Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Security Certification > Security 101 > Flashcards

Security 101 Flashcards

1
Q

What does CIA stand for ?

A

Confidentiality, Integrity and Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is confidentiality ?

A

It relates to the concept of keeping things (objects) private and available to only those people that have an requirement to know about it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is integrity ?

A

The assurance that assets have not been tampered with ? Hashing is a good example of a control that ensures integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is availability ?

A

Making sure that people can access those assets ? Hardware failure is a good example of something that undermines availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the AAA model ?

A

Extends the CIA triad with Authentication, Authorization and Accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What services cover the AAA model ?

A

Authentication - IAM
Authorization - Permission Policies
Accounting - Cloudtrail

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the five main areas of Physical and Environmental Security covered by AWS ?

A
  1. Fire Detection and Suppression
  2. Power
  3. Climate and Temperature
  4. Management
    1. Storage Device Decommissioning
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the four areas of business continuity management handled by Amazon ?

A
  1. Availability
  2. Incident Response
  3. Company Wide Executive Review
  4. Communication
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the six areas of network security that are the responsibility of Amazon AWS ?

A
  1. Secure Network Architecture
  2. Secure Access Points
  3. Transmission Protection
  4. Amazon Corporate Segregation
  5. Fault Tolerant Design
  6. Network Monitoring and Protection
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What does the phrase Security is neither a product or a service mean ?

A

There is no single product or service that can act as a magic black box

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What does the phrase security is not a technology mean ?

A

Security does not depend on a single technology but a grouping of technologies to provide a defence in depth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What doe the phrase security is not static mean ?

A

It is not something you do once and forget

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What does the phrase security is not a check box mean ?

A

It means that we should constantly be aware of why we are doing the security control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the four main items that drive a security policy ?

A
  1. Business Requirements/Objectives
  2. Regulatory Requirements
  3. Risk Evaluation (Agree Acceptable Level of Risk by Senior Execs)
  4. Cost Benefit Analysis (Determines if the control cost is justified against the risk its protecting against)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

If the organizational policy is written in broad terms what are the four common document types that implement its vision in concrete terms ?

A
  1. Standards (Mandatory rules and Regulations)
  2. Guideline (Recommendation for areas not covered by standards)
  3. Baseline (Define minimum level of security for a given system)
  4. Procedures (step by step instructions)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the eight most common attack types ?

A
  1. Reconnaissance
  2. Password
  3. Eavesdropping
  4. IP Spoofing
  5. Man in the Middle
  6. Denial of Service
  7. Malware
  8. Phishing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the reconnaissance phase ?

A

Underlying goal is to obtain as much information as possible about targets with techniques such as ping sweep and social engineering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are password attacks ?

A

Either brute force or dictionary attacks aimed at creating a new priveleged account or compromising an existing account and elevating its privilege

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is an eavesdropping attack ?

A

Aka sniffing such as port scans

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is an IP Spoofing attack ?

A

Falisifying the IP origin of the attack to either remain incognito or place the blame on somebody else

21
Q

What is a Denial of Service attack ?

A

Level 8 TCP ACK Flood

Level 3 Smurf Attack

Level 2 Spanning Tree Protocol

22
Q

What are the 7 types of Malware attacks

A
  1. Virus - replicates through infection of other code bases
  2. Worm - self replicating
  3. Trojan Horse - mascarading
  4. Adware
  5. Launcher - Downloads other malicious software
  6. Keylogger
  7. Ransomware
23
Q

What is the Shared Responsibility Model ?

A

AWS looks after security of the cloud while you the customer is responsible for security in the cloud

24
Q

Under the Shared Responsibility Model what are AWS responsibilities ?

A

Global Infrastructure

Networking Hardware and Software

Managed Services

25
Q

Under the Shared Responsibility Model what are the customers responsibilities ?

A

IAAS

Software/Patches

Configuration of the AWS provided firewall

26
Q

How does the shared responsibility model change for container services such as elastic beanstalk and emr and rds ?

A

Here ec2 instances are provisioned but you dont have access to them so patching and looking after the os becomes AWS responsibility but all the stuff you can control is still your responsibility.

27
Q

What AWS Service provides visibility of your assets for compliance ?

A

AWS Config

28
Q

What AWS Service helps with auditing ?

A

AWS Cloudtrail

29
Q

What are the two main services for Data Controlability ?

A

KMS and CloudHSM

30
Q

What is the prime difference between Cloud HSM and KMS ?

A

KMS is multi tenanted while Cloud HSM is not and id FIPS 140-2 compliant

31
Q

How would you enforce https access to S3 ?

A

Have a statement that allows everyone and a deny statement for everyone where the boolean condition aws:Securetransport is false

32
Q

For Cross Region Replication do you need a bucket policy or ACL ?

A

No it is always done by default via SSL

33
Q

Once an object is replicated in S3 can it be replicated again ?

A

No

34
Q

Can you replicate in S3 to multiple destinations ?

A

No only one

35
Q

What bucket feature needs to be switched on for Cross Region replication in S3 ?

A

Versioning

36
Q

Where in Cross region replication would you use the READ and READ_ACP acl permissions ?

A

Where the bucket owner need to replicate objects where they are not the owner of those objects

37
Q

Can you do Cross Region/Cross Account replication in S3 ?

A

Yes but the IAM Role needs to have permissions to the destination bucket within another account

38
Q

Can you in S3 replication across accounts create rules that changes the ownership of the replication item to the ownership of the destination account bucket ?

A

Yes

39
Q

Are encrypted objects replicated in Cross Region replication ?

A

Yes if the object is encrypted with SSE-S3 or SSE-KMS

40
Q

What else is replicated in S3 cross region replication ?

A

Object metadata, Object Tags, ACL

41
Q

What is not replicated in cross region replication ?

A
  • Anything before replication is turned on
  • Encrypted objected with SSE-C
  • Object for which bucket owner does not have permissions for
  • Deletes to a particular version of an object
42
Q

What is the main security concern with S3 and Cloudfront ?

A

The main issue that we are tackling here is in a situation where we have a S3 bucket sitting behind Cloudfront we want to force users to go through Cloudfront rather than directly to the S3 bucket.

43
Q

How do you force users to access S3 buckets through Cloudfront CDN urls rather than S3 urls before CDN is created§§?

A

This is done by clicking restrict-bucket access when setting up the Cloudfront CDN.

44
Q

Can a Cloudfront distribution use the same SSL certificate as your Loadbalancers ?

A

No they must be seperate

45
Q

What is an Origin Access Identity ?

A

This is the identity that all users assume when accessing S3 content from a CDN. You can do this after a CDN is created by clicking on the Restrict option, then choosing create Origin Access Identity and the select Yes Update Bucket Policy on the Grant Permissions option.

You normally have to be concerned about this is if you are trying to restrict access to S3 urls after the distribution has been created.

46
Q

Why would you need a custom ssl certificate with Cloudfront ?

A

You will need to use a custom SSL certificate with Cloudfront if you want to use your own domain name rather than the default one of Cloudfront.

47
Q

When using a custom certificate with Cloudfront what is the limitation of storing that certificate in ACM ?

A

Has to be stored in us-east-1

48
Q

What does the awscli command aws s3 presign / –expires-in 300 do ?

A

Creates a pre-signed url that lives for 300 seconds

49
Q

Whats the default time period for a pre-signed url ?

A

1 hour

AWS Security Certification (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions