AWS Cloud Practitioner > Security & Compliance > Flashcards

Security & Compliance Flashcards

(21 cards)

Study These Flashcards
1
Q

DDOS Protection on AWS

A
  • AWS Shield Standard: protects against DDOS attack for your website and applications, for all customers at no additional costs
  • AWS Shield Advanced: 24/7 premium DDoS protection
  • AWS WAF: Filter specific requests based on rules
  • CloudFront and Route 53:
    - Availability protection using global edge network
    - Combined with AWS Shield, provides attack mitigation at the edge
  • Be ready to scale – leverage AWS Auto Scaling
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

AWS Shield

A
  • AWS Shield Standard:
    - Free service that is activated for every AWS customer
    - Provides protection from attacks such as SYN/UDP Floods, Reflection attacks and other layer 3/layer 4 attacks
  • AWS Shield Advanced:
    - Optional DDoS mitigation service ($3,000 per month per organization)
    - Protect against more sophisticated attack on Amazon EC2, Elastic Load Balancing (ELB), Amazon CloudFront, AWS Global Accelerator, and Route 53
    - 24/7 access to AWS DDoS response team (DRP)
    - Protect against higher fees during usage spikes due to DDoS
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

AWS WAF – Web Application Firewall

A
  • Protects your web applications from common web exploits (Layer 7)
  • Layer 7 is HTTP (vs Layer 4 is TCP)
  • Deploy on Application Load Balancer, API Gateway, CloudFront
  • Define Web ACL (Web Access Control List):
    - Rules can include IP addresses, HTTP headers, HTTP body, or URI strings
    - Protects from common attack - SQL injection and Cross-Site Scripting (XSS)
    - Size constraints, geo-match (block countries)
    - Rate-based rules (to count occurrences of events) – for DDoS protection
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

AWS Network Firewall

A
  • Protect your entire Amazon VPC
  • From Layer 3 to Layer 7 protection
  • Any direction, you can inspect
    - VPC to VPC traffic
    - Outbound to internet
    - Inbound from internet
    - To / from Direct Connect & Siteto-Site VPN
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Penetration Testing on AWS Cloud

A
  • AWS customers are welcome to carry out security assessments or penetration tests against their AWS infrastructure without prior approval for 8 services:
    -Amazon EC2 instances, NAT Gateways, and Elastic Load Balancers
    -Amazon RDS
    -Amazon CloudFront
    -Amazon Aurora
    -Amazon API Gateways
    -AWS Lambda and Lambda Edge functions
    -Amazon Lightsail resources
    -Amazon Elastic Beanstalk environments
  • Prohibited Activities
    -DNS zone walking via Amazon Route 53 Hosted Zones
    -Denial of Service (DoS), Distributed Denial of Service (DDoS), Simulated DoS, Simulated DDoS
    -Port flooding
    -Protocol flooding
    -Request flooding (login request flooding, API request flooding)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Data at rest vs. Data in transit

A
  • At rest: data stored or archived on a device
    -On a hard disk, on a RDS instance, in S3 Glacier Deep Archive, etc.
  • In transit (in motion): data being moved from one location to another
    -Transfer from on-premises to AWS, EC2 to DynamoDB, etc.
    -Means data transferred on the network
  • We want to encrypt data in both states to protect it!
  • For this we leverage encryption keys
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

AWS KMS (Key Management Service)

A
  • KMS = AWS manages the encryption keys for us (AWS manages the software
    for encryption)
  • Encryption Opt-in:
    -EBS volumes: encrypt volumes
    -S3 buckets: Server-side encryption of objects
    -Redshift database: encryption of data
    -RDS database: encryption of data
    -EFS drives: encryption of data
  • Encryption Automatically enabled:
    -CloudTrail Logs
    -S3 Glacier
    -Storage Gateway
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

CloudHSM

A
  • CloudHSM => AWS provisions encryption hardware
  • Dedicated Hardware (HSM = Hardware Security Module)
  • You manage your own encryption keys entirely (not AWS)
  • HSM device is tamper resistant, FIPS 140-2 Level 3 compliance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Types of Customer Master Keys: CMK

A
  • Customer Managed CMK:
    -Create, manage and used by the customer, can enable or disable
    -Possibility of rotation policy (new key generated every year, old key preserved)
    -Possibility to bring-your-own-key
  • AWS managed CMK:
    -Created, managed and used on the customer’s behalf by AWS
    -Used by AWS services (aws/s3, aws/ebs, aws/redshift)
  • AWS owned CMK:
    -Collection of CMKs that an AWS service owns and manages to use in multiple accounts
    -AWS can use those to protect resources in your account (but you can’t view the keys)
  • CloudHSM Keys (custom keystore):
    -Keys generated from your own CloudHSM hardware device
    -Cryptographic operations are performed within the CloudHSM cluster
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

AWS Certificate Manager (ACM)

A
  • Let’s you easily provision, manage, and deploy SSL/TLS Certificates
  • Used to provide in-flight encryption for websites (HTTPS)
  • Supports both public and private TLS certificates
  • Free of charge for public TLS certificates
  • Automatic TLS certificate renewal
  • Integrations with (load TLS certificates on)
    -Elastic Load Balancers
    -CloudFront Distributions
    -APIs on API Gateway
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

AWS Secrets Manager

A
  • Newer service, meant for storing secrets
  • Capability to force rotation of secrets every X days
  • Automate generation of secrets on rotation (uses Lambda)
  • Integration with Amazon RDS (MySQL, PostgreSQL, Aurora)
  • Secrets are encrypted using KMS
  • Mostly meant for RDS integration
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

AWS Artifact
(not really a service)

A
  • Portal that provides customers with on-demand access to AWS compliance documentation and AWS agreements
  • Artifact Reports - Allows you to download AWS security and compliance documents from third-party auditors, like AWS ISO certifications, Payment Card Industry (PCI), and System and Organization Control (SOC) reports
  • Artifact Agreements - Allows you to review, accept, and track the status of AWS agreements such as the Business Associate Addendum (BAA) or the Health Insurance Portability and Accountability Act (HIPAA) for an individual account or in your organization
  • Can be used to support internal audit or compliance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Amazon GuardDuty

A
  • Intelligent Threat discovery to protect your AWS Account
  • Uses Machine Learning algorithms, anomaly detection, 3rd party data
  • One click to enable (30 days trial), no need to install software
  • Input data includes:
    -CloudTrail Events Logs – unusual API calls, unauthorized deployments
    –CloudTrail Management Events – create VPC subnet, create trail, …
    –CloudTrail S3 Data Events – get object, list objects, delete object, …
    -VPC Flow Logs – unusual internal traffic, unusual IP address
    -DNS Logs– compromised EC2 instances sending encoded data within DNS queries
    -Optional Features – EKS Audit Logs, RDS & Aurora, EBS, Lambda, S3 Data Events…
  • Can setup EventBridge rules to be notified in case of findings
  • EventBridge rules can target AWS Lambda or SNS
  • Can protect against CryptoCurrency attacks (has a dedicated “finding” for it)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Amazon Inspector

A
  • Automated Security Assessments
  • For EC2 instances
    • Leveraging the AWS System Manager (SSM) agent
    • Analyze against unintended network accessibility
    • Analyze the running OS against known vulnerabilities
  • For Container Images push to Amazon ECR
    • Assessment of Container Images as they are pushed
  • For Lambda Functions
    • Identifies software vulnerabilities in function code and package dependencies
    • Assessment of functions as they are deployed
  • Reporting & integration with AWS Security Hub
  • Send findings to Amazon Event Bridge
  • Remember: only for EC2 instances, Container Images & Lambda functions
  • Continuous scanning of the infrastructure, only when needed
  • Package vulnerabilities (EC2, ECR & Lambda) – database of CVE
  • Network reachability (EC2)
  • A risk score is associated with all vulnerabilities for prioritization
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

AWS Config

A
  • Helps with auditing and recording compliance of your AWS resources
  • Helps record configurations and changes over time
  • Possibility of storing the configuration data into S3 (analyzed by Athena)
  • Questions that can be solved by AWS Config:
    • Is there unrestricted SSH access to my security groups?
    • Do my buckets have any public access?
    • How has my ALB configuration changed over time?
  • You can receive alerts (SNS notifications) for any changes
  • AWS Config is a per-region service
  • Can be aggregated across regions and accounts
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

AWS Macie

Study These Flashcards
A
  • Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS.
  • Macie helps identify and alert you to sensitive data, such as personally identifiable information (PII)
  • Sends notification to EventBridge
17
Q

AWS Security Hub

Study These Flashcards
A
  • Central security tool to manage security across several AWS accounts and automate security checks
  • Integrated dashboards showing current security and compliance status to quickly take actions
  • Automatically aggregates alerts in predefined or personal findings formats from various AWS services & AWS partner tools:
    • Config
    • GuardDuty
    • Inspector
    • Macie
    • IAM Access Analyzer
    • AWS Systems Manager
    • AWS Firewall Manager
    • AWS Health
    • AWS Partner Network Solutions
  • Must first enable the AWS Config Service
18
Q

Amazon Detective

Study These Flashcards
A
  • GuardDuty, Macie, and Security Hub are used to identify potential security issues or findings
  • Sometimes security findings require deeper analysis to isolate the root cause and take action – it’s a complex process
  • Amazon Detective analyzes, investigates, and quickly identifies the root cause of security issues or suspicious activities (using ML and graphs)
  • Automatically collects and processes events from VPC Flow Logs, CloudTrail, GuardDuty and create a unified view
  • Produces visualizations with details and context to get to the root cause
19
Q

AWS Abuse

Study These Flashcards
A
  • Report suspected AWS resources used for abusive or illegal purposes
  • Abusive & prohibited behaviors are:
  • Spam – receving undesired emails from AWS-owned IP address, websites & forums
    spammed by AWS resources
  • Port scanning – sending packets to your ports to discover the unsecured ones
  • DoS or DDoS attacks – AWS-owned IP addresses attempting to overwhlem or crash your servers/softwares
  • Intrusion attempts – logging in on your resources
  • Hosting objectionable or copyrighted content – distributing illegal or copyrighted content without consent
  • Distributing malware – AWS resources distributing softwares to harm computers or machines
20
Q

Root user privileges

Study These Flashcards
A
  • Root user = Account Owner (created when the account is created)
  • Has complete access to all AWS services and resources
  • Lock away your AWS account root user access keys!
  • Do not use the root account for everyday tasks, even administrative tasks
  • Actions that can be performed only by the root user:
    • Change account settings (account name, email address, root user password, root user access keys)
    • View certain tax invoices
    • Close your AWS account
    • Restore IAM user permissions
    • Change or cancel your AWS Support plan
    • Register as a seller in the Reserved Instance Marketplace
    • Configure an Amazon S3 bucket to enable MFA
    • Edit or delete an Amazon S3 bucket policy that includes an invalid VPC ID or VPC endpoint ID
    • Sign up for GovCloud
21
Q

IAM Access Analyzer

Study These Flashcards
A
  • Identify which resources are shared externally
    • S3 Buckets
    • IAM Roles
    • KMS Keys
    • Lambda Functions and Layers
    • SQS queues
    • Secrets Manager Secrets
  • Define Zone of Trust = AWS Account or AWS Organization
  • Access outside zone of trusts => findings
AWS Cloud Practitioner
flashcards
Decks in class (22)
# Cards
Brainscape helps you reach your goals faster, through stronger study habits.
© 2026 Bold Learning Solutions. Terms and Conditions