Security Controls

Security Groups** — stateful, instance-level. Allow rules only (no deny). Return traffic automatically allowed. All rules evaluated before decision.

Units

Start module

Practice questions

Generated from this module’s study material.

1. What best describes "NACLs: Stateless" in this context?

generate URLs granting temporary access for GET or PUT. The URL holder inherits the permissions of the user who generated it. Expires in 1 min to 12 hours (Console) or up to 7 days (CLI).IP sets (up to 10,000 IPs), HTTP headers/body/URI strings, size constraints, geo-match (block countries), rate-based rules. WAF does not support NLB. Workaround: Global Accelerator (fixed IP) + ALB + WAF.dedicated hardware security module. You manage keys entirely (AWS has no access). FIPS 140-2 Level 3. Single-tenant. Multi-AZ for HA. Good for Oracle TDE, SSL acceleration, strict compliance.stateless, subnet-level. Support both allow and deny rules. Rules evaluated in order (lowest number \= highest priority, first match wins). Last rule is * which denies everything. Must explicitly allow return traffic (ep

2. What best describes "Customer Managed Keys" in this context?

single key for encrypt/decrypt. Most services use this.AWS manages keys. AES-256. Default for new buckets. Header: x-amz-server-side-encryption: AES256.$1/month. You control rotation and policies. Must enable auto-rotation.control access to KMS keys (like S3 bucket policies). Default policy gives root user complete access to the key.

How to use this

Open a unit and mark it complete when you are ready to move on.

Module progress

0/0 complete · 0%

Back to modules Next module: Monitoring, Audit & Governance