Security Automation and Compliance on AWS Flashcards

Which AWS Systems Manager capability allows you to run predefined or custom automation workflows on AWS resources?

Answer: Automation

AWS Systems Manager Automation runs automation runbooks (SSM documents) to perform operational tasks on AWS resources without manual steps.

What AWS feature enforces MFA for sensitive IAM API calls using a condition key in IAM policies?

Answer: aws:MultiFactorAuthPresent

The aws:MultiFactorAuthPresent condition key checks whether the request was authenticated using MFA, allowing policies to enforce MFA for sensitive operations.

Which AWS service provides a centrally managed firewall policy that can be applied across multiple VPCs and accounts?

Answer: AWS Firewall Manager

AWS Firewall Manager centrally manages security policies including WAF rules, Shield protections, and Security Groups across an AWS Organization.

Which S3 bucket feature prevents objects from being deleted or overwritten for a specified retention period, supporting compliance requirements?

Answer: S3 Object Lock

S3 Object Lock implements WORM (Write Once, Read Many) protection, preventing objects from being deleted or modified for a fixed retention period.

What AWS Systems Manager feature provides secure, auditable shell and RDP access to EC2 instances without requiring SSH ports or bastion hosts?

Answer: Session Manager

Session Manager provides browser-based interactive shell access to EC2 instances over SSM without opening inbound ports or needing bastion hosts.

Which AWS Config conformance pack provides a pre-built set of Config rules mapped to a specific compliance standard like CIS or PCI DSS?

Answer: AWS Config conformance packs

AWS Config conformance packs are collections of Config rules and remediation actions that map to compliance standards like CIS Benchmarks or PCI DSS.