AWS Lambda
-AWS Config can check for rule violations whenever there is a config change or periodically, and can trigger Amazon Eventbridge if any configuration is non compliant
-Any non-compliant ule can be treated through SSM Automations

A

-False, you cannot deny actions of being performed using AWS Config
-True
-True
-True
-True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is AWS System Manager (SSM)?

A

System Manager is an instance management service for both EC2 and on-prem. It allows you to automate patching, execute commands or run scripts automatically and on multiple instances at the same time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Assign True or False to the following statements regarding AWS System Manager:
- Works only for Linux OS
- It bills you for each instance integrated with it
- Integrated with both CloudWatch metrics/dashboards and AWS Config
- Needs SSM Agent installed on systems for it to work. This is true by default on EC2 instances
- System Manager can run commands on múltiple instances at the same time without the need for SSH

A
  • False, works for both Linux OS and Windows
  • False, it has no costs
  • True
  • False, it only comes installed on Amazon Linux AMI and some Ubuntu AMIs
  • True
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

AWS System Manager can be used to run commands on instances before they are scaled down by an Autoscaling Group (ASG). Explain how this process works

A

To do what is described, you must first create a life cycle hook that puts the scaling down instance on the Terminating:Wait state. Then you must configure EventBridge to monitor the Terminating:Wait and trigger the SSM Automation Document to perform the actions on the instance before termination.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is SSM Session Manager?

A

Session Manager is a System Manager functionality that allows you to star a secure shell on your EC2 or on-prem instance. The access can be performed through the AWS Console, AWS CLI or Session Manager SDK and it does not need SSH Access, SSH keys or Bastion Hosts. Works for Linux, MacOS and Windows

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is SSM OpsCenter?

A

OpsCenter is a System Manager functionality that helps you resolve operational events (events, alarms and issues) by aggregating informations on the event from sources such as CloudTrail Logs, CloudWatch alarms, AWS Config changes and relationships and CloudFormation stack information. Also allows you to automate responses using Automation Runbooks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Describe what AWS Firewall Manager does

A

Firewall manager allows you to manage security rules in all accounts of an organization. Some common rules managed by firewall manager Security Policies are:
-Security Groups
-WAF Rules
-AWS Shield Advanced
-AWS Network Firewall
-Amazon Route 53 Resolver DNS Firewall
The Security Policies are created regionally, and are applied to all new resources created inside your organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is Amazon Inspector?

A

Amazon Inspector is an AWS Service that inspects your EC2 instances, Lambda Functions and Container images for vulnerabilities. All identified vulnerabilities in regarding packages and reachability are associated with a risk score, and can be analysed in Security Hub or EventBridge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is AWS Certificate Manager?

A

It an AWS service that helps with the management of security certificates. It automatically loads the certificate on Load Balancer, CloudFront and API Gateway, and it can be use to create public or private certificates and renew certificates. ACM is a regional service, and you can’t use it to copy certificate between regions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is AWS CloudHSM (Hardware Security Module)? What is a good use case for it?

A

CloudHSM is a service that offers harware focused on processing security software. It allow you to store, generate, import, export and manage cryptographic keys, and can only be accessed the CloudHSM Client Software. Good for cases where SSE-C encryption is used.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is AWS Macie?

A

Macie is a service that uses ML to automatically detect sensitive data and report it to the account owner. It also provides a dashboard informing how this data is being used and transfered.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the differences between AWS Shield Standard and AWS Shield Premium?

A

-Shield Standard is free and working by default on AWS, while Premium is optional and paid ($3,000 per month per organization)
- Shield Standard provides from common layer 3/4 attacks such as SYN/UDP Flood and Reflection attacks, while Premium also protects against more sophisticated attacks on services such as EC2, ELB, Cloudfront, Route 53 and AWS Global Accelerator
- AWS Premium also grants access to a 24/7 DDoS response team and prtoects against fee spikes due to DDoS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is AWS WAF?

A

AWS WAF, or Web Application Firewall, is a service that protects your application from common layer 7 exploits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Assign True or False to the following statements regarding AWS WAF:
- AWS WAF can to no services other than CloudFront, ELB (Application Load Balancer) and API Gateway
- WAF provides no help against a DDoS attack
- WAF access control is done through Web ACLs, which can be use to perform only Allow and Block actions
-Some of the filters that can be applied to Web ACLs include IP Adresses, HTTP Headers, HTTP Body or URI strings
-WAF can block common attacks such as SQL injection and cross-site scripting (XSS)

A

-False, it can also be applied to AppSync
-True
-False, WAF can perform Allow, Block, Count, CAPTCHA or Challenge actions
-True
-True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Aside from Web ACLs, WAF also implement Managed Rules implemented by AWS and marketplace sellers. What are some rule groups for those rules?

A
  • Baseline Rule Groups: General protection from common threats.
  • Use-Case Specific Rule Groups: Protection from common WAF use cases. Ex: AWSManagedRulesSQLiRuleSet
  • IP Reputation Rule Groups: Block requests based on source (ex: Malicious IPs)
  • Bot Control Managed Rule Group: Block and manage requests from bots
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Where can WAF logs be sent to?

A

-S3 Bucket (5 min intervals)
-Kinesis Data Firehose (limited by Firehose quotas)
- CloudWatch Logs Log Group (5MB/s)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What must be done so EC2 can send metrics to CloudWatch?

A

The CloudWatch agent must be installed inside the EC2 instance/on-prem server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What are the 4 main Cloudwatch functionalities?

A

-Metrics
-Alarms
-Logs
-EventBridge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

On an EC2 instance, there are some network metrics that have a maximum value allowed so EC2 runs properly. What are those metrics?

A

-Bandwidth capability
-Link local service access
-Packets-per-second (PPS) performance
-Connections tracked

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Cloudwatch Logs possess Log Events, Log Streams and Log Groups. Explain the difference between them.

A
  • Log events are singular events that are logged inside a Log Stream.
  • A Log Stream is a sequence of Log Events coming from the same source.
  • A Log Groups are groups of log streams that share the same retention, monitoring, and access control settings
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

True or false: Logs stored in Cloudwatch Logs cannot be deleted without deleting the log group.

A

False, it is possible to configure log groups so logs are deleted or exported to s3 after a certain period of time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What kinds of Cloudwatch alarms are there?

A

-Metric alarm: Watches the value of a single metric and generates an alarm if it goes outside the configured thresholds
-Composite alarm: Uses rules to chek the states of multiple alarms and only goes off if all rules are met.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

In what states can a CloudWatch alarm be in?

A

-OK: Metric is within the defined threshold
-Alarm: Metric is outside the defined threshold
-INSUFFICIENT_DATA: not enough information has been gathered to determine whether the metric is within or outside of the threshold range.

33
Q

What are the 3 aspects you can configure that control when a Cloudwatch alarm changes state?

A

-Period: The frequency in which the data points being evaluated by the alarm are created
-Evaluation period: The number of data points (interval of time) to be evaluated when deciding to change the alarm status
-Datapoint to alarm: The number of points within the interval that must be on the ALARM threshold before the alarm changes state

34
Q

In what status can alarm data points be in?

A
  • Breaching: Breaching the alarm threshold
  • Not breeching: Within the alarm threshold
  • Missing: Data point is missing
35
Q

Where can VPC Flow Logs be stored?

A

S3, CloudWatch Logs or Kinesis Firehose

36
Q

What is the capture windows for data captured for VPC Flow Logs?

A

The capture window is approximately 10min long

37
Q

Complete the statement regarding VPC Flow Logs:
If you store your VPC flow logs on CloudWatch logs, you can query them using ___________, meanwhile, if you store them on S3, you can use _____________.

A

-Cloudwatch Logs Insights
-Amazon Athena

38
Q

What is the retention period for Amazon CloudWatch metrics ?

A

Data points with a 1-minute period are available for 15 days.

39
Q

Complete the statement rearding AWS Private Link:
An AWS Private Link connection is composed of a _________ on the service side and an ________ on the customer side.

A
  • Network Load Balancer
  • ENI
40
Q

AWS Firewall Manager can manage resources on multiple accounts of an organization. What are the pre-requisites needed to enable that?

A
  • Enable AWS Organization Full Features
  • Enable AWS Config on all accounts
  • Enable AWS Resource Access Manager
  • Designate an account as Firewall Manager Admin
41
Q

Where can AWS WAF be deployed?

A

-CloudFront
-API Gateway
-Application Load Balancer
-AppSync

42
Q

Where are AWS WAF logs sent to?

A

Kinesis Firehose, where they are then redirected somewhere else

43
Q

What are the 4 main goals of cryptography?

A

-Confidentiality: Keep your data secret
-Integrity: Ensure data has not been manipulated
-Authentication: Confirm user identity
-Non-repudiation: Prevent user from denying prior commitments or actions

44
Q

The most common service on AWS for encrypting data at rest is ___________

A

KMS

45
Q

Explain the steps taken by AWS to encrypt an object uploaded to an s3 bucket with the S3-KMS security option

A

S3 requests a data key to encrypt the uploaded object then uses the wrapping key configured at the ecnryption setup to encrypt the data key and store both it and the object together

46
Q

Every KMS key has a ___________ associated with it, which determines who has permission to use the key and how.

A

Key policy

47
Q

What is a KMS grant?

A

It’s a temporary permission policy that allows aws principals to use KMS keys for specific actions.

48
Q

AWS KMS offers both customer managed key (CMK) and AWS managed keys (AMK). What are the difference between them?

A

-Key policy: AMK policies are amanaged by AWS while CMKs’ are managed by the customer
-Key Rotation: AMK have to be rotated every year, while CMK rotation is optional
- Import custom key material: not allowed by AMKs
- Costs: both are billed by api calls, but CMKs cost an additional 1 USD per month

49
Q

True or False: Whenever you use an AWS service integration with KMS you use a symmetric key

A

True

50
Q

What are the possible key material origins that can be used to create a new key on KMS?

A

-KMS
-External
-Custom Key Store (ex: Cloud HSM cluster)

51
Q

True or false: An external key brought into KMS must be 1024 bits symmetrical key and cannot be automatically rotated

A

False, must have 256 bits

52
Q

What are KMS multi-region keys?

A

They are sets of identical keys located in multiple regions that can be used interchangeably

53
Q

True or False: CloudHSM is single AZ by default

A

True, but you can set-up multi-AZ for increased availability

54
Q

True or False: CloudHSM can be used to perform SSL

A

True

55
Q

When you need more security when storing your encryption key, a good option is ____________

A

CloudHSM

56
Q

What are the 2 ways to prove key ownership to AWS Certificate Manager

A
  • DNS Validation
  • Email Validation
57
Q

What are the 3 main services offered by AWS to perform application level encryption?

A
  • AWS Encryption SDK
  • AWS Database Encryption SDK
  • Amazon S3 Encryption Client
58
Q

Does AWS Firewall Manager need AWS Organizations to work?

A

Yes

59
Q

How many Devices can you have on a CloudHSM cluster?

A

Up to 28

60
Q

True or False: Secrets from Secrets Manager cannot be shared accross accounts

A

False, Secrets can be shared

61
Q

What are the differences between Secrets Manager and SSM Parameter Store

A

-Secrets Manager is more expensive
-Secrets Manager encryption is mandatory, in parameter store it’s optional
-Parameter Store cannot rotate secrets

62
Q

True or False: SSM Parameter Store can pull a Secrets Manager Secret using the SSM Parameter Store API

A

True

63
Q

How is SSM Parameter Store Hierarchy structured? Give examples.

A

It is structured path style. Ex: /aws/example/example_secret

64
Q

SSM Parameter store has 2 tiers, Standard and Advanced. Explain the differences between them.

A

-Standard allows you to have only 10.000 parameters per account and region, Advanced allow 100.000
-Max parameter size on Standard is 4KB, on Advanced its 8KB
-Advanced costs $0.05 per advanced parameter per month, while standard is free
-Advanced parameters have access to parameter policies

65
Q

What kinds of SSM Parameter Store Policies can be configured to force parameter rotation after a set amount of time? Explain each one.

A

-Expiration: After a set amount of time the parameter is deleted
-ExpirationNotification: Notifies EventBridge the time left before a parameter expires
-NoChangeNotification: Notifies EventBridge that a parameter hasn’t been changed since a set amount of time.

66
Q

True or False: Secrets Manager does not allow secret versioning

A

False, it implements it by default

67
Q

True or False: Envelope Encryption uses assymetric KMS keys

A

False, it uses symetric keys

68
Q

In KMS, what are AWS Owned Keys?

A

They are keys created and managed by AWS used to protect your resources. They can’t be viewed, used, tracked or audited

69
Q

What are common types of DDoS attacks on AWS?

A

-SYN Flood (Layer 4): Sends too many TCP requests
-UDP Reflection (Layer 4): Get other servers to send many large UDP requests
-DNS flood attack: Overload the DNS so legitimate users can’t find the site
-Slow Loris attack: A lot of HTTP connections are opened and mantained

70
Q

What is Amazon Detective?

A

It is a service that receives secuirty alarms and treis to perform a detailed inspection to determine the cause of those alarms.

71
Q

What data sources can Amazon Detective inspect?

A

-CloudTrail
-VPC Flow Logs
-Guard Duty

72
Q

What is CloudWatch Synthetics Canary?

A

It is a CloudWatch functionality that allows you to setup a Script to run on your achitecture to try to find issues before customers

73
Q

In what languages can the CloudWatch Synthetics Canary be in?

A

Python or Node.js

74
Q

What are the default CloudWatch Synthetics Canary blueprints?

A
  • Heartbeat Monitor – load URL, store screenshot and an HTTP archive file
  • API Canary – test basic read and write functions of REST APIs
  • Broken Link Checker – check all links inside the URL that you are testing
  • Visual Monitoring – compare a screenshot taken during a canary run with a
    baseline screenshot
  • Canary Recorder – used with CloudWatch Synthetics Recorder (record your
    actions on a website and automatically generates a script for that)
  • GUI Workflow Builder – verifies that actions can be taken on your webpage (e.g.,
    test a webpage with a login form)
75
Q

Where can CloudWatch send logs to?

A

-S3
-Kinesis Data Streams
-Kinesis Firehose
-Lambda
-ElasticSearch

76
Q

True or False: CloudWatch Logs can be exported to S3, but to do so the destination bucket must be encrypted (SSE-C) and the process might take up to 24 hours

A

False, the bucket must be encrypted using SSE-S3 or SSE-KMS and the process might take up to 12 hours

77
Q

True or False: EventBridge Event Buses cannot be accessed by other AWS Accounts

A

False, they can be accessed using resource policies

78
Q

What does AWS X-Ray do?

A

It allows you to track requests between components of your microservices architecture

79
Q

What AWS Services are compatible with AWS X-Ray?

A

-EC2 (install X-Ray agent)
-ECS (install X-Ray agentor contained)
-Elastic Beanstalk (Enabled by Default)
-API Gateway
-Lambda

80
Q

What is CloudTrail Log File Integrity validation?

A

It is a CloudTrail feature you can enable that generates a hash of the logs of a specific trail that can be used to detect if the logs are being altered somehow

81
Q

To deliver Cloudwatch Logs to S3 in real-time, on must use ____________

A

Cloudwatch Logs Subscription

AWS Solutions Architect Professional (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions