Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

My-Aws-Cloud Practitioner-training CLF-C02 > Security & Compliance > Flashcards

Security & Compliance Flashcards

1
Q

What principle should be applied to AWS users, application users, and other clouds and data centers connected to AWS?

A

The principle of least privilege.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the shared responsibility model in AWS?

A

The customer is responsible for security in the cloud, while AWS is responsible for security of the cloud.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the core tenets of security in the Well-Architected Framework?

A

Identity and access management, data stewardship and encryption, network security, application security compliance, and security management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Who is responsible for access management in AWS?

A

The customer is responsible for access management in their AWS cloud.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are customers responsible for in terms of operating systems and networking within their AWS account?

A

Customers are responsible for ensuring secure connections to VPC resources, keeping EC2 instances’ operating systems and security patches up to date, and provisioning firewalls to secure their network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the principle of least privilege?

A

It is the practice of giving the minimum permissions necessary to complete a task.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How can customers offload some security responsibilities using managed services?

A

For instance, customers are responsible for security OS patches and encryption on EC2, but on RDS, these are built-in features.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Who is responsible for encryption on AWS?

A

The customer is responsible for client-side encryption, encryption in transit, and encryption at rest.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What can IAM policies be applied to?

A

IAM policies can be applied to users, user groups, and IAM roles, which can then be applied to resources or applications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is encryption in transit and what AWS service helps with it?

A

Encryption in transit revolves around HTTPS, and AWS Certificate Manager helps with obtaining TLS certificates.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is IAM Identity Center used for?

A

IAM Identity Center is used to give users access to AWS resources by leveraging existing single sign-on directories.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How is S3 encrypted by default?

A

S3 is encrypted by default using SSE S3 managed keys.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is Macie used for in AWS?

A

Macie is used to scan S3 buckets for sensitive information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How are EBS volumes and RDS instances encrypted?

A

They are encrypted by KMS (Key Management Service).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What must you do to encrypt an existing RDS instance?

A

You must create a copy of the existing RDS instance to enable encryption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are Parameter Store and Secrets Manager used for?

A

They are used to securely store parameters like login credentials or environment variables, with Secrets Manager also able to automatically rotate those secrets.

17
Q

What does AWS WAF protect against?

A

AWS WAF protects web applications.

18
Q

What does AWS Shield protect against?

A

AWS Shield protects against DDoS attacks (Distributed Denial of Service).

19
Q

What does AWS Firewall Manager do?

A

AWS Firewall Manager manages AWS WAF, AWS Shield, and other security settings across multiple accounts.

20
Q

What is AWS Security Hub?

A

AWS Security Hub provides a single-pane view to prioritize and take action on security findings from multiple AWS services.

21
Q

Who are the four horsemen of security confusion?

A

Trusted Advisor, Amazon GuardDuty, Amazon Detective, and Amazon Inspector.

22
Q

What does AWS Trusted Advisor do?

A

AWS Trusted Advisor provides best practice advice.

23
Q

What does Amazon GuardDuty do?

A

Amazon GuardDuty alerts you if it detects active threats.

24
Q

What does Amazon Detective help with?

A

Amazon Detective helps investigate security events that have already happened.

25
Q

What does Amazon Inspector detect?

A

Amazon Inspector detects workload vulnerabilities, including software and network vulnerabilities.

26
Q

What is AWS Artifact used for?

A

AWS Artifact is used to download compliance documents to prove compliance and help improve AWS architecture.

27
Q

What is AWS Organizations used for?

A

AWS Organizations helps manage multiple accounts and enables consolidated billing.

28
Q

What is AWS Control Tower used for?

A

AWS Control Tower automates best practices in multi-account management.

29
Q

How does AWS Security Hub integrate with AWS Organizations?

A

AWS Security Hub provides an organization-wide view of security findings and integrates well with AWS Organizations.

30
Q

Your company wants to use machine learning to assist in monitoring for sensitive data such as PII (personally identifiable information) in their S3 buckets. How can they most easily achieve this?

A

Macie uses machine learning (ML) and pattern matching to discover and help you protect your sensitive data.

31
Q

Which AWS service will protect your AWS resources from DDoS attacks?

A

AWS Shield

32
Q

Your company has decided to split its workloads into multiple AWS accounts, but it still wants to be able to take advantage of consolidated billing. How can it accomplish this?

A

Use AWS Organizations to manage multiple accounts.

33
Q

Your company want to leverage machine learning to automatically detect security events across your AWS environment. How can they achieve this with the lowest operational overhead?

  1. Trusted Advisor
  2. Enable Amazon Inspector
  3. Enable GuardDuty
  4. Enable Detective
A

While Detective does leverage machine learning, its purpose is primarily investigating security events that have already happened.

Correct Answer
GuardDuty is an intelligent threat detection service that can dynamically detect threats across your AWS account or Organization.

34
Q

Which service can be used to scan for network and software vulnerabilities on your EC2 instances?

  1. GuardDuty
  2. Detective
  3. Trusted Advisor
  4. Inspector
A

Inspector

35
Q

What is the easiest way to ensure that you S3 objects are encrypted at rest?

  1. Encrypt the S3 bucket with Secrets Manager.
  2. Encrypt the data at rest by applying KMS managed keys.
  3. Use Certificate Manager to provision SSL/TLS certificates to encrypt the S3 bucket.
  4. S3 buckets are server-side encrypted by default with SSE-S3 managed keys.
A

S3 buckets are server-side encrypted by default with SSE-S3 managed keys.

36
Q

What can you use to assign granular permissions to users, roles, and groups?

  1. KMS
  2. IAM Policies
  3. Security Token Service (STS)
  4. Config Rules
A

IAM Policies

37
Q

A regulator has requested documentation that proves your AWS solutions can meet GDPR compliance. What service can help with this?

  1. AWS Control Tower
  2. AWS Cloud Security
  3. AWS Artifact
  4. Security Hub
A

AWS Artifact

38
Q
A

My-Aws-Cloud Practitioner-training CLF-C02 (20 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions