Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

AWS > Security and Monitoring > Flashcards

Security and Monitoring Flashcards

1
Q

What is a security group?

A

A virtual firewall for EC2 instances

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is bootstrap scripts?

A

a script that runs when instance first runs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

what permissions does bootstrap script have?

A

full administrative access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How long does it take for changes to security groups to occur?

A

Immediately

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How many EC2 instances can you have in a security group?

A

Any number

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Why can there only be one security group attached to an EC2 instance?

A

There can many security groups attached to an EC2 instance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What inbound traffic is blocked by default?

A

All inbound traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Is a network ACL or security group hit first when a request is coming from the internet into a public subnet?

A

The network ACL is hit first

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What does 0.0.0.0/0 do?

A

Let’s everything in

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the first line of defense?

A

Network ACL’s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a Network ACL?

A

An layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

By default what inbound and outbound traffic is allowed by the default network ACL?

A

All

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Does a VPC automatically have a network ACL?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What inbound and outbound traffic is allowed by default in a custom network ACL?

A

None

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Should you block IP addresses using a network ACL’s or security groups

A

Network ACL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How many network ACL’s can a subnet be associated with?

A

One

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Are security groups or network ACL’s stateless?

A

Network ACL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

In what order are the network ACL’s numbered list of rules evaluated?

A

In order from lowest number

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What does VPN Cloudhub do?

A

Connect multiple sites with differing VPN’s together

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What measure does VPN Cloudhub do to protect your data since it uses the public internet?

A

Encrypts your data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is cloudwatch?

A

A monitoring and observability platform designed to give insight into your AWS architecture and potential problems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What should you create to notify you of a system failure?

A

An alarm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are default metrics for cloudwatch?

A

CPU utilization and network throughout

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are custom metrics for cloudwatch?

A

EC2 memory utilization, EBS storage capacity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What is cloudwatch logs?
A tool that allows you to monitor, store, and access log files from a variety of sources
26
What is a log event?
A record of what happened
27
What does a log event contain?
The data and a timestamp
28
What is a log stream?
A collection of log events from the same source
29
What is a log group?
A collection of log streams
30
What is a filter pattern in cloud watch logs?
A way to look for specific errors
31
What is Amazon managed Grafana?
Fully managed AWS service allowing instant querying correlating and visualizing of your operational metrics, logs, and traces
32
What are Grafana workspaces?
areas created to allow separate data visualizations and querying
33
Does Grafana have built in security?
Yes
34
What are some key use examples for Amazon managed Grafana?
container metric visualizations, internet of things monitoring, troubleshooting
35
What is Amazon managed service for prometheus?
Serverless, prometheus compatible service used for securely monitoring container metrics at scale
36
What is CloudTrail?
it increases visibility into your user and resource activity by recording AWS Management Console actions and API calls
37
What is logged with CloudTrails?
Metadata of API call, identity of API caller, time of API call, source IP address of API caller, request parameters, response elements returned by server
38
What is logged with CloudTrails?
Metadata of API call, identity of API caller, time of API call, source IP address of API caller, request parameters, response elements returned by server
39
What can you think of CloudTrails as?
The CCTV system of your AWS account
40
What is AWS Shield?
Free DDoS protection for ELB, CloudFront, and Route 53
41
What layer attacks does Shield protect against?
Layer 3/4 (SYN floods, reflection attacks, etc)
42
What is AWS Shield Advanced?
Enhanced protection for ELB, Cloudfront, and Route 53
43
What is the difference between Shield and Shield Advanced?
24/7 access to DDoS response time, real time alerts, and Advanced is 3000 per month
44
What is AWS WAF?
AWS web application firewall is a service that lets you monitor the HTTP and HTTPS requests that are forwarded to Amazon CloudFront or an application load balancer
45
If you want to control what IP addresses are allowed to make requests, what should you use?
AWS WAF
46
If you are afraid of layer 7 attacks, what should you use?
AWS WAF
47
What are the three conditions available on AWS WAF?
Allow all (except what you specify), deny all (except what you specify), count what matches conditions you stated
48
What is AWS GuardDuty?
A threat detection service that uses machine learning to continuously monitor for malicious behavior
49
Where do GuardDuty alerts appear?
GuardDuty console and Cloudwatch events
50
What does GuardDuty monitor?
Cloudtrail logs, VPC flow logs, and DNS logs
51
What is firewall manager?
A security management service that goes across multiple AWS accounts
52
What is Macie?
Uses machine learning and pattern matching to discover sensitive data stored in S3
53
Can Macie utilize automated remediation actions?
Yes
54
What is amazon inspector?
Automatically assesses applications for vulnerabilities or deviations from best practice
55
What are the 2 types of Amazon inspector assessments?
Network assessments, host assessments
56
What is KMS?
Key management service
57
What is a CMK in regards to KMS?
A customer master key is a logical representation of a master key
58
What is a HSM?
a hardware security module is a physical computing device that safeguards and manages digital keys and performs encryption and decryption functions
59
What are the three ways a CMK is created?
AWS creates it for you in HSMs, import key material from own key management infrastructure, have key material generated in AWS CloudHSM cluster
60
How often can you have AWS KMS rotate the CMK?
every year
61
What CMKs do not support automatics key rotation?
imported keys, asymmetric keys, or keys generated in AWS CloudHSM
62
What type of policy do KMS CMK's require?
a resource policy
63
What is the difference between KMS and CloudHSM?
KMS has shared tenancy of underlying hardware, CloudHSM is dedicated to you, KSM has automatic key rotation, CloudHSM does not
64
What is Secrets Manager?
A service that securely stores, encrypts, and rotates your database credentials and other secrets
65
What must you do before enabling credential rotation?
make sure all application instances are configured to use secrets manager
66
Does secret manager rotate credentials automatically?
Yes
67
What is parameter store?
a capability of AWS systems manager that provides secure, hierarchical storage
68
If you are trying minimize costs and don't need key rotation, what secure storage solution should you use?
parameter storage
69
What is the maximum amount of parameters for parameter storage?
10,000
70
How can the owner of a private object in S3 grant time limited permission to download the object?
by creating a presigned URL
71
if you want someone to have access to all the contents of multiple restricted files, what should you use?
Presigned cookies
72
What is AWS Certificate Manager?
allows you to create, manage, and deploy public and private SSL certificates for use with other AWS services
73
How much does AWS charge for provisioning public and private certificates?
for free
74
Does AWS Certificate Manager automatically renew and deploy certificates?
Yes
75
What service should you use to manage your SSL certificates?
AWS Certificate manager
76
What is AWS audit manager?
with it, you can continuously audit your AWS usage to make sure you stay compliant with industry standards and regulations
77
Is audit manager an automated service?
yes
78
If you need continuous auditing, what should you use?
audit manager
79
What is AWS artifact?
A single source you can visit to get the compliance -related information that matters to you
80
If you need to compliance reports, what should you use?
AWS artifact
81
What is amazon cognito?
it provides authentication, authorization, and user management for your web and mobile apps in a single service without the need for custom code
82
What is the series of events that Cognito does to sign in?
Authenticates and gets a token, exchanges that token in for AWS credentials in the identity pool, finally uses AWS credentials to sign in
83
What is Amazon Detective?
it pulls data in from your AWS resources and uses machine learning, stat analysis, and graph theory to quickly figure out the root cause of your security issues
84
If you need to know the root cause of an event, what should you use?
Amazon detective
85
What is network firewall?
a managed service that makes it easy to deploy a physical firewall across your VPC's.
86
Does AWS Network Firewall work with Firewall Manager?
Yes
87
If you need an intrusion prevention system or to filter internet traffic before it reaches your gateway, what should you use?
AWS Network FIrewall
88
If you need an intrusion prevention system or to filter internet traffic before it reaches your gateway, what should you use?
AWS Network FIrewall
89
What is AWS Security Hub?
a single place to view all your security alerts from differing services

AWS (18 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions