SAA - Security

Question 1

How do you protect objects in your Amazon S3 buckets from deletion or overwrite?

Answer 1

Turn on versioning and MFA delete

Question 2

How do you secure sensitive data in Amazon EBS volumes?

Answer 2

Ensure you turn on EBS encryption when creating the volume.

Question 3

What AWS service can you use to provide short-term access that acts as temporary security credentials for access to your AWS resources?

Answer 3

AWS Security Token Service

Question 4

What permissions do IAM identities start with when you create a new user, group, or role?

Answer 4

No permissions, all permissions must be explicitly granted.

Question 5

What two types of policies can be attached to an IAM role?

Answer 5

Trust policy and permission policy

Question 6

What two main ways are Service Control Policies used?

Answer 6

• To block services by default and then allow certain services. (allow list).
• Allow by default and block access to certain services (deny list)

Question 7

What are some differences between network access control lists and security groups?

Answer 7

• Network ACLs are used with subnets and are used for explicit denies and allows
• Security groups are used for almost everything else and are simpler because they are stateful, so there are less rules needed to secure your environment
• Security groups are used with the elastic network interfaces of your Amazon EC2 instances or resources
• Security groups have an explicit deny, meaning anything not explicitly allowed will be denied
• Network ACLs are processed in order from the lowest rule number to the highest rule number
• Network ACLs are stateless and security groups are stateful

Question 8

What are the two types of endpoints that you can create inside your Amazon VPC?

Answer 8

• Gateway Endpoints are used for AWS public services. Sometimes we want to connect to these public services like S3 or DynamoDB from a private instance or subnet that does not have access to the internet or a NAT Gateway setup. Gateway endpoints can be restricted using policies, use routing, and need an entry on the route table.
• Interface Endpoints are used for everything else, and you have to pick the correct endpoint depending on the AWS services. Interface endpoints use security groups, not policies. They also use DNS with a prefix list.

Question 9

Which AWS service do you integrate to encrypt and rotate all database credentials, API keys, and secrets?

Answer 9

AWS Secrets Manager

Question 10

Which AWS service do you integrate to secure your web application and allow multiple domains to serve SSL traffic over the same IP address?

Answer 10

AWS Certificate Manager

Question 11

Which AWS Directory Service do you implement to access resources both on premises and in AWS using the on premises credentials?

Answer 11

AWS Directory Service for Microsoft Active Directory

Question 12

You need to limit the maximum number of requests from a single IP address for your AWS WAF rule. What do you create?

Answer 12

A rate-based rule and set the rate limit.