Font size
WorksheetsSecurity Quiz Chapter 12
Total questions: 100
Worksheet time: 50mins
What are the three elements of data that need to be ensured for effective protection, collectively known as "CIA"?
Confidentiality, Integrity, Authorization
Confidentiality, Identity, Availability
Confidentiality, Integrity, Availability
Confidentiality, Integration, Access
Which two mechanisms are commonly used for enforcing data confidentiality?
Encryption and Access Control Lists (ACLs)
Hashing and Logging
Usernames and Passwords
Firewalls and Antivirus Software
What is the primary goal of cryptographic hashing and logging in terms of data security?
To validate the integrity of data
To ensure data availability
To encrypt data
To control user access
What is the first step in protecting your AWS credentials according to the text?
To manage services and edit resources
To protect them from accidental exposure and unauthorized use
To ensure that users have only the permissions they need
To log into the AWS management console
What is the second step to ensure when managing AWS credentials?
To give users more permissions than they need
To ensure that users have only the permissions they need, and no more
To frequently change user permissions
To monitor user activity continuously
What is a principal in AWS IAM terminology?
A set of credentials used to authenticate with AWS resources
A password policy
An entity that can take an action on an AWS resource
A multi-factor authentication device
Which of the following is recommended to secure the root user in AWS?
Enabling a password policy for all IAM users
Creating an IAM user and attaching the AdministratorAccess policy
Using the root user for routine administrative tasks
Requiring an administrator to reset an expired password
What is the minimum password length that you can set for IAM users in AWS?
Four characters
Six characters
Eight characters
Ten characters
What is the principle of least privilege in information security?
Giving IAM principals permissions to all resources
Assigning an MFA token to every user
Giving IAM principals permissions to only the resources they need and no more
Enforcing a password policy to all IAM users
By default, what permissions do IAM principals have when they are created?
Full access to AWS resources
No permissions
Read-only permissions
Limited permissions based on common job roles
What does an IAM policy consist of at a minimum?
One or more users
One or more roles
One or more permission statements
One or more groups
What is the effect of an IAM policy statement?
It specifies the AWS service to be used
It allows or denies access to a resource
It designates the principal that will receive the permissions
It lists the actions that can be performed on a resource
What can the 'Action/Operation' element of an IAM policy specify?
The user who performs the action
The resource that the action can be performed on
The set of actions or operations that can be performed on AWS resources
The conditions under which the policy is effective
What is a customer-managed policy in AWS IAM?
A policy managed by AWS for common job roles
A standalone policy created and managed by the customer
A policy that automatically applies to all AWS accounts
A policy that grants full access to AWS resources
What is an inline policy in the context of IAM?
A policy that is attached to multiple IAM principals simultaneously
A set of permissions embedded in an IAM principal or group
A managed policy that exists independently of any IAM principals
A document that outlines the structure of IAM within an organization
What is the purpose of permissions boundaries?
To define the structure of IAM roles and responsibilities
To grant all permissions available in AWS to a user
To limit the maximum permissions an IAM principal can be assigned
To attach a policy to the wrong principal
What happens if you attach the AdministratorAccess policy to a user with a permissions boundary that only allows actions in EC2?
The user will have full access to all AWS services
The user will only be able to perform actions in EC2
The user's permissions boundary will be overridden by the AdministratorAccess policy
The user will not be able to perform any actions in AWS
What is the name of the customer-managed policy that needs to be created according to EXERCISE 12.1?
AdministratorAccessPolicy
LimitedUserPolicyBoundary
LimitedAdminPolicyBoundary
FullAccessPolicyBoundary
Which AWS service is specifically mentioned in the permissions policy content provided in EXERCISE 12.1?
DynamoDB
EC2
S3
IAM
According to the text under "Roles," what is a role in IAM?
A user with a password and access key
An IAM principal without a password or access key
A resource within AWS
A type of AWS service
What does the AdministratorAccess permissions policy allow according to the exercise instructions?
Full access to all AWS services
Limited access to EC2 instances only
Access to DynamoDB only
No access to AWS services
What does the permissions boundary policy override according to the exercise instructions?
It overrides the AdministratorAccess policy to limit actions to EC2 only.
