AWS Certified Solutions Architect Design Secure Architectures Flashcards

24 sample cards from the Design Secure Architectures deck

Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.

1. What is CloudHSM and how does it differ from AWS KMS in terms of key control?

   CloudHSM provides dedicated, single-tenant FIPS 140-2 Level 3 hardware security modules where you have exclusive control of keys; AWS cannot access them. KMS is multi-tenant and managed by AWS. CloudHSM suits strict compliance and custom cryptographic needs.

2. What FIPS 140-2 validation levels are associated with AWS KMS and AWS CloudHSM respectively?

   KMS HSMs are validated to FIPS 140-2 Level 3 (and offer FIPS endpoints), and CloudHSM provides FIPS 140-2 Level 3 validated single-tenant HSMs giving the customer sole control of key material.

3. What is a KMS custom key store and how does it relate to CloudHSM?

   A custom key store backs KMS keys with a CloudHSM cluster you control, combining the KMS API integration with AWS services and the single-tenant, customer-controlled HSM key material required for stricter compliance.

4. What is AWS Artifact and what does it provide for compliance?

   AWS Artifact is a self-service portal for on-demand access to AWS compliance reports and documents (e.g., SOC, PCI DSS, ISO) and agreements, used as evidence for audits.

5. What is the difference between a security group and a network ACL in a VPC?

   Security groups are stateful, operate at the instance/ENI level, support only allow rules, and evaluate all rules. Network ACLs are stateless, operate at the subnet level, support allow and deny rules, and are evaluated in numbered order.

6. Why must a network ACL have explicit outbound rules for return traffic while a security group does not?

   NACLs are stateless, so response traffic must be explicitly allowed (often on ephemeral ports). Security groups are stateful and automatically allow return traffic for any permitted inbound/outbound flow.

7. What is the difference between a public subnet and a private subnet in a VPC?

   A public subnet has a route to an internet gateway, allowing direct inbound/outbound internet access. A private subnet has no direct internet route; outbound internet access requires a NAT gateway/instance, providing isolation for backend resources.

8. What is a VPC endpoint, and how do Gateway vs Interface endpoints differ?

   A VPC endpoint privately connects a VPC to AWS services without traversing the internet. Gateway endpoints (route-table entries) support only S3 and DynamoDB. Interface endpoints (PrivateLink ENIs with private IPs) support most other services.

9. What is the security benefit of a NAT gateway for private subnet instances?

   It allows instances in private subnets to initiate outbound internet connections (e.g., updates) while preventing any unsolicited inbound connections from the internet, preserving isolation.

10. What is AWS Network Firewall and how does it differ from security groups/NACLs?

    Network Firewall is a managed, stateful network/VPC-level firewall with IDS/IPS, domain filtering, and deep packet inspection using Suricata-compatible rules. It provides far richer controls than the basic allow/deny of security groups and NACLs.

11. What is AWS WAF and at which layer does it protect applications?

    AWS WAF is a web application firewall operating at Layer 7 (HTTP/HTTPS). It filters requests by rules (SQL injection, XSS, rate limiting, geo, IP) and attaches to CloudFront, ALB, API Gateway, or AppSync.

12. What is AWS Shield Standard versus AWS Shield Advanced?

    Shield Standard is free, automatic protection against common L3/L4 DDoS attacks. Shield Advanced is paid and adds enhanced detection, protection for higher-layer attacks, 24/7 DDoS Response Team access, WAF integration, and DDoS cost protection (billing reimbursement).

13. How does Amazon CloudFront improve security at the edge for an application?

    CloudFront serves content from edge locations over TLS, integrates with AWS WAF and Shield for DDoS/L7 protection, supports Origin Access Control to restrict S3 origins, and can use signed URLs/cookies and geo-restriction to control access.

14. What is Origin Access Control (OAC) for CloudFront with S3?

    OAC restricts an S3 bucket so it can only be accessed through the CloudFront distribution (not directly), by having CloudFront sign origin requests; the bucket policy denies all other access. It replaces the legacy Origin Access Identity (OAI).

15. What is Amazon GuardDuty and what data sources does it analyze?

    GuardDuty is a managed threat-detection service using ML and threat intelligence to find malicious or unauthorized activity. It analyzes CloudTrail events, VPC Flow Logs, and DNS logs (plus optional S3, EKS, malware, and RDS protection) without deploying agents.

16. What is AWS CloudTrail and what does it record?

    CloudTrail records account activity by logging API calls and management/data events (who, what, when, from where) for governance, compliance, auditing, and incident investigation. Logs can be delivered to S3 and CloudWatch Logs.

17. What is the difference between AWS CloudTrail and Amazon CloudWatch?

    CloudTrail audits API activity (who did what to which resource) for governance/security. CloudWatch monitors operational performance via metrics, logs, alarms, and dashboards. CloudTrail = audit trail; CloudWatch = monitoring/observability.

18. What is AWS Config and what core question does it answer?

    AWS Config records and evaluates resource configurations over time, answering 'what is my configuration and is it compliant?'. It tracks configuration history/changes and uses Config rules to flag non-compliant resources.

19. What is Amazon Inspector and what does it assess?

    Amazon Inspector is an automated vulnerability management service that continuously scans EC2 instances, container images in ECR, and Lambda functions for software vulnerabilities (CVEs) and unintended network exposure.

20. What is Amazon Macie and what is its primary purpose?

    Macie is a managed data security service that uses machine learning and pattern matching to discover, classify, and protect sensitive data (e.g., PII, credentials) stored in Amazon S3.

21. What is AWS Security Hub and how does it relate to GuardDuty, Inspector, and Macie?

    Security Hub is a central dashboard that aggregates, normalizes, and prioritizes security findings from GuardDuty, Inspector, Macie, and partner tools, and runs automated compliance checks against standards (CIS, PCI DSS, AWS Foundational Best Practices).

22. What are VPC Flow Logs and what security purpose do they serve?

    VPC Flow Logs capture metadata about IP traffic to/from network interfaces (source/dest IPs, ports, protocol, accept/reject). They support troubleshooting, traffic analysis, and detecting anomalous or unauthorized network activity, and feed GuardDuty.

23. What is AWS IAM Access Analyzer and what does it detect?

    Access Analyzer uses automated reasoning to identify resources (S3 buckets, roles, KMS keys, etc.) shared with external entities or made public, flagging unintended access, and it can validate and generate least-privilege policies.

24. Under the AWS Shared Responsibility Model, who is responsible for encryption configuration, IAM policies, and OS patching on EC2?

    The customer. AWS is responsible for security OF the cloud (hardware, global infrastructure, managed service software); the customer is responsible for security IN the cloud, including IAM, encryption settings, network/firewall config, and guest OS patching on EC2.

What this deck covers

Design Secure Architectures flashcards FAQ