AWS Security Best Practices Essentials Quiz Quiz

Enhance your understanding of AWS security best practices with this concise quiz designed for beginners. Discover key principles, common threats, and practical techniques for securing cloud environments using widely recommended approaches.

1. Password Policies

   Which setting is recommended to strengthen authentication by requiring users to change their passwords on a regular basis?

   1. Enabling password rotation
   2. Allowing short, simple passwords
   3. Setting no password expiration
   4. Using only numbers in passwords

   Explanation: Enabling password rotation requires users to change their passwords frequently, reducing the risk if a password is compromised. Using only numbers in passwords weakens their strength, while not setting password expiration leaves accounts vulnerable over time. Allowing short, simple passwords creates security risks by making them easier to guess.

2. Principle of Least Privilege

   What does the principle of least privilege recommend when assigning permissions in a cloud environment?

   1. Allowing access based on job titles alone
   2. Giving every user the same rights
   3. Assigning administrator access to all users
   4. Granting only the minimum permissions needed

   Explanation: Granting only the minimum permissions needed helps prevent unauthorized access and limits potential damage from compromised accounts. Granting administrator access to all users or giving everyone the same rights are overly broad and risky. Granting access based on job titles alone may not accurately reflect necessary permissions.

3. Multi-Factor Authentication (MFA)

   How does multi-factor authentication (MFA) improve account security for cloud services?

   1. By allowing unlimited login attempts
   2. By automatically logging users out daily
   3. By requiring an extra verification step beyond just a password
   4. By using only PIN codes

   Explanation: MFA adds an additional layer of security by requiring something users know (like a password) and something they have (like a code). Automatic logouts help but are not as strong as MFA, allowing unlimited login attempts increases risk, and PIN codes alone do not provide sufficient security.

4. Encryption In Transit

   Why is it important to use encryption for data transmitted between services in a cloud environment?

   1. Because encrypted data loads faster
   2. To prevent unauthorized reading during transfer
   3. Because unencrypted data is always corrupted
   4. To reduce storage costs

   Explanation: Encryption for data in transit ensures that if the data is intercepted, it cannot be easily read or modified. It does not make data load faster or reduce storage costs, and unencrypted data is not always corrupted but is more vulnerable to eavesdropping.

5. Security Groups

   What is the primary function of a security group in managing virtual servers in a cloud environment?

   1. To automatically assign administrator passwords
   2. To update software patches
   3. To control inbound and outbound network traffic
   4. To schedule server backups

   Explanation: Security groups act as virtual firewalls, controlling allowed traffic to and from servers. They do not manage passwords, perform backups, or update software patches. Those other tasks require different security or administrative tools.

6. Data Backup Best Practices

   Which backup strategy helps ensure that data can be recovered after accidental deletion or ransomware?

   1. Maintaining regular automated backups
   2. Deleting old backups frequently
   3. Storing all data in a single location
   4. Backing up only critical files once

   Explanation: Regular automated backups provide consistent, up-to-date data copies for recovery if data is lost or damaged. Deleting old backups reduces options for recovery, and storing all data in one location creates a single point of failure. Backing up only once means recent changes could be lost.

7. Shared Responsibility Model

   In the cloud shared responsibility model, what is the customer's responsibility regarding user permissions?

   1. Repairing underlying hardware failures
   2. Designing the power supply systems
   3. Properly configuring and managing user access controls
   4. Maintaining physical security of data centers

   Explanation: Customers must manage user access, ensuring only authorized individuals have appropriate permissions. Physical security, hardware repairs, and power supply are typically the responsibility of the cloud provider, not the customer.

8. Auditing and Monitoring

   Why is it important to enable logging and monitoring for cloud-based resources?

   1. To update the operating system automatically
   2. To detect unauthorized actions and security events
   3. To reduce monthly billing
   4. To improve screen brightness

   Explanation: Logging and monitoring help quickly identify suspicious activity and respond to potential threats. These actions do not impact billing, screen brightness, or automatically update systems. Instead, they provide essential visibility into system behavior.

9. Access Keys Management

   What is a recommended practice for managing access keys used by applications?

   1. Store access keys inside application code
   2. Rotate access keys regularly and remove unused ones
   3. Share access keys in emails for convenience
   4. Use the same access key for all applications

   Explanation: Regularly rotating access keys and deleting unused ones reduces the risk if a key is exposed. Sharing keys by email is insecure, storing them in code can lead to accidental exposure, and using the same key for all applications increases potential damage from a single compromised key.

10. Public Access to Storage Buckets

    Which security setting is most important when storing sensitive files in a cloud storage bucket?

    1. Storing files with generic names only
    2. Blocking public access to the storage bucket
    3. Setting low storage quotas
    4. Enabling public read-write permissions

    Explanation: Blocking public access ensures only authorized users can view or modify sensitive files. Enabling public permissions exposes data to unauthorized users, setting low quotas does not prevent data breaches, and naming files generically does not protect against unauthorized access.