AWS Cloud Practitioner Domain 2 - Security and Compliance

AWS Shared Responsibility Model

A fundamental security framework that clearly defines the security obligations between AWS and its customers, ensuring comprehensive protection of cloud environments by dividing responsibilities into two main categories: security IN the cloud, and security OF the cloud.

What are Amazon’s responsibilities under the Shared Responsibility Model?

• Physical security of data centers

• Hardware and software infrastructure

• Network infrastructure

• Virtualization layer

• Managed services infrastructure

What are the customer’s responsibilities under the Shared Responsibility Model?

• Customer data and encryption

• Identity and Access Management (IAM)

• Operating system patches and updates (for EC2)

• Network and firewall configuration

• Application security

• Client-side data encryption

• Compliance Validation

• Backup and Disaster Recovery

How does the Shared Responsibility Model operate for Infrastructure Services like EC2, EBS, and VPCs?

The customer has more responsibility on these services, including OS patching, network configuration, and firewall rules.

How does the Shared Responsibility Model operate for Container Services like RDS and Elastic Beanstalk?

AWS manages the operating system and platform for these services while the customer manages data, access, and application code.

How does the Shared Responsibility Model operate for Abstracted Services like S3, DynamoDB, and Lambda?

AWS handles most infrastructure tasks for these services, leaving customers to focus on data management, access policies, and client-side encryption.

What are the key examples of AWS responsibilities to remember for Shared Responsibility Model questions?

• Data center physical security

• hardware decomissioning

• Hypervisor patching

• Network infrastructure

What are the key examples of customer responsibilities to remember for Shared Responsibility Model questions?

• S3 bucket policies

• IAM user permissions

• EC2 security groups

• Data encryption choices

What are the key examples of shared controls to remember for Shared Responsibility Model questions?

• Patch management

• Configuration management

• Awareness and training

What is the key phrase for Shared Responsibility Model?

AWS is responsible for security OF the cloud, customers are responsible for security IN the cloud.

Who patches EC2 operating systems?

Customer

Who patches RDS database engine?

AWS

Who secures the data center?

AWS

Who configures security groups?

Customer

Who manages IAM policies?

Customer

Explain customer responsibilities when it comes to Data Protection in the cloud.

Customers are responsible for encrypting data at rest and in transit, managing data classification, and implementing backup strategies.

Explain customer responsibilities when it comes to Identity and Access Management (IAM) in the cloud.

Customers are responsible for creating and managing IAM users, groups, roles, and policies; implementing multi-factor authentication (MFA); and managing passwords and access keys.

Explain customer responsibilities when it comes to Operating System Management in the cloud.

Customers are responsible for patching and updating guest operating systems on EC2 instances.

Explain customer responsibilities when it comes to Application Security in the cloud.

Customers are responsible for securing applications deployed on AWS, including code vulnerabilities and updates.

Explain customer responsibilities when it comes to Network Configuration in the cloud.

Customers are responsible for configuring security groups, network ACLs, and VPC settings properly.

Explain customer responsibilities when it comes to Firewall Configuration in the cloud.

Customers are responsible for setting up host-based firewalls and managing traffic rules.

Explain customer responsibilities when it comes to Client-Side Encryption in the cloud.

Customers are responsible for encrypting data before sending it to AWS.

What terms signal customer responsibilities under the Shared Responsibility Model?

• configure

• manage access

• encrypt

• patch guest OS

• application security

Explain AWS responsibilities when it comes to the physical security of the cloud.

AWS is responsible for the security of physical data centers, including access control, surveillance, and environmental controls.

Explain AWS responsibilities when it comes to the hardware infrastructure of the cloud.

AWS is responsible for the security and integrity of servers, storage devices, and networking equipment.

Explain AWS responsibilities when it comes to the software infrastructure of the cloud.

AWS is responsible for the host operating systems, virtualization layers, and service software that the cloud runs on.

Explain AWS responsibilities when it comes to the network infrastructure of the cloud.

AWS is responsible for the routers, switches, load balancers, and firewalls at the infrastructure level of the cloud.

Explain AWS responsibilities when it comes to the global infrastructure of the cloud.

AWS is responsible for managing the security, integrity, and availability of the Regions, Availability Zones, and Edge Locations that make the cloud’s global reach possible.

What aspect of compliance is AWS responsible for?

For all aspects of the cloud that customers cannot access or modify, AWS handles and provides compliance certifications (SOC, ISO, PCI-DSS) as proof of their security practices.

Under the shared responsibility model, who is responsible for replacing failed hardware?

AWS

Under the shared responsibility model, who is responsible for patching the hypervisor?

AWS

Under the shared responsibility model, who is responsible for physical access controls to data centers?

AWS

Under the shared responsibility model, who is responsible for network infrastructure protection?

AWS

Under the shared responsibility model, who is responsible for disposing of storage devices securely?

AWS

Under the shared responsibility model, who is responsible for ensuring Availability Zone isolation?

AWS

Where can customers find compliance reports for certifications that AWS maintains?

AWS Artifact

Inherited Controls

Security and compliance controls that AWS implements and manages entirely on behalf of all customers so that customers automatically benefit from them simply by using AWS services without having to configure, manage, or maintain anything.

AWS Security Hub

A comprehensive cloud security service that provides a centralized view of the customer’s security posture across their AWS accounts.

What are the key features of AWS Security Hub?

1. Centralized Security Management

2. Automated Security Checks

3. Security Standards and Compliance

4. Integration Capabilities

5. Automated Response

6. Cross-Account Aggregation

What does CSPM stand for, and what is AWS’s CSPM service?

Cloud Security Posture Management - AWS Security Hub

Why is it important that AWS Security Hub provides a centralized security view?

This allows a customer to view all their security alerts in one place instead of checking multiple services separately. The unified view helps security teams monitor their entire AWS environment efficiently.

What services are consolidated on the AWS Security Hub?

• Amazon GuardDuty

• Amazon Inspector

• Amazon Macie

• AWS Firewall Manager

• AWS IAM Access Analyzer

What is the benefit of AWS Security Hub’s automated security checks?

The automated security checks run continuously and test compliance based on AWS best practices and industry standards to help identify misconfigurations and security gaps.

What are three of the AWS best practices of industry standards that Security Hub runs automated compliance checks against?

1. CIS AWS Foundations Benchmark

2. PCI DSS

3. AWX Foundational Security Best Practices

What is the value of AWS Security Hubs security standards and compliance feature?

The service maps any findings to specific compliance frameworks, making it easier for organizations subject to regulatory requirements to assess their compliance status and identify areas requiring attention.

What integration capabilities does AWS Security Hub boast?

The AWS Security Finding Format (ASFF) allows Security Hub to integrate with AWS services and third-party tools so that customers can standardize data sharing across different security solutions.

How does AWS Security Hub’s automated response feature work?

Security Hub can integrate with Amazon EventBridge to trigger automated remediation actions when specific findings occur, enabling faster incident response.

How does AWS Security Hub provide enterprise-wide visibility into security issues?

By aggregating findings across multiple AWS accounts.

How does data collection work on AWS Security Hub?

Security Hub collects findings from integrated AWS security services and third-party products, which are then normalized into the AWS Security Finding Format for easy processing.

What are the finding severity levels on AWS Security Hub?

1. critical

2. high

3. medium

4. low

5. informational

Which AWS security service acts as a threat detector?

GuardDuty

What combination of AWS services allows customers to automate responses to security findings?

Security Hub + EventBridge + Lambda or Systems Manager

Does Security Hub cover all regions?

It must be enabled per region; it will not automatically cover all regions.

Which AWS security tool scans for vulnerabilities?

Inspector

Which AWS security tool protects sensitive data?

Macie

Which AWS tool provides continuous compliance monitoring against industry standards?

Security Hub

Which AWS tool can collect and normalize security findings from GuardDuty, Inspector, and Macie?

Security Hub

What is the maximum number of custom insights that can be created per AWS account in AWS Security Hub?

100 custom insights per account in each AWS Region

What AWS Security Hub feature allows users to group and organize security findings based on specific attributes?

Insights, which provide collections of related findings filtered by criteria to identify security trends and patterns

Compliance and governance

Critical aspects of cloud computing that ensure organizations meet regulatory requirements, maintain security standards, and follow best practices.

What are some of the key compliance and governance certifications and attestations that AWS maintains?

• SOC 1, SOC 2, and SOC 3 - Service Organization Control reports

• PCI DSS - Payment Card Industry Data Security Standard

• HIPAA

• FedRAMP - Federal Risk and Authorization Management Program

• GDPR - General Data Protection Regulation

• ISO 27001, 27017, 27018 - Information security standards

AWS Governance

Involves the tools, services, and practices that help organizations manage and control their AWS environment, enforce policies, and maintain oversight of resources and spending.

AWS Compliance

AWS’s adherence to global and industry-specific regulatory standards and frameworks.

AWS Artifact

Provides on-demand access to AWS compliance reports and select online agreements — the customer’s go-to portal for downloading compliance documentation.

AWS Config

Tracks resource configurations and evaluates them against desired configurations, enabling compliance auditing and security analysis.

AWS CloudTrail

Records API calls and account activity, providing an audit trail for governance, compliance, and operational troubleshooting.

AWS Organizations

Allows centralized management of multiple AWS accounts with Service Control Policies (SCPs) to enforce governance policies.

AWS Control Tower

Provides a pre-configured environment for setting up and governing a secure, multi-account AWS environment based on best practices.

