Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Cloud Practitioner > Governance & Security > Flashcards

Governance & Security Flashcards

1
Q

AWS Global Infrastructure

A

Edge locations and Regional Edge Cache
Local Zones
Availability Zones
Regions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

AWS Regions

A
  • A region is a geographical area
  • Each region consists of 2 or more availability zones
  • Isolated from other AWS Regions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Availability Zones

A
  • Availability Zones are physically separate and isolated from each
    other
  • AZs span one or more data centers
  • Each AZ is designed as an independent failure zone
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Local Zones

A
  • AWS Local Zones place compute, storage, database, and other select
    AWS services closer to end-users
  • Extension of an AWS Region where you can run your latency sensitive
    applications
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Edge Locations and Regional Edge Caches

A
  • Edge locations are Content Delivery Network (CDN) endpoints for
    CloudFront
  • There are many more edge locations than regions
  • Regional Edge Caches sit between your CloudFront Origin servers and
    the Edge Locations
  • A Regional Edge Cache has a larger cache-width than each of the
    individual Edge Locations
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Advantages of cloud?

A
  • Trade capital expense for variable expense
  • Benefit from massive economies of scale
  • Stop guessing about capacity
  • Increase speed and agility
  • Stop spending money running and maintaining data centres
  • Go global in minutes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

IAM Best Practices - General

A
  • Create individual IAM users
  • Use groups to assign permissions to IAM users
  • Grant least privilege
  • Use access levels to review IAM permissions
  • Monitor activity in your AWS account
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

IAM Best Practices - Roles

A

*Use roles for applications that run on Amazon EC2 instances
* Use roles to delegate permissions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

IAM Best Practices - Policies

A
  • Get started using permissions with AWS managed policies
  • Use customer managed policies instead of inline policies
  • Use policy conditions for extra security
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

IAM Best Practices - Credential Management

A
  • Lock away your AWS account root user access keys
  • Configure a strong password policy for your users
  • Enable MFA
  • Do not share access keys
  • Rotate credentials regularly
  • Remove unnecessary credentials
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Amazon EC2 Metadata and User Data

A
  • User data is data that is supplied by the user at instance
    launch in the form of a script
  • Instance metadata is data about your instance that you can use to configure or manage the running instance
  • User data and metadata are not encrypted
  • Instance metadata is available at
    http://169.254.169.254/latest/meta-data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Access keys

A
  • Access keys can be used on EC2 instances to gain permissions
    to other AWS services
  • Access keys are stored in plaintext so this is not secure
  • Better to use IAM roles whenever possible and avoid access
    keys
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

AWS Organizations

A
  • Allows you to consolidate multiple AWS accounts into an
    organization that you create and centrally manage
  • Available in two feature sets:
  • Consolidated Billing
  • All features
  • Includes root accounts and organizational units
  • Policies are applied to root accounts or OUs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

AWS Organization Consolidated billing includes?

A
  • Paying Account – independent and cannot access resources of other
    accounts
  • Linked Accounts – all linked accounts are independent
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

AWS Control Tower

A
  • Simplifies the process of creating multi-account environments
  • Sets up governance, compliance, and security guardrails for
    you
  • Integrates with other services and features to setup the
    environment for you including:
  • AWS Organizations, SCPs, OUs, AWS Config, AWS CloudTrail,
    Amazon S3, Amazon SNS, AWS CloudFormation, AWS Service
    Catalog, AWS Single Sign-On (SSO)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

AWS Systems Manager

A
  • Manages many AWS resources including Amazon EC2, Amazon
    S3, Amazon RDS etc.
  • Systems Manager Components:
  • Automation – uses documents to run automations
  • Run Command – run commands on EC2 instances
  • Inventory – gather inventory information
  • Patch Manager – manage patching schedules and installation
  • Session Manager – connect securely without SSH or RDP
  • Parameter Store – store secrets and configuration data securely
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

AWS Service Catalog

A
  • Allows organizations to create and manage catalogs of IT
    services that are approved for use on AWS
  • Allows you to centrally manage commonly deployed IT
    services
  • IT services can include virtual machine images, servers,
    software, and databases and multi-tier application
    architectures
  • Enables users to quickly deploy only the approved IT services
    they need
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

AWS Config

A
  • Fully-managed service for compliance management
  • Helps with compliance auditing, security analysis, resource
    change tracking and troubleshooting
19
Q

Trusted Advisor

A
  • Online resource that helps to reduce cost, increase
    performance and improve security by optimizing your AWS
    environment
  • Provides real time guidance to help you provision your
    resources following best practices
  • Advises you on Cost Optimization, Performance, Security,
    and Fault Tolerance
20
Q

AWS Personal Health Dashboard

A
  • Provides alerts and remediation guidance when AWS is
    experiencing events that may impact you
  • Gives you a personalized view into the performance and
    availability of the AWS services underlying your AWS
    resources
  • Also provides proactive notification to help you plan for
    scheduled activities
21
Q

Service Health Dashboard

A
  • Shows you current status of AWS services
  • Not personalized
22
Q

AWS Directory Services

A

AWS Directory Service
for Microsoft Active
Directory

AD Connector
Simple AD

23
Q

AWS Directory Service for Microsoft Active Directory - description, use case

A

Service Description
AWS-managed full Microsoft AD running on Windows Server 2012 R2

Use Case
Enterprises that want hosted Microsoft Active Directory

24
Q

AD Connector - description, use case

A

AD Connector Allows on-premises users to log into AWS services with their existing AD credentials

Use Case
Single sign-on for on-premises employees

25
Q

Simple AD - description, use case

A

Low scale, low cost, AD implementation based on Samba
Use case: Simple user directory, or you need LDAP compatibility

26
Q

AWS Systems Manager Parameter Store

A
  • Provides secure, hierarchical storage for configuration data
    management and secrets management
  • You can store data such as passwords, database strings, and
    license codes as parameter values
  • You can store values as plaintext (unencrypted data) or
    ciphertext (encrypted data)
  • You can then reference values by using the unique name that
    you specified when you created the parameter
27
Q

AWS Secrets Manager

A
  • Similar to Parameter Store
  • Allows native and automatic rotation of keys
  • Fine-grained permissions
  • Central auditing for secret rotation
28
Q

AWS Certificate Manager (ACM)

A
  • Create, store and renew SSL/TLS X.509 certificates
  • Single domains, multiple domain names and wildcards
  • Integrates with several AWS services including:
  • Elastic Load Balancing
  • Amazon CloudFront
  • AWS Elastic Beanstalk
  • AWS Nitro Enclaves
  • AWS CloudFormation
29
Q

AWS Key Management Service (KMS)

A
  • Used for creating and managing encryption keys
  • Gives you centralized control over the encryption keys used
    to protect your data
  • KMS is integrated with most other AWS services
  • Easy to encrypt the data you store in these services with
    encryption keys you control
30
Q

AWS CloudHSM

A
  • Cloud-based hardware security module (HSM)
  • Generate and use your own encryption keys on the AWS Cloud
  • Manage your own encryption keys using FIPS 140-2 Level 3 validated
    HSMs
  • CloudHSM runs in your VPC
31
Q

AWS CloudTrail

A
  • CloudTrail logs API activity for auditing
  • By default, management events are logged and retained for
    90 days
  • A CloudTrail Trail logs any events to S3 for indefinite
    retention
  • Trail can be within Region or all Regions
  • CloudWatch Events can be triggered based on API calls in
    CloudTrail
  • Events can be streamed to CloudWatch Logs
32
Q

VPC Flow Logs

A
  • Flow Logs capture information about the IP traffic going to
    and from network interfaces in a VPC
  • Flow log data is stored using Amazon CloudWatch Logs
  • Flow logs can be created at the following levels:
  • VPC
  • Subnet
  • Network interface
33
Q

Elastic Load Balancing Access Logs

A
  • Capture detailed information about requests sent to the load
    balancer
  • Use to analyze traffic patterns and troubleshoot issues
  • Can identify requester, IP, request type etc.
  • Can be optionally stored and retained in S3
34
Q

S3 Access Logs

A
  • Provides detailed records for the requests that are made to a
    bucket
  • Details include the requester, bucket name, request time, request
    action, response status, and error code (if applicable)
  • Disabled by default
35
Q

Amazon Detective

A
  • Analyze, investigate, and quickly identify the root cause of
    potential security issues or suspicious activities
  • Automatically collects data from AWS resources
  • Uses machine learning, statistical analysis, and graph theory
  • Data sources include VPC Flow Logs, CloudTrail, and
    GuardDuty
36
Q

AWS GuardDuty

A
  • Intelligent threat detection service
  • Detects account compromise, instance compromise,
    malicious reconnaissance, and bucket compromise
  • Continuous monitoring for events across:
  • AWS CloudTrail Management Events
  • AWS CloudTrail S3 Data Events
  • Amazon VPC Flow Logs
  • DNS Logs
37
Q

Amazon Macie

A
  • Macie is a fully managed data security and data privacy
    service
  • Uses machine learning and pattern matching to discover,
    monitor, and help you protect your sensitive data on Amazon
    S3
  • Macie enables security compliance and preventive security
38
Q

AWS WAF

A

AWS WAF
* AWS WAF is a web application firewall
* Create rules that block common web exploits like SQL
injection and cross site scripting
* The rules are known as Web ACLs

39
Q

AWS Shield

A

AWS Shield
* AWS Shield is a managed Distributed Denial of Service
(DDoS) protection service
* Safeguards web application running on AWS with always-on
detection and automatic inline mitigations

40
Q

AWS Artifact

A
  • AWS Artifact provides on-demand access to AWS’ security
    and compliance reports and select online agreements
  • Reports available in AWS Artifact include:
  • Service Organization Control (SOC) reports
  • Payment Card Industry (PCI) reports
41
Q

AWS Security Hub

A
  • Provides a comprehensive view of security alerts and
    security posture across AWS accounts
  • Aggregates, organizes, and prioritizes security alerts, or
    findings, from multiple AWS services
42
Q

AWS Security Bulletins

A
  • Security and privacy events affecting AWS services are
    published (also has an RSS feed)
43
Q

AWS Trust & Safety Team

A
  • Contact the AWS Trust & Safety team if AWS resources are
    being used for:
  • Spam
  • Port scanning
  • Denial-of-service attacks
  • Intrusion attempts
  • Hosting of objectionable or copyrighted content
  • Distributing malware
44
Q

Penetration Testing

A
  • Penetration testing is the practice of testing one’s own
    application’s security for vulnerabilities by simulating an
    attack
  • AWS allows penetration testing without prior approval for 8
    AWS services

AWS Cloud Practitioner (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions