Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

SysOps Admin > Security & Compliance > Flashcards

Security & Compliance Flashcards

1
Q

Compliance Frameworks

A 
ISO
PCI
HIPAA
FedRAMP
NIST
SAS70
SOC1
FISMA
FIPS140-2
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

How to mitigate DDoS attacks?

A 
Minimize the attack surface area
- use ALB with WAFs
Be ready to scale to absorb attacks
- use auto scaling groups
Safeguard exposed resources
- Learn normal behaviour of your application
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q
  • It’s a free service that protects all AWS customers on Elastic Load Balancing, Amazon CloudFront and Route 53.
  • It protects against SYN/UDP floods, reflection attacks, and other Layer 3 and Layer 4 attacks.
A

AWS Shield

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q
  • provides a always-on flow-based monitoring of network traffic and active application monitoring to provide near real-time notifications of DDoS attacks.
  • DDoS Response Team 24x7 to manage and mitigate application layer DDoS attacks
  • Protects your AWS bill against higher fees due to Elastic Load Balancing, CloudFront and Route 53 usage spikes during a DDoS attack.
  • $3000 a month
A

AWS Shield Advanced

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What services can you use to mitigate DDoS attacks?

A
  • CloudFront
  • ELBs
  • Route53
  • WAF
  • Autoscaling
  • CloudWatch
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How can you get a report of all of the users in your account who uses MFA?

A

Get credential reports on the IAM console.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which service is used to grant users limited and temporary access to AWS resources.
User can come from three sources:
- Federation (typically done with Active Directory)
- Federation with Mobile Apps
- Cross Account Access

A

Security Token Service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Joining a list of users in one domain (such as IAM) with a list of users in another domain (such as AD, Facebook, etc), what does this define?

  • Federation
  • Identity Broker
  • Identity Store
  • Identity?
A

Federation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

A service that allows you to take an identity from point A and join it (federate it) to point B, what does this define?

A

Identity Broker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Services like AD, Facebook, Google, etc., what does this define?

  • Federation
  • Identity Broker
  • Identity Store
  • Identity?
A

Identity Store

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

A user of a service like Facebook, etc., what does this define?

  • Federation
  • Identity Broker
  • Identity Store
  • Identity?
A

Identity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How does STS work?

A
  1. Authenticate against third party first (AD, Facebook, Google)
  2. Then you authenticate against STS.
  3. STS will give you a token.
  4. When you try and access your AWS resource
  5. That resource will check that token against IAM
  6. If everything’s correct it will give you access to the platform.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

4 Main services for Security & Logging

A
  • AWS CloudTrail - API Calls
  • AWS Config - Alerts any changes
  • AWS CloudWatch
  • VPC Flow Logs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How can you control access to Log Files?

3 ways

A
  • IAM users, groups, roles and policies
  • S3 bucket policies
  • MFA
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How can you obtain alerts on Log File Creation and Misconfiguration?

A
  • Alerts when logs are created or fail:
  • CloudTrail notifications
  • AWS Config Rules
  • Alerts are specific, but don’t divulge detail:
  • CloudTrail SNS notifications only point to log file location
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How can you manage changes to AWS Resources and Log files?

A

Log changes to system components:

  • CloudTrail
  • AWS Config Rules

Controls exist to prevent modifications to logs:

  • IAM and S3 controls and policies
  • CloudTrail log file validation → you can see if somebody modified log files
  • CloudTrail log file encryption
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is WAF?

A
  • Layer 7 Firewall
  • Monitor HTTP/HTTPS requests that are forwarded to CloudFront, ALB, or API Gateway.
  • Let’s you control access to your content.
  • IP addresses
  • Query string parameters
  • If blocked, user gets a 403 error code.
18
Q

WAF Behaviors:

A
  • Allow all or Block all requests except the ones that you specify
  • Count the requests that match the properties you specify
19
Q

WAF provides more protection against web attacks using conditions that you specify, give some examples.

A
  • IP addresses that requests originate from
  • Country
  • Values in request headers
  • Strings that appear in requests, either specific string or string that match regular expression (regex) patterns.
  • SQL Injection
  • Cross-site scripting
20
Q

Which services does WAF Integrates with?

A
  • CloudFront
  • API Gateway
  • Application Load Balancer (only)
21
Q

In an IAM policy, what action does IAM:PassRole allows?

A

The IAM:PassRole allows any affected entity to pass roles to AWS services or Accounts, granting them permission to assume the role.

22
Q

Using AWS WAF, two types of rules can be set:
- Regular rules
- Rate-based rules
What is the difference between them two?

A

Regular rule:
- Allow or block a matching IP address
Rate-based rules:
- It considers the number of requests coming from a particular IP in a five minute interval, if those requests exceeds the threshold limit, WAF will block the IP address.

23
Q

What is Hypervisor?

A

Hypervisor is the physical host that is going to run your virtual machines.

24
Q

What is HVM?

A

Hardware Virtual Machine

  • Windows only
  • Guests are fully virtualized.
  • The VMs on top of the hypervisor are no aware that they are sharing processing time with other VMs
25
Q

What is PV?

A

Paravirtualization

  • Linux and Windows
  • Lighter form of virtualization, used to be quicker.
  • Isolated by layers, from 0 to 3:
    • Layer 0: Host OS
    • Layer 1: Guest OS
    • Layer 3: Application
26
Q

Which type of instance should you use if you have specific regulatory requirements or licensing conditions?

A

Dedicated Hosts

27
Q

True or false: Both Dedicated Instances and Dedicated Hosts have dedicated hardware.

A

True

28
Q

True or false: Dedicated Hosts may share the same hardware with other AWS instances from the same account that are not dedicated:

A

False, Dedicated Instances may share the same hardware with other AWS instances from the same account that are not dedicated.

29
Q

AWS Systems Manager Run Command

A
  • Commands can be applied to a group of systems based on AWS instances tags or by selecting manually
  • SSM agent needs to be installed on all your managed instances
  • The commands and parameters are defined in a Systems Manager Document
  • Commands can be issued using the console, CLI, AWS Tools for Windows Powershell, System Managers API or Amazon SDKs
  • You can use this service with your on-premise system as well as EC2 Instances
30
Q

AWS Systems Manager Parameter Store

A
  • You can store confidential information such as passwords, database connection, strings, license codes, etc. inside SSM Parameter Store.
  • You can encrypt or store as plain text.
  • You can then reference these values by using their names.
31
Q

Secure S3 - using pre signed URLs

A
  • You can access objects using pre-signed URLs
  • Typically these are done via the SDK but can also be done using the CLI
  • They exist for a certain length of time in seconds. Default is 1 hour.
  • You can change this using “–expires-in” followed by the number of seconds.
32
Q 
What does this bucket policy do?
{ 
"Version":"2012-10-17",
"Id":"S3PolicyId1",
"Statement":[
  {
   "Sid":"IPAllow",
   "Effect": "Allow",
   "Principal": "*",
   "Action":"s3:*",
   "Resource":"arn:aws:s3:::examplebucket/*",
   "Condition":{
     "IpAddress": {"aws:SourceIp": "10.0.12.0/24"},
     "NotIpAddress": {"aws:SourceIp": "54.240.143.188/32"}
   }
  }
 ]
}
A
  • Anyone on the 10.0.12 IP address range will be able to access this S3 bucket.
  • The IP 54.240.143.188/32 will not be able to access this S3 bucket.
33
Q

What are two main rules for AWS Config with S3?

A

Two main rules:

  1. s3-bucket-public-read-prohibited
  2. s3-bucket-public-write-prohibited

Checks that your Amazon S3 buckets do not allow public write or read access. The rule checks the Block Public Access settings, the bucket policy, and the bucket access control list (ACL).

34
Q

It’s asking you about installing an agent on your guest operating system and creating reports that map back to the Center for Internet Security. Which service should you use?
Inspector OR Trusted Advisor?

A

Inspector

35
Q

What do these steps do?

  • Create “Assessment target”
  • Install agents on EC2 instances
  • Create “Assessment template”
  • Perform “Assessment run”
  • Review “Findings” against “Rules”
A

Inspects services that are against Security Rules - Inspector

36
Q

Which service provides you visibility of:

  • Cost optimization, Availability, Performance, and Security.
  • If it’s just asking you to tell you whether or not you’ve got some security groups unlocked, or if you’ve got MFA on your root account or something like that.
A

Trusted Advisor

37
Q

How can you check your Service Limits?

A

By using Trusted Advisor, it offers a Service Limits check, and it’s in the Performance category, and that will display your usage and limits for some aspects of the services.

38
Q

Do you have to perform updates on PHP running on ElasticBeanstalk?

A

Yes

39
Q

______________ provides on-demand downloads of AWS security and compliance documents, such as:

  • AWS ISO certifications
  • PCI
  • Service Organization Control or SOC reports.
  • You can submit security and compliance documents also known as audit artifacts to your auditors, or your regulators to demonstrate the security and compliance of AWS infrastructure and services that you use.
A

AWS Artifact

40
Q

What types of metadata does CloudTrail log around API calls?

A
  • Identity
  • Time
  • Source IP address
  • Request parameters → what are they trying to do?
  • Response elements returned by the service
41
Q

Where are CloudTrail Event Logs sent to? What’s the retention period? Delivered within how many minutes? Can you enable notifications? Can it be aggregated across regions and accounts?

A
  • Sent to an S3 bucket
  • You manage the retention in S3
  • Delivered every 5min up to 15 min delay
  • Notifications available → you can set up SNS notifications
  • Can be aggregated across regions and accounts.
42
Q

How can you validate the integrity of your CloudTrail Log Files?

A
  • By checking the Digest file.
  • CloudTrail log file integrity validation:
  • SHA-256 hashing
  • SHA-256 with RSA for digital signing

SysOps Admin (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions