What does Amazon GuardDuty analyze to detect threats?
GuardDuty analyzes CloudTrail, VPC flow and DNS logs for threats.
← AWS Certified Security – Specialty pathway
Try AWS Certified Security – Specialty free
15 flashcards and 10 practice questions, with every answer explained, exactly as members see them. No account needed.
Flashcards 15 of 240
That is the free sample.
Associate membership gives you 100 cards for this exam, and every other exam in the catalogue.
Become an Associate Member to continue1 of 15
Practice questions 10 of 131
Why disable rather than delete a suspected compromised IAM user during investigation?
Deactivating the user's access keys and console password, or attaching a deny-all policy, stops access at once while keeping the user, its policies and its history available for investigation. Letting in-progress work continue gives the attacker more time. Deleting a user does not delete CloudTrail records, and active IAM users can be deleted; preserving evidence is the real reason to disable first.
How can you reach an AWS service privately without traversing the internet?
VPC endpoints connect to AWS services privately over the AWS network.
What does IAM Access Analyzer help identify?
IAM Access Analyzer uses automated reasoning on resource policies to find resources, such as S3 buckets, KMS keys and IAM roles, that are shared with principals outside your account or organization; it can also report unused access. Vulnerabilities in Lambda functions are found by Amazon Inspector. Sensitive data in S3 is discovered by Macie, and malicious API activity is detected by GuardDuty.
Which service manages encryption keys for AWS data protection?
KMS creates and controls encryption keys used across AWS services.
What is the shared responsibility model in AWS?
Under the shared responsibility model, AWS is responsible for security of the cloud, meaning hardware, facilities and global infrastructure, and customers are responsible for security in the cloud, such as their data, IAM configuration and network settings. AWS does not manage customer data or IAM choices, and customers do not secure physical facilities. The split shifts by service type, with customers managing more for EC2 than for managed services such as S3 or Lambda.
Which AWS service records API calls made in an account for detection and audit?
CloudTrail records management and data API activity. CloudWatch handles metrics and logs, Config tracks configuration and Inspector scans for vulnerabilities.
What should follow containment and eradication?
In the NIST-based incident lifecycle that AWS guidance follows, containment and eradication are followed by recovery, which restores normal operation, and then a post-incident lessons-learned review. Closing the case without a review loses those lessons. Forensic evidence should be kept according to retention and legal requirements, and rebuilding every account is rarely justified.
Which stateful control filters traffic to an EC2 instance?
Security groups are stateful instance-level firewalls; network ACLs are stateless at the subnet.
Why review IAM permissions regularly?
People change jobs and projects, and permissions granted for past work tend to stay, so regular reviews, helped by IAM last-accessed data and Access Analyzer unused access findings, catch stale and excessive access. A review does not rotate keys by itself. IAM does not remove unused permissions automatically, and review frequency is set by your own policy rather than by an AWS rule.
0 of 10