2 Security and Compliance Free Online FlashCards

What does IAM control in AWS?

AWS Identity and Access Management (IAM) evaluates permissions to determine whether a user, role, or service can perform an action on an AWS resource.

What happens when an IAM policy explicitly denies an allowed action?

An explicit deny overrides an allow, so the action is denied.

How does an IAM role provide access?

An IAM role provides permissions through temporary credentials. Authorized people, applications, or AWS services can assume it.

What is the principle of least privilege?

Grant only the permissions needed for a task. This limits unnecessary access.

How does the AWS shared responsibility model divide security duties?

AWS protects the underlying cloud infrastructure; customers protect their data, identities, permissions, and service configurations.

What security tasks do customers manage for Amazon EC2?

For Amazon EC2, customers manage the guest operating system, patches, applications, and instance network access.

What protects stored data, and what AWS service manages cryptographic keys?

Encryption at rest protects stored data. AWS Key Management Service (AWS KMS) lets customers create and control cryptographic keys.

How can data in transit be protected in AWS?

Encryption in transit protects data as it moves between clients and services. TLS is commonly used, and AWS Certificate Manager (ACM) helps manage TLS certificates for supported services.

How does AWS Secrets Manager help protect credentials?

AWS Secrets Manager stores and manages secrets such as database credentials, allowing applications to retrieve them without embedding passwords in source code.

Does an AWS certification automatically make a customer's workload compliant?

Customers must determine and meet the requirements that apply to their workloads. An AWS certification or attestation does not by itself certify a customer's application or business.

What compliance resources does AWS Artifact provide?

AWS Artifact provides access to AWS security and compliance documents, including audit reports and certifications, to support customers' compliance work.

What does AWS CloudTrail record?

AWS CloudTrail records account activity and API calls, helping determine who did what, when, and from where.