Security, Compliance, and Governance on AWS DevOps Flashcards

Which AWS feature enforces MFA deletion on S3 bucket versioning to prevent accidental or malicious deletion?

Answer: S3 MFA Delete

S3 MFA Delete requires multi-factor authentication to permanently delete object versions or change the versioning state of a bucket.

Which AWS service provides a web application firewall to protect against SQL injection and XSS attacks?

Answer: AWS WAF

AWS WAF is a web application firewall that lets you create rules to block common web exploits like SQL injection and cross-site scripting.

Which AWS service allows you to centrally manage and enforce WAF rules, Security Groups, and Shield Advanced protections across multiple accounts?

Answer: AWS Firewall Manager

AWS Firewall Manager provides centralized management of firewall rules across accounts in an AWS Organization, ensuring consistent security policies.

Which AWS Config rule type uses AWS-managed logic to evaluate resource configurations against best practices?

Answer: AWS managed rules

AWS managed rules are pre-built Config rules maintained by AWS that check common compliance and security configurations without requiring custom code.

Which AWS service provides a set of prescriptive security controls and a landing zone to govern a multi-account AWS environment?

Answer: AWS Control Tower

AWS Control Tower automates the setup of a multi-account environment with built-in governance guardrails using AWS Organizations, Config, and other services.

Which IAM concept defines the maximum permissions an IAM entity can have, regardless of what policies are attached to it?

Answer: Permission Boundary

Permission Boundaries set the maximum permissions that an IAM user or role can have, even if their attached policies grant broader access.