Security & Compliance Flashcards
(21 cards)
1
Q
DDOS Protection on AWS
A
- AWS Shield Standard
- AWS Shield Advanced (premium protection)
- AWS WAF
- CloudFront and Route 53
2
Q
AWS Shield Standard
A
- Free service that is activated for every AWS customer
3
Q
AWS Shield Advanced
A
- Protect against more sophisticated attack
- 24/7 access to AWS DDoS response team (DRP)
4
Q
AWS WAF – Web Application Firewall
A
- Protects your web applications from common web exploits (Layer 7)
- Layer 7 is HTTP
5
Q
AWS Network Firewall
A
- Protect your entire Amazon VPC
- From Layer 3 to Layer 7 protection
6
Q
AWS Firewall Manager
A
- Manage security rules in all accounts of an AWS Organization
- Rules are applied to new resources as they are created
7
Q
Data at rest vs. Data in transit
A
- Data at rest: data stored or archived
- Data in transit: data being moved from one location to another
- to encrypt use encryption keys
8
Q
AWS KMS (Key Management Service)
A
- KMS = AWS manages the encryption keys for us
- Anytime you hear “encryption” for an AWS service, it’s most likely KMS
9
Q
CloudHSM
A
- AWS provisions encryption hardware
10
Q
Types of KMS Keys
A
- Customer Managed Key, AWS Managed Key, AWS Owned Key, CloudHSM Keys (custom keystore)
11
Q
AWS Certificate Manager (ACM)
A
- provision, manage, and deploy SSL/TLS Certificates
12
Q
AWS Secrets Manager
A
- for storing secrets
- rotation of secrets every X days
- Integration with Amazon RDS
13
Q
Amazon GuardDuty
A
- Threat discovery to protect AWS Account
- Can protect against CryptoCurrency attacks
14
Q
Amazon Inspector
A
- Automated Security Assessments for EC2 instances, Container Images & Lambda
functions
15
Q
AWS Config
A
- Helps with auditing and recording compliance
- Helps record configurations and changes over time
16
Q
AWS Macie
A
- uses machine learning and pattern matching to discover and protect sensitive data
17
Q
AWS Security Hub
A
- Central security tool
- automate security checks across several accounts
18
Q
Amazon Detective
A
- analyzes, investigates, and quickly identifies the root cause of security issues or suspicious activities (ML and graphs)
19
Q
AWS Abuse
A
- Report suspected AWS resources
- Spam, Port scanning, DoS or DDoS attacks, Intrusion attempts, Hosting objectionable or copyrighted content, Distributing malware
20
Q
Root user privileges
A
- Root user = Account Owner
- Lock away your AWS account root user access keys
- only by root user: Change account settings, Close your AWS account, Change or cancel your AWS Support plan, Register as a seller
21
Q
IAM Access Analyzer
A
- identify which resources are shared externally (Define ZoneofTrust)
