Security, Compliance, and Governance on AWS DevOps Flashcards

Which AWS service continuously assesses your AWS account configuration against the AWS Well-Architected Framework and CIS benchmarks?

Answer: AWS Security Hub with standards

AWS Security Hub supports security standards like AWS Foundational Security Best Practices and CIS AWS Benchmarks, continuously checking resource compliance.

What is the purpose of AWS CloudTrail Lake?

Answer: To aggregate, query, and analyze CloudTrail event data using SQL-based queries

CloudTrail Lake is a managed data lake for CloudTrail events that lets you run SQL-based queries on aggregated activity logs across accounts and regions.

Which S3 feature prevents objects from being deleted or overwritten for a defined retention period, supporting WORM compliance?

Answer: S3 Object Lock

S3 Object Lock stores objects using a write-once-read-many (WORM) model, preventing deletion or overwrite for a fixed or indefinite retention period.

Which AWS service discovers, classifies, and protects sensitive data like PII stored in Amazon S3?

Answer: Amazon Macie

Amazon Macie uses machine learning to automatically discover and classify sensitive data in S3, such as personally identifiable information (PII).

Which AWS Systems Manager feature securely stores configuration data and secrets, with optional encryption via KMS?

Answer: Parameter Store

Systems Manager Parameter Store provides hierarchical storage for configuration data and secrets, with SecureString parameters encrypted using AWS KMS.

Which IAM tool generates a report showing which IAM users, roles, groups, and policies have accessed AWS services and when?

Answer: IAM Access Advisor

IAM Access Advisor shows the service last accessed data for IAM entities, helping you identify and remove unnecessary permissions following least-privilege principles.