Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CLF-CO1 > Security and Compliance > Flashcards

Security and Compliance Flashcards

1
Q

Which service has a feature to download a report including the status of passwords and MFA devices?

A

IAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Where do you create access keys for accessing AWS via the CLI?

A

IAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Where do you control access to mobile and web applications?

A

Cognito

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What does Macie do?

A

Uses ML to discover and protects sensitive data in S3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What does Shield do?

A

It is a managed DDoS protection service, giving notifications of suspected attacks and assistance from AWS during the attack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Pillar of the Well-Architected Framework that includes the use of information gathered through a workload process evaluation to drive adoption of new services or resources when they become available?

A

Performance Efficiency - the effective use of resources to meet demand.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the 6 pillars of the Well-Architected Framework?

A

Cost optimisation
Operational excellence
Reliability
Performance efficiency
Sustainability+Security

CORPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Whose responsibility is it to manage the Lambda runtime environment?

A

AWS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Whose responsibility is it to manage the versions of Lambda function code?

A

Your’s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which service automatically and continually scans an S3 bucket for mobile app users’ addresses?

A

Macie - uses ML to discover sensitive data stored on Amazon S3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which is the most efficient AWS feature to allow a company to restrict IAM users from making changes to a common admin IAM role created in all accounts in their organisation?

A

Service control policies (SCPs).

A feature of Organizations that allows you to create permissions/guardrails that apply to all accounts in a given organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the best way to give S3 access to all applications running on an EC2 instance?

A

Use an instance profile to pass an IAM role with S3 permissions to the EC2 instance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Why would you not use a policy to give S3 access to all applications running on an EC2 instance?

A

Policies are used to manage permissions for IAM users, groups, and roles, not applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How would you solve an issue of an employee not being able to perform any RDS actions on the Clients table?

A

Add the user to the group that has the necessary permission policy.

Create an identity-based policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Who is responsible for managing network traffic?

A

You. Includes security group firewall configuration.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Who is responsible for maintaining networking components?

A

AWS. Includes generators, uninterruptible power supply (UPS) systems, computer room air conditioning (CRAC) units, fire suppression systems, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is GuardDuty?

A

An intelligent threat detection system than uncovers unauthorised behaviour.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which services can be used to prevent DDoS attacks?

A

AWS Shield Standard provides free protection against common and frequently occurring DDoS attacks.

Shield Advanced provides enhanced protections and 24/7 access to AWS experts for a fee, and is supported on Route 53, CloudFront, Elastic Load Balancing, AWS Global Accelerator.

Web Application Firewall (WAF) offers a “rate-based” rule that protects you from web-layer DDoS attacks, brute-force login attemps, and bots.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which service powers the creation of encrypted EBS volumes for EC2?

A

Key Management Service (KMS).

You can specify a KMS customer master key when you create an encrypted Amazon EBS volume.

20
Q

What is CloudHSM?

A

A hardware security module (HSM).

Generates encryption keys.

Used for handling encryption keys in AWS (not with EBS Volume Encryption)

21
Q

What does a developer need to log into an EC2 instance via SSH from their local machine?

A

Private key

SSH client

22
Q

What is KMS used for?

A

Generating keys for encrypting and decrypting data

23
Q

Which of these tasks require you to be signed in with root user credentials?

Close an AWS account

Changing the email address associated with the account

Configuring an S3 bucket to enable MFA

Creating a user with administrative access

Activating IAM access to Billing and Cost Management console

Modifying the support plan

A

Close an AWS account

Changing the email address associated with the account

Configuring an S3 bucket to enable MFA

Activating IAM access to Billing and Cost Management console

24
Q

Which security item is needed for developers to interact with AWS from the CLI?

A

Access key

25
Q

Which service allows grouping users together and applying permissions to them as a group?

A

AWS IAM

26
Q

Which service scans the contents of incoming or outgoing traffic for known attacks?

A

WAF

27
Q

What is the most efficient intelligent threat detection service for analysing malicious/unauthorised activity and continuously monitor CloudTrail event logs, Amazon VPC Flow Logs, and DNS logs?

A

Amazon GuardDuty

28
Q

Which service assesses software vulnerabilities and unintended network exposure of your EC2 instances?

A

Amazon Inspector

29
Q

What is Amazon Inspector?

A

An automated vulnerability management service.

Continually scans EC2 and container workloads for software vulnerabilities and unintended network exposure.

30
Q

What is WAF?

A

Helps protect web applications from attacks

Allows you to configure rules that allow, block, or monitor web requests

Considers conditions such as
* IP addresses
* HTTP headers
* HTTP body
* URI strings
* SQL injection
* cross-site scripting

31
Q

Does AWS Shield Standard provide post-attack analysis?

A

No

32
Q

Does AWS Shield Standard provide network flow monitoring?

A

Yes

33
Q

Does AWS Shield Standard provide assistance with protection from common DDoS attacks?

A

Yes

34
Q

Does AWS Shield Standard reimburse related Route 53, CloudFront, and ELB DDoS charges?

A

No

35
Q

What does AWS Shield Standard do?

A

Safeguards web applications.

Its features include network flow monitoring and assistance with protection from common DDoS attacks

36
Q

What type of logs does CloudWatch produce?

A

Application-based logs

37
Q

What does CloudTrail do?

A

Provides visibility to API call activity for AWS infrastructure and other services

38
Q

What should be used to set up a virtual firewall for an EC2 instance?

A

Security group

39
Q

What does a security group do?

A

Acts as a firewall to protect your EC2 instance by controlling inbound and outbound traffic

40
Q

What does a Network ACL (NACL) do?

A

Acts as a firewall at the subnet level

41
Q

When attaching policies to users, groups, and roles, are you attaching the policies to:
* Principals
* Entities, or
* Identities

A

Identities

42
Q

What are principals?

A

A person or application that uses the AWS account root user, an IAM user, or an IAM role to sign in and make requests to AWS

43
Q

What are identities?

A

IAM resource objects that are used to identify and group e.g. users, groups, roles

44
Q

What are entities?

A

The users (IAM and federated) and roles that are created and used for authentication

45
Q

What is the difference between KMS and Secrets Manager?

A

KMS:
Generate and store encryption keys
SM:
Manage and retrieve secrets (passwords/keys)

46
Q

Which AWS feature can be used to manage and automate tasks on many resources?

A

Resource groups

CLF-CO1 (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions