Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Cloud Practioner(CLF-C02) > Security, Compliance and Governance > Flashcards

Security, Compliance and Governance Flashcards

1
Q

What is the shared responsibility model?

A

A model where you can see who is responsible for what?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is main responsibility of AWS conform the Shared Responsibility Model?

A

AWS is responsible for the security ‘of’ the cloud.

  • hardware
  • underlaying software
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the main responsibility of the Customer conform the Shared Responsibility Model?

A

As a customer you are responsible for the security in the cloud,

  • data in the cloud
  • network and firewall config
  • Encryption of data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

who is responsible for having all the EC2 instances up-to-date

A

You, as a customer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Who is responsible for server-side encryption?

A

You, as the customer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Who is responsible for security of AWS Managed Services like RDS?

A

AWS is. If you host your DB on an EC2 server you, as a user, is responsible. When using RDS to run your DB AWS is responsible.

the customer stays responsible for network and who has access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the principle of least privilege?

A

this states that you should only grant permissions needed to complete a task.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are granular permissions?

A

specific (parts) of a service that someone had access to. To achieve this we need to have IAM in place.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is stated in IAM Policies?

A

The permissions for users, user-groups, IAM role (resoures can also have a role)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is best practice for IAM access keys?

A

Rotate them regularly. So the changes of a key gets ‘stolen’ is reduced.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Do IAM role-keys rotate automatically?

A

yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What does IAM Access Analyzer do?

A
  • Identify resources with external access
  • Validate IAM Policies
  • Generate IAM policies based on usages
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What does IAM Policy Simulator do?

A
  • Test new IAM policies before granting them to users, groups or roles
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is federated identity?

A

Using an external Identity provider (like Microsoft AD -> single sign on) to verify someone’s identity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is IAM Identity Center

A

The service that gives a user a (temporarily) role when they are log-in via single-sign-on method

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is Amazon Cognito?

A
  • Create user pools and grand temporary access keys
  • Leverage social or identity provider for authentication.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What does AWS Directory Service do?

A
  • Connect our AWS eco system to an existing MS AD
  • Host a managed Microsoft AD on AWS
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What does AWS Security Token Service (STS) do?

A

provide temporary access. e.g. like read-only access for an audit.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is Amazon Macie?

A

A service that searches your S3 buckets for personally identifiable information and encrypt this.

20
Q

What is Key Management Service (KMS)?

A

provides a key for ECB or other resources like RDS?

21
Q

What does AWS Certificate Manager do?

A

Provision, deploy, renew SSL/TLS certificates

22
Q

What does Systems Manager Parameter Store do?

A

keeps parameters secure. for example an EC2 service needs access to an Database, you keep the login credentials save in the Systems Manager Parameter Store.

23
Q

What does Secrets Manager do?

A

Adds an extra layer of protection on top of Systems Manager Parameter Store by automatically rotating your secrets,

24
Q

True / false | new S3 buckets are always encrypted unless (encrypt is disabled)

A

true

25
Q

What is a Network Access Control List (NACLs)?

A

Stateless access control in your VPC and subnets

stateless doesn’t care about in- or outgoing traffic

26
Q

What do security groups do for Network access control?

A

provide statefull acces contol

staefull means it checks if it’s in-or out going traffic.

27
Q

What does AWS network firewall do?

A

firewall goes further then security groups and NACLL’s .

A firewall can define complex rules to inspect traffic within your VPCs

28
Q

What does AWS Web Application firewall (WAF) do?

A

protects you web application against the most common exploit’s.

like SQL injections, cross site scripting.

29
Q

What is AWS Shield?

A

protects you against DDoS attacks.

30
Q

What are the costs of the different AWS shield service?

A

Shield standard -> free
Shield advanced -> paid but with 24/7 access to a DDoS support team

31
Q

What is AWS Firewall manager?

A

The central place where you manage:
- AWS Firewall
- AWS WAF
- AWS Shield

32
Q

What is AWS Security Hub?

A

The hub where you see prioritized findings (security risks) Sercies that are connected are:
- Firewall manager
- Macie
- IAM Access manager
- Guard Duty
- Systems Manager

33
Q

What is AWS Guard Duty do?

A

Tracks activity logs and scans for malicious behavior using machine learning

34
Q

What does AWS Inspector do?

A

Inspects workload for vulnerabilities and network access.

35
Q

What does Amazon Detective do?

A

Used for analyzing security events that already happened.

36
Q

What does Amazon inspector do?

A

Inspects / scans workloads for software vulnerabilities and network exposure. (check lambda’s , ec2 instances etc)

37
Q

What is AWS Cloud Security?

A

The main landing page for security information.

38
Q

What is on the AWS Security blog?

A

The blog helps you to stay up-2-date about announcements and innovation about security.

39
Q

What is on the AWS marketplace?

A

Here you find pre-build security solutions from 3rd party vendors.

40
Q

What does AWS Organizations?

A

Administer multiple AWS accounts from a single point. ere you have:
- an over view of all cost
- ability to organize and limit access to resources

41
Q

What is AWS control tower?

A

Automate account creation and the application best-practice config rules and SCP’s. It provides automated guard rails

42
Q

What is AWS artifact?

A

Download AWS security and other compliance documents and provide them to regulators and inform them about your cloud architecture,

43
Q

What does AWS audit manager do?

A

Automate assessments against framework designed to meet common compliance standards.

44
Q

Who’s resposibility is it to demonstrate beeing compliant with (GDPR, other security rulings)?

A

The customer is in the end responsible, but AWS and the customer share this

45
Q
A

AWS Cloud Practioner(CLF-C02) (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions