Security & Complaince Section

Question 1

What has KMS automatically enabled?

Answer 1

• CloudTrail Logs
• S3 Glacier
• Storage Gateway

Question 2

What can opt-into KMS?

Answer 2

• EBS volumes: encrypt volumes
• S3 buckets: Server-side encryption of objects
• Redshift database: encryption of data
• RDS database: encryption of data
• EFS drives: encryption of data

Question 3

What captures information about IP traffic (VPC/Subnet/ElasticNetworkInterface flow logs) to help monitor & troubleshoot connectivity issues, and capture network infromation from AWS managed interfaces?

Answer 3

VPC Flow Logs

Question 4

What 9 svcs can you not run pen test against?

Answer 4

• Amazon EC2 instances, NAT Gateways, and Elastic Load Balancers
• Amazon RDS
• Amazon CloudFront
• Amazon Aurora
• Amazon API Gateways
• AWS Lambda and Lambda Edge functions
• Amazon Lightsail resources
• Amazon Elastic Beanstalk environments