Drag and Drop Matching Questions

Management events: Records management operations performed on AWS resources, such as creating or deleting VPCs.

Management events record control plane operations that create, modify, or delete AWS resources, such as CreateVpc, DeleteSubnet, or attaching an IAM policy. CloudTrail logs these events by default in every region and delivers them to your configured S3 bucket. They capture the identity, source IP, and time of each API call, but they do not include the high-volume data plane activity inside a resource.

Data events: Records resource operations performed on or within a resource, such as reading or writing S3 objects.

Data events capture data plane operations performed on or within a resource, such as GetObject and PutObject on an S3 bucket, or Invoke calls on a Lambda function. Unlike management events, data events are not logged by default; you must explicitly enable them on specific resources or resource types in a trail or CloudTrail Lake event data store. Because data events can have extremely high volume, they are typically disabled by default to avoid unexpected storage costs.

Insight events: Detects unusual activity in your account, such as a spike of API calls or a change in access patterns.

Insight events are generated by CloudTrail Insights, which continuously analyzes management events against baseline patterns to detect anomalous activity, such as a sudden spike in API calls, unusual access patterns, or a write role being used unexpectedly. When an anomaly is identified, CloudTrail emits a pair of insight events marking the start and end of the anomalous window. These events do not correspond to a single API action; rather, they are derived from statistical deviations in overall management activity.

SOC: Report on controls at a service organization relevant to security, availability, processing integrity, confidentiality, or privacy.

SOC reports (System and Organization Controls) are independent attestation reports issued by a CPA firm, examining controls at a service organization against the AICPA Trust Services Criteria (security, availability, processing integrity, confidentiality, privacy). SOC 1 focuses on controls relevant to user entities' internal control over financial reporting (ICFR), while SOC 2 and SOC 3 focus on the five trust service criteria; they are not laws or government programs but bridge audited evidence for customers.

PCI DSS: Set of security standards designed to ensure that all companies that accept, process, store or transmit credit card information maintain a secure environment.

The Payment Card Industry Data Security Standard (PCI DSS) is a contractual/industry standard mandated by the card brands (Visa, Mastercard, etc.), not a US law or government program. It applies to any entity that stores, processes, or transmits cardholder data, and sets twelve baseline requirements spanning network security, encryption, access control, and ongoing monitoring. Compliance is validated via self-assessment questionnaires (SAQ) or a Report on Compliance (ROC) by an approved scanning vendor/assessor.

HIPAA: US law designed to provide privacy standards to protect patients' medical records and other health information.

The Health Insurance Portability and Accountability Act is a US federal statute enacted in 1996 that created national privacy and security rules for protected health information (PHI). Its Privacy Rule governs permissible uses and disclosures of PHI by covered entities and business associates, while the Security Rule mandates administrative, physical, and technical safeguards for electronic PHI (e-PHI). HIPAA is enforced by the HHS Office for Civil Rights, not a security assessment framework for cloud services.

FedRAMP: US government program that standardizes security assessment, authorization, and continuous monitoring for cloud products and services.

The Federal Risk and Authorization Management Program (FedRAMP) is a US government initiative established to provide a standardized, repeatable approach for assessing, authorizing, and continuously monitoring cloud service offerings used by federal agencies. It relies on NIST SP 800-53 controls and requires a third-party assessment organization (3PAO) to validate an SSP and produce deliverables that allow a Joint Authorization Board (JAB) or agency to grant an Authority to Operate (ATO). It is neither a law nor a data-specific standard, but an accreditation process for cloud providers.

Security Group: A stateful firewall that controls inbound and outbound traffic at the instance level.

Security groups are stateful virtual firewalls that operate at the elastic network interface (ENI) level, directly attached to EC2 instances or other VPC resources. When an inbound rule permits traffic, the corresponding outbound response is automatically allowed even if no outbound rule exists, because the security group tracks established connections. Rules are evaluated as a cumulative allow list, with an implicit deny for anything not explicitly permitted, and no explicit deny rules can be configured. This instance-level, stateful behavior is what separates security groups from stateless network ACLs at the subnet boundary.

Network ACL: A stateless firewall that controls inbound and outbound traffic at the subnet level.

A network ACL is a stateless filter associated with a VPC subnet, inspecting both inbound and outbound traffic at the boundary between the subnet and the rest of the VPC. Because it lacks connection state, every packet is evaluated independently, so you must define separate inbound and outbound rules to allow response traffic, often including ephemeral port ranges. Rules are processed in ascending numeric order, and the first rule whose criteria match dictates the allow or deny action, permitting explicit deny rules that security groups cannot express. This subnet-level, stateless scope makes NACLs a coarse-grained layer beyond instance-level security groups.

AWS WAF: Web application firewall that protects against common web exploits.

AWS WAF is a web application firewall that operates at Layer 7 (HTTP/S) to inspect and filter traffic destined for Amazon CloudFront, an Application Load Balancer, or Amazon API Gateway. It uses managed or custom rules to block common web exploits such as SQL injection (SQLi), cross-site scripting (XSS), excessive URI lengths, and geo-based attacks. Because it sees application-layer requests and can apply rate-based rules, it is purpose-built for web application protection, not network or transport-level attack mitigation.

AWS Shield: Managed DDoS protection service.

AWS Shield is a fully managed DDoS protection service; the always-on AWS Shield Standard is automatically enabled for all AWS customers at no cost, absorbing common network and transport-layer DDoS attacks. AWS Shield Advanced adds enhanced detection, near real-time visibility via CloudWatch metrics, and 24/7 access to the DDoS Response Team, along with cost protection against scaling-related charges. It defends against volumetric and protocol-level attacks such as SYN floods and UDP reflection attacks, making it distinct from a web application firewall.

Amazon GuardDuty: Threat detection service that monitors for malicious activity.

Amazon GuardDuty is a continuous threat detection service that consumes foundational data sources, including AWS CloudTrail management events, VPC Flow Logs, and DNS query logs. Using machine learning, anomaly detection, and curated threat intelligence feeds, it raises findings for suspicious activities like compromised credentials, cryptocurrency mining, or unusual API behavior. Unlike WAF and Shield, GuardDuty is not designed to stop attacks in real time; instead, it detects indicators of compromise so customers can investigate and remediate.

AWS KMS: Managed service for creating and controlling encryption keys.

AWS Key Management Service (KMS) is a regional, managed service used to create, store, rotate, and control the life cycle of customer master keys and, more recently, KMS keys. These keys are protected by FIPS 140-2 validated hardware security modules (HSMs) and can be used for envelope encryption, where a KMS key encrypts data keys that then encrypt customer data in services such as S3, EBS, and RDS. Access is governed by IAM and key policies, with auditability through CloudTrail, so it is fundamentally about cryptographic control, not attack filtering or DDoS defense.

AWS Shield: Protects against DDoS attacks

AWS Shield is a managed DDoS protection service that safeguards applications running on AWS.

AWS WAF: Filters web traffic using rules

AWS WAF is a web application firewall that helps protect web applications from common web exploits.

AWS GuardDuty: Provides intelligent threat detection

Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity.