AWS Security Specialty flashcards
AWS Security Specialty · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- GuardDuty data sources
- GuardDuty analyzes VPC Flow Logs, CloudTrail management and S3 data events, and DNS logs; it requires no agents on instances and can be enabled per Region.
- Security Hub ASFF
- AWS Security Hub normalizes findings from GuardDuty, Inspector, Macie, and partner tools into the AWS Security Finding Format, then evaluates them against enabled standards such as CIS and AWS Foundational Security Best Practices.
- Amazon Detective purpose
- Detective builds interactive behavior graphs from CloudTrail, VPC Flow Logs, GuardDuty, and EKS audit logs to investigate root cause, retaining up to one year of data.
- EC2 instance isolation
- To contain a compromised instance, replace its security groups with an empty group denying all inbound and outbound traffic, or move it to an isolated subnet, then snapshot volumes for forensics.
- GuardDuty malware scan
- GuardDuty Malware Protection for EC2 scans attached EBS volumes, including snapshots, for malware without installing an agent and reports findings with the affected resource details.
- CloudTrail log integrity
- CloudTrail log file integrity validation produces SHA-256 digests for each log file plus an RSA-signed digest file, letting you prove logs were not altered after delivery.
- CloudTrail data events
- S3 object-level events and Lambda Invoke events are data events; they are not logged by default and must be explicitly enabled on a trail, incurring additional charges.
- VPC Flow Log scope
- Flow logs record metadata such as source and destination IP, ports, protocol, packets, bytes, and ACCEPT or REJECT action; they never capture packet payload contents.
- CloudTrail Insights
- Insights continuously analyzes management event volume and detects anomalous API call rates, such as spikes in IAM CreateUser calls, generating an insight event in the trail's Region.
- CloudWatch Logs metric filter
- A metric filter scans log events for a pattern and increments a CloudWatch metric, which an alarm can watch to alert on events such as repeated console login failures.
- Organization trail
- An organization trail created in the management account applies to all accounts in AWS Organizations, logging events centrally to a chosen S3 bucket and optional CloudWatch Logs.
- Security group statefulness
- Security groups are stateful and allow-only: return traffic for an allowed connection is automatically permitted, and there are no deny rules, so use network ACLs for explicit deny.
- Network ACL evaluation
- Network ACLs are stateless and evaluated in ascending rule number order; the first matching allow or deny rule applies, and both inbound and outbound rules must permit the flow.
- WAF rate-based rule
- An AWS WAF rate-based rule counts requests per originating IP over a configurable five-minute window and blocks or counts sources that exceed the threshold, mitigating brute force and DDoS.
- IMDSv2 protection
- Instance Metadata Service version 2 requires a session token obtained via PUT before metadata requests, which blocks most server-side request forgery attempts to steal instance role credentials.
- Session Manager benefit
- SSM Session Manager provides shell access without inbound ports, bastion hosts, or SSH keys, and can log session commands and output to S3 or CloudWatch Logs.
- IAM policy evaluation logic
- Explicit deny overrides everything. Otherwise an action is allowed only if the SCP, resource policy, identity policy, permissions boundary, and session policy all permit it.
- Permissions boundary
- A permissions boundary sets the maximum permissions an IAM user or role can have but grants nothing itself; effective permissions are the intersection with identity policies.
- SCP effect
- Service control policies limit permissions for accounts in an organization but never grant them; they do not affect the management account or service-linked roles.
- Cross-account role assumption
- The trusting account's role trust policy must allow the source principal to call sts:AssumeRole, and the source identity also needs an identity policy permitting that call.
- Access Analyzer findings
- IAM Access Analyzer uses resource policies and CloudTrail to identify resources shared with external entities and to generate findings for unused permissions and invalid policies.
- KMS key policy requirement
- Every KMS key must have a key policy; IAM policies alone cannot grant access unless the key policy delegates to IAM or names the principal explicitly.
- Envelope encryption
- KMS GenerateDataKey returns a plaintext data key plus an encrypted copy; encrypt data locally with the plaintext key, store the encrypted key, and delete the plaintext key.
- S3 Block Public Access
- Block Public Access has four settings at bucket and account level; enabling all four rejects public ACLs and policies and blocks cross-account public access regardless of bucket policy.
- Macie function
- Macie uses machine learning and pattern matching to discover sensitive data such as credentials and personal information in S3 buckets and publishes findings to EventBridge.
- RDS encryption enablement
- RDS encryption can only be enabled at creation; to encrypt an existing unencrypted instance, snapshot it, copy the snapshot with encryption, then restore a new instance.
- Control Tower guardrails
- Control Tower deploys preventive guardrails as SCPs and detective guardrails as AWS Config rules across enrolled accounts, and can automatically remediate noncompliant resources.
- Config aggregator
- A Config aggregator collects configuration and compliance data from multiple accounts and Regions into one account, supporting organization-wide or individual account authorization.
- CloudTrail Lake
- CloudTrail Lake is an immutable event data store that retains events for up to ten years and supports SQL-based queries without building external analytics pipelines.
- AWS Audit Manager
- Audit Manager continuously collects evidence from CloudTrail, Config, and Security Hub into assessments mapped to frameworks such as PCI DSS, SOC 2, and ISO 27001.
- Trusted Advisor categories
- Trusted Advisor inspects cost optimization, performance, security, fault tolerance, and service quotas; Business and Enterprise support plans unlock the full check set and API access.
- Security Hub delegated administrator
- A delegated administrator account manages Security Hub for an organization, enabling standards and aggregating findings from all member accounts and selected Regions centrally.