Security Products

Question 1

Which of the following services can alert you to malware on an EC2 instance?

A. AWS GuardDuty
B. AWS Inspector
C. AWS Shield
D. AWS Web Application Firewall

Answer 1

A. GuardDuty looks for potentially malicious activity.

Inspector looks for vulnerabilities that may result in compromise.

Shield and Web Application Firewall protect applications from attack.

Question 2

What does GuardDuty monitor?

Answer 2

• VPC flow logs
• CloudTrail management event logs
• Route 53 DNS query logs

Question 3

What is the target of GuardDuty findings?

Answer 3

• Inappropriate use of AWS credentials

- The presence of malware on an EC2 instance (e.g. Trojan, Cryptocurrency)

Question 4

What is Amazon Inspector?

Answer 4

Amazon Inspector is an agent-based service that looks for vulnerabilities on your EC2 instance.

Question 5

What is Amazon Detective?

Answer 5

Amazon Detective takes information from VPC flow logs, CloudTrail, and GuardDuty and places this information into a graph database.

Detective is designed to help you correlate events and see how a given event affects particular resources.

Question 6

What is Security Hub?

Answer 6

Security Hub collects security information from various AWS services, including Inspector, GuardDuty, and Macie. In addition, Security Hub assesses your account against AWS security best practices and the Payment Card Industry Data Security Standard (PCI DSS).

Question 7

What is the difference between AWS Sheild Standard and Advanced?

Answer 7

• Standard: defend against layer 3/4 DDoS attack
• Advanced: defend against layer 7 DDoS attack; protect specific EC2 instance, access to AWS DDoS team; AWS WAF is included at no charge

Question 8

How long does it take for Shield to mitigate DDoS attacks?

Answer 8

• 99% attack is mitigated in 5 minutes or less
• Attacks against CloudFront and Route 53 is mitigated under 1 second
• Attack against ELB is under 5 minutes
• All other attack: 20 minutes

Question 9

Can you directly encrypt a volume at rest?

Answer 9

No,

• Create a snapshot from the volume
• Copy the snapshot with encryption enabled.
• Create a new volume with the encrypted snapshot

Question 10

What is Macie?

Answer 10

Macie is a service that automatically locates and classifies your sensitive data in S3 buckets?

Question 11

Can you encrypt an existing EFS system?

Answer 11

No, the only option to encrypt the data using KMS is to create a new EFS filesystem and copy the data to it.

Question 12

What is the typical DDoS attacks?

Answer 12

• Application layer (HTTP flood)
• Transport layer (SYN flood)
• DNS Amplification