AWS Security Specialty Infrastructure Protection

1. AWS Config is used to monitor what aspect of infrastructure security?

Real-time malware detection

Compliance and configuration changes of AWS resources

User login attempts and authentication events

Network traffic patterns

2. What is server-side encryption (SSE) primarily used for in AWS?

Protecting data in transit over the internet

Encrypting data at rest in AWS storage services

Securing SSH connections to EC2 instances

Authenticating users to AWS services

3. Which AWS service detects unusual account activity and potential security threats?

AWS Config

AWS CloudWatch

AWS GuardDuty

AWS Systems Manager

4. What does the principle of least privilege mean in AWS IAM context?

Users should have maximum permissions for flexibility

Users should have only the minimum permissions needed for their role

All users must use MFA at all times

Administrative access should be shared among team members

5. AWS WAF protects applications from which type of security threats?

DDoS attacks only

SQL injection, XSS, and other web-layer attacks

Malware and viruses

All network-level threats

6. What is the purpose of a subnet in a VPC from a security perspective?

To divide IP address space and apply different security rules

To encrypt all traffic within the network

To automatically scale compute resources

To manage DNS resolution

7. Which AWS service performs automated security assessments and provides recommendations?

AWS Security Hub

AWS Inspector

AWS Macie

AWS GuardDuty

8. What does AWS CloudTrail primarily record for security auditing?

Network packet payloads

API calls and account activity

Database query logs

Application performance metrics

9. Which encryption approach uses two keys—one public and one private—for secure communication?

Symmetric encryption

Asymmetric encryption

Hash-based encryption

Stream cipher encryption

10. What is the primary function of AWS Secrets Manager?

To encrypt data at rest in S3

To store, rotate, and manage secrets like database credentials

To monitor API calls and user activity

To filter malicious web traffic

11. Which AWS service provides network-level protection by filtering inbound and outbound traffic based on security group rules?

AWS WAF

Security Groups

Network ACLs

AWS Shield

12. Which AWS service provides DDoS protection and is considered part of the AWS Shield offering?

AWS WAF only

AWS Shield Standard (free) and Shield Advanced

VPC Security Groups

AWS GuardDuty

13. What does MFA (Multi-Factor Authentication) add to AWS account security?

Additional password complexity requirements

A second authentication factor beyond username and password

Automatic account lockout after failed attempts

Encryption of all stored credentials

14. AWS Organizations is primarily used for what security-related purpose?

Centralized identity management

Consolidated billing and policy management across accounts

Real-time threat detection

Database encryption management

15. Which IAM policy type explicitly denies permissions and overrides all allow statements?

Identity-based policy

Resource-based policy

Permission boundary

Deny policy

16. What is the purpose of VPC Flow Logs in AWS security architecture?

To encrypt network traffic

To monitor and record IP traffic flow information

To automatically block malicious traffic

To manage DNS resolution

17. Which service allows you to establish a private, encrypted connection between your on-premises network and AWS?

VPN Connection

Direct Connect

AWS PrivateLink

Both A and B

18. AWS KMS (Key Management Service) is primarily used to manage what type of security controls?

Access control policies

Encryption keys

Network traffic filtering

Identity federation

19. Which encryption method protects data in transit between AWS services and client applications?

Server-side encryption

TLS/SSL encryption

AWS KMS envelope encryption

Client-side hashing

20. What is the primary difference between Security Groups and Network ACLs in AWS?

Security Groups are stateless; NACLs are stateful

Security Groups are stateful; NACLs are stateless

Security Groups only apply to EC2; NACLs apply to all resources

NACLs are deprecated and no longer used

AWS Security Specialty Infrastructure Protection Quiz

1. AWS Config is used to monitor what aspect of infrastructure security?

2.

What first name or nickname would you like us to use?

2. What is server-side encryption (SSE) primarily used for in AWS?

3. Which AWS service detects unusual account activity and potential security threats?

4. What does the principle of least privilege mean in AWS IAM context?

5. AWS WAF protects applications from which type of security threats?

6. What is the purpose of a subnet in a VPC from a security perspective?

7. Which AWS service performs automated security assessments and provides recommendations?

8. What does AWS CloudTrail primarily record for security auditing?

9. Which encryption approach uses two keys—one public and one private—for secure communication?

10. What is the primary function of AWS Secrets Manager?

11. Which AWS service provides network-level protection by filtering inbound and outbound traffic based on security group rules?

12. Which AWS service provides DDoS protection and is considered part of the AWS Shield offering?

13. What does MFA (Multi-Factor Authentication) add to AWS account security?

14. AWS Organizations is primarily used for what security-related purpose?

15. Which IAM policy type explicitly denies permissions and overrides all allow statements?

16. What is the purpose of VPC Flow Logs in AWS security architecture?

17. Which service allows you to establish a private, encrypted connection between your on-premises network and AWS?

18. AWS KMS (Key Management Service) is primarily used to manage what type of security controls?

19. Which encryption method protects data in transit between AWS services and client applications?

20. What is the primary difference between Security Groups and Network ACLs in AWS?