Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Cloud Foundations > M4: AWS Cloud Security > Flashcards

M4: AWS Cloud Security Flashcards

Module 4

1
Q

Shared responsibility model

A

AWS responsibility for security of the cloud, customer in the cloud.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Security of the cloud

A

Physical security of data centres, hardware, software which hosts OS, network infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

IaaS

A

Provides building blocks for cloud IT (eg EC2)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

PaaS

A

Remove the need to manage underlying infrastructure - hardware, OS… (Eg lambda, RDS) But customer responsible for security group configurations, firewalls…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

IAM policies

A

In JSON and define permissions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

IAM entities are…

A

IAM users, IAM groups and IAM roles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

IAM user

A

Provides a way for a person, application or service to authenticate to AWS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

IAM group

A

Arches the same policies to multiple users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

IAM role

A

Can have permission policies arched to it and can be used to delegate temporary access to users or applications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Types of access possible for users

A
  1. Programmatic

2. Management console

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What does MFA stand for?

A

Multi factor authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How can you generate MFA token?

A
  1. Virtual MFA-compliant applications
  2. U2F security key devices
  3. Hardware MFA devices
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Default for IAM users

A

No permissions to access any resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Principle of least privilege

A

All permissions need to be granted explicitly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How widely do IAM policies apply

A

The scope is global: apply across all AWS regions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Identity - based policies

A

Permission policies attached to a principal identity - managed or inline.

17
Q

Managed policies

A

Standalone identity - based policies that can be attached to multiple users, groups and roles in your AWS account.

18
Q

Managed policies

A

Standalone identity - based policies that can be attached to multiple users, groups and roles in your AWS account.

19
Q

Inline policies

A

Policies that you create and name, and that are embedded directly into a single user group or role.

20
Q

Resource based policies

A

JSON policy documents that are attached to a resource. Inline only. E.g. ACL.

21
Q

ACL

A

Access control list

22
Q

IAM explicit deny statement

A

Takes precedence over explicit allow statement.

23
Q

IAM policy simulator

A

Test and troubleshoot IAM policies

24
Q

IAM role

A

Can attach permission policies to. Does not have any log in credentials, usually temporary change in permissions. Eg to grant access to your account to third parties so they can perform an audit on your resources.

25
Q

Best practises for securing an AWS account

A
  1. Securing login with MFA
  2. Delete root user access keys
  3. Create individual IAM users and use principle of least privilege for permissions
  4. Use groups to assign permissions to IAM users
  5. Configure a strong password policy
  6. Delegate using rules instead of sharing credentials
  7. Monitor account activity using CloudTrail
26
Q

CloudTrail

A

Logs all API requests in your account
Enabled by default
Stores 90 days

27
Q

AWS Organizations security features

A
  1. Organizational units with their policies
  2. Integrates with IAM
  3. Service control policies: maximum permissions that member accounts in the organization can have
28
Q

AWS Key Management Service

A

Create and manage encryption keys
Handles encryption automatically
Secure and resilient service that uses hardware security modules validated under Federal Information Processing Standards

29
Q

Amazon Cognito

A

Control access to AWS resources from application, sign on. Can be used with HIPPA, workloads compliant with Payment card industry data security standard

30
Q

AWS Shield

A

Managed distributed denial of service protection service

31
Q

Data at rest

A

Data physically stored on disk or tape

32
Q

Data at rest encryption

A

Can encrypt file systems, eg EFS. Then all data transferred between EC2 and mounted EFS is encrypted. Alternatively, AWS Storage Gateway.

33
Q

Data in transit

A

Data that is moving across a network

Transport layer security used

34
Q

AWS certificate manager

A

Provision, manage and deploy SSL and TLS certificate

35
Q

S3 bucket access

A

Private by default

  1. Block public access
  2. IAM policies
  3. Bucket policies
  4. Setting ACLs on buckets and objects
  5. AWS Trusted Advisor can check permissions on buckets
36
Q

AWS Config

A

Used to access, audit, evaluate the config of AWS resources. Regional service.

AWS Cloud Foundations (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions