Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS > Security and Monitoring > Flashcards

Security and Monitoring Flashcards

1
Q

What is a security group?

A

A virtual firewall for EC2 instances

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is bootstrap scripts?

A

a script that runs when instance first runs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

what permissions does bootstrap script have?

A

full administrative access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How long does it take for changes to security groups to occur?

A

Immediately

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How many EC2 instances can you have in a security group?

A

Any number

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Why can there only be one security group attached to an EC2 instance?

A

There can many security groups attached to an EC2 instance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What inbound traffic is blocked by default?

A

All inbound traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Is a network ACL or security group hit first when a request is coming from the internet into a public subnet?

A

The network ACL is hit first

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What does 0.0.0.0/0 do?

A

Let’s everything in

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the first line of defense?

A

Network ACL’s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a Network ACL?

A

An layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

By default what inbound and outbound traffic is allowed by the default network ACL?

A

All

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Does a VPC automatically have a network ACL?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What inbound and outbound traffic is allowed by default in a custom network ACL?

A

None

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Should you block IP addresses using a network ACL’s or security groups

A

Network ACL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How many network ACL’s can a subnet be associated with?

A

One

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Are security groups or network ACL’s stateless?

A

Network ACL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

In what order are the network ACL’s numbered list of rules evaluated?

A

In order from lowest number

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What does VPN Cloudhub do?

A

Connect multiple sites with differing VPN’s together

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What measure does VPN Cloudhub do to protect your data since it uses the public internet?

A

Encrypts your data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is cloudwatch?

A

A monitoring and observability platform designed to give insight into your AWS architecture and potential problems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What should you create to notify you of a system failure?

A

An alarm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are default metrics for cloudwatch?

A

CPU utilization and network throughout

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are custom metrics for cloudwatch?

A

EC2 memory utilization, EBS storage capacity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is cloudwatch logs?

A

A tool that allows you to monitor, store, and access log files from a variety of sources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is a log event?

A

A record of what happened

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What does a log event contain?

A

The data and a timestamp

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is a log stream?

A

A collection of log events from the same source

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is a log group?

A

A collection of log streams

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is a filter pattern in cloud watch logs?

A

A way to look for specific errors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is Amazon managed Grafana?

A

Fully managed AWS service allowing instant querying correlating and visualizing of your operational metrics, logs, and traces

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What are Grafana workspaces?

A

areas created to allow separate data visualizations and querying

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Does Grafana have built in security?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What are some key use examples for Amazon managed Grafana?

A

container metric visualizations, internet of things monitoring, troubleshooting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is Amazon managed service for prometheus?

A

Serverless, prometheus compatible service used for securely monitoring container metrics at scale

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is CloudTrail?

A

it increases visibility into your user and resource activity by recording AWS Management Console actions and API calls

37
Q

What is logged with CloudTrails?

A

Metadata of API call, identity of API caller, time of API call, source IP address of API caller, request parameters, response elements returned by server

38
Q

What is logged with CloudTrails?

A

Metadata of API call, identity of API caller, time of API call, source IP address of API caller, request parameters, response elements returned by server

39
Q

What can you think of CloudTrails as?

A

The CCTV system of your AWS account

40
Q

What is AWS Shield?

A

Free DDoS protection for ELB, CloudFront, and Route 53

41
Q

What layer attacks does Shield protect against?

A

Layer 3/4 (SYN floods, reflection attacks, etc)

42
Q

What is AWS Shield Advanced?

A

Enhanced protection for ELB, Cloudfront, and Route 53

43
Q

What is the difference between Shield and Shield Advanced?

A

24/7 access to DDoS response time, real time alerts, and Advanced is 3000 per month

44
Q

What is AWS WAF?

A

AWS web application firewall is a service that lets you monitor the HTTP and HTTPS requests that are forwarded to Amazon CloudFront or an application load balancer

45
Q

If you want to control what IP addresses are allowed to make requests, what should you use?

A

AWS WAF

46
Q

If you are afraid of layer 7 attacks, what should you use?

A

AWS WAF

47
Q

What are the three conditions available on AWS WAF?

A

Allow all (except what you specify), deny all (except what you specify), count what matches conditions you stated

48
Q

What is AWS GuardDuty?

A

A threat detection service that uses machine learning to continuously monitor for malicious behavior

49
Q

Where do GuardDuty alerts appear?

A

GuardDuty console and Cloudwatch events

50
Q

What does GuardDuty monitor?

A

Cloudtrail logs, VPC flow logs, and DNS logs

51
Q

What is firewall manager?

A

A security management service that goes across multiple AWS accounts

52
Q

What is Macie?

A

Uses machine learning and pattern matching to discover sensitive data stored in S3

53
Q

Can Macie utilize automated remediation actions?

A

Yes

54
Q

What is amazon inspector?

A

Automatically assesses applications for vulnerabilities or deviations from best practice

55
Q

What are the 2 types of Amazon inspector assessments?

A

Network assessments, host assessments

56
Q

What is KMS?

A

Key management service

57
Q

What is a CMK in regards to KMS?

A

A customer master key is a logical representation of a master key

58
Q

What is a HSM?

A

a hardware security module is a physical computing device that safeguards and manages digital keys and performs encryption and decryption functions

59
Q

What are the three ways a CMK is created?

A

AWS creates it for you in HSMs, import key material from own key management infrastructure, have key material generated in AWS CloudHSM cluster

60
Q

How often can you have AWS KMS rotate the CMK?

A

every year

61
Q

What CMKs do not support automatics key rotation?

A

imported keys, asymmetric keys, or keys generated in AWS CloudHSM

62
Q

What type of policy do KMS CMK’s require?

A

a resource policy

63
Q

What is the difference between KMS and CloudHSM?

A

KMS has shared tenancy of underlying hardware, CloudHSM is dedicated to you, KSM has automatic key rotation, CloudHSM does not

64
Q

What is Secrets Manager?

A

A service that securely stores, encrypts, and rotates your database credentials and other secrets

65
Q

What must you do before enabling credential rotation?

A

make sure all application instances are configured to use secrets manager

66
Q

Does secret manager rotate credentials automatically?

A

Yes

67
Q

What is parameter store?

A

a capability of AWS systems manager that provides secure, hierarchical storage

68
Q

If you are trying minimize costs and don’t need key rotation, what secure storage solution should you use?

A

parameter storage

69
Q

What is the maximum amount of parameters for parameter storage?

A

10,000

70
Q

How can the owner of a private object in S3 grant time limited permission to download the object?

A

by creating a presigned URL

71
Q

if you want someone to have access to all the contents of multiple restricted files, what should you use?

A

Presigned cookies

72
Q

What is AWS Certificate Manager?

A

allows you to create, manage, and deploy public and private SSL certificates for use with other AWS services

73
Q

How much does AWS charge for provisioning public and private certificates?

A

for free

74
Q

Does AWS Certificate Manager automatically renew and deploy certificates?

A

Yes

75
Q

What service should you use to manage your SSL certificates?

A

AWS Certificate manager

76
Q

What is AWS audit manager?

A

with it, you can continuously audit your AWS usage to make sure you stay compliant with industry standards and regulations

77
Q

Is audit manager an automated service?

A

yes

78
Q

If you need continuous auditing, what should you use?

A

audit manager

79
Q

What is AWS artifact?

A

A single source you can visit to get the compliance -related information that matters to you

80
Q

If you need to compliance reports, what should you use?

A

AWS artifact

81
Q

What is amazon cognito?

A

it provides authentication, authorization, and user management for your web and mobile apps in a single service without the need for custom code

82
Q

What is the series of events that Cognito does to sign in?

A

Authenticates and gets a token, exchanges that token in for AWS credentials in the identity pool, finally uses AWS credentials to sign in

83
Q

What is Amazon Detective?

A

it pulls data in from your AWS resources and uses machine learning, stat analysis, and graph theory to quickly figure out the root cause of your security issues

84
Q

If you need to know the root cause of an event, what should you use?

A

Amazon detective

85
Q

What is network firewall?

A

a managed service that makes it easy to deploy a physical firewall across your VPC’s.

86
Q

Does AWS Network Firewall work with Firewall Manager?

A

Yes

87
Q

If you need an intrusion prevention system or to filter internet traffic before it reaches your gateway, what should you use?

A

AWS Network FIrewall

88
Q

If you need an intrusion prevention system or to filter internet traffic before it reaches your gateway, what should you use?

A

AWS Network FIrewall

89
Q

What is AWS Security Hub?

A

a single place to view all your security alerts from differing services

AWS (18 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions