Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

aws - certified solutions architect - associate (saa-c03) > Security > Flashcards

Security Flashcards

1
Q

What is Cloud Trail?

A

A service that logs all API calls made your AWS account and stores these in logs in S3.

It monitors whats going on via API or console.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is AWS Shield?

A

Free DDOS Protection

Protects agains layer 3 and 4 attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What does AWS Shield Advanced give you?

A

A 24/7 DDoS Response team at $3,000 a month

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is AWS WAF?

A

Web Application Firewall

Lets you monitor the HTTP and HTTPS requests to your application.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What layer does WAF work on?

A

Layer 7

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is AWS Guard Duty?

A

GuardDuty is a threat detection service that uses machine learning to continuously monitor for malicious behavior.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is AWS Macie?

A

A service that uses machine learning to find PII information in S3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is AWS Inspector?

A

Automated security assessment service that helps improve the security and compliance of applications deployed on AWS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is AWS Key Management Service? (AWS KMS?)

A

A managed service that makes it easy for you to create and control the encryption keys used to encrypt your data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the three ways to generate a CMK?

A

1) AWS Creates the CMK for you

2) You import key material from your own key management infrastructure and associate it with a CMK

3) Have the key material generated and used in an AWS CloudHSM cluster as part of the custom key store feature in AWK KMS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is AWS Secrets Manager?

A

A service that securely stores, encrypts, and rotates your database credentials and other secrets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is AWS Parameter Store?

A

A free version of AWS Secrets manager but you don’t get auto key rotation and need to have 10,000 or less parameters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is AWS Cognito?

A

Provides authentication, authorization, and user management for your web and mobile apps.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

In general, what does a DDoS attack entail?

A

A large number of connections overwhelms your architecture. Your application is unable to answer the legitimate requests that are sent to it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the best way to deliver content from an S3 bucket that only allows users to view content for a set period of time?

A

Create a presigned URL using S3.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

You need a single source you can visit to get the compliance-related information that matters to you, such as AWS security and compliance reports or select online agreements. Which service should you use?

A

AWS Artifact

17
Q

What does DDoS stand for?

A

Distributed Denial of Service

18
Q

True or False? Amazon Inspector requires an agent for host assessment rules packages.

A

True

19
Q

Which of the following is NOT a data source for GuardDuty?

A) RDS event history

B) VPC Flow Logs

C) CloudTrail logs

D) DNS query logs

A

A) RDS Event History

20
Q

What is a good use case for AWS Audit Manager?

A

To automatically produce reports specific to auditors for PCI compliance, GDPR, and more.

21
Q

What is the minimum length of time before you can schedule a KMS key to be deleted?

A

7 days

22
Q

Which of the following best describes AWS Firewall Manager?

A) A managed service that makes it easy to deploy physical firewall protection across your VPCs via its managed infrastructure (e.g., a physical firewall that is managed by AWS).

B) A service that provides authentication, authorization, and user management for your web and mobile apps without the need for custom code.

C) A security management service that allows you to centrally configure and manage firewall rules across your accounts and applications.

D An automated service that produces reports specific to auditors for PCI compliance, GDPR, and more.

A

C) A security management service that allows you to centrally configure and manage firewall rules across your accounts and applications.

23
Q

Which Layers does WAF provide protection on?

A

Layer 7

24
Q

Which service provides authentication, authorization, and user management for your web and mobile apps without the need for custom code?

A

Amazon Cognito

25
Q

What kind of findings can AWS Inspector discover?

A

Insufficient patching of applications on an EC2 instance.

26
Q

True or False? For customers on Business or Enterprise support plans, AWS Shield Advanced provides access to a 24/7 support team to help with DDoS issues.

A

True

27
Q

True or False? You must explicitly deny all IAM policy API calls that a user shouldn’t be able to make.

A

False

28
Q

You need a managed service that makes it easy to deploy physical firewall protection across your VPCs. Which service should you use?

A

AWS Network Firewall

29
Q

Where is the most cost effective place to store your database passwords in a secure manner?

A

Parameter Store

30
Q

What would you use AWS Network Firewall for?

A

As a way to deploy physical firewall protection across your VPCs via its managed infrastructure (e.g., a physical firewall that is managed by AWS).

31
Q

What is the easiest way to log API calls in AWS?

A

Enable CloudTrail and pick an S3 bucket to store the logs in.

32
Q

Which AWS service supports automatic rotation of RDS security credentials?

A

Secrets Manager

33
Q

Your boss requires automatic key rotation for your encrypted data. Which AWS service supports this?

A

KMS

34
Q

What kind of data can Macie identify?

A

Personal identifiable information (PII) such as names and addresses, Social Security numbers, credit card numbers

35
Q

Which Layers does AWS Shield Standard provide protection on?

A

Layers 3 and 4

aws - certified solutions architect - associate (saa-c03) (17 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions