Spring 2024 > Cloud Security > Flashcards

Cloud Security Flashcards

(76 cards)

Start Studying
1
Q

What are the three aspects of information security?

A

Confidentiality, Integrity and Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What does AWS Security Token Service (STS) do?

A

Issue temporary credentials

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is an IAM role?

A

It is an AWS identity that defines and provides temporary security credentials to access resources and make API requests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the compliance standard for information security?

A

ISO/IEC 27001 Framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is SIEM

A

Security Information and Event Management - Big data threat intelligence with automated response

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is an IDS?

A

Intrusion Detection Systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the difference between resource and identity based policies?

A

Identity based is attached to an identity, indicating what they can do
Resource based is attached to a resource allowing specific users or groups to perform certain API requests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the different between inline and managed policies?

A

Inline policies are embedded in a principal identity (group, user or role)
Managed policies are standalone identity based policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the security design principles?

There are 7

A
  • Apply principle of least privilege
  • Enable traceability
  • Secure all layers
  • Automate security (infrastructure as code)
  • Protect data in transit and at rest
  • Prepare for security events
  • Minimise the attack surface
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is TLS?

A

Transport Layer Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are MSOs and MSPs and what do they do?

A

Managed Services Organisation or Managed Service Providers (external) create guardrails for security, data protection and disaster recovery in the company

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the benefit of elasticity in the cloud?

A

Creates systems that can scale on demand

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What can a company use to ensure high availability during an attack?

A

Automatic scaling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What security principle addresses monitoring, auditing, alerting actions and changes to the environment

A

Enable traceability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a best practice for automation that can assist with providing a repeatable secure infrastructure?

A

Implement infrastructure as code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the two things IAM provides?

A

Authentication - Who
Authorisation - What

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the two primary types of credentials used for authentication

A

Username and password
AWS Access Key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the IAM Authentication best policy for long-term access?

A

To attach IAM Policies to groups and assign users to groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What does the AWS Organisation Service Control Policy (SCP) do?

A

Defines the maximum permissions for the account members of an OU

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How does AWS determine permissions with policies?

A

An explicit deny overrides any allow statement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which AWS Services provide identity federation to AWS Accounts and applications?

A

SSO and IAM (for multiple directories)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What does AWS Directory Service do?

A

Allows you to use existing on-premises user credentials to access cloud resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What does Amazon Cognito do?

A

Enable user sign up, sign in and access control with web and mobile applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What can Amazon VPC do?

A

Provision a logically isolated section of the AWS Cloud to launch resources
- Select IP address range
- Create subnets
- Configure route tables and network gateways

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What is an internet gateway?
Provides a target in VPC route tables for internet-routable addresses Performs NAT for instances with public IPv4 addresses
26
What does a NAT Gateway do?
Supports instances in a private subnet to connect to the internet Prevents the internet from initiating connection
27
What does a NAT gateway require you to specify?
Public subnet to reside Elastic IP address to associate with the gateway
28
What does the interface require when external traffic needs to reach an interface
A public IP Address on the interface and a route on the subnet's route table
29
What is the largest and smallest CIDR block?
/16 is the largest, /28 the smallest
30
How many IP Addresses does AWS reserve in CIDR blocks?
5 addresses 0 - network address 1 - internal communication 2 - DNS resolution 3 - future use 255 - broadcast
31
What two things can you do with an elastic network interface?
Attach it to an instance, detach it and attach to a different one to reroute network traffic
32
What is a security group?
A security group acts as a virtual firewall for an EC2 instance and controls traffic
33
What do stateful security groups do?
Deny all inbound traffic and allow all outbound traffic
34
What is a NACL?
Network Access Control Lists act as virtual firewalls on the VPC level to control traffic in and out of subnets.
35
Are network ACLs stateful or stateless?
Stateless. They can either deny or allow inbound and outbound traffic
36
What are the features of the default network ACL?
All inbound and outbound traffic is allowed
37
What are the features of a default custom network ACL?
All inbound and outbound traffic is denied.
38
Differentiate between security groups and network ACLs
Security groups are interface level, but network ACLs are subnet level Security groups support allow rules only, but network ACLs support both allow and deny rules. Security groups are stateful, but network ACLs are stateless. For security groups, all rules are evaluated before the decision is made to allow traffic. For network ACLs, rules are evaluated in number order before the decision is made to allow traffic
39
What does ELB do? What are its three types?
Distributes incoming traffic and supports high availability with health checks Provides - Classic Load Balancer - Network Load Balancer - Application Load Balancer
40
What three features serve as data protection in ELB?
Single Point of Contact Encryption at rest Encryption in transit
41
What are the best practices to protect your network? (4)
Control traffic at all layers Inspect and filter at application level Automate network protection Limit exposure
42
What does Amazon Inspector do?
Run automated security assessments on EC2 instances and applications to find vulnerabilities
43
What does AWS Systems manager do?
Lets you view operational data from multiple AWS services
44
What are the three tiers of a web application?
Presentation, Application and data
45
What does S3 Block public Access do?
Helps manage access to S3 resources
46
What are the Amazon S3 Protection features?
- Block public access - Versioning - Object Lock
47
What does Object lock do?
Stores objects using write-once read-many
48
What are the two object lock retention modes?
Governance - users need special permissions to alter settings Compliance - cannot be altered by any user
49
What are the two types of protection through encryption?
Client side encryption and server side encryption
50
What are the types of server side encryption?
SSE-C, SSE-S3 and SSE-KMS
51
How do you protect data in transit?
Use SSL (Secure Socket Layer) endpoints over TLS (Transport layer security) Use encryption Use VPC
52
What is AWS ACM?
Amazon Certificate Manager provides an interface to manage both public and private certificates
53
What is AWS CA?
Certificate Authority can manage private CAs to issue certificates
54
What are the data protection best practices?
Presigned url for temporary access Use S3 protection features Enabla MFA for deletion
55
What is AWS Secrets Manager?
Manages access to secrets
56
What is Amazon Macie?
Machine learning service that can discover, classify and protect sensitive data in AWS
57
What is logging?
The collection and recording of activity and data
58
What are the 4 things logging is useful for?
1. Troubleshooting 2. Auditing 3. Recordkeeping 4. Incident Response and remediation
59
What is monitoring
The continuous verification of the security and performance of applications and data
60
What does CloudTrail do?
Records actions taken by user, role or AWS Account
61
What are the AWS services with built in logs?
S3 - server access logs VPC - Flow logs (inbound and outbound IP traffic) ELB - access logs
62
What is Amazon CloudWatch?
Monitors resource and application performance
63
# D C A What are the best practices for logging and monitoring?
Define organisational requirements Configure service and application logging Analyse your logs centrally
64
What does Trusted Advisor do?
Provides recommendations based on cost optimization, security, fault tolerance, service limits and performance imporvements
65
What is amazon EventBridge?
A serverless event bus service
66
What is AWS Security hub?
Automated cloud security monitor that aggregates security alerts from various services
67
What does amazon Config do?
Assess, audit and evaluate resource configurations
68
What is incident recognition and response?
A set of information security policies and procedures that can be used to identify, contain and eliminate cyber attacks
69
What are the two phases of incident response?
Discovery and recognition - identify, log and categorise Resolution and recover - isolate, stage and deploy fix
70
What does Amazon GuardDuty do?
Continuous security monitoring service to identify unauthorised and malicious activity
71
What does Amazon Shield do?
Automatically protects network from a DDoS attack
72
Name the AWS Services that support the discovery and recognition phase?
CloudWatch (monitoring solution) Trusted Advisor Config Inspector Shield GuardDuty
73
What does CloudFormation do?
Model and setup AWS resources with templates
74
What is SNS?
Simple Notification Service - apps, end users and devices can send and receive notifications from the cloud
75
What is AWS Step functions?
Visual workflow service that developers use to build event-driven applications
76
What is AWS Lambda
Serverless event driven compute service that can run code on demand

Spring 2024 (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions