Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS - Dev Associate > 30. Security & Encryption **IMPORTANT** > Flashcards

30. Security & Encryption **IMPORTANT** Flashcards

1
Q

What is encryption in flight?

A

SSL/TLS (HTTPS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is server-side encryption at rest

A

Data is encrypted after being received by the server and is decrypted before being sent (KMS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is client-side encryption?

A

Data is encrypted by client and never decrypted by server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What standard does KMS use for symmetric encryption?

A

AES-256

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What standard does KMS use for asymmetric encryption?

A

RSA & ECC key pairs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the KMS data per call maximum?

A

4KB of data per call

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What should you use if your KMS data is greater than the maximum?

A

If data > 4KB, use envelope encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What should you do in KMS to authorize cross-account access?

A

Attach a KMS Key Policy to authorize cross-account access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

True or False: KMS keys have a global view.

A

False. KMS keys are bound to the region they are in.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the API used for envelope encryption?

A

GenerateDataKey

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the API for data key caching?

A

LocalCryptoMaterialsCache

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the API for creating a unique symmetric data key (DEK)?

A

GenerateDataKey

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the API for encrypting data 4KB or less?

A

Encrypt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the API for generating a DEK for later use (not immediately)?

A

GenerateDataKeyWithoutPlaintext

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

When you exceed a KMS request quota, what happens?

A

You get a ThrottlingException

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the possible solutions for resolving a KMS ThrottlingException?

A
  1. exponential backoff
  2. For GenerateDataKey, use DEK caching from the Encryption SDK
  3. you can request a quota increase through API or AWS support
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

True or False: Shared KMS request quotas vary with the AWS Region and the type of CMK used in the request.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the 4 methods of encrypting objects in S3?

A
  1. SSE-S3
  2. SSE-KMS
  3. SSE-C
  4. Client-side Encryption
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is SSE-S3?

A

SSE-S3 encrypts S3 objects using keys handled and managed by AWS

20
Q

What is SSE-KMS?

A

SSE-KMS leverages KMS to manage encryption keys

21
Q

What is SSE-C?

A

SSE-C is when you want to manage your own encryption keys

22
Q

What are the advantages of SSE-KMS?

A

user control and audit trail

23
Q

What header must be set for SSE-KMS?

A

“x-amz-server-side-encryption”: “aws:kms”

24
Q

What API calls does SSE-KMS leverage?

A

GenerateDataKey and DecryptKMS

these KMS API calls will show up in CloudTrail

25
Q

What do you need to perform SSE-KMS?

A
  1. A KMS Key Policy that authorizes the user / role
  2. An IAM policy that authorizes access to KMS
    (otherwise you’ll get an access denied error)
26
Q

True or False: S3 calls to KMS for SSE-KMS do not count against your KMS limits.

A

False.

S3 calls to KMS for SSE-KMS do count against your KMS limits.

27
Q

How can you enforce SSL on an S3 bucket?

A

Create an S3 bucket policy with a DENY on the condition aws:SecureTransport = false

28
Q

What is SSM Parameter Store?

A

AWS Systems Manager Parameter Store

  • secure, hierarchical storage for configuration data management and secrets management
  • simple API
  • KMS encryption is optional
  • can integrate with CloudFormation
  • can track versions
  • 2 tiers: Standard (free) and Advanced ($)
29
Q

What is AWS Secrets Manager?

A
  • protect secrets needed to access your applications and services
  • Capability to force rotation of secrets
  • automatic creation of secrets on rotation (using Lambda)
  • KMS encryption is mandatory
  • integration with RDS and CloudFormation
30
Q

How does KMS encryption work?

A

KMS stores the CMK, and receives data from the clients, which it encrypts and sends back

31
Q

Which AWS entities can be used to deploy SSL/TