Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Cloud Practitioner - My Study > Introduction to Security & Architecture on AWS > Flashcards

Introduction to Security & Architecture on AWS Flashcards

1
Q

Acceptable Use Policy

A

AWS’s policy for acceptable and unacceptable uses of their cloud platform. All users must agree with this policy to have an account on the platform.

Examples:

  • Sending unsolicited mass emails is prohibited
  • Hosting or distributing harmful content is prohibited
  • Penetration tests are allowed for a list of specific services
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Least Privilege Access

A

When granting permission for a user to access AWS resources, you should grant them the minimum permissions needed to complete their tasks and no more.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Shared Responsibility Summary

A

AWS Responsibility:
AWS is responsible for the security of the cloud

Customer Responsibility:
Customer is responsible for security in the cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

AWS Responsibility

A

Access & Training for Amazon Employees

Global Data Centers & Underlying Network

Hardware for Global Infrastructure

Configuration Management for Infrastructure

Patching Cloud Infrastructure & Services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Customer Responsibility

A

Individual Access to Cloud Resources & Training

Data Security & Encryption (both in transit and at rest)

Operating System, Network, and Firewall Configuration

All Code Deployed onto Cloud Infrastructure

Patching guest OS and custom applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Pillars of the Well-architected Framework

A

Cost Optimization
- Achieving minimal costs for the desired value
Operational Excellence
- Running and monitoring systems for business value
Performance Efficiency
- Using resources efficiently to achieve business value
Reliability
- Enabling infrastructure to recover from disruptions
Security
- Protecting information and business assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Reliability on AWS

A

Fault Tolerance
Being able to support the failure of components within your architecture

High Availability
Keeping your entire solution running in the expected manner despite issues that may occur

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Common Compliance Standards

A

PCI-DSS
- Compliance standard for processing credit cards
HIPAA
- Compliance standard for healthcare data
SOC 1, SOC 2, SOC 3
- Third-party reviews of operational processes
FedRAMP
- Standards for US government data handling
ISO 27018
- Standard for handling PII

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Compliance Services

A

AWS Config
- Provides conformance packs for standards
AWS Artifact
- Provides self-service access to reports
Amazon GuardDuty
- Provides intelligent threat detection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Jane’s company is building an application to process credit cards

They will be processing cards directly and not through a service

Their bank needs a PCI DSS compliance report for AWS

Where would Jane go to get the information?

A

Solution: AWS Artifact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Tim’s company is considering a transition to the cloud

They store personal information securely in their system

Tim’s CTO has asked what the company’s responsibility is for security

What would you tell Tim’s CTO?

A

Solution: Review the Shared Responsibility Model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Ellen is a solutions architect at a startup

They are building a new tool for digital asset management

Ellen is curious how to best leverage the capabilities of AWS in this application

What resources would you recommend for Ellen and her team?

A

Solution: AWS Well Architected Framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What portal provides self-service access to compliance reports?

A

AWS Artifact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What service continually monitor AWS resources and provides conformance packs for specific compliance standards?

A

AWS Config

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What service provides intelligent threat detection?

A

AWS GuardDuty

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

AWS Identity & Access Management (IAM)

A

Service that controls access to AWS resources

Using the service is free

Manages both authentication and authorization

Supports identity federation through SAML providers including Active Directory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

AWS IAM Identities

A

Users
Account for a single individual to access AWS resources

Groups
Allows you to manage permissions for a group of IAM users

Roles
Enables a user or AWS service to assume permissions for a task

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Policies in AWS IAM

A

A JSON document that defines permissions for an AWS IAM identity (principal)

Defines both the AWS services that the identity can access and what actions can be taken on that service

Can be either customer managed or managed by AWS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

AWS IAM Best Practices

A

Multi-Factor Authentication
Provides additional security with either a physical or virtual device that generates a token for login

Least Privilege Access
Users should only be granted access to AWS resources that are required for their current tasks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Amazon Cognito overview

A

A managed service that enables you to handle
authentication and aspects of authorization for your
custom web and mobile applications through AWS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Amazon Cognito details

A

User directory service for custom applications

Provides UI components for many platforms

Provides security capabilities to control account access

Enables controlled access to AWS resources

Can work with social and enterprise identity providers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Amazon Cognito Identity Providers

A
  • Google
  • Amazon
  • Facebook
  • Microsoft Active Directory
  • SAML 2.0 Providers
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Sylvia manages a team of DevOps engineers for her company

Each member of her team needs to have the same access to cloud systems

It is taking her a long time to attach permissions to each user for access

What approach would help Sylvia manage the team’s permissions?

A

Solution: Use an IAM Group for the team

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Edward works for a startup that is building a mapping visualization tool

Their EC2 servers need to access data stored within S3 buckets

Edward created a user in IAM for these servers and uploaded keys to the server

Is Edward following best practices for this approach? If not, what should he do?

A

Solution: Use an IAM Role with EC2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

William is leading the effort to transition his organization to the cloud

His CIO is concerned about securing access to AWS resources with a password

He asks William to research approaches for additional security

What approach would you recommend to William for this additional security?

A

Solution: Use Multi-factor Authentication (MFA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

On-premise Data Integration Services

A

AWS Storage Gateway
Hybrid-cloud storage service

AWS DataSync
Automated data transfer service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

AWS Storage Gateway

A

Integrates cloud storage into your local network

Deployed as a VM or specific hardware appliance

Integrates with S3 and EBS

Supports three different gateway types

  • Tape Gateway
  • Volume Gateway
  • File Gateway
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

AWS Storage Gateway Types

A

File Gateway
Stores files in Amazon S3 while providing cached low-latency local access

Tape Gateway
Enables tape backup processes to store data in the cloud on virtual tapes

Volume Gateway
Provides cloud based iSCSI volumes to local applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

AWS DataSync

A

Leverages the DataSync agent deployed as a VM on your network

Integrates with S3, EFS, and FSx for Windows File Server on AWS

Greatly improved speed of transfer due to custom protocol and optimizations

Charged per GB of data transferred

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Data Processing Services

A

AWS Glue
Managed Extract, Transform, and Load (ETL) Service

Amazon EMR
Big-data cloud processing using popular tools

AWS Data Pipeline
Data workflow orchestration service across AWS services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

AWS Glue

A

FULLY managed ETL (extract, transform, and load) service on AWS

Supports data in Amazon RDS, DynamoDB, Redshift, and S3

Supports a serverless model of execution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Amazon EMR

A

Enables big-data processing on Amazon EC2 and S3

Supports popular open-source frameworks and tools

Operates in a clustered environment without additional configuration

Supports many different big-data use cases

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Supported Amazon EMR Frameworks

A 
Apache Spark 
Apache Hive 
Apache HBase
Apache Flink 
Apache Hudi 
Presto
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

AWS Data Pipeline

A

Managed ETL (extract, transform, and load) service on AWS

Manages data workflow through AWS services

Supports S3, EMR, Redshift, DynamoDB, and RDS

Can integrate on-premise data stores

35
Q

Data Analysis Services

A

Amazon Athena
Service that enables querying of data stored in Amazon S3

Amazon Quicksight
Business intelligence service enabling data dashboards

Amazon CloudSearch
Managed search service for custom applications

36
Q

Amazon Athena

A

Fully-managed serverless service

Enables querying of large-scale data stored within Amazon S3

Queries are written using standard SQL

Charged based on data scanned for query

37
Q

Amazon Quicksight

A

Fully managed business intelligence service

Enables dynamic data dashboard based on data stored in AWS

Charged on a per-user and per-session pricing model

Multiple versions provided based on needs

38
Q

Amazon CloudSearch

A

Fully-managed search service on AWS

Support scaling of search infrastructure to meet demand

Charged per hour and instance type of search infrastructure

Enables developers to integrate search
into custom applications

39
Q

AI and Machine Learning Services

A

Amazon Rekognition
Computer vision service powered by Machine Learning

Amazon Translate
Text translation service powered by Machine Learning

Amazon Transcribe
Speech to text solution using Machine Learning

40
Q

Amazon Rekognition

A

Fully-managed image and video recognition deep learning service

Identifies objects in images

Identifies objects and actions in videos

Can detect specific people using facial analysis

Supports custom labels for your business objects

41
Q

Amazon Translate

A

Fully-managed service for translation of text

Currently supports 54 languages

Can perform language identification

Works both in batch and real-time

42
Q

Amazon Transcribe

A

Fully-managed speech recognition services

Recorded speech is converted into text in custom applications

Includes a specific sub-service for medical use

Supports batch and real-time transcription

Currently supports 31 languages

43
Q

Ruth is a data scientist for a financial services company

Large-scale data set needs to be processed before analysis

Ruth doesn’t want to manage servers but just wants to define processing

What service would you recommend to Ruth?

A

Solution: AWS Glue

44
Q

Jessi is a member of the IT team for a biotech company

She is currently working to identify an approach for controlled lab access

She wants leverage AI to determine access based on facial imaging

Is there an AWS service that can help with this approach?

