All things 'Security'

AWS Security Hub is a cloud security posture management service that performs security best practice checks, aggregates alerts, and enables automated remediation. Which AWS services does it integrate with ?

• Amazon GuardDuty, Inspector, IAM Access Analyzer, Macie, Firewall Manager, Amazon Health, Amazon Systems Manager, AWS Config

• Amazon GuardDuty, Inspector, Firewall Manager, Macie

• Amazon GuardDuty,

  Inspector, AWS Config, IAM Access Analyzer

• Amazon GuardDuty,

  Inspector, AWS Config, Amazon Health, Firewall Manager

You have discovered a number of unauthorized API calls have been made in your development environment over the last week, including changes to Security Groups, routing tables and the addition of an Internet Gateway. When you ask the development team leader about this, they are surprised because nobody in the team is supposed to have permission to perform these actions. You suspect that somebody in your organization has been making unauthorized changes to IAM permissions which has allowed people in the development team to have elevated privileges. How can you investigate what has happened?

• Use Athena to query your CloudTrail data and compare the IAM permissions before the incident with the current IAM permissions

• Generate a Credential Report and compare the IAM permissions before the incident with the current IAM permissions

• Compare the IAM permissions before the incident with the current IAM permissions using AWS Config

• Compare the IAM permissions before the incident with the current IAM permissions using CloudTrail

Your Head of Infrastructure suspects that some of your EC2 instances have been compromised and are being used for bitcoin mining. Which of the following services can you use to quickly determine if that is really the case?

• Check your DNS logs to see if any of your instances are querying a domain name that is associated with cryptocurrency-related activity

• Use Amazon Inspector to check if any of your instances are querying a domain name that is associated with cryptocurrency-related activity

• Check your VPC Flow logs to see if any of your instances are querying a domain name that is associated with cryptocurrency-related activity

• Use AWS GuardDuty to see if any of your instances are querying a domain name that is associated with cryptocurrency-related activity

You have been asked to design a solution to perform deep packet inspection, which of the following can you use?

• AWS Inspector

• VPC Flow logs

• AWS Network Firewall

• GuardDuty

You have recently fallen victim to a malicious attack that resulted in some of your EC2 instances being compromised. As part of your Incident Response Plan, one of the critical steps is to isolate any compromised instances so that they cannot communicate with any other instances in your VPC or with any third party command and control server. Your head of security has asked you to recommend a way to do this automatically. What do you recommend?

• Use Lambda to create a restrictive Security Group which only allows SSH from a single forensic workstation. Use AWS Config to replace the Security Group to the instance as soon as it is detected as being compromised.

• Create a restrictive Security Group which only allows SSH from a single forensic workstation. Use Lambda to replace the Security Group to the instance as soon as it is detected as being compromised.

• Create a restrictive Security Group which only allows SSH from a single forensic workstation. Use CloudFormation to apply the Security Group to the instance as soon as it is detected as being compromised

• Create a restrictive Network ACL which only allows SSH from a single forensic workstation. Use AWS Config to apply the ACL to the instance as soon as it is detected as being compromised

Security teams can use me to analyze security data across the organization to improve the protection of workloads, applications, and data.​ Which service am I ?

'Crazy Rydes' is a fast-growing e-commerce start-up. They recently had an issue where one of the developers inadvertently change configuration for S3. Though this incident didn't result into a data compromise, the 'Security' team is looking for the best mechanism to identify, alert and automatically remediate any such issues across all AWS accounts. Which AWS services will help provide a simple solution to the above problem ?

• AWS Config, Config Rules, Lambda

• EventBridge

  Lambda

  SNS

• GuardDuty

  SecurityHub

  SNS

• EventBridge

  SecurityHub

  SNS

Amazon Inspector allows customers to...

• Immediately discover and scan AWS workloads for vulnerabilities;

  Consolidate vulnerability management for Amazon EC2, AWS Lambda functions, and container images in Amazon ECR;

  Use the highly accurate Inspector risk score to efficiently prioritize remediation.

• Consolidate vulnerability management for Amazon EC2, AWS Lambda functions, and container images in Amazon ECR

• Immediately discover and scan AWS workloads for vulnerabilities;

  Use the highly accurate Inspector risk score to efficiently prioritize remediation.

• Use the highly accurate Inspector risk score to efficiently prioritize remediation;

  Consolidate vulnerability management for Amazon EC2, AWS Lambda functions, and container images in Amazon ECR

Your Lambda function needs to write to the ev_charge_stations, ev_networks and ev_plugs DynamoDB tables. From a security perspective, select the best answer that describes the most suitable policy.

• Configure the resource and action values as 'arn:aws:dynamodb:region:account-id:table/' and 'dynamodb:'

• For the resource value, specify all 3 tables individually, e.g. 'arn:aws:dynamodb:region:account-ID:table/ev_charge_stations' and use 'dynamodb:PutItem' as the policy's action value.

• Use '*' as the resource value and specify 'dynamodb:PutItem' as the policy's action value.

• Specify 'dynamodb:PutItem' as the policy's action value and use 'arn:aws:dynamodb:region:account-id:table/ev_*' as the value for the resource.

I can integrate supported AWS and self-managed services as event producers and event consumers into your application in a simple, reliable, consistent, and cost-effective way. Which service am I ?