It grants additional permissions beyond the AdministratorAccess policy.
It removes all access to AWS services.
It has no effect on the AdministratorAccess policy.
What does the "Effect": "Allow" in the permissions policy JSON indicate?
It denies access to the specified actions
It allows access to the specified actions
It is irrelevant to the access level
It encrypts the specified actions
Which AWS service is specified in the "Principal" element of the trust policy JSON?
Amazon S3
Amazon EC2
Amazon DynamoDB
Amazon RDS
What is the purpose of a trust policy in an IAM role?
To define the actions a user can perform
To encrypt data stored in AWS
To allow an AWS resource to assume the role
To monitor AWS resource usage
What action is allowed by the trust policy for the EC2 service?
sts:TerminateInstance
sts:AssumeRole
ec2:ModifyInstance
ec2:StartInstances
When IAM automatically creates an instance profile with the same name as the role, what is the purpose of this instance profile?
To provide billing details for the EC2 instance
To allow the EC2 instance to assume the role
To restrict the EC2 instance from accessing other services
To log the activities performed by the EC2 instance
Which AWS CLI command is used to view the instance profile associated with a specific role?
aws iam get-instance-profile --role-name MyAppRole
aws iam list-instance-profiles-for-role --role-name MyAppRole
aws iam describe-instance-profiles --role MyAppRole
aws iam show-instance-profile --role MyAppRole
What does the "Action" field in the AssumeRolePolicyDocument specify in the provided JSON output?
The permission to launch an EC2 instance
The permission to delete the IAM role
The permission to assume the IAM role
The permission to modify the IAM role
What is the effect of the policy statement included in the AssumeRolePolicyDocument in the JSON output?
Deny
Queue
Allow
Reject
Which AWS service places the temporary credentials in the instance metadata when an instance is associated with an instance profile?
AWS Identity and Access Management (IAM)
AWS Security Token Service (STS)
AWS Key Management Service (KMS)
AWS Directory Service
How often are the temporary credentials granted by a role named MyappRole updated?
Every hour
Every six hours
Every twelve hours
Once a day
What is the purpose of the credentials shown in the example?
To authenticate to the AWS API for performing operations
To encrypt data stored in AWS
To increase the security of the AWS Management Console
To monitor AWS service usage
What should be done to ensure the security of the access key ID, secret access key, and session token?
Store them in a database
Share them publicly
Be very careful to avoid exposing them
Use them frequently
Which AWS CLI command correctly exports the ACCESS_KEY_ID from the given example?
export AWS_ACCESS_KEY_ID=ASIAT5J6QWJME3E2SJ56C
export AWS_ACCESS_KEY_ID=MyAppRole
export AWS_ACCESS_KEY_ID=Success
export AWS_ACCESS_KEY_ID=2018-10-14T20:47:19Z
What is the potential risk if a user may use the credentials to attempt to enumerate resources using the AWS CLI?
They can perform operations with no limitations
They can gain unauthorized access
They can encrypt the AWS data
They can delete the AWS account
What AWS CLI command is used to list all DynamoDB tables?
aws dynamodb describe-tables
aws dynamodb get-tables
aws dynamodb list-tables
aws dynamodb show-tables
What error message is returned when an unauthorized attempt is made to describe EC2 instances?
UnauthorizedOperation
AccessDeniedException
InvalidPermission
OperationNotPermitted
What principle should be followed to avoid granting a role more permissions than it requires?
Principle of least privilege
Principle of maximum access
Principle of necessary access
Principle of sufficient privilege
What can you do as an additional precaution to ensure IAM roles are not overly permissive?
Enable Amazon GuardDuty
Disable Security Token Service on a per-region basis
Increase the permissions of the IAM user
Grant all permissions to the IAM user
What is the first step to create and assume a role as an IAM user according to Exercise 12.2?
Click the Switch Role button.
Enter your AWS account number.
Click Roles on the menu on the left side of the IAM Dashboard screen and then click the Create Role button.
Select the AmazonEC2ReadOnlyAccess AWS managed policy.
What should you do after selecting the AmazonEC2ReadOnlyAccess AWS managed policy when creating a role?
Click the Create Role button.
Click the Review button.
Click the Switch Role button.
Enter a name for the role.
What is the name suggested for the new role in Exercise 12.2?
IAMFullAccessRole
EC2FullAccessRole
EC2ReadOnlyRole
EC2ReadOnlyRole
According to the instructions in Exercise 12.2, how do you access the Switch Role feature in the AWS Management Console?
Click on the IAM Dashboard.
Click on the navigation bar at the top of the AWS Management Console and select your IAM account name.
Click on the Roles menu and select the newly created role.
Click on the Create Role button.
What is the final step in Exercise 12.2 to assume a role as an IAM user?
Click the Review button.
Click the Create Role button.
Click the Switch Role button.
Enter your AWS account number.
What will happen if you try to launch an EC2 instance with a role that doesn't have the RunInstances permission?
The instance will launch without any issues.
The instance will launch, but with limited functionality.
The instance launch will fail.
The instance will launch, but it will not be accessible.
Which AWS service offers optional bucket policies that control access to objects or entire buckets?
Key Management Service (KMS)
Simple Notification Service (SNS)
Simple Queue Service (SQS)
S3
What type of policy allows you to define who can publish messages or subscribe to a topic in SNS?
Identity-based IAM policies
Resource-based policies
User-based policies
Group-based policies
Which service uses resource-based SQS access policies to control who can send to and receive messages from a queue?
Key Management Service (KMS)
Simple Notification Service (SNS)
Simple Queue Service (SQS)
S3
Users without AWS credentials typically consume AWS services that offer what type of policies?
Identity-based IAM policies
Resource-based policies
User-based policies
Group-based policies
What is the purpose of detective controls in AWS?
To modify the security settings of your AWS environment
To keep a record of the events that occur in your AWS environment and alert you to security incidents or potential threats
To provide a backup service for your AWS data
To manage the computational resources of your AWS environment
Which AWS service allows you to log activities on your AWS account and is discussed in Chapter 7?
CloudWatch Logs
CloudTrail
S3 Bucket
Simple Notification Service (SNS)
What can you decide to log with CloudTrail?
Only management events
Only data events
Both management and data events
Neither management nor data events
How long can it take for CloudTrail to deliver a log file to the S3 bucket after an event occurs?
Instantly
Up to 5 minutes
Up to 10 minutes
Up to 15 minutes
What additional security feature can you enable when creating a trail in CloudTrail?
S3 Bucket encryption
SSE-KMS encryption and log file integrity validation
Global services logging
Simple Notification Service (SNS) encryption
What can CloudWatch Logs aggregate?
Logs from a single AWS service
Logs from multiple AWS services for easy storage and searching
Only CloudTrail logs
Only S3 bucket logs
What information do VPC flow logs include?
DHCP traffic only
Network interface, source and destination IP addresses, ports, protocols, and packet and byte counts
Usernames and passwords
Encrypted data packets
Which AWS service can be used to stream logs from database engines like MariaDB, MySQL, Aurora with MySQL compatibility, and Oracle?
Lambda
CloudTrail
RDS Logs
Athena
What can you configure Route 53 to log?
VPC flow logs
DHCP traffic
DNS queries for a hosted zone
Encrypted data packets
Where does Lambda automatically stream log events to?
A log group derived from the name of the function, using the format /aws/lambda/
A log group named after the user
A log group named FlowLogs
A log group in S3
What is the role of Athena in the context of AWS logs?
It automatically deletes old logs.
It encrypts log data.
It uses the Structured Query Language (SQL) to search data stored in S3.
It streams logs to CloudWatch.
What is the filter pattern used to search for DetachVolume, AttachVolume, and DeleteVolume events in a CloudWatch log stream containing CloudTrail logs?
{ $.eventName = "AttachVolume" && $.eventName = "DetachVolume" && $.eventName = "DeleteVolume" }
{ $.eventName = "AttachVolume" || $.eventName = "DetachVolume" || $.eventName = "DeleteVolume" }
{ $.eventName == "AttachVolume" || $.eventName == "DetachVolume" || $.eventName == "DeleteVolume" }
{ $.eventName == "Attach*" || $.eventName == "Detach*" || $.eventName == "Delete*" }
Why might someone use Amazon Athena with CloudWatch Logs?
To filter logs by specific event names only
To read each matching event in its native JSON format
To query it using SQL, sort it, and display only specific columns
To increase the storage capacity of CloudWatch Logs
What is inherently difficult about the way CloudWatch Logs displays matching events?
It displays them in a compressed format
It displays them in an alphabetical order
It displays them in their native JSON format
It displays them without timestamps
What can you use Amazon Athena for in the context of CloudWatch Logs?
To automatically delete old logs
To visualize the logs in a graphical format
To convert JSON format into CSV format
To select only a few key elements from the logs
Which SQL statement is used to define the structure of the data in Athena?
SELECT
INSERT
CREATE TABLE
UPDATE
What data formats does Athena support for importing multiple logs into a single database? (Choose two)
CSV and TSV
TXT and DOC
BMP and JPG
XML and HTML
What is the purpose of the ec2-volume-inuse-check rule in AWS Config?
To check if an EBS volume is attached to any instance
To monitor the network traffic
To validate the security group configurations
To report the CPU usage of EC2 instances
What action will AWS Config report as non-compliant if an EBS volume is not attached to an instance?
Starting an EC2 instance
Detaching the EBS volume
Attaching the EBS volume
Stopping an EC2 instance
What storage formats for Apache Hadoop does Athena support?
ORC and Parquet
MP3 and WAV
AVI and MP4
ZIP and RAR
What is the main benefit of using AWS Config to view the configuration timeline for a resource?
It provides real-time monitoring of network traffic.
It allows viewing specific API events that triggered the configuration change.
It automatically updates the resource to the latest configuration.
It enhances the computational performance of the resource.
What does AWS Config check in the "ec2-volume-inuse-check" according to Figure 12.3?
It checks if the EC2 instances are running the latest version of AWS software.
It checks whether EBS volumes are attached to EC2 instances and optionally checks if EBS volumes are marked for deletion when an instance is terminated.
It checks the network configuration of attached EBS volumes.
It monitors the performance metrics of EBS volumes.
What is the compliance status of the EBS volume shown in the AWS Config timeline in Figure 12.4?
Compliant
Noncompliant
Not applicable
Under review
What does Amazon GuardDuty analyze?
It analyzes the performance of AWS services.
It analyzes AWS Config rules and their compliance status.
It analyzes VPC flow logs, CloudTrail management event logs, and Route 53 DNS query logs, looking for known malicious IP addresses, domain names, and potentially malicious activity.
It provides a timeline of user activities and permissions within AWS.
What does a GuardDuty finding indicating 'Backdoor' suggest about an EC2 instance?
The instance is communicating on an unusual protocol and port.
The instance has been compromised by malware that can be used for DDoS attacks.
The instance is exhibiting network activity related to Bitcoin operations.
The instance is sending an abnormally large amount of traffic to an external host.
What type of GuardDuty finding is generated when an EC2 instance communicates on TCP port 25 or resolves the domain name of a known command-and-control server?
Behavior
Backdoor
Cryptocurrency
Unauthorized access
Which GuardDuty finding type is associated with an EC2 instance sending an abnormally large amount of traffic to an external host?
Backdoor
Unauthorized access
Behavior
Cryptocurrency
What does a GuardDuty finding indicating 'Cryptocurrency' suggest about an EC2 instance?
The instance is being used for Bitcoin mining activities.
The instance is sending an abnormally large amount of traffic to an external host.
The instance has been compromised by malware that can be used for DDoS attacks.
The instance is communicating on an unusual protocol and port.
What does the term 'Persistence' indicate in the context of AWS security findings?
An IAM user is launching an EC2 instance despite having no history of doing so.
An IAM user with no prior history of doing so has modified user or resource permissions, security groups, routes, or network ACLs.
Root user credentials were used or S3 block public access was disabled.
CloudTrail logging was disabled or modified, or CloudTrail logs were deleted.
What behavior is indicative of a 'Recon' finding type?
An IAM user has modified user or resource permissions without prior history.
An EC2 instance is showing behavior that suggests a Trojan might be installed.
A host from a known malicious IP address is probing an EC2 instance on a port that’s not blocked by a security group or network ACL.
An IAM user has launched an EC2 instance despite having no history of doing so.
Which finding type suggests that an IAM user has launched an EC2 instance without any prior history of such activity?
Persistence
ResourceConsumption
UnauthorizedAccess
Stealth
What does the 'Stealth' finding type indicate?
An IAM user has launched an EC2 instance without any prior history of such activity.
A possible unauthorized attempt to access your AWS resources via an API call or console login.
Password policy was weakened, CloudTrail logging was disabled or modified, or CloudTrail logs were deleted.
An EC2 instance is showing behavior that suggests a Trojan might be installed.
What is a 'Trojan' finding type associated with in AWS security?
An IAM user with no prior history of doing so has modified user or resource permissions.
An EC2 instance is exhibiting behavior that indicates a Trojan may be installed.
Root user credentials were used or S3 block public access was disabled.
A possible unauthorized attempt to access your AWS resources via an API call or console login.
What does 'UnauthorizedAccess' finding type usually indicate?
An IAM user has modified user or resource permissions without prior history.
An EC2 instance is showing behavior that suggests a Trojan might be installed.
A possible unauthorized attempt to access your AWS resources via an API call or console login.
An IAM user has launched an EC2 instance despite having no history of doing so.
What is the purpose of Amazon Inspector?
To monitor the performance of applications
To look for vulnerabilities on EC2 instances
To manage user access and permissions
To store data in the cloud
Which of the following is NOT one of the five rules packages offered by Amazon Inspector?
Common Vulnerabilities and Exposures
Security Best Practices
Runtime Behavior Analysis
Data Encryption Standards
What does the Runtime Behavior Analysis rules package detect?
Use of insecure client and server protocols
Network configurations that make resources in your VPC vulnerable
Security best practices for Linux and Windows operating system configurations
Performance metrics of EC2 instances
What kind of threats does GuardDuty look for compared to Amazon Inspector?
Vulnerabilities on EC2 instances
Security threats by inspecting network traffic to and from instances
Insecure permissions on system directories
Use of insecure client and server protocols
What severity level should be resolved immediately according to Amazon Inspector?
Low
Medium
High
Informational
What does a finding with a severity level of 'Informational' indicate in Amazon Inspector?
The issue should be resolved at your convenience.
The issue should be resolved immediately.
The issue should be resolved at the next possible opportunity.
A security configuration detail that isn't likely to result in your system being compromised.
What is required to be enabled for Amazon Detective to function?
VPC flow logs
CloudTrail
GuardDuty
AWS Config
What is the purpose of Amazon Detective?
To automatically resolve security vulnerabilities.
To create new AMIs from instances.
To help correlate events and investigate activities against AWS resources.
To increase the availability of information.
What is the purpose of Security Hub in AWS?
To provide a user-friendly dashboard for tracking application performance
To serve as a one-stop shop for the security status of your entire AWS environment
To manage network access to and from AWS resources
To create custom fraud-detection engines
Which AWS service allows you to create custom fraud-detection engines?
Security Hub
AWS Audit Manager
Amazon Fraud Detector
Protecting Network Boundaries
What does Amazon Fraud Detector use to establish a normal baseline?
Network configurations
Machine learning
User-defined security rules
Predefined security templates
What does AWS Audit Manager help with?
It helps in tracking application performance metrics.
It assists in creating user-friendly security dashboards.
It is a tool for assessing your controls and generating audit reports.
It provides a defense against attacks on network boundaries.
What is the primary defense against attacks in AWS according to the text?
Machine learning algorithms
User-friendly dashboards
The network
Custom fraud-detection engines
What do Network ACLs define within a VPC?
The type of traffic that can access the Internet Gateway
What traffic is allowed to and from a subnet
The security protocols for AWS resources
The list of instances and elastic load balancer listeners
What is the purpose of a VPC's Internet Gateway?
To monitor HTTP and HTTPS requests to an application
To provide a target for route tables
To allow resources in the VPC to access the Internet
To protect against DDoS attacks
What does AWS WAF primarily protect against?
Unauthorized access to route tables
DDoS attacks on Internet-facing applications
Denial of service and unauthorized access to your application
Traffic that does not comply with the route table
