Section 26: AWS Security and Encryption Flashcards
A managed service that makes it easy for you to create and control the cryptographic keys that are used to protect your data
AWS Key Management Service (KMS)
How often do AWS Managed Keys rotate?
Once per year
What are the three types of KMS keys in AWS KMS?
AWS Managed Key
Customer Managed Keys (CMK) created in KMS
Customer Managed Keys Imported
True/False: KMS keys are global
False - KMS keys are scoped per region
What are the two KMS Key Policy types?
Default KMS Key Policy
Custom KMS Key Policy
A capability of AWS Systems Manager that provides secure, hierarchical storage for configuration data management and secrets management
AWS Systems Manager Parameter Store
AWS service that enables you to replace hardcoded credentials in your code, including passwords, with an API call to retrieve the secret programmatically
AWS Secrets Manager
AWS service that handles the complexity of creating, storing, and renewing public and private SSL/TLS X.509 certificates and keys that protect your AWS websites and applications
AWS Certificate Manager
True/False: AWS Web Application Firewall can be deployed on the following:
Network Load Balancer
API Gateway
CloudFront
AppSync GraphQL API
Cognito user Pool
False -
Application Load Balancer
API Gateway
CloudFront
AppSync GraphQL API
Cognito user Pool
A managed DDoS protection service that safeguards applications running on AWS
AWS Shield
A security management service that allows you to centrally configure and manage firewall rules across your accounts and applications in AWS Organizations
AWS Firewall Manager
A security monitoring service that analyzes and processes data sources, such as AWS CloudTrail data events for Amazon S3 logs, CloudTrail management event logs, DNS logs, Amazon EBS volume data, Kubernetes audit logs, Amazon VPC flow logs, and RDS login activity
Amazon GuardDuty
A vulnerability management service that continuously scans your AWS workloads for software vulnerabilities and unintended network exposure
Amazon Inspector
A data security service that discovers sensitive data by using machine learning and pattern matching, provides visibility into data security risks, and enables automated protection against those risks
Amazon Macie
What three object types does Amazon Inspector evaluate?
EC2 instances, container images, and Lambda functions
True/False: To enable In-flight Encryption (In-Transit Encryption), we need to have an HTTPS endpoint with an SSL certificate
True
True/False: Server-Side Encryption means that the data is sent encrypted to the server.
False - The server encrypts the data for “data-at-rest”
In Server-Side Encryption, where do the encryption and decryption happen?
Both happen on the server
True/False: In Client-Side Encryption, the server must know our encryption scheme before we can upload the data
False - The server needs no information about the encryption scheme
True/False: AWS KMS supports both symmetric and asymmetric KMS keys.
True
You have a secret value that you use for encryption purposes, and you want to store and track the values of this secret over time. Which AWS service should you use?
SSM Parameter Store
Your user-facing website is a high-risk target for DDoS attacks and you would like to get 24/7 support in case they happen and AWS bill reimbursement for the incurred costs during the attack. What AWS service should you use?
AWS Shield Advanced
You have a website hosted on a fleet of EC2 instances fronted by an Application Load Balancer. What should you use to protect your website from common web application attacks (e.g., SQL Injection)?
AWS WAF
You would like to analyze OS vulnerabilities from within EC2 instances. You need these analyses to occur weekly and provide you with concrete recommendations in case vulnerabilities are found. Which AWS service should you use?
AWS Inspector
What is the most suitable AWS service for storing RDS DB passwords which also provides you automatic rotation?
AWS Secrets Manager
Which AWS service allows you to centrally manage EC2 Security Groups and AWS Shield Advanced across all AWS accounts in your AWS Organization?
AWS Firewall Manager
What are three AWS data sources that GuardDuty analyzes for malicious activity and unauthorized behavior?
AWS CloudTrail Events
Amazon VPC Flow Logs
DNS logs
True/False: If you delete a customer master key (CMK) in AWS Key Management Service (AWS KMS), then the key is immediately lost
False - KMS enforces a waiting period of 7-30 days before the key is deleted
If a company decides to stop using AWS GuardDuty, how can you ensure that all data gets deleted?
Disable the service in the general settings
What resources can you protect using a Web Application Firewall (WAF)?
Amazon CloudFront distribution
Amazon API Gateway REST API
Application Load Balancer
AWS AppSync GraphQL API
Amazon Cognito user pool
