Security Automation and Compliance on AWS Flashcards

Which AWS Config resource type is used to create custom compliance rules using Lambda functions?

Answer: AWS::Config::ConfigRule with type CUSTOM_LAMBDA

Custom Lambda config rules (type CUSTOM_LAMBDA) invoke a Lambda function to evaluate resource configurations against custom compliance logic.

Which AWS KMS key type allows key material to be imported by the customer?

Answer: Customer managed key with imported key material

Customer managed keys with imported key material allow you to supply your own key material to AWS KMS, giving you full control over the cryptographic material.

What AWS service discovers, classifies, and protects sensitive data such as PII stored in Amazon S3?

Answer: Amazon Macie

Amazon Macie uses machine learning to automatically discover and classify sensitive data like PII in S3 and alerts on data security risks.

Which AWS service provides automated remediation of non-compliant AWS Config rules?

Answer: Both AWS Config Remediation Actions using SSM Automation

AWS Config supports automatic remediation by triggering SSM Automation documents to fix non-compliant resources without manual intervention.

What is the purpose of a VPC endpoint policy?

Answer: To restrict which AWS service APIs can be accessed through the VPC endpoint

A VPC endpoint policy controls which AWS principals can access which AWS service resources through the VPC endpoint.

Which AWS service provides a managed WAF that protects web applications from common exploits like SQL injection and XSS?

Answer: AWS WAF

AWS WAF is a web application firewall that protects against common web exploits by allowing you to create rules that filter malicious traffic.