1 - Intro cloud security

Which of the following are advantages of cloud computing? (Select TWO)

• Provision resources up front.

• Stop guessing capacity.

• Trade fixed expense for variable expense.

• Trade variable expense for fixed expense.

How does cloud computing assist in resource capacity management?

• By providing fixed capacity at all times.

• By allowing access to capacity as needed and being quickly scalable.

• By limiting resource usage.

• By requiring large investments in data centers.

Which of the following are characteristics of security principles for preparing for security incidents? (Select TWO.)

• Use subnets only in one Availability Zone.

• Regularly conduct incident response drills through game days.

• Create processes to isolate incidents and restore operations.

• Use different AWS services.

• Use hardcoded credentials.

Which statement is true about multi-factor authentication (MFA)?

• MFA requires two or more factors for authentication.

• MFA is enabled by default.

• MFA is used as a replacement for your username and password.

• MFA requires the use of hardware.

An AWS Identity and Access Management (IAM) administrator determines what users need to do, defines the correct set of permissions, and then creates a policy that allows users to perform only those tasks. Which principle is the administrator following?

• Principle of availability

• Principle of authentication

• Principle of managed policy

• Principle of least privilege

A company wants to build a federated identity solution for their AWS accounts and wants to use a single centralized directory for identity management. Which AWS federated identity solution is most appropriate for the company to use?

• AWS CloudTrail

• AWS Single Sign-On

• AWS CloudFormation

• AWS Config

A company wants to use an automated security assessment tool to enhance the security and compliance of the applications they deploy on AWS. Which AWS service will meet their needs?

• AWS Identity and Access Management (IAM)

• Amazon GuardDuty

• Elastic Load Balancing (ELB)

• Amazon Inspector

An administrator wants to distribute incoming application traffic to several targets, such as Amazon EC2 instances, containers, and IP addresses. The solution must be able to handle varying application traffic loads within a single Availability Zone or across multiple Availability Zones. Which security feature should they implement?

• Security groups

• Network access control lists (ACLs)

• Subnets

• Elastic Load Balancing (ELB)

What is the appropriate approach to ensure that data stored in AWS is encrypted at rest?

• Use only Amazon EBS–optimized EC2 instances when storing data in Amazon EBS.

• Encrypt the volume using AWS Key Management Service (AWS KMS) when storing data in Amazon EBS.

• Use EC2 instance store.

• Use S3 Versioning and multi-factor authentication (MFA) delete when storing data in Amazon S3.

A company needs to store sensitive documents in an Amazon S3 bucket. The documents must be encrypted at rest, and the company wants to manage the keys used for encryption. Which method can be used for this purpose?

• Server-side encryption with customer-provided keys

• Client-side encryption

• Server-side encryption with Amazon S3-managed keys

• Client-side encryption with Amazon Macie