Luyện thi AWS Security Specialty

Amazon GuardDuty analyzes CloudTrail, VPC Flow Logs, and DNS logs to detect threats. Route 53 is DNS, CloudFormation is infrastructure as code, and Elasticsearch is search.

GuardDuty uses CloudTrail, VPC Flow Logs, DNS query logs, and additional sources to find suspicious behavior. It does not rely only on instance storage, S3 events, or billing alarms.

Security Hub aggregates, prioritizes, and correlates security findings across accounts. CloudFormation deploys infrastructure, ECS runs containers, and Lambda runs functions.

Incident Manager helps you prepare for, respond to, and recover from incidents. S3 stores objects, QuickSight visualizes data, and App Mesh manages service mesh.

AWS Shield provides DDoS protection, with Shield Advanced offering enhanced detection and mitigation. Glue is ETL, Athena queries S3, and CodePipeline deploys software.

AWS WAF filters HTTP and HTTPS requests using rules such as IP sets and SQL injection patterns. GuardDuty detects threats, CloudTrail records API calls, and Inspector scans workloads.

Amazon Inspector assesses workloads for vulnerabilities and network exposure. CloudWatch monitors metrics, ACM manages certificates, and Transfer Family handles file transfers.

Incident response begins with preserving evidence and containing impact so you can investigate safely. Deleting logs, terminating accounts, or public disclosure are dangerous.

GuardDuty includes findings for unusual compute activity such as cryptocurrency mining. Glacier is archive storage, Direct Connect is private networking, and Lex is conversational AI.

GuardDuty detects threats, Security Hub aggregates findings, Inspector scans workloads, and WAF filters web traffic.

CloudTrail records management and data events performed through APIs. VPC Flow Logs capture network traffic, Budgets track cost, and Route 53 is DNS.

VPC Flow Logs capture IP traffic metadata for network analysis. CloudTrail records API calls, Config tracks configuration, and GuardDuty detects threats.

CloudWatch Logs stores, monitors, and queries log data. Glacier is archive storage, ACM manages certificates, and ECR stores container images.

CloudTrail log file validation uses hashes to detect changes. S3 versioning and replication preserve objects, and lifecycle policies manage retention, but validation specifically proves integrity.

The CloudWatch agent collects OS and application logs plus custom metrics. CLI is a command tool, ECS agent runs containers, and WAF has no host agent.

Metric filters scan log events and create metrics from matched patterns. Alarms trigger on metrics, log groups store logs, and export tasks move logs.

Logs Insights provides interactive queries for CloudWatch Logs. WAF filters web traffic, GuardDuty detects threats, and Shield protects against DDoS.

An organization trail delivers management events for all member accounts to a central S3 bucket. Regional trails alone, VPC peering, and security groups do not centralize logs.

CloudWatch Alarms monitor metrics and trigger actions such as SNS notifications. Dashboards display data, log groups store logs, and subscriptions route log data.

CloudTrail records API calls, Flow Logs capture network metadata, CloudWatch Logs stores logs, and Insights queries them.

Security groups act as virtual instance firewalls with allow-only rules. NACLs filter at the subnet level, route tables direct traffic, and internet gateways provide public access.

Network ACLs are stateless subnet-level filters with allow and deny rules. Security groups filter instances, EBS volumes store data, and NAT gateways provide outbound internet.

PrivateLink exposes services through private endpoints inside a VPC. Direct Connect is a private physical link, VPN uses encrypted tunnels, and CloudFront is a CDN.

Transit Gateway simplifies hub-and-spoke connectivity between VPCs and on-prem networks. Shield is DDoS protection, Cognito is identity, and AppSync is GraphQL.

AWS Network Firewall filters traffic at the VPC level with stateful rules. WAF protects web apps, Shield stops DDoS, and Inspector scans workloads.

Session Manager provides secure browser-based shell access without public inbound ports. Direct Connect is private connectivity, Global Accelerator improves routing, and Route 53 is DNS.

A bastion host is a hardened entry point that administrators use to reach private resources. Load balancers distribute traffic, DNS resolves names, and vaults store backups.

AWS Organizations manages accounts and applies SCPs centrally. CloudWatch monitors metrics, CloudTrail records API calls, and GuardDuty detects threats.

Site-to-Site VPN creates encrypted tunnels between on-prem and AWS. S3 stores objects, Elastic Beanstalk deploys apps, and Athena queries data.

Security groups filter instances, NACLs filter subnets, PrivateLink exposes private endpoints, and Network Firewall provides stateful filtering.

An IAM role is an identity with permissions attached, assumed by users, services, or federated identities. It is not a static login or resource.

IAM policies are JSON documents granting or denying actions on resources. Routes, schemas, and backup plans are unrelated.

AWS Security Token Service issues temporary credentials for roles and federated sessions. Route 53 is DNS, ACM manages certificates, and EBS provides volumes.

A trust policy controls who or what can assume a role. Buckets, VPC peering, and log groups are not defined by trust policies.

Least privilege limits permissions to what is necessary. Granting admin access, removing users, or using root account only are not least privilege practices.

IAM Identity Center centralizes workforce identities and single sign-on. GuardDuty detects threats, WAF filters web traffic, and Inspector scans workloads.

A permission boundary caps the maximum permissions granted by policies. Firewall rules, lifecycle rules, and alarms are unrelated.

The aws:MultiFactorAuthPresent condition checks whether MFA was used. SourceIp checks the IP, TagKeys checks tags, and ec2:ResourceTag checks EC2 tags.

The root user should have MFA enabled and be used only for limited account management tasks. Sharing credentials or disabling MFA increases risk.

Roles are assumable identities, policies define permissions, STS issues temporary credentials, and boundaries limit maximum permissions.

AWS Key Management Service creates, rotates, and controls encryption keys. GuardDuty detects threats, CloudTrail records calls, and QuickSight visualizes data.

Secrets Manager stores secrets and supports automated rotation. S3 stores objects, ACM manages certificates, and ECR stores container images.

ACM provisions and renews SSL/TLS certificates. KMS manages keys, GuardDuty detects threats, and Config tracks configurations.

Envelope encryption wraps a data key with a master key, then uses the data key to encrypt data. Plaintext keys and shared passwords are insecure.

SSE-S3 uses Amazon S3 managed keys automatically. SSE-C uses customer-provided keys, and client-side encryption happens before upload.

TLS encrypts traffic between clients and AWS services. Snapshots, versioning, and policies protect other aspects of storage and access.

CloudHSM gives you dedicated HSM appliances for cryptographic operations. KMS is a managed key service, WAF filters traffic, and GuardDuty detects threats.

S3 Object Lock enforces write-once-read-many retention. Lifecycle policies manage transitions, replication copies data, and CloudFront is a CDN.

KMS integrates with most AWS services for encryption. EFS is file storage, Glue is ETL, and Athena queries data.

KMS manages keys, Secrets Manager rotates secrets, ACM handles certificates, and CloudHSM provides dedicated hardware security modules.

AWS Artifact provides on-demand access to compliance reports and agreements. GuardDuty detects threats, CloudTrail records calls, and S3 stores data.

AWS Config records resource configuration changes and evaluates compliance with rules. CloudFormation deploys infrastructure, Route 53 is DNS, and Direct Connect is networking.

AWS Organizations manages multiple accounts, applies SCPs, and supports consolidated billing. CloudWatch monitors, WAF filters traffic, and Inspector scans workloads.

SCPs define the maximum permissions available to accounts in an organization. S3 policies, routes, and dashboards are different.

Conformance packs deploy collections of Config rules and remediation actions. Metric filters, log groups, and alarms are CloudWatch features.

Trusted Advisor reviews accounts and recommends improvements. GuardDuty detects threats, WAF filters web traffic, and Inspector scans for vulnerabilities.

AWS Config rules can trigger remediation actions such as Systems Manager documents. Route 53 is DNS, Shield is DDoS protection, and QuickSight visualizes data.

Security Hub gives a consolidated security and compliance dashboard. CodeBuild builds code, ECS runs containers, and App Runner deploys web apps.

SCPs can deny access to specific services or actions at the organization level. Flow logs, dashboards, and lifecycle policies do not restrict service use.

Artifact provides reports, Config tracks compliance, Organizations manages accounts, and Trusted Advisor gives recommendations.