Practice Test

True or False: An AWS Security Group acts as a virtual firewall for your EC2 instances to control incoming and outgoing traffic.

  • True
  • False

Answer: True

Explanation: AWS Security Groups acts as a firewall for associated Amazon EC2 instances, controlling both inbound and outbound traffic at the instance level.

What is the primary function of AWS WAF (Web Application Firewall)?

  • (A) Mitigate DDoS attacks
  • (B) Protects web apps from exploits that could compromise security
  • (C) Automate the scaling of EC2 instances
  • (D) None of the above

Answer: (B) Protects web apps from exploits that could compromise security

Explanation: AWS WAF helps protect your web applications from common web exploits that could affect application availability, compromise security, or consume excessive resources.

Network ACLs operate at the network interface level. True or False?

  • True
  • False

Answer: False

Explanation: Network ACLs operate at the subnet level, not the network interface level.

AWS Shield is a service designed to protect:

  • (A) Data stored in S3 buckets
  • (B) Endpoints of an EC2 instance
  • (C) Data in transit between EC2 and S3
  • (D) AWS applications from DDoS attacks

Answer: (D) AWS applications from DDoS attacks

Explanation: AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS.

Is it possible to use both Security Groups and Network ACLs together to secure your AWS resources?

  • True
  • False

Answer: True

Explanation: Security Groups and Network ACLs can be used together to provide layered security.

AWS GuardDuty is which type of service?

  • (A) Visualization tool for cloud resources
  • (B) Threat detection service
  • (C) Data backup service
  • (D) None of the above

Answer: (B) Threat detection service

Explanation: AWS GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior.

IAM is the service that gives the administrator permission to manage access to AWS resources. True or False?

  • True
  • False

Answer: True

Explanation: AWS Identity and Access Management (IAM) is a web service that helps you securely control access to AWS resources.

AWS Network ACLs control the traffic _______________.

  • (A) Leaving an EC2 instance
  • (B) Leaving the subnet
  • (C) Entering the subnet
  • (D) Both B and C are correct

Answer: (D) Both B and C are correct

Explanation: Network ACLs provide a rule-based tool for controlling inbound and outbound traffic at the subnet level.

AWS Security Groups can block or allow traffic based on port, protocol, and source or destination IP. True or False?

  • True
  • False

Answer: True

Explanation: Security groups act as a firewall. They control inbound and outbound traffic based on the port, protocol, and source or destination IP address.

AWS WAF can only be used for incoming traffic protection. True or False?

  • True
  • False

Answer: False

Explanation: AWS WAF can be used for both incoming traffic and for filtering outbound traffic.

AWS Macie is primarily used for what purpose?

  • (A) Detecting Distributed Denial of Service attacks
  • (B) Detecting potentially sensitive data stored in S3 buckets
  • (C) Filtering malicious web traffic
  • (D) Managing user access to AWS resources

Answer: (B) Detecting potentially sensitive data stored in S3 buckets

Explanation: AWS Macie is a security service that uses machine learning to automatically discover, classify, and protect sensitive data such as PII.

Firewall Manager in AWS is used for which of the following tasks?

  • (A) Configuration and management of VPC security groups
  • (B) Centralized configuration and management of firewall rules across accounts and applications
  • (C) Monitoring network traffic in real-time
  • (D) All of the above

Answer: (B) Centralized configuration and management of firewall rules across accounts and applications

Explanation: AWS Firewall Manager is a security management service that allows you to centrally configure and manage firewall rules across your accounts and applications in AWS Organisation.

AWS Inspector is a tool that’s used for analyzing the applications for exposure, vulnerabilities, and deviations from best practice. True or False?

  • True
  • False

Answer: True

Explanation: AWS Inspector is an automated security assessment service that helps improve the security and compliance of applications running on EC2 instances.

AWS Certificate Manager provides:

  • (A) SSL/TLS certificates
  • (B) Real-time network monitoring
  • (C) Data backup service
  • (D) Machine learning models

Answer: (A) SSL/TLS certificates

Explanation: AWS Certificate Manager is a service that lets you easily manage the digital certificates for public or private cybersecurity by letting you deploy Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificates.

Network ACLs in AWS are stateful just like security groups. True or False?

  • True
  • False

Answer: False

Explanation: Unlike security groups, Network ACLs in AWS are stateless — each rule must be written for both inbound and outbound traffic.

Interview Questions

What is the purpose of Amazon AWS security groups in AWS EC2 instances?

The security groups in Amazon AWS act as a firewall for associated Amazon EC2 instances, controlling both inbound and outbound traffic at the instance level.

How does a network Access Control List (ACL) differ from a security group in AWS?

Network ACLs operate at the subnet level and evaluate traffic entering and exiting a subnet. Security groups operate at the instance level. Network ACLs support allow and deny rules whereas Security groups only support allow rules.

What is the AWS WAF service?

AWS WAF, or Web Application Firewall, helps protect your web applications from common web exploits that could affect application availability, compromise security, or consume excessive resources.

Can you change the rules of a security group after it’s been created and associated with an EC2 instance?

Yes, you can change the rules of a security group after it’s been created. The new rules are automatically applied to all instances that are associated with the security group.

What is the maximum number of security groups that you can assign to an EC2 instance in Amazon AWS?

In Amazon AWS, you can assign up to 5 security groups to an EC2 instance.

How are rules evaluated in a network access control list (ACL)?

In a network ACL, rules are evaluated starting with the lowest numbered rule. As soon as a rule matches traffic, it’s applied regardless of any higher-numbered rule that may contradict it.

What type of security threats does AWS WAF help protect against?

AWS WAF helps protect against threats such as SQL injection and Cross-site scripting (XSS) attacks.

How does AWS Shield help in enhancing security?

AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield provides automatic DDoS detection and mitigation to minimize application downtime and latency.

What is AWS Inspector used for?

Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS by identifying potential security issues, vulnerabilities or deviations from best practices.

How does the AWS Key Management Service (KMS) enhance data security?

The AWS Key Management Service (KMS) makes it easy to create and manage cryptographic keys and control their use across a wide range of AWS services and in your applications. KMS is integrated with AWS CloudTrail to provide logs of all key usage to help meet your regulatory and compliance needs.

What is the main purpose of AWS Identity and Access Management (IAM)?

AWS IAM allows you to manage access to AWS services and resources securely. With IAM, organizations can create and manage AWS users and groups and use permissions to allow and deny their permissions to AWS resources.

What is AWS Certificate Manager (ACM)?

AWS Certificate Manager is a service that lets you easily provision, manage, and deploy public and private Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificates for use with AWS services and your internal connected resources.

What is the value of the AWS CloudTrail service for monitoring?

AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. It provides event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services. This enables security analysis, resource change tracking, and troubleshooting.

What is Amazon Macie?

Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS.

Can you share security groups among AWS accounts?

No, security groups can’t be shared among AWS accounts. They are limited to the VPC they were created in. However, you can use AWS Resource Access Manager to share your resources with any AWS account or within your AWS Organization.

Leave a Reply

Your email address will not be published. Required fields are marked *