AWS Audit Manager

Helps automate evidence collection to assess whether policies, procedures, and activities are operating effectively.

What are the three categories of AWS Compliance Programs?

1. Certifications and Attestations - Third-party auditor assessments

2. Laws, Regulations, and Privacy - Compliance with specific legal requirements

3. Alignments and Frameworks - Industry-specific security and privacy frameworks

Which AWS compliance service provides information about who did what?

CloudTrail, through API logging and audit trail

Which AWS compliance service provides information about what has changed and whether it is compliant?

AWS Config through resource configuration tracking

Where and how are Service Control Policies (SCPs) used?

In AWS Organizations to set permission guardrails across accounts.

What are the primary services for managing governance across multiple accounts?

AWS Control Tower and AWS Organizations

How is compliance a shared effort in the AWS environment?

AWS provides compliant infrastructure, but customers must configure and use services in a compliant manager

PCI DSS

Payment Card Industry Data Security Standard - regulatory standard for payment processing

FedRAMP

Federal Risk and Authorization Management Program - regulatory standard for government workloads

Why is AWS Artifact important?

AWS Artifact supplies crucial services for organizations that need to demonstrate compliance with regulatory requirements.

AWS Artifact 4 Key Services

1. Compliance Documentation

2. Audit Support

3. Agreement Management

4. Cost and Time Efficiency

How does AWS Artifact provide Audit Support?

By providing downloadable reports that can be shared as proof of AWS’s compliance certifications with both internal and external auditors.

How does AWS Artifact provide Agreement Management?

Through its Agreements service, where customers can review, accept, and manage agreements such as the Business Associate Addendum (BAA) for HIPAA compliance.

How does AWS Artifact provide Cost and Time Efficiency?

By providing documents on-demand through the AWS Management Console instead of requiring customers to go through AWS support to obtain compliance documentation.

AWS Artifact 2 Main Sections

1. AWS Artifact Reports

2. AWS Artifact Agreements

What can be accessed through AWS Artifact Reports?

1. AWS compliance reports from third-party auditors.

2. SOC1, SOC2, and SOC3 reports

3. ISO 27001, ISO 27017, ISO 27018 certifications

4. PCI DSS Attestation of Compliance

5. FedRAMP reports and other regional compliance documents

What can be done through AWS Artifact Agreements?

1. Review and accept agreements with AWS.

2. Manage Business Associate Addendum (BAA) for HIPAA

3. Handle agreements at both individual account and organizational levels using AWS Organizations

Where can users find AWS Artifact?

In the AWS Management Console

What are 4 major functions that AWS Artifact does NOT perform?

1. Make user applications compliant.

2. Provide configuration recommendations.

3. Monitor user compliance status (AWS Config).

4. Scan for vulnerabilities (Amazon Inspector).

How much does AWS Artifact cost?

It’s a free service available to all AWS customers with no additional charge for accessing reports or agreements.

Where would a company find SOC 2 reports for an audit?

AWS Artifact Reports

Where would an organization find ISO certification proof?

AWS Artifact Reports

What AWS service would a healthcare company use to accept HIPAA BAA?

AWS Artifact Agreements

Where would a user go if they need to submit PCI compliance documentation for an audit?

AWS Artifact Reports

What is the primary technical integration that AWS Artifact uses to enforce permissions and control which users can access compliance reports and agreements?

AWS Identity and Access Management (IAM) policies and permissions

Amazon GuardDuty

A managed threat detection service that continuously monitors a user’s AWS accounts and workloads for malicious activity and unauthorized behavior using machine learning, anomaly detection, and integrated threat intelligence to identify and prioritize potential threats.

What 5 features of GuardDuty make it essential?

1. Continuous Security Monitoring - 24/7 monitoring

2. No Infrastructure to Manage - no servers to deploy or software to install

3. Intelligent Threat Detection - advance AI and machine learning

4. Cost-Effective Security - pay only for events analyzed

5. Integration with AWS Ecosystem

What are the 5 main sources of data that GuardDuty analyzes?

1. AWS CloudTrail Event Logs - API calls and account activity

2. VPC Flow Logs - network traffic patterns

3. DNS Logs - DNS query patterns, suspicious domains

4. EKS Audit Logs - Kubernetes cluster activity

5. S3 Data Events - suspicious access patterns to S3 buckets

What does GuardDuty do when it detects a potential threat?

It generates a finding with details about the issue, severity level, and recommended remediation steps.

Name 5 key features of Amazon GuardDuty.

1. One-Click Enablement

2. Multi-Account Support

3. Severity Levels

4. 30-Day Free Trial

5. Regional Service

How does a user enable GuardDuty?

With a single click from the AWS Console.

AWS GuardDuty severity levels

Low, Medium, and High