AWS Security & Encryption Interview Questions

What is the AWS Shared Responsibility Model?

The AWS Shared Responsibility Model defines the security responsibilities shared between AWS and the customer. AWS is responsible for securing the infrastructure that runs all the services offered in the AWS Cloud, while the customer is responsible for securing their data, applications, and the configuration of their services. In essence, AWS takes care of the underlying infrastructure, while the customer is responsible for their data and how they use AWS services securely.

What is Amazon S3 server-side encryption?

Amazon S3 server-side encryption is a feature that automatically encrypts data before it is written to disk and decrypts it when it is retrieved, ensuring that all data stored in Amazon S3 is encrypted at rest. This encryption is performed transparently, so there is no performance impact or additional management overhead for the customer. In other words, it ensures that your data stored in Amazon S3 is always protected through encryption, without requiring manual intervention.

What encryption options are available for Amazon RDS?

Amazon RDS provides several encryption options for database instances:

• Amazon RDS managed keys (AWS KMS) for encryption at rest

• SSL/TLS for encryption in transit

• Transparent Data Encryption (TDE) for Microsoft SQL Server and Oracle database instances. These options allow you to encrypt your data at rest and in transit, ensuring the security of your database instances.

What is Amazon Virtual Private Cloud (Amazon VPC)?

Amazon Virtual Private Cloud (Amazon VPC) is a secure and scalable virtual network that provides customers with complete control over their IP address space and the ability to define their own network architecture. Amazon VPC enables customers to launch Amazon Web Services (AWS) resources into a virtual network, which is isolated from the public Internet. Essentially, it allows you to create your isolated network within AWS for added security and customization.

How does Amazon GuardDuty help with security in the AWS Cloud?

Amazon GuardDuty is a threat detection service that uses machine learning and security analytics to detect and respond to malicious activity in the AWS environment. GuardDuty analyzes large amounts of data from various AWS sources, such as AWS CloudTrail event logs, Amazon VPC flow logs, and DNS logs, to identify suspicious activity. GuardDuty also integrates with Amazon CloudWatch and Amazon SNS to enable automated security response and remediation, helping to protect your AWS resources from threats.

What is Amazon Key Management Service (KMS)?

Amazon Key Management Service (KMS) is a managed service that makes it easy for customers to create, control, and use encryption keys for their applications and services. KMS enables customers to encrypt data stored in the AWS Cloud, as well as data moving in and out of the AWS Cloud. It is a central service for managing encryption keys and enhancing the security of data within AWS.

What is Amazon Inspector?

Amazon Inspector is an automated security assessment service that helps customers identify security issues in their applications. The inspector runs a set of security assessments on the Amazon Machine Images (AMIs) and running instances in an Amazon Elastic Compute Cloud (EC2) environment, providing detailed security findings and recommendations to improve the security of your applications.

What is Amazon S3 Transfer Acceleration?

Amazon S3 Transfer Acceleration is a feature that enables customers to upload large files to Amazon S3 faster. Transfer Acceleration uses the Amazon CloudFront content delivery network (CDN) to transfer data to S3, taking advantage of the globally distributed CloudFront edge locations. This results in faster uploads, especially for customers uploading data from far away from the AWS region where their S3 bucket is located, improving data transfer speed.

What is AWS Identity and Access Management (IAM)?

AWS Identity and Access Management (IAM) is a web service that provides secure control of access to AWS resources. IAM enables customers to create and manage AWS users and groups, and to use permissions to allow and deny access to AWS resources. IAM is a critical component of security in the AWS Cloud and is used to ensure that only authorized users and processes have access to AWS resources, helping to manage access control securely.

What is Amazon CloudWatch?

Amazon CloudWatch is a monitoring service for AWS resources and the applications that run on the AWS Cloud. CloudWatch enables customers to monitor various metrics, such as CPU utilization, network traffic, and disk I/O, and to set alarms to take automated actions based on the metric values. CloudWatch also integrates with other AWS services, such as Amazon EC2 and Amazon RDS, to provide a complete picture of the health and performance of the customer's environment, aiding in monitoring and maintaining the health of AWS resources.

What are Amazon Elastic Compute Cloud (EC2) Security Groups?

Amazon Elastic Compute Cloud (EC2) Security Groups are stateful firewall rules that control inbound and outbound traffic to EC2 instances. Security groups enable customers to specify which traffic is allowed to reach their EC2 instances and can be used to restrict access to specific IP addresses, ports, and protocols. They essentially act as a network-level security mechanism for EC2 instances.

What is AWS Direct Connect?

AWS Direct Connect is a network service that provides customers with a dedicated network connection from their data center to AWS. Direct Connect enables customers to reduce network costs, increase bandwidth throughput, and provide a more reliable network connection compared to a standard Internet connection. Direct Connect also enables customers to bypass the public Internet and securely connect their on-premises infrastructure to their AWS environment, enhancing network reliability and security.

What is Amazon S3 Cross-Region Replication (CRR)?

Amazon S3 Cross-Region Replication (CRR) is a feature that enables customers to automatically replicate objects between Amazon S3 buckets in different AWS regions. CRR provides customers with the ability to store their data in multiple regions for disaster recovery and data durability, while also enabling low-latency access to their data from multiple geographic locations, ensuring data availability and resilience.

What is an AWS Certificate Manager (ACM)?

AWS Certificate Manager (ACM) is a service that enables customers to easily and securely manage SSL/TLS certificates for their applications and services. ACM provides a simple and cost-effective way to obtain and manage SSL/TLS certificates, including automatic renewal and deployment of certificates to various AWS resources, such as Amazon CloudFront, Amazon Load Balancer, and AWS Elastic Beanstalk. ACM also integrates with AWS Certificate Manager Private Certificate Authority (ACM PCA) for customers who require private certificate management, simplifying certificate management for secure communications.