Security and Monitoring Flashcards
Default security group behavior
deny all inbound traffic
SNMP
Simple Network Mgmt Protocol
monitor and manage network devices connected over an IP. SNMP is used for communication between routers, switches, firewalls, load balancers, servers, CCTV cameras, and wireless devices
HTTP
Hypertext transfer protocol
TCP
Transmission Control Protocol
enables application programs and computing devices to exchange messages over a network. It is designed to send packets across the internet and ensure the successful delivery of data and messages over networks.
TCP port 80 is used for non-encrypted web services, and TCP port 443 is used for encrypted web services.
IP
Internet Protocol
ICMP
Internet Message Control Protocol
used for reporting errors and performing network diagnostics. In the error reporting process, ICMP sends messages from the receiver to the sender when data does not come though as it should.
WMI
Windows Management Instrumentation Protocol
SSL
Secure Socket Layers
securing an internet connection by encrypting data sent between a website and a browser (or between two servers). It prevents hackers from seeing or stealing any information transferred, including personal or financial data.
Traceroute
Tool that use successive echo packets to display the path to the destination and the response time of each hop (ping)
Simple fault monitoring
system polls registered devices at established intervals to verify if they respond.
packet analyzer…or packet sniffer
standard tool for capturing packets.
Logs each packet it intercepts, decodes the packet, and presents the values of the various fields within the packet for examination.
Traffic Mirroring
direct network traffic coming to and from an EC2 instance to a separate Amazon EC2 based packet analyzerto analye
five phases of reliability pillar
generate, aggregate, alert, analyze, , storage
Cloudwatch
Monitoring service for AWS workloads and resources.
Cloudwatch Events
near real-time stream of events which describe resources changes
What do you use to send an email with a Cloudwatch Alarm?
SNS topic
Most important metrics to track
- Bandwidth capacity maximum data transmission rate
- Throughput: megabyte or gigabyte per second of data packets that are successfully being sent
- Latency
- Packet Loss
- Retransmission
- Availability (up tiime)
7 Connectivity: Nodes properly working - Network and Server response time
- Cloudwatch Metrics
Transit Gateway Manager
provides a single global view of your private network to visualize and monitor the health of your Amazon VPCs, Transit Gateways, Direct Connect, and VPN connections to branch locations and on-premises networks.
Wavelength
AWS Wavelength embeds AWS compute and storage services within 5G networks, providing mobile edge computing infrastructure for developing, deploying, and scaling ultra-low-latency application
VPC Flow Logs
information about the IP traffic going to and from network interfaces in your VPC.
SIM
Security Information Monitoring
SEM
Security Event Monitoring
AWS Compliance Frameworks
ensure regulation of data happens securely.
Benching Tools
How your network is performing.
Throughput and bandwidth are measured by benching tools
iPerf and IPefr3
Tools for active measurements of the maximum achievable bandwidth on IP networks. It supports tuning of various parameters related to timing, buffers, and protocols (TCP, UDP, SCTP with IPv4 and IPv6). For each test, they report the bandwidth, loss, and other parameters.
ExtraHop
monitoring solution for security, network performance, and the cloud. It gives detailed metrics on average bandwidth utilization, average throughput, and more.
Netperf
CLI tool similar to iPerf that measures throughput and benchmarking speeds.
CloudWatch agent
collect metrics for your Amazon EC2 instances and your on-premises servers.
How does Cloudwatch categorize Data?
A Namespace contains data and each different namespace holds different data. For example, all AWS data is contained inside a namespace named AWS/service.
Dimensions separates resources in the namespace
Systems Manager Agent (formerly ssm)
view and control your infrastructure on AWS
automate operational tasks across your AWS resources
maintain security and compliance by scanning your managed instances and reporting on (or taking corrective action on) any policy violations it detects.
Once installed EC2 becomes a managed instance
How do you collect Systems Mgr Agent logs
Sending to cloudwatch
T/F you can connect Cloudwatch Logs to your VPC using an endpoint.
True
Cloudwatch Insights
Visualize data in graphs and supports Cloudwatch Query language
Cloudwatch alarm types
Metric (one) , Composite (group)