A

Solution: Amazon Rekognition

45
Q

Roger’s company sells custom services around machine learning

His head of sales is trying to find a great way to visualize their sales data

This data is currently stored in Redshift as their data warehouse

What AWS service would allow this access to the data by non-technical resources?

A

Solution: Amazon Quicksight

46
Q

AWS Glue supports data in…

A

RDS
DynamoDB
Redshift
S3

47
Q

AWS Data Pipeline integrates with…

A 
RDS
DynamoDB
Redshift
S3
EMR
48
Q

Disaster recovery (DR) is…

A

Preparing for and recovering from a disaster. Any event that has a negative impact on a company’s business continuity or finances could be termed a disaster. This includes hardware or software failure, a network outage, a power outage, physical damage to a building like fire or flooding, human error, or some other significant event.

49
Q

Disaster Recovery Scenarios

A

Cost and complexity increasing / Recovery time decreasing…

1) Backup and restore
2) Pilot light
3) Warm standby
4) Multi-site

50
Q

Backup and Restore

A
  • Production data is backed up into Amazon S3
  • Data can be stored in either standard or archival storage classes
  • EBS data can be stored as snapshots in Amazon S3 also
  • In a Disaster Recovery event, a process is started to launch new environment
    This approach has the longest recovery time
51
Q

Pilot Light

A
  • Key infrastructure components are kept running in the cloud
  • Designed to reduce recovery time over the Backup and Restore approach
  • Does incur cost of this infrastructure continually running in the cloud
  • AMI’s are prepared for additional systems and can be launched quickly
52
Q

Warm Standby

A
  • A scaled-down version of the full environment is running in the cloud
  • Critical systems can be running on less capable instance types
  • Instance types and other systems can be ramped up for disaster recovery event
  • Does incur cost of this infrastructure continually running in the cloud
53
Q

Multi Site

A
  • Full environment is running in the cloud at all times
  • Utilizes instance types needed for production not just recovery
  • Provides a near seamless recovery process
  • Incurs the most cost over the other approaches
54
Q

Disaster Recovery Approach Considerations

A
  • Recovery Time Objective (RTO)

- Recovery Point Objective (RPO)

55
Q

Recovery Time Objective (RTO)

A

The time it takes to get your systems back up and
running to the ideal business state after a disaster
recovery event.

56
Q

Recovery Point Objective (RPO)

A

The amount of data loss (in terms of time) for a

production system during a disaster recovery event.

57
Q

Roger’s company runs several production workloads in AWS

Roger is tasked with architecting the disaster recovering approach

His organization wants there to be a seamless transition during an event

Which disaster recovery approach would Roger’s company use for this?

A

Solution: Multi Site approach

58
Q

Jennifer’s company is a startup

They do not currently have a disaster recovery approach

In this case, minimizing cost is more critical than minimizing RTO

What disaster recovery approach would you recommend to Jennifer?

A

Solution: Backup and Restore approach

59
Q

Eliza is documenting her company’s disaster recovery approach

They keep a few key servers up an running in AWS in case of an event

These servers have smaller instance types than what production would need

Which disaster recovery approach most closely matches this scenario?

A

Solution: Pilot Light approach

60
Q

Scaling on Amazon EC2

A

Vertical Scaling
You “scale up” your instance type to a larger instance type with additional resources

Horizontal Scaling
You “scale out” and add additional instances to handle the demand of your application

61
Q

Amazon EC2 Horizontal Scaling Services

A

Auto-scaling Group
Set of EC2 instances with rules for scaling & management

Elastic Load Balancer
Distributes traffic across multiple targets

62
Q

Amazon EC2 Auto-Scaling Group

A

Launch template defines the instance configuration for the group

Defines the minimum, maximum, and desired number of instances

Performs health checks on each instance

Exists within 1 or more availability zones in a single region

Works with on-demand and spot instances

63
Q

AWS Secrets Manager

A

Secure way to integrate credentials, API keys, tokens, and other secret content

Integrates natively with RDS, DocumentDB, and Redshift

Can auto-rotate credentials with integrated services

Enables fine-grained access control to secrets

64
Q

Security in Amazon VPC

A

Security groups
Enables firewall-like controls for resources within the VPC

Network ACL’s
Controls inbound and outbound traffic for subnets within the VPC

AWS VPN
Secure access to an entire VPC using an encrypted tunnel

65
Q

Security Groups

A
  • Serve as a firewall for your EC2 instances
  • Control inbound and outbound traffic
  • Works at the instance level
  • EC2 instances can belong to multiple security groups
  • VPC’s have default security groups
  • Must be explicitly associated with an EC2 instance
  • By default all outbound traffic is allowed
66
Q

Network ACL

A
  • Works at the subnet level with an VPC
  • Enables you to allow and deny traffic
  • Each VPC has a default ACL that allows all inbound and outbound traffic
  • Custom ACL’s deny all traffic until rules are added
67
Q

AWS VPN

A

Creates an encrypted tunnel into your VPC

Can be used to connect your data center or even individual client machines

Supported in two services:

  • Site-to-site VPN
  • Client VPN
68
Q

Security Services

A

AWS Shield
Managed DDoS protection service for apps on AWS

Amazon Macie
Data protection service powered by machine learning

Amazon Inspector
Automated security assessment service for EC2 instances

69
Q

Distributed Denial of Service (DDoS)

A

A type of attack where a server or group of servers are flooded with more traffic than they can handle in a coordinated effort to bring the system down

70
Q

AWS Shield

A

Provides protection against DDoS attacks for apps running on AWS

Enables on-going threat detection and mitigation

Has two different service levels:

  • Standard
  • Advanced
71
Q

Amazon Macie

A
  • Utilizes machine learning to analyze data stored in Amazon S3
  • It can detect personal information and intellectual property in S3
  • Provides dashboards that show how the data is being stored and accessed
  • Enables alerts if it detects anything unusual about data access
72
Q

Amazon Inspector

A

Enables scanning of Amazon EC2 instances for security vulnerabilities

Charged by instance per assessment run

Two types of rules packages:

  • Network reachability assessment
  • Host assessment
73
Q

Deploying Pre-defined Solutions on AWS

A

AWS Service Catalog
Managed catalog of IT services on AWS for
an organization

AWS Marketplace
Catalog of software to run on AWS from third-party providers

74
Q

AWS Service Catalog

A
  • Targeted to serve as an organizational service catalog for the cloud
  • Can include single server image to multi-tier custom applications
  • Enables organizations to leverage services that meet compliance
  • Supports a lifecycle for services released in the catalog
75
Q

AWS Marketplace

A
  • Curated catalog of third-party solutions for customers to run on AWS
  • Provides AMI’s, CloudFormation stacks, and SaaS based solutions
  • Enables different pricing options to overcome licensing in the cloud
  • Charges appear on your AWS bill
76
Q

AWS Developer Services

A 
AWS CodeCommit
AWS CodeBuild
AWS CodeDeploy
AWS CodePipeline
AWS CodeStar
77
Q

AWS CodeCommit

A
  • Managed source control service
  • Utilizes Git for repositories
  • Control access with IAM policies
  • Serves as an alternative to Github and Bitbucket
78
Q

AWS CodeBuild

A
  • Fully managed build and continuous integration service on AWS
  • Don’t have to worry about maintaining infrastructure
  • Charged per minute for compute resources you utilize
79
Q

AWS CodeDeploy

A
  • Managed deployment service for deploying your custom applications
  • Deploys to Amazon EC2, AWS Fargate, AWS Lambda, and on-premise servers
  • Provides dashboard for deployments in the AWS Console
80
Q

AWS CodePipeline

A
  • Fully-managed continuous delivery service on AWS
  • Provides the capabilities to automate building, testing, and deploying
  • Integrates with other developer tools as well as Github
81
Q

AWS CodeStar

A
  • Workflow tool that automates the use of the other developer services
  • Creates a complete continuous delivery toolchain for a custom application
  • Provides custom dashboards and configurations in the AWS Console
  • You only are charged for the other services you leverage
82
Q

Ellen is a solutions architect at a traditional financial services company

They recently transitioned to AWS

They want to be sure each department follows best practices

They want to create compliant IT services that other departments can use

What service would you recommend for Ellen and her team?

A

Solution: AWS Service Catalog

83
Q

Tim’s company leverages AWS for multiple production workloads

Recently they have had downtime due to one of their applications failing on EC2

Tim is looking to avoid downtime if an instance stops responding

What approach would you recommend for Tim to solve this issue?

A

Solution: Create an EC2 Auto-scaling Group alongside an Elastic Load Balancer

84
Q

Jane’s company deals with sensitive information from its users

They have put reasonable policies in place for data stored in S3

Jane is worried if some of those policies accidentally get changed

She is also worried of a breach going unnoticed

What service would you recommend to Jane and her company?

A

Solution: Amazon Macie

AWS Cloud Practitioner - My Study (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions