Security Flashcards by Jeremy Lim

What is a DDOS attack?

Attack that tries to make your service unavailable.

How well did you know this?

Not at all

Perfectly

What are 3 types of DDOS attacks and at what layers?

Syn Ack flood attack layer 4
NTP Amplification attack layer 4
HTTP/HTTPS flood attack layer 7

How well did you know this?

Not at all

Perfectly

What is CloudTrail?

CloudTrail is a service that logs AWS API calls for ip address, time, and api call (request params, metadata, response)

How well did you know this?

Not at all

Perfectly

Would CloudTrail be able to log SSH/RDP into EC2?

No it would not as it needs to be an API call.

How well did you know this?

Not at all

Perfectly

Where are CloudTrail Logs stored?

How well did you know this?

Not at all

Perfectly

What is AWS Shield?

It is free DDOS Protection for CloudFront, ELB, Route 53 against layer 3/4 attacks

How well did you know this?

Not at all

Perfectly

What is AWS Shield Advanced? What are 3

Enhanced protection for CloudFront, ELB, Route 53
2 Provides a dedicated 24/7 AWS response team
Near realtime monitoring of DDOS attacks

How well did you know this?

Not at all

Perfectly

How much is AWS Shield Advanced?

3k a month

How well did you know this?

Not at all

Perfectly

What Layer does AWS Shield protect? What about WAF?

AWS Shield protects against layer3/4

WAF protects against layer 7

How well did you know this?

Not at all

Perfectly

What is WAF?

Web Application Firewall provides monitoring and access control for HTTP/HTTPS to ELB,Route 53,CloudFront

How well did you know this?

Not at all

Perfectly

What kinds of attacks does WAF protect against?

SQL Injection, Cross site scripting, DDOS layer 7

How well did you know this?

Not at all

Perfectly

What can WAF look at in requests that go through it?

It can look at

IP addresses
Request parameters
string search patterns
country originating
if there is sql code or scripts

How well did you know this?

Not at all

Perfectly

What returns if WAF blocks access?

It will return a 403

How well did you know this?

Not at all

Perfectly

What are the 3 behvious of WAF?

allow all content you specify
block all content you specify
count requests meeting the properties you specify

How well did you know this?

Not at all

Perfectly

What is AWS Guard Duty? What can be triggered from it?

Threat detection Service that monitors your AWS account for malicious behavior using machine learning AI (taking a baseline)
External db of known threats
Can trigger lambda from Cloudwatch events if threat detected

How well did you know this?

Not at all

Perfectly

What does AWS Guard Duty monitor?

DNS Logs, Cloudtrail logs, VPC Flow logs

What is AWS Macie?

Uses Machine learning to find PII/sensitive data in S3 and alerts you through EventBridge (which you can then automate remediation)

What is AWS Inspector?

A security assessment service that inspects for vulnerabilities and best practices

What are the 2 types of scanning AWS Inspector does? How do they differ?

Network Assesment of configurations in VPC
Host Assessment of EC2
One does not need an agent installed while the other does

What is KMS? What are CMK?

KMS is a service that lets you manage and create encryption keys.
CMK are customer master keys, the actual encryption key itself.

What is CloudHSM?

A dedicated hardware security module in the cloud that generates your CMK

What are 3 ways to generate a CMK?

Use AWS HSM
Use your own HSM
Rent a cloud HSM from AWS

What are 3 ways to control access to CMKs?

Key policies (who can manage and use keys)
IAM policies
Grants with key policies (for delegation)

What are 3 ways to control access to CMKs?

Key policies (who can manage and use keys)
IAM policies
Grants with key policies (for delegation)

What is AWS Secrets Manager?

Service that lets you store encrypted credentials and retrieve/rotate them. e.g. RDS

What is AWS Parameter Store?

Service that lets you store your parameters in a hierarchy.

What is the difference between Secrets Manager and Parameter store?

Secrets Manager can handle secrets at scale, but costs money | Parameter Store is free but can only handle 10k secrets, and doesn't have key rotation

What should you watch out for with Secrets Manager rotation?

When rotation is enabled, it will immediately attempt to rotate credentials once

What is the encryption like for Secrets Manager?

Automatically encrypted in transit and at rest

When should you use Presigned URL's over Presigned Cookies?

Use Presigned URLs with you have a single resource needing public access Use presigned cookies if there are multiple resources needing to be shared

How do you share a video in a private S3 bucket?

Use a presigned url

What is a presigned url?

A url generated with a time duration giving access to a private S3 bucket using the object owners credentials

Why do we need presigned urls?

By default all objects in S3 are private and only object owner has permission to access

How is a not explicitly allowed permission treated in IAM policy?

It is implicitly denied if it is not defined

How is an explicit denied permission treated?

IAM will take the denial over everything else

How does AWS treat multiple policies on attached to the same role?

The union of all permissions is taken.

What is AWS Certificate Manager? What is the cost? What services does it work with?

Service that lets create/manage SSL certificates. Certificates are free and automatically renews/deploys for ELB, CLoudfront,APi Gateway