Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Professional > 02 Security > Flashcards

02 Security Flashcards

1
Q

Describe Security Assertion Markup Language (SAML).

A

SAML is an open standard used by identity providers (IdP) for federation, primarily for internal corporate IdPs, and it returns a SAML assertion when a user logs in.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

How does SAML assertion work in the context of AWS?

A

When a user logs in, the IdP returns a SAML assertion which can be exchanged for credentials using sts:AssumeRoleWithSAML.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Define IAM Identity Center and its purpose.

A

IAM Identity Center manages access to AWS accounts and custom applications using Single Sign-On (SSO), intended for workforce identity federation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the key functions of Amazon Cognito?

A

Amazon Cognito has two key functions: user pools for managing users and providing JWTs, and identity pools for exchanging external identities for temporary AWS credentials.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How do user pools in Amazon Cognito operate?

A

User pools are a database of users that provide JWTs upon sign-in, allowing for user management, social sign-in, and optional email and MFA verification.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Explain the role of identity pools in Amazon Cognito.

A

Identity pools offer access to temporary AWS credentials and can provide access for guest users, allowing external identities to be exchanged for AWS credentials.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Describe Amazon Workspaces and its billing options.

A

Amazon Workspaces is a desktop-as-a-service offering with pricing available on an hourly or monthly basis, though hourly billing includes a fixed overhead.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the function of AWS Directory Service in Amazon Workspaces?

A

AWS Directory Service is required for authentication and user management in Amazon Workspaces and can integrate with existing Active Directory installations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How does Amazon Workspaces ensure networking access?

A

Each Workspace uses an Elastic Network Interface (ENI) to access networking in a Virtual Private Cloud (VPC), with the option to add a VPN for connectivity to on-premises resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What storage options are available in Amazon Workspaces?

A

Storage in Amazon Workspaces is provided by a user volume and a system volume, based on EBS volumes, which can be encrypted at rest.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Define the availability characteristics of Amazon Workspaces.

A

Workspaces are not designed for high availability and are tied to a single Availability Zone (AZ).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Describe the Directory Service in the context of AWS.

A

Directory Service is a native Microsoft Active Directory service that can serve as a drop-in replacement for an existing server and is highly available by default, using two AZs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How does Directory Service establish trust with on-premises AD servers?

A

Directory Service can establish a two-way trust, allowing users with access to an on-premises AD server to connect.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Describe the function of the Key Management Service (KMS) in AWS.

A

KMS creates, stores, and manages cryptographic keys, implementing encryption and decryption directly without key material leaving the service.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How does Simple AD differ from native Active Directory (AD)?

A

Simple AD is a non-native AD compatible server that is cheaper but does not support all features of native AD.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Define the purpose of Control Tower in AWS.

A

Control Tower orchestrates other AWS services to set up multi-account environments, providing governance and management capabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the role of Guard Rails in Control Tower?

A

Guard Rails detect and mandate standards across all accounts, ensuring compliance and security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Explain the concept of Multi-Region Keys in KMS.

A

Multi-Region Keys automatically replicate cryptographic material between regions, allowing decryption of data encrypted in another region.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How does the AD Connector function in AWS?

A

AD Connector redirects requests to an on-premises AD server, enabling AWS services to integrate with existing on-premises AD installations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are the two types of Guard Rails in Control Tower?

A

Preventative Guard Rails, enforced using Service Control Policies (SCPs), and Detective Guard Rails, checked using AWS Config rules.

21
Q

Describe the automatic management features provided by AWS for patching and backups.

A

Patching, maintenance, and backups are managed automatically by AWS services.

22
Q

What is the significance of key policies in KMS?

A

Key policies are resource policies that control access to the key using IAM statements, denying all access by default.

23
Q

How many AWS accounts are automatically created by Control Tower and for what purposes?

A

Two AWS accounts are automatically created: the audit account and the log archive account.

24
Q

Define the term ‘aliases’ in the context of KMS.

A

Aliases are logical pointers to keys in KMS, allowing easier management and reference.

25
Q

What happens to key material during encryption and decryption in KMS?

A

Key material never leaves KMS; the service directly implements encryption and decryption.

26
Q

How does MFA support work in AWS services?

A

MFA is supported using RADIUS for enhanced security during authentication.

27
Q

What is the function of the Account Factory in Control Tower?

A

The Account Factory automates and standardizes the creation of new accounts within the multi-account setup.

28
Q

Explain the compliance standards associated with KMS.

A

KMS is FIPS 140-2 compliant, with some features having Level 3 compliance.

29
Q

What is the maximum amount of data that can be encrypted or decrypted at a time using KMS?

A

Only 4KB of data can be directly encrypted or decrypted at a time using KMS.

30
Q

Describe the purpose of the Landing Zone in Control Tower.

A

The Landing Zone provides the multi-account setup, establishing Single Sign-On, centralized logging, auditing, and governance.

31
Q

Describe the process of using GenerateDataKey for encryption.

A

GenerateDataKey is called to obtain a plaintext key for encryption. This key is used client-side for encryption, while the ciphertext key is stored alongside the data. When decryption is needed, the ciphertext key is decrypted via KMS.

32
Q

Define CloudHSM and its primary function.

A

CloudHSM is a hardware security module that allows for the secure management of cryptographic material, ensuring dedicated tenancy for customers’ cryptographic needs.

33
Q

How does CloudHSM ensure compliance and security?

A

CloudHSM is FIPS 140-3 compliant, providing a higher level of security than KMS, which is FIPS 140-2 compliant. AWS provisions the hardware but does not have access to the secure enclave.

34
Q

What APIs are used to access CloudHSM?

A

Access to CloudHSM is provided via industry-standard APIs such as PKCS#11, JCE, and CryptoNG.

35
Q

Explain the relationship between KMS and CloudHSM.

A

KMS can utilize CloudHSM as a custom key store, allowing for enhanced security and management of cryptographic keys.

36
Q

Describe the high availability setup for CloudHSM.

A

High availability in CloudHSM requires multiple HSMs running as a cluster, which replicates keys and other data between the HSMs.

37
Q

What role do HSMs play in SSL/TLS processing?

A

HSMs can offload SSL/TLS processing from web servers, enhancing performance and security.

38
Q

How does Certificate Manager function in AWS?

A

Certificate Manager stores SSL/TLS certificates for use by other AWS services, such as CloudFront and ELB, and can generate or import public certificates.

39
Q

What is required for generating public certificates in Certificate Manager?

A

Generating public certificates requires validation, such as through DNS, and these certificates renew automatically.

40
Q

Explain the limitations of certificates managed by Certificate Manager.

A

Certificates cannot be exported or used directly for self-managed encryption, and they are regional, meaning they cannot be used across different AWS accounts.

41
Q

Describe the function of Private CAs in Certificate Manager.

A

Private CAs generate self-signed certificates, which require clients to be configured to trust the CA.

42
Q

What is the purpose of SSM Parameter Store?

A

SSM Parameter Store is used to store parameters, which can have data types such as String, StringList, or SecureString.

43
Q

How are SecureString parameters encrypted in SSM Parameter Store?

A

SecureString parameters in SSM Parameter Store are encrypted using KMS.

44
Q

Describe how Parameter Store handles data storage.

A

Parameter Store will only store the cyphertext, and parameters are stored hierarchically and can be versioned.

45
Q

Define the primary function of Secrets Manager.

A

Secrets Manager stores secrets and allows for automatic credential rotation.

46
Q

How does Secrets Manager integrate with AWS services?

A

Secrets Manager directly integrates with some AWS services, such as RDS.

47
Q

Do Lambda functions play a role in Secrets Manager?

A

Yes, Lambda can perform automatic credential rotation in Secrets Manager.

48
Q

Explain the versioning capability of Parameter Store.

A

Parameters in Parameter Store can be versioned, allowing for management of different versions of parameters.

AWS Professional (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions