Module 4

Question 1

What is AWS responsibility?

Answer 1

1) software: compute, storage, database, networking
2) Hardware: regions, AZs, edge locations

-> this means physical security of data centers, instance isolation, intrusion detection

Question 2

What is customer responsibility?

Answer 2

1) customer data
2) platform, apps, IAM
3) OS, network & firewall configuration: client-side data, encryption, data integrity & authentication, server side encryption, networking traffic protection

-> this means patching & maintaining OS, apply role-based access to apps, secure passwords, configure security groups, install firewalls, configure networks, manage account (logins, permissions)

Question 3

What are components of IAM?

Answer 3

• user
• group
• policy
• role

Question 4

What are the 2 types of policies?

Answer 4

1) identity based

2) resource based

Question 5

How can you secure a new AWS account? (8)

Answer 5

• IAM
• Multi factor authentication
• cloudtrail
• billing Reports
• aws organizations
• KMS (create & manage encryption keys)
• cognito
• aws shield

Question 6

How can you control S3 data access? (5)

Answer 6

1) amazon s3 block public access
2) IAM policies
3) bucket policies
4) ACLs
5) AWS trusted advisor

Question 7

How can you ensure compliance? (3)

Answer 7

1) AWS compliance programs (eg. ISO)
2) AWS config
3) AWS artifact