Card 1
Q: How do you protect objects in your Amazon S3 buckets from deletion or overwrite?
Show Answer
Turn on versioning and MFA delete.
Card 2
Q: How do you secure sensitive data in Amazon EBS volumes?
Show Answer
Ensure you turn on EBS encryption when creating the volume.
Card 3
Q: What AWS service can you use to provide short-term access that acts as temporary security credentials for access to your AWS resources?
Show Answer
AWS Security Token Service
Card 4
Q: What permissions do IAM identities start with when you create a new user, group, or role?
Show Answer
No permissions, all permissions must be explicitly granted.
Card 5
Q: What two types of policies can be attached to an IAM role?
Show Answer
Trust policy and permission policy
Card 6
Q: What two main ways are Service Control Policies used?
Show Answer
- To block services by default and then allow certain services. This is known as an allow list.
- Allow by default and block access to certain services known as a deny list.
Card 7
Q: What are some differences between network access control lists and security groups?
Show Answer
- Network ACLs are used with subnets and are used for explicit denies and allows
- Security groups are used for almost everything else and are simpler because they are stateful, so there are less rules needed to secure your environment
- Security groups are used with the elastic network interfaces of your Amazon EC2 instances or resources
- Security groups have an explicit deny, meaning anything not explicitly allowed will be denied
- Network ACLs are processed in order from the lowest rule number to the highest rule number
- Network ACLs are stateless and security groups are stateful
Card 8
Q: What are the two types of endpoints that you can create inside your Amazon VPC?
Show Answer
- Gateway Endpoints are used for AWS public services. Sometimes we want to connect to these public services like S3 or DynamoDB from a private instance or subnet that does not have access to the internet or a NAT Gateway setup. Gateway endpoints can be restricted using policies, use routing, and need an entry on the route table.
- Interface Endpoints are used for everything else, and you have to pick the correct endpoint depending on the AWS services. Interface endpoints use security groups, not policies. They also use DNS with a prefix list.
Card 9
Q: Which AWS service do you integrate to encrypt and rotate all database credentials, API keys, and secrets?
Show Answer
AWS Secrets Manager
Card 10
Q: Which AWS service do you integrate to secure your web application and allow multiple domains to serve SSL traffic over the same IP address?
Show Answer
AWS Certificate Manager
Card 11
Q: Which AWS Directory Service do you implement to access resources both on premises and in AWS using the on premises credentials?
Show Answer
AWS Directory Service for Microsoft Active Directory
Card 12
Q: You need to limit the maximum number of requests from a single IP address for your AWS WAF rule. What do you create?
Show Answer
A rate-based rule and set the rate limit.
Card 13
Q: For your AWS WAFs, why is knowledge of the OSI model important?
Show Answer
Because what the firewall can read depends on what layer your firewall runs at on the OSI model. You have to know what layer our product or application operates at, and then you can determine what capabilities the firewall can have. The higher layer of the firewall, the more compute performance is needed, and the cost is also more.