Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Certified Solutions Architect Associate > Security > Flashcards

Security Flashcards

1
Q

If you see a question that asks for an Intrusion Prevention System (IPS), think of…

A

Network Firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which AWS service has access to a database of known malicious IPs?

A

GuardDuty

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How does a Web ACL relate to AWS WAF?

A

A Web ACL is a configurable component of AWS WAF.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is GuardDuty?

A

A threat detection service that uses machine learning to continuously monitor for malicious behaviour.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which AWS services does AWS Shield work with?

A

ELB, CloudFront, Route53

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

If you see a scenario about multiple AWS accounts and resources that need to be secured centrally, think of…

A

AWS Firewall Manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which AWS service provides sign-up and sign-in options for your apps?

A

Cognito

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

If you see a question about filtering your network traffic before it even reaches your internet gateway, think of…

A

Network Firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What two types of assessment does Inspector offer and what do they check for?

A

Network - ports reachable from outside VPC.
Host - CVEs, security best practices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is AWS Network Firewall?

A

A managed service that deploys a physical firewall protection across your VPCs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

For exam questions that ask for an AI / automated solution to protect your AWS account, think of…

A

GuardDuty

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Apart from DDoS attacks, what kind of attacks can AWS WAF protect against?

A

SQL injection
Cross-site scripting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is KMS?

A

A managed services that makes it easy for you to manage the encryption keys used to encrypt your data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Shield/Shield Advanced protects against attacks on which layers?

A

Layers 3 and 4

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What logs does AWS GuardDuty monitor?

A

CloudTrail Logs
VPC Flow Logs
DNS Logs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Shield Advanced gives you 24/7 access to…

A

a dedicated DDoS response team.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

When should you use Secrets Manager over Parameter Store?

A

If you need:
- more than 10,000 parameters
- key rotation
- the ability to generate passwords with CloudFormation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Where can you view all your alerts from services like GuardDuty, Inspector, Macie, and Firewall Manager, across multiple accounts?

A

Security Hub

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What’s a typical use case for pre-signed cookies?

A

A stock photo website

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What does Inspector do?

A

It performs vulnerability scans on EC2 instances and VPCs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

If you need to share an object in a bucket, but both bucket and object are private, think of using…

A

pre-signed URLS.

22
Q

How does GuardDuty work?

A

It needs 7 - 14 days to set a baseline, then alerts on anomalies.

23
Q

If you enable rotation in Secrets Manager, when will be the next time it rotates the secret?

A

Immediately

24
Q

Which AWS tool operates across multiple AWS services and uses graph theory to uncover the root cause of an event?

A

Detective

25
Q

What does CloudTrail do?

A

It records actions in the AWS console and API calls.

i.e. it increases visibility.

26
Q

When would you use a pre-signed cookie?

A

When you want to provide access to multiple restricted files in an S3 bucket.

27
Q

What does AWS Certificate Manager do?

A

Allows you to create, manage, and deploy SSL certificates for use with other AWS services.

28
Q

Which tool can tell you, in real time, if you are being DDoSed?

A

AWS Shield Advanced

29
Q

When should you use Parameter Store over Secrets Manager?

A

When trying to minimize costs.

30
Q

How much does Shield Advanced cost?

A

$3000 per month

31
Q

What does CMK stand for?

A

Customer Master Key

32
Q

How do you start using KMS?

A

By requesting the creation of a CMK.

33
Q

To implement ratelimiting, would you use a Web ACL or a NACL?

A

Web ACL

34
Q

What layer does AWS WAF operate on?

A

Layer 7 (Application layer)

35
Q

If you need to block specific countries or IP addresses, you can use…

A

AWS WAF

36
Q

What are two benefits of AWS Certificate Manager?

A
  • Certificates are free.
  • It automates the renewal of your SSL certificate.
37
Q

What’s are 3 differences between a Web ACL and a NACL?

A

Web ACL:
- application layer (Inspects HTTP/S traffic)
- fine-grained control
- stateful

NACL:
- network layer (Inspects IP traffic)
- broad control
- stateless

38
Q

What does Cognito allow your users to do?

A

Sign in to your web or mobile apps with a username and password they create OR through a third party, e.g. Google, Facebook, Apple.

39
Q

What are the two limitations of Parameter Store?

A
  • There is a limit to the number of parameters you can store (currently 10,000)
  • No automatic key rotation
40
Q

For questions about HIPAA or GDPR compliance that asks about continuous auditing or automating audit reports, think of…

A

AWS Audit Manager

41
Q

What is Parameter Store?

A

Storage for configuration data management and secrets management.

42
Q

TRUE or FALSE?
Secrets Manager automatically rotates credentials

A

TRUE

43
Q

Where does CloudTrail store the logs?

A

S3

44
Q

In Cognito, what does an identity pool do?

A

It allows your users to access other AWS services.

45
Q

How can AWS Shield Advanced help with cost savings?

A

It protects your AWS bill against higher fees due to usage spikes during a DDoS attack.

46
Q

What can you do with Detective?

A

It lets you analyse the root cause of potential security issues or suspicious activities.

47
Q

What is AWS Shield?

A

Free DDoS protection

48
Q

What does AWS WAF do?

A

Monitors the HTTP(S) requests to CloudFront or an Application Load Balancer, and controls access to your content.

49
Q

What should you make sure of before enabling rotation in Secrets Manager?

A

That all applications that use those credentials are updated to retrieve them from Secrets Manager, and don’t have them embedded.

This is because Secrets Manager will rotate the credentials immediately, and your application will break.

50
Q

What does Macie do?

A

Uses machine learning and pattern matching to discover sensitive data stored in S3, e.g. PII

51
Q

If you want to get alerts on unencrypted or public S3 buckets, use…

A

Macie

AWS Certified Solutions Architect Associate (22 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions