Practice Test
True/False: Amazon SNS can be used to protect data in transit across services.
- Answer: False.
Explanation: Amazon Simple Notification Service (SNS) is a fully managed service covered by Amazon but it does not inherently protect data in transit. Data protection is achieved through various encryption methods like SSL or TSL.
In AWS, which of the following can be used to protect data at rest? (Select all that apply)
- a) Server Side Encryption with Amazon S3 managed keys (SSE-S3)
- b) Amazon Glue
- c) Client Side Encryption with a master key stored in AWS KMS
- d) AWS Transfer for SFTP
- Answer: a, c
Explanation: AWS supports various methods to protect data at rest such as Server Side Encryption with S3 managed keys (SSE-S3) and Client Side Encryption with a master key stored in AWS KMS.
True/False: You should use Amazon Macie to protect your data from unauthorized access.
- Answer: True
Explanation: Amazon Macie is a fully managed data security and data privacy service that uses machine learning to discover, monitor, and protect your sensitive data.
Which AWS service uses machine learning to protect your sensitive data automatically?
- a) AWS Shield
- b) AWS Macie
- c) AWS Inspector
- d) Amazon GuardDuty
- Answer: b) AWS Macie
Explanation: AWS Macie uses machine learning to automatically discover, classify, and protect sensitive data like Personally Identifiable Information (PII).
True/False: Multi Factor Authentication (MFA) is an effective way to add an extra layer of protection to user data.
- Answer: True.
Explanation: MFA adds an extra layer of protection on top of username and password, requiring users to verify their identity by providing two or more pieces of evidence.
Which of the following are methods to protect data in transit in AWS? (Select all that apply)
- a) SSL/TLS
- b) IPSec
- c) PGP
- d) Amazon S3 Transfer Acceleration
- Answer: a, b
Explanation: SSL/TLS and IPSec are both methods to secure data in transit. PGP is used for encrypting, decrypting and signing emails. Amazon S3 Transfer Acceleration is used for fast transfer of files over long distances.
True/False: Network Access Control Lists (NACLs) in AWS provide a rule-based tool for controlling network access to one or more subnets.
- Answer: True.
Explanation: NACLs act as a firewall for controlling traffic in and out of one or more subnets. They provide a rule-based tool for controlling network access.
Which AWS service would you use to manage keys for encrypting your data at rest?
- a) Amazon Inspector
- b) AWS KMS
- c) Amazon Trust Advisor
- d) AWS Artifact
- Answer: b) AWS KMS
Explanation: AWS Key Management Service (KMS) is a managed service that helps you create and control the encryption keys used to encrypt your data.
True/False: Amazon CloudFront does not support HTTPS for secure data transmission.
- Answer: False.
Explanation: Amazon CloudFront supports HTTPS for secure data transmission using SSL/TLS encryption.
Which of the following can help you protect data from unauthorized access in AWS? (Select all that apply)
- a) Encryption
- b) Multi-Factor Authentication
- c) Identity and Access Management (IAM)
- d) Amazon CloudWatch
- Answer: a, b, c
Explanation: Encryption, Multi-Factor Authentication and Identity and Access Management (IAM) are key features to ensure data is protected from unauthorized access. Although Amazon CloudWatch monitors your applications, it does not inherently protect data from unauthorized access.
Interview Questions
What does AWS Identity and Access Management (IAM) do?
AWS IAM enables you to manage access to AWS services and resources securely. It allows you to create and manage AWS users and groups while using permissions to allow and deny their access to AWS resources.
How does AWS Key Management Service (KMS) contribute to data protection?
AWS KMS is a regional service that helps you to easily create and control the keys used for cryptographic operations. The service is integrated with other AWS services making it easier to encrypt data and manage keys.
What is the purpose of AWS Shield in data protection?
AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards your application running on AWS. It provides automatic protections that minimize application downtime and latency.
Can Amazon VPC help protect data from unauthorized access?
Yes, Amazon VPC can help protect data. VPC allows you to provision a logically isolated section of the Amazon Web Services (AWS) Cloud where you can launch AWS resources in a virtual network that you define, enhancing the security and network configuration, which can protect data from unauthorized access.
How do AWS firewall and security group rules enhance data protection?
Firewall and security group rules act as a virtual firewall for your instance to control inbound and outbound traffic. It enables you to specify the protocols, ports, and source IP ranges that can reach your instances, thus protecting data by limiting unauthorized access.
What does AWS CloudTrail do for data protection?
AWS CloudTrail allows governance, compliance, operational auditing, and risk auditing of your AWS account. It enables you to log, continuously monitor, and retain account activity related to actions across your AWS infrastructure, thereby assisting in data protection.
What is AWS Secrets Manager and how does it contribute to data protection?
AWS Secrets Manager protects access to your applications, services, and IT resources. This eliminates the upfront and ongoing investment needed to operate and maintain infrastructure security. It also rotates, manages and retrieves database credentials, API keys, and other secrets throughout their lifecycle, which helps in protecting sensitive data.
How does Multifactor Authentication (MFA) help in protecting data in AWS?
MFA adds an extra layer of protection on top of your user name and password. It combines two or more independent credentials: something the user knows (password), something the user has (security token), and something the user is (biometric verification), making it more difficult for unauthorized users to access your AWS resources.
What is the AWS Artifact service used for?
AWS Artifact is your go-to, central resource for compliance-related information that matters to you. It provides on-demand access to AWS’ security and compliance reports and select online agreements.
What is the role of AWS Certificate Manager in data protection?
AWS Certificate Manager is a service that lets you easily provision, manage, and deploy public and private Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificates for use with AWS services and your internal connected resources to secure network communications and establish the identity of websites over the Internet.
How does Amazon Macie assist with data protection?
Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS, such as identification numbers, financial information, or intellectual property.
Can Amazon Inspector help protect my data on AWS?
Yes, Amazon Inspector is an automated security assessment service that helps improve the security and compliance of your applications deployed on AWS. It assesses applications for vulnerabilities or deviations from best practices and produces a detailed report with prioritized steps for remediation, thereby strengthening data protection.
How does AWS Guard Duty aid in data protection?
AWS GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts, workloads, and data stored in Amazon S3. It identifies unexpected and potentially unauthorized activities indicating a threat or data breach in your environment.
What is the role of AWS WAF in data protection?
AWS WAF, Web Application Firewall, helps protect your web applications or APIs against common web exploits that may affect availability, compromise security, or consume excessive resources. AWS WAF gives the control to customize the rules that allow, block, or count web requests based on conditions like IP addresses, HTTP headers, HTTP body, URI strings, SQL injection, and cross-site scripting.
How do AWS encrypted data volumes contribute to security and protection of data?
Encrypted data volumes are a key feature of Amazon Elastic Block Store (EBS). When you create an encrypted EBS volume and attach it to a supported instance type, all data on the volume, the disk I/O, and all snapshots created from the volume are encrypted, adding a strong layer of data protection.
extutorials.com