4 AWS Security Governance and Operations Free Online FlashCards

How does the AWS shared responsibility model divide security?

AWS secures the infrastructure of the cloud; customers secure what they deploy and configure in the cloud.

How does customer responsibility differ between EC2 and S3?

With EC2, customers manage the guest operating system and applications. With S3, AWS manages more of the underlying stack, but customers still manage their data, access, and service configuration.

What do AWS compliance reports establish for a customer workload?

AWS compliance reports can support a customer’s assessment, but they do not by themselves make the customer’s workload compliant.

Why use separate AWS accounts and organizational units?

Separate accounts create boundaries for workloads, teams, environments, and security functions. Related accounts can be grouped into OUs and governed with consistent guardrails.

Why create dedicated logging and security operations accounts?

Dedicated accounts for centralized logging and security operations help separate those functions from workload administration.

What do service control policies do—and not do?

SCPs set the maximum permissions available to principals in member accounts; they do not grant permissions. An IAM policy must still grant an action, and applicable guardrails must allow it.

Do SCPs restrict principals in the AWS Organizations management account?

SCPs do not affect principals in the management account, so that account must be protected and tightly limited separately.

What are core IAM practices for limiting access?

Use IAM to grant people and workloads only the access they need. Prefer roles and temporary credentials where practical, apply least privilege, and review permissions regularly.

What does a preventive control do?

Preventive controls block prohibited actions, such as attempts to disable a required safeguard.

What does a detective control do?

Detective controls identify noncompliant resource configurations and report them.

When do proactive controls check infrastructure-as-code deployments?

Proactive controls check supported infrastructure-as-code deployments before resources are provisioned.

What activity evidence does AWS CloudTrail provide?

CloudTrail records account activity and API events. It can help establish who performed an action and when.