Security Automation and Compliance on AWS Flashcards

Which AWS service continuously monitors AWS resource configurations and evaluates them against desired configurations?

Answer: AWS Config

AWS Config continuously records resource configurations and evaluates them against config rules to detect non-compliant resources.

What AWS IAM feature allows you to set permission boundaries that limit the maximum permissions an IAM entity can have?

Answer: Permission boundaries

Permission boundaries define the maximum permissions that an IAM entity (user or role) can have, even if their identity-based policies grant more.

Which AWS service manages encryption keys and provides hardware security module (HSM) backing for cryptographic operations?

Answer: AWS KMS

AWS KMS (Key Management Service) provides managed encryption key creation and control, backed by FIPS 140-2 validated HSMs.

What AWS service automates security assessments of EC2 instances and container images for vulnerabilities and deviations from best practices?

Answer: Amazon Inspector

Amazon Inspector automatically assesses EC2 instances and container images for software vulnerabilities and unintended network exposure.

Which AWS Organizations feature allows central governance by setting guardrails that restrict what actions can be performed in member accounts?

Answer: Service control policies (SCPs)

Service Control Policies (SCPs) in AWS Organizations set maximum available permissions for all accounts in an organizational unit or the entire organization.

What is the purpose of AWS Secrets Manager in a DevOps pipeline?

Answer: Storing, rotating, and retrieving secrets like database credentials and API keys

AWS Secrets Manager securely stores and automatically rotates secrets such as database passwords and API keys, integrating with services like RDS.