Security and Compliance Exam Tips Flashcards
If you need an AWS service to have multiple IAM capabilities not offered by managed Roles or policies, how can you achieve this?
Through a custom policy or role
How can you create a new IAM policy?
Through the visual editor, or JSON
When you attach a role to an EC2 instance, how long does it take for the effect to propagate to the server?
Immediately
How long does it take for a newly attached policy to take effect on an EC2 instance?
right away
True or false: While attaching a policy or role takes effect immediately, changing a policy takes time to propagate the changes?
False: Changes are immediate.
Do you attach roles to EC2 instances via the CLI, or through the console?
Both - another trick question
MFA Enabling can be done via…
CLI or console
Can MFA be enabled for both root and user accounts?
yes
Should you remember at a high level how STS token authentication works?
Yes.
Which AWS services provide logging?
CloudTrail
Config
CloudWatch Logs
VPC flow Logs
True or False: CloudWatch monitor API calls?
False: CloudTrails monitors API calls.
True or False: CloudWatch monitors performace?
True
True or False: AWS Config records the state of your environment
True
If you need to be notified of changes to your environment, which service should you use?
AWS Config
While taking the exam, should you choose HVM, or PV wherever possible?
HVM
Do you have access to the AWS hypervisor?
No
Does AWS have access to your EC2 instances?
No
Does AWS scrub all RAM and storage before allocating to a new customer?
Yes
PV is isolated by layers. On which layer does the Guest OS sit? On which does the application sit?
Guest on layer 1
Application on layer 3
Do dedicated instances and dedicated hosts have dedicated hardware?
Yes
How are dedicated instances charged?
Per instance
How are dedicated hosts charged?
Per host
if you have specific licensing, regulatory or compliance requirements, should you choose dedicated instancs, or hosts?
Hosts
Can dedicated instances share hardware with other non-dedicated instances within the same AWS account?
yes
Do dedicated hosts give you better visibility in to things like sockets, cores, and host IDs?
Yes
In what two ways can you select instances to run commands using system manager?
via tagged groups, or manual selection
does an SSM agent need to be installed on managed instances?
Yes
Where are commands and parameters defined for Systems Manager?
in a Systems Manager Document
From where can commands be issued to EC2 instances?
AWS Console, CLI, Tools for Windows PowerShell, Systems Manager API, or Amazon SDKs
Can you manage on-prem systems using System Manager?
Yes
Where would you store confidential information such as passwords, license codes, etc for later use by your systems and applications?
AWS Systems Manager Parameter Store
Does the Parameter Store save string as clear text, or cipher?
Either, depending on your needs?
If you need to give access to an S3 object without needing to create an account, or make it public, how would you achieve this?
pre-signed URLs
How can pre-signed URLs be created
AWS SDK or CLI
What time unit are pre-signed URL availabilty based on?
Seconds
What is the default availability of a newly created pre-signed URL?
1 hour (3600 seconds)
What CLI command would you use to change the default availability time of a pre-signed URL?
–expires-in
Which two AWS Config rules should you be aware of for the SysOps exam?
No Public Read Access
No Public Write Access
How does Inspector work?
Create an assessment target Install agents on EC2 instances Create assessment template perform assessment run Review Findings against the rules
For Inspector, what Rules Packages are available?
Common vulnerabilities and exposures CIS Operating Systems Security Configuration Benchmarks Security Best Practices Runtime Behavior Analysis
What severity levels are there for Rules in AWS Inspector?
High
Medium
Low
Informational
What will an Inspector Run do?
Monitor the network, file system, and processess activity.
Compare what it sees to security rules
Report on security issues observed within target during run
Report findings and advise remediation
Will Inspector relieve you of the shared responsibility model, or perform miracles?
No, and… no.
What does Trusted Advisor advise on
Cost Optimization
Availability
Performance
Security
Should you do more research on the shared responsibility model?
yes
Are security groups stateless or stateful?
Stateful
What is AWS Artifact?
A place to download compliance documents, and a place to upload your compliance results for auditors and regulators.
True or False: A Cloud Guru practice exams will ask questions not covered in the lessons?
True. So take them, and research things that aren’t covered to ensure broader understanding of AWS stuff.
