Task 2.4: Identify components and resources for security.

• AAWS Shield

  Incorrect

  Shield protects against distributed denial of service (DDoS) attacks. It does not inspect requests for SQL injection.

• BAmazon GuardDuty

  Incorrect

  GuardDuty is a threat detection service that analyzes logs and raises findings. It does not sit in front of the load balancer filtering requests.

• CAmazon Inspector

  Incorrect

  Inspector scans workloads for software vulnerabilities and unintended network exposure. It does not block incoming requests.

• DAWS WAF

  Correct

  AWS WAF is a web application firewall for HTTP(S) requests to resources such as an Application Load Balancer, and its SQL database managed rule group blocks request patterns associated with SQL injection.

Filtering individual web requests by what they contain is a web application firewall's job. Shield handles floods of traffic; GuardDuty and Inspector detect and report rather than block.

• AEnable Amazon Inspector

  Incorrect

  Inspector scans workloads for software vulnerabilities and unintended network exposure. It does not mitigate DDoS attacks.

• BEnable Amazon GuardDuty

  Incorrect

  GuardDuty detects suspicious activity in an account and raises findings. It does not absorb or mitigate attack traffic.

• CSubscribe to AWS Shield Advanced for the distribution

  Correct

  Shield Advanced is the paid subscription that adds expanded DDoS protection to the resources you protect, with ways to escalate to AWS when you need expert help.

• DNothing more is available beyond the automatic protection

  Incorrect

  The automatic protection covers common volumetric attacks; Shield Advanced exists for higher levels of protection.

Every AWS customer gets the automatic, no-cost DDoS protection. Shield Advanced is the upgrade for critical applications that need more, including help from AWS during an event.

• AAWS Config

  Incorrect

  AWS Config records configurations and evaluates them against rules. It does not deploy firewall rules to accounts.

• BAWS Shield Advanced

  Incorrect

  Shield Advanced adds DDoS protection to the resources you protect. It is not a way to manage WAF and security group rules across accounts.

• CAmazon GuardDuty

  Incorrect

  GuardDuty detects threats from account activity and logs. It does not manage firewall rules.

• DAWS Firewall Manager

  Correct

  With Firewall Manager you set up protections such as AWS WAF rules and security group rules once, and it applies them across your accounts and resources, even as new ones are added.

One rule set, many accounts, applied automatically to newcomers: that is Firewall Manager's job in an organization.

• AAWS Marketplace

  Correct

  AWS Marketplace is a curated catalog of third-party software, including security products, that you can deploy quickly; its charges appear on your AWS bill.

• BAWS Artifact

  Incorrect

  Artifact provides AWS's own compliance reports and agreements, not third-party software.

• CAmazon Inspector

  Incorrect

  Inspector is AWS's own vulnerability management service. It is not a place to find or buy third-party products.

• DAWS Trusted Advisor

  Incorrect

  Trusted Advisor inspects your environment and recommends improvements. It does not sell or deploy third-party software.

Third-party security tools, from firewalls to managed WAF rules, are found, bought and deployed through AWS Marketplace and billed with the rest of the account.

• AAWS Artifact

  Incorrect

  Artifact provides AWS's own compliance reports and agreements. It does not inspect your account.

• BAWS Trusted Advisor

  Correct

  Trusted Advisor inspects your environment and recommends actions to close security gaps, and it has a security check that flags a root user without MFA.

• CAmazon Macie

  Incorrect

  Macie discovers and helps protect sensitive data in Amazon S3. It does not review account settings such as root user MFA.

• DAWS Shield

  Incorrect

  Shield protects against DDoS attacks. It does not review your configuration.

Trusted Advisor is AWS's best-practice checker for a running account, across cost, performance, security and fault tolerance; how many checks you get depends on your support plan.