Quiz
Chapter 3
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (20)
1Whose responsibility is it to secure the AWS Cloud?
- AOnly Amazon Web Services
- BOnly you
- CThe World Wide Web Consortium (W3C)
- DYou and AWS share the responsibility.
2For which aspects of physical and environmental security is Amazon Web Services
responsible?- AFire detection and suppression
- BPower redundancy
- CClimate and temperature control in AWS datacenters
- DAll of the above
3True or False: The AWS network provides protection against traditional network security
issues.- ATrue
- BFalse
4Which AWS service provides centralized management of access and authentication of users
administering the services in an AWS account?- AAWS Directory Service
- BAWS Identity and Access Management Service
- CAmazon Cognito
- DAWS Config
5Which credentials can an IAM user have in order to access AWS services via the AWS Management
Console and the AWS Command Line Interface (AWS CLI)? (Choose two.)- AKey pair
- BUser name and password
- CEmail address and password
- DAccess keys
6True or False: A password policy can be set in IAM that requires at least two lowercase letters
and at least two non-alphanumeric characters.- ATrue
- BFalse
7The IAM access keys used to access AWS services via the AWS Command Line Interface
(AWS CLI) and/or AWS Software Development Kits (SDK) consist of which two parts?- AAccess Key ID and password
- BPublic Access Key and Secret Access Key
- CAccess Key ID and Secret Access Key
- DUser name and Public Access Key
8Which Multi-Factor Authentication devices does the IAM service support?
- AHardware devices (Gemalto)
- BVirtual MFA applications (for example, Google Authenticator)
- CSimple Message Service (SMS) (via mobile devices)
- DAll of the above
9Which of the following is true when using AWS Identity and Access Management groups?
- AIAM users are members of a default user group.
- BGroups can be nested.
- CAn IAM user can be a member of multiple groups.
- DIAM roles can be members of a group.
10Which of the following is not a best practice for securing an AWS account?
- ARequiring Multi-Factor Authentication for root-level access
- BCreating individual IAM users
- CMonitoring activity on your AWS account
- DSharing credentials to provide cross-account access
11Which of the following is true when using AWS Key Management Service (AWS KMS)?
- AAll API requests to AWS KMS must be made over HTTP.
- BUse of keys is protected by access control policies defined and managed by you.
- CAn individual AWS employee can access a Customer Master Key (CMK) and export
the CMK in plaintext. - DAn AWS KMS key can be used globally in any AWS Region
12The AWS CloudTrail service provides which of the following?
- ALogs of the API requests for AWS resources within your account
- BInformation about the IP traffic going to and from network interfaces
- CMonitoring of the utilization of AWS resources within your account
- DInformation on configuration changes to AWS resources within your AWS account
13Amazon CloudWatch Logs enable Amazon CloudWatch to monitor log files. Pattern
filtering can be used to analyze the logs and trigger Amazon CloudWatch alarms based
on customer specified thresholds. Which types of log files can be sent to Amazon
CloudWatch Logs?- AOperating system logs
- BAWS CloudTrail Logs
- CAccess Flow Logs
- DAll of the above
14AWS CloudTrail logs the API requests to AWS resources within your account. Which other
AWS service can be used in conjunction with CloudTrail to capture information about
changes made to AWS resources in your AWS account?- AAuto Scaling
- BAWS Config
- CAmazon VPC Flow Logs
- DAWS Artifact
15True or false: Amazon Inspector continuously monitors your AWS account’s configuration
against the Well Architected Framework’s best practice recommendations for security.- ATrue
- BFalse
16A workload consisting of Amazon EC2 instances is placed in an Amazon VPC. What feature of VPC can be used to deny network traffic based on IP source address and port number?
- ASubnets
- BSecurity groups
- CRoute tables
- DNetwork Access Control Lists
17You want to pass traffic securely from your on-premises network to resources in your
Amazon VPC. Which type of gateway can be used on the VPC?- AInternet Gateway (IGW)
- BAmazon Virtual Private Cloud endpoint
- CVirtual Private Gateway
- DAmazon Virtual Private Cloud peer
18To protect data at rest within Amazon DynamoDB, customers can use which of the
following?- AClient-side encryption
- BTLS connections
- CServer-side encryption provided by the Amazon DynamoDB service
- DFine-grained access controls
19When an Amazon Relational Database Service database instance is run within an Amazon
Virtual Private Cloud, which Amazon VPC security features can be used to protect the
database instance?- ASecurity groups
- BNetwork ACLs
- CPrivate subnets
- DAll of the above
20Which of the following is correct?
- AAmazon SQS and Amazon SNS encrypt data at rest.
- BAmazon SQS and Amazon SNS do not encrypt data at rest.
- CAmazon SQS encrypts data at rest and Amazon SNS does not encrypt data at rest.
- DAmazon SQS does not encrypt data at rest and Amazon SNS encrypts data at rest.
Information
- Description
- Chapter 3
- Author
- Andres M Chaparro M
- Language
- Español
- Views
- 50
- Tags
- Rating
- No ratings yet Rate this quiz