Security, Compliance, and Governance on AWS DevOps Flashcards

Which AWS service manages encryption keys used to protect data at rest and in transit across AWS services?

Answer: AWS Key Management Service (KMS)

AWS KMS is a managed service that creates and controls the cryptographic keys used to encrypt your data, integrating with most AWS services.

Which AWS service automatically rotates database credentials, API keys, and other secrets on a configurable schedule?

Answer: AWS Secrets Manager

AWS Secrets Manager automatically rotates secrets on a defined schedule by invoking a Lambda function, eliminating hardcoded credentials.

Which IAM feature allows you to grant temporary, limited access to AWS resources without sharing long-term credentials?

Answer: IAM Roles

IAM Roles provide temporary security credentials via AWS STS, allowing entities to assume permissions without needing permanent access keys.

Which AWS service provides threat detection by analyzing CloudTrail, VPC Flow Logs, and DNS logs using ML?

Answer: Amazon GuardDuty

Amazon GuardDuty continuously monitors CloudTrail, VPC Flow Logs, and DNS logs using machine learning to detect malicious activity and unauthorized behavior.

Which AWS service scans EC2 instances and container images for software vulnerabilities and unintended network exposure?

Answer: Amazon Inspector

Amazon Inspector automatically discovers and scans EC2 workloads and container images for software vulnerabilities and network reachability issues.

Which AWS policy type can be applied to an entire AWS Organization or OU to restrict the maximum permissions available to member accounts?

Answer: Service Control Policy (SCP)

Service Control Policies in AWS Organizations define the maximum available permissions for accounts and OUs, acting as guardrails that cannot be overridden.