Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS SAA > Security > Flashcards

Security Flashcards

1
Q

What is a DDOS attack?

A

Attack that tries to make your service unavailable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are 3 types of DDOS attacks and at what layers?

A
  1. Syn Ack flood attack layer 4
  2. NTP Amplification attack layer 4
  3. HTTP/HTTPS flood attack layer 7
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is CloudTrail?

A

CloudTrail is a service that logs AWS API calls for ip address, time, and api call (request params, metadata, response)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Would CloudTrail be able to log SSH/RDP into EC2?

A

No it would not as it needs to be an API call.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Where are CloudTrail Logs stored?

A

S3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is AWS Shield?

A

It is free DDOS Protection for CloudFront, ELB, Route 53 against layer 3/4 attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is AWS Shield Advanced? What are 3

A
  1. Enhanced protection for CloudFront, ELB, Route 53
    2 Provides a dedicated 24/7 AWS response team
  2. Near realtime monitoring of DDOS attacks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How much is AWS Shield Advanced?

A

3k a month

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What Layer does AWS Shield protect? What about WAF?

A

AWS Shield protects against layer3/4

WAF protects against layer 7

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is WAF?

A

Web Application Firewall provides monitoring and access control for HTTP/HTTPS to ELB,Route 53,CloudFront

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What kinds of attacks does WAF protect against?

A

SQL Injection, Cross site scripting, DDOS layer 7

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What can WAF look at in requests that go through it?

A

It can look at

  1. IP addresses
  2. Request parameters
  3. string search patterns
  4. country originating
  5. if there is sql code or scripts
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What returns if WAF blocks access?

A

It will return a 403

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the 3 behvious of WAF?

A
  1. allow all content you specify
  2. block all content you specify
  3. count requests meeting the properties you specify
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is AWS Guard Duty? What can be triggered from it?

A

Threat detection Service that monitors your AWS account for malicious behavior using machine learning AI (taking a baseline)
External db of known threats
Can trigger lambda from Cloudwatch events if threat detected

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What does AWS Guard Duty monitor?

A

DNS Logs, Cloudtrail logs, VPC Flow logs

17
Q

What is AWS Macie?

A

Uses Machine learning to find PII/sensitive data in S3 and alerts you through EventBridge (which you can then automate remediation)

18
Q

What is AWS Inspector?

A

A security assessment service that inspects for vulnerabilities and best practices

19
Q

What are the 2 types of scanning AWS Inspector does? How do they differ?

A
  1. Network Assesment of configurations in VPC
  2. Host Assessment of EC2
    One does not need an agent installed while the other does
20
Q

What is KMS? What are CMK?

A

KMS is a service that lets you manage and create encryption keys.
CMK are customer master keys, the actual encryption key itself.

21
Q

What is CloudHSM?

A

A dedicated hardware security module in the cloud that generates your CMK

22
Q

What are 3 ways to generate a CMK?

A
  1. Use AWS HSM
  2. Use your own HSM
  3. Rent a cloud HSM from AWS
23
Q

What are 3 ways to control access to CMKs?

A
  1. Key policies (who can manage and use keys)
  2. IAM policies
  3. Grants with key policies (for delegation)
24
Q

What are 3 ways to control access to CMKs?

A
  1. Key policies (who can manage and use keys)
  2. IAM policies
  3. Grants with key policies (for delegation)
25
Q

What is AWS Secrets Manager?

A

Service that lets you store encrypted credentials and retrieve/rotate them. e.g. RDS

26
Q

What is AWS Parameter Store?

A

Service that lets you store your parameters in a hierarchy.

27
Q

What is the difference between Secrets Manager and Parameter store?

A

Secrets Manager can handle secrets at scale, but costs money

Parameter Store is free but can only handle 10k secrets, and doesn’t have key rotation

28
Q

What should you watch out for with Secrets Manager rotation?

A

When rotation is enabled, it will immediately attempt to rotate credentials once

29
Q

What is the encryption like for Secrets Manager?

A

Automatically encrypted in transit and at rest

30
Q

When should you use Presigned URL’s over Presigned Cookies?

A

Use Presigned URLs with you have a single resource needing public access
Use presigned cookies if there are multiple resources needing to be shared

31
Q

How do you share a video in a private S3 bucket?

A

Use a presigned url

32
Q

What is a presigned url?

A

A url generated with a time duration giving access to a private S3 bucket using the object owners credentials

33
Q

Why do we need presigned urls?

A

By default all objects in S3 are private and only object owner has permission to access

34
Q

How is a not explicitly allowed permission treated in IAM policy?

A

It is implicitly denied if it is not defined

35
Q

How is an explicit denied permission treated?

A

IAM will take the denial over everything else

36
Q

How does AWS treat multiple policies on attached to the same role?

A

The union of all permissions is taken.

37
Q

What is AWS Certificate Manager? What is the cost? What services does it work with?

A

Service that lets create/manage SSL certificates. Certificates are free and automatically renews/deploys for ELB, CLoudfront,APi Gateway

AWS SAA (20 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions