Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Cloud Practitioner > Security & Compliance > Flashcards

Security & Compliance Flashcards

1
Q

What is AWS’s responsibility with security?

A

Security OF the cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is your responsibility with security?

A

Security IN the cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are shared responsibilities with between AWS and you?

A
  1. Patch Management
  2. Configuration Management
  3. Awareness and Training
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is DDOS attack?

A

Distributed Denial of service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What does AWS Shield Standard do to help against DDOS attack?

A

Protects against DDOS attack for your website and applications, for all customers at no additional cost

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What does AWS Shield Advanced do to help against DDOS attack?

A

24/7 premium DDOS protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What does AWS WAF (web application firewall) do to help with DDOS attack?

A

Filter specific requests based on rules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How does CloudFront and Route 53 protect against DDOS?

A

Availability protection using global edge network and combined with AWS Shield provides attack mitigation at the edge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What role does AWS Auto Scaling have in a DDOS attack?

A

Scale to provide more servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is AWS Shield?

A

Free service that is activated for every AWS customer. Provides protection from attacks on layers 3 and 4

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is AWS Shield Advanced?

A

Optional DDoS mitigation service ($3000 per month per organization). Protect against more sophisticated attacks. 24/7 access to AWS DDoS response team (DRP). Protect against higher fees during usage spikes due to DDoS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is AWS WAF?

A

Protects your web applications from common web exploits (layer 7). Deploy on ALB, API Gateway, CloudFront. Define Web Access Control List (ACL)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is layer 7?

A

HTTP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is layer 4?

A

TCP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Can you do penetration testing on AWS?

A

You can test some of your own infrastructure without approval, but only some and only some types of attacks. Others you need approval

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Data at rest?

A

Data stored or archived on a device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Data in transit?

A

Data being moved from one location to another

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is used to encrypt data?

A

Encryption keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is AWS KMS (Key Management Service)?

A

AWS manages the encryption keys for us

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is CloudHSM?

A

AWS provisions encryption hardware. Dedicated hardware (HSM = Hardware security module) is sent and you manage your own encryption keys entirely

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What types of customer master keys: CMK (customer master keys)?

A
  1. Customer Managed CMK
  2. AWS managed CMK
  3. AWS owned CMK
  4. CloudHSM Keys (custom keystore)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is customer managed CMK?

A

Create, manage, and used by the customer, can enable or disable. Can have a rotation policy and can have possibility of bring-your-own-key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is AWS managed CMK?

A

Created, managed, and used on the custom’s behalf by AWS, used by aws services

24
Q

What is AWS owned CMK?

A

Collection of CMKs that an AWS service owns and manages to use in multiple account. You cannot see the keys

25
Q

What is CloudHSM Keys?

A

Keys generated from your own CloudHSM hardware device

26
Q

What is AWS Certificate Manger (ACM)?

A

Lets you easily provision, manage, and deploy SSL/TLS Certificates. Used to provide in-flight encryption for websites (HTTPS), free of charge for public TLS certificates and loads certificates to services

27
Q

What is AWS Secrets Manager?

A

Meant for storing secrets. Capability to force rotation of secrets every X days. Mostly meant for RDS integration

28
Q

What is AWS Artifact?

A

Not really a service, but is a portal that provides customers with on-demand access to AWS compliance documentation and AWS agreements. Can be used to support internal audit or compliance

29
Q

What is Artifact Reports?

A

Allows you to download AWS security and compliance documents from third party auditors

30
Q

What is Artifact Agreements?

A

Allows you to review, accept, and track the status of AWS agreements.

31
Q

What is Amazon GuardDuty?

A

Intelligent Threat discovery to Protect AWS account. Uses machine learning to look for anomaly in logs. Can setup CloudWatch Event rule to be notified in case of findings

32
Q

What is Amazon Inspector?

A

Automated Security Assessments for EC2 Instances. After assessment you get a report with list of vulnerabilities

33
Q

What is AWS Config?

A

Helps with auditing and recording compliance with your AWS resources. Helps record configurations and changes over time. Per region service, but can be aggregated across regions and accounts

34
Q

What is AWS Macie?

A

Fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect your sensitive data, personally identifiable information (PII). in AWS. Helps identify and alerts you of findings

35
Q

What is AWS security Hub?

A

Central security tool to manage security across several AWS accounts and automate security checks. Need to first enable AWS Config service

36
Q

What is Amazon Detective?

A

Analyzes, investigates, and quickly identifies the root cause of security issues or suspicious activities.

37
Q

What is AWS Abuse?

A

Report to abuse team if you suspect abuse

38
Q

What is root user prileges?

A

Root user is Account Owner. Has complete access to all AWS services and resources. Can do things even the most privileged created users can’t do

39
Q

What actions can only a root user do?

A
  1. Change account settings
  2. Close your AWS account
  3. Change or cancel your AWS Support plan
  4. Register as a seller in the Reserved Instance Marketplace
40
Q

Data sitting on an RDS instance would be referred to as?

  1. Data in transit
  2. Data at rest
  3. Encrypted data
A

Data at rest

41
Q

According to the Shared Responsibility Model, who is responsible for firewall and network configuration for EC2 Instances?

  1. AWS
  2. The customer
  3. AWS and the customer
A

The customer

42
Q

Which of the following services can you use to discover and protect your sensitive data in AWS?

  1. Macie
  2. Shield
  3. Artifact
  4. X-Ray
A

Macie

43
Q

Which AWS service lets you quickly find the root of potential security issues to take faster actions?

  1. Inspector
  2. Detective
  3. CloudWatch
  4. WAF
A

Detective

44
Q

A company would like to protect its web applications from common web exploits that may affect availability, compromise security, or consume excessive resources. Which AWS service should they use?

  1. Auto Scaling Groups
  2. Shield
  3. CloudHSM
  4. Web Application Firewall
A

Web Application Firewall

45
Q

Where can you find on-demand access to AWS compliance documentation and AWS agreements?

  1. Artifact
  2. Personal Health Dashboard
  3. Secrets Manger
  4. Shared Responsibility Model
A

Artifact

46
Q

You can perform any kind of penetration testing on any AWS service without prior approval

  1. True
  2. False
A

False

47
Q

You want to record configurations and changes over time. Which service allows you to do this?

  1. Config
  2. Inspector
  3. GuardDuty
  4. Secrets Manager
A

Config

48
Q

According to the shared responsibility model, who is responsible for patch management?

  1. AWS
  2. The customer
  3. AWS and the customer
A

AWS and the customer

49
Q

You want to centrally automate security checks across several AWS accounts. Which AWS service can you use?

  1. Macie
  2. Detective
  3. CloudTrail
  4. Security Hub
A

Security Hub

50
Q

Which of the following services is managed by AWS and is used to manage encryption keys?

  1. CloudHSM
  2. KMS
  3. AWS Secrets Manager
  4. IAM
A

KMS

51
Q

A company would like to automate security on EC2 instances to assess security and vulnerabilities in these instances. Which AWS service should it use?

  1. Config
  2. Trusted Advisor
  3. Inspector
  4. Systems Manager
A

Inspector

52
Q

Which of the following actions does NOT require the root user?

  1. Close your AWS account
  2. Change your AWS Support Plan
  3. Register as a seller in the Reserved Instance Marketplace
  4. Access the billing dashboard
A

Access the billing dashboard

53
Q

According to the Shared Responsibility Model, who is responsible for protecting hardware?

  1. AWS
  2. The customer
  3. AWS and the customer
A

AWS

54
Q

Which AWS service’s ONLY role is to safeguard running applications from DDoS attacks?

  1. WAF
  2. Shield
  3. CloudFront
  4. KMS
A

Shield

55
Q

Which service is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads?

  1. KMS
  2. WAF
  3. Inspector
  4. GuardDuty
A

GuardDuty

56
Q

Which of the following options is NOT a situation where you should contact the AWS Abuse team?

  1. DDoS attack from AWS-owned IP addresses
  2. Spam from AWS-owned IP addresses or AWS resources
  3. Hosting objectionable or copyrighted content on AWs
  4. Losing your MFA device
A

Losing your MFA device

AWS Cloud Practitioner (20 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions