Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Definitions > security > Flashcards

security Flashcards

1
Q

Well-architected framework

A

design principles and best practices for running workloads in the cloud.

  • Operational Excellence
  • Security
  • Reliability
  • Performance Efficiency
  • Cost optimization
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Operational Excellence

A 
CODECOMMIT
Focuses on creating applications that effectively support production workloads.
-plan for and anticipate failure
-script operations as code
-deploy smaller, reversible changes
-Learn from failure and refine
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Security

A

CLOUDTRAIL
Focus on putting mechanisms in place that help protect your systems and data
-Automate security tasks
-encrypt data in transit and at rest
-Assign only the least privilege’s required
-track who did what and when
-ensure security at all application layers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Reliability

A 
RDS
Focuses on designing systems that works consistently and recover quickly
-Recover from failure automatically
-Scale horizontally for resilience
-Reduce idle resources
-Manage change through automation
-Test recovery procedures
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Performance efficiency

A 
LAMBDA
Effectively use of computing resources to meet system and business requirements while removing bottlenecks
-Use serverless architectures first
-Use multi-region deployments
-Delegate tasks to a cloud vendor
-Experiment with virtual resources.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Cost Optimization

A

S3 intelligent -tiering
Focuses on delivering optimum and resilient solutions at the least cost to the user.
-Utilize consumption-based pricing
-Implement cloud financial management
-Measure overall efficiency
-Pay only for resources your application requires.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

CodeCommit

A

to enable tracking of code changes and version-control

Cloudformation templates of your infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

CloudTrail

A

You can configure central logging of all actions performed in your account

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

RDS

A

You can use Multi-AZ Deployments for enhanced availability and reliability of RDS databases

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Lambda

A

To run code with zero administration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

S3 Intelligent-Tiering

A

automatically move your data between access tiers based on your usage patterns.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

IAM

A

Allows you to control access to your AWS Services and resources.

  • Helps secure your cloud resources
  • You define who has access.
  • You define what they can do
  • a free global service
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Identities

A

WHO can access your resources

  • root user
  • individual user
  • groups-roles
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Access

A

WHAT resources they can access

  • policies
  • aws managed policies
  • customer managed policies
  • permissions boundaries
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Authentication

A

Where you present your identity and provide verification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Authorization

A

Determines which services and resources the authenticated identity has access to.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Users

A

Users are entities that you create in IAM to represent the person or application needing to access your AWS resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Root user

A

Created when you first open your AWS account.

  • close account
  • change email address
  • modify support plan
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Individual users

A

created in IAM and are used for everyday tasks.

  • Perform Administrative tasks
  • Access application code
  • Launch EC2 instances
  • configure databases
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Applications

A

You create a user in IAM so you can generate access keys for application running on-premises that needs access to your cloud resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Principle of least privilege

A

Giving a user the minimum access required to get the job done

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Developers

A

Responsible for building applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Project managers

A

Responsible for managing the budget

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

CLI

A

Command line interface.
Allows you to access resources in your AWS account through terminal or command windows. Access keys are needed when using the CLI and can be generated using IAM.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Groups

A

Collection of users of IAM users that helps you apply common access controls to all group members

  • -used to group users that perform similar tasks
  • access permissions apply to all members of the group
  • access is assigned using policies and roles.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Administrators

A

Perform admin tasks like creating new users

27
Q

Developer

A

Use compute and database services to build applications.

28
Q

Analysts

A

Run budget and usage reports

29
Q

Roles

A

Define access permissions and are temporarily assumed by an IAM user or service

  • You assume a role to perform a task in a single session.
  • Assumed by any user or service that needs it.
  • Access is assigned using policies
  • You grant users in one AWS account access to resources in another AWS account
30
Q

Policies

A

you manage permissions for IAM users, groups, and roles by creating a policy document in JSON format and attaching it.

31
Q

Bucket access policy

A

Add directly to an Amazon S3 bucket to grant IAM users access permissions for the bucket and objects in it.

32
Q

IAM best practices

A
  1. Enable MFA for privilaged users.
  2. Always implement strong password policies.
  3. Create individual users instead of using root user.
    Shouldn’t use the root user for daily tasks.
  4. Use roles for Amazon EC2 instances
33
Q

IAM Credential Report

A

Lists all users in your account and the status of their various credentials.

  • Lists all users and status of passwords, access keys, and MFA devices
  • used for auditing and compliance
34
Q

Firewall

A

prevent unauthorized access to your networks by inspecting incoming and outgoing traffic against security rules you’ve defined.

35
Q

WAF

A

Web application firewall.
Protects apps against common attack patterns
-Protects against SQL injection
-protects against cross-site scripting.

IRL: Deploy web application directly to EC2 instance. You can also deploy WAF on cloudfront as part of you CDN solution to block malicious traffic

36
Q

DDos

A

Distributed denial of service.

DDos attach causes traffic jam on a website or web application in attempt to cause it to crash.

37
Q

Shield

A

a managed ddos protection service.

  • Always-on detection
  • Shield standard is free
  • shield advanced is a paid service
38
Q

Shield Standard

A

Provides free protection against common and frequent occurring attacks

39
Q

Shield Advanced

A

Provides enhanced protections and 24/7 access to AWS experts for a fee

40
Q

DDos Protection via shield advanced is supported on several services

A
  • Cloudfront
  • Route53
  • Elastic load balancing
  • AWS Global accelerator.
41
Q

Macie

A

Helps discover and protect sensitive data.

  • Uses machine learning
  • evaluates s3 environment
  • uncovers PII (personal identifiable identifications)
42
Q

Config

A

Allows you to asses, audit, and evaluate the configurations of your resources.

  • Track configuration changes over time.
  • Delivers configuration history file to S3
  • Notifications via SNS of every configuration change
  • Allows you to record configuration changes with your EC2 instances. You can view network, software and OS configuration changes, system-level updates
43
Q

GuardDuty

A

An intelligent threat detection system that uncovers unauthorized behavior
-uses machine learning
-built-in detection for EC2, S3, and IAM
-Reviews Cloudtrail, VPC flow logs, and DNS logs
IRW: anomaly detection feature evaluates all API requests in your account and identifies events that are associated with common techniques used by attackers.

44
Q

Inspector

A

Works with EC2 instances to uncover and report vulnerabilities.
-Agent installed on EC2 instances (only works for EC2 instances)
-Reports vulnerabilities found
-Checks access from the internet, remote root login, vulnerable software versions
IRW: has several built in rules to access your EC2 instances to find vulnerabilities and report them prioritized by level of severity

45
Q

Artifact

A

Offers on-demand access to AWS security and compliance reports.
-Central repository for compliance reports from third-party auditors.
-Service organization controls (SOC) reports
-Payment card industry (PCI) reports.
IRW: provides a central repository for AWS’s security and compliance reports via self-service portal.

46
Q

Cognito

A

Helps you control access to mobile and web applications.

-provides authentication and authorization.
-Helps you manage users
-Assist with user sign up and sign in to mobile or web app.
IRW: provides functionality that allows your users to sign in to your application through social media accounts like facebook or google.

47
Q

data in flight

A

data that is moving from one location to another

48
Q

data at rest

A

Data that is inactive or stored for later use

49
Q

KMS

A

Key management service (KMS).
Allows you to generate and store encryption keys
-Key generator
-Store and control keys
-AWS manages encryption keys
-automatically enabled for certain services.
IRW: When you create a encrypted Amazon EBS volume, you are able to specify a KMS customer master key.

50
Q

CloudHSM

A

a hardware security module (HSM) used to generate encryption keys
-Dedicated hardware for security
-generate and manage your own encryption keys
-AWS does not have access to your keys
IRW: Allows you to meet corporate, contractual, and regulatory compliance requirements for data security by using dedicated hardware in the cloud.

51
Q

Secrets Manager

A

Allows you to manage and retrieve secrets (password or keys).
-rotate, manage and retrieve secrets
-encrypt secrets at rest
-integrates with services like RDS, Redshift and DocumentDB
IRW: Allows you to retrieve database credentials with a call to secrets Manager APIs, removing the need to hardcode sensative information in plain tedxt within your application code.

52
Q

Fault tolerance

A

Property that e4nables a system to continue to operating properly in the event of the failure of one or more components

53
Q

Firewall

A

a type of software that either allows or blocks certain kinds of internet traffic to pass through it

54
Q

Folder

A

Any “subfolder” created in a bucket

55
Q

High Availability

A

refers to systems that are durable and likely to operate continuously without failure for a long time

56
Q

organizations

A

Access manage billing and access to multiple AWS accounts in one user interface

57
Q

Publishers

A

Human/alarm/event that gives the SNS message to be sent

58
Q

RDS

A

relational database service.

SQL database service that provides a wide range of SQL database options to select from

59
Q

subnet

A

a subsection of a network and generally includes all the computers in specific region

60
Q

subscriptions

A

endpoints to which a topic sends messages

61
Q

Topic

A

how you label and group different endpoints to which you send messages

62
Q

Trusted advisor

A

service that “advises” and help you optimize apsects of your aws account

63
Q

Elastic beanstalk

A

service for deploying and scaling web applications and services developed with java, net, php, node.js

AWS Definitions (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions