Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS CP > Security > Flashcards

Security Flashcards

1
Q

What is AWS artefact?

A

features comprehensive list of acmes-controlled documents relevant to compliance and security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which compliance programs does AWS have?

A 
Can access reports for auditors:
ISO
CSA
PCI - credit card
SOC
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the shared responsibility model?

A

AWS manages security of the cloud, security in the cloud is the responsibility of the customer
Customers retain control of what security they choose to implement their own content, platform, applications, systems and networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are examples of what the customer is responsible for with EC2?

A

Security groups, IAM users, patching EC2 operating systems, patching databases running on EC2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are examples of what AWS is responsible for?

A

Management of data centres, security cameras, cabling, patching RDS operating system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the AWS WAF?

A

Web application firewall
Protects your web application from common web exploits that could affect application availability, compromises security, or consume excessive resources
Layer 7 - sees traffic from application layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is AWS shield ?

A

Managed distributed denial of service (DDos) protection service that safeguards web applications running on AWS
Provides always-on detection and automatic inline mitigations that minimise application downtime and latency, so there is no need to engage AWS Support to benefit from DDoS protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the tiers of AWS shield?

A

Standard

Advanced

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is AWS inspector?

A

Automated security assessment service that helps improve the security and compliance of applications deployed on AWS
Automatically assesses applications for vulnerabilities or deviations from best practices
After an assessment it produces a detailed list of security findings prioritised by level of severity
These findings can be reviewed directly or as part of detailed assessment reports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is AWS trusted advisor?

A

Online resource to help you reduce cost, increase performance, and improve security by optimising your AWS environment
Provides real time guidance to help you provision your resources following AWS best practises
Advisors will advise you on Cost optimisation, performance, security, fault tolerance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the tiers of AWS trusted advisor?

A

Core checks and recommendations

Full trusted advisor - business and enterprise companies only

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is AWS CloudTrail?

A

Increases visibility into your used and resource activity. by recording AWS Management Console actions and API calls
You can identify which users and accounts called AWS, the source IP address from which the calls were made and when the calls occurred

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Where does trusted advisor apply?

A

Global service - not regional

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is CloudWatch?

A 
Monitors performance:
Host level metrics:
CPU
Network
Disk
Status check
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is AWS Config?

A

Detailed view of the configuration of AWS resources in your AWS account
Includes how the resources are related to one another and how they were configured int he past so that you can see how the configurations and relationships change over time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the key services provided by trusted advisor?

A 
Cost optimisation 
Security
Performance
Fault tolerance
Service limits

To unlock full must upgrade to business

17
Q

What is penetration testing?

A

Simulated cyber attack against your computer system to check for exploitable vulnerabilities

18
Q

Which services can you test without approval? (8)

A 
EC2, NAT gateways, ELB
Amazon RDS
Amazon CloudFront
Amazon Aurora
Amazon API Gateway
AWS Lamda
Amazon Lightsail Resources
Amazon Elastic Beanstalk Environments
19
Q

What are prohibited activities?

A 
1 DNS zone walking via amazon route 53 Hosted Zones
2 DoS, DDos, Simulated DDoS
3 Port flooding
4 Protocol flooding
5 Request flooding
20
Q

What is Amazon KMS?

A

Key management service
Regional service that does secure management and encryption/decryption
Manages customer master keys
Ideal for S3 objects, database passwords, API keys
Encrypt and decrypt data put to 4KB
Integrated with most AWS services
KMS is on shared hardware

21
Q

What is CloudHSM?

A

Dedicated hardware security module
FIPS140-2 Level3
Single tenant, dedicated hardware, multi-AZ cluster

22
Q

What is parameter store?

A

Component of AWS Systems manager
secure serverless storage of configuration nd secrets
Values stored encrypted KMS or plaintext
Can set TTL
No cost to use however limit of 10000 parameters per account

23
Q

What is secrets manager?

A

Charge per secret stored and per 10000 API calls
automatically rotate secrets
apply the new key/password for RDS for you
generate random secrets

24
Q

What is GuardDuty?

A

Uses machine learning algorithms for anomaly detection and third-party data to monitor and protect your AWS account
One click to enable (30-day trial)
Input data includes - cloud trail, VPC flow, DNS logs

25
Q

What is Amazon Control Tower?

A

the easiest way to set up and govern a new, secure, multi-account AWS environment
Those accounts will conform to company policies
Large enterprises

26
Q

What is security hub?

A

A comprehensive view of your security alert across multiple AWS accounts
Aggregates, organises, and prioritises your security alerts or findings

27
Q

How to resolve compromised IAM credentials?

A 
1 Determine what resources those credentials have access to
2 Invalidate the IAM credentials
3 Consider any temporary credentials
4 Restore appropriate access
5 Review access to AWS account
28
Q

What is Athena?

A

Interactive query service which enables you to analyse and query data located in S3 using standard SQL
Serverless
No need for ETL
Works with S3

29
Q

What can Athena be used for?

A

Log files
Business reports
Analyse AWS cost and usage reports
Run queries on click-stream data

30
Q

What is PII?

A

Personal data used to establish an individual’s identity
Home address, email, SSN
Passport number, driver license number
DOB, phone number, bank account

31
Q

What is Macie?

A

security service uses machine learning and NLP to discover, classify and protect sensitive data stored in S3
Can analyse CloudTrail for suspicious API activity
Includes dashboards, reports and alerting
Great for PCI-DSS compliance and preventing ID theft

32
Q

What is AWS acceptable use policy?

A

Describes prohibited actions on AWS infrastructure:
No illegal, harmful, or offensive use or content
No security violations
No network abuse
No email or other message abuse

33
Q

How can cloudwatch alarms alert the customer?

A 
SNS via:
HTTPS
SQS
Lambda
mobile push notification
Email
SMS

AWS CP (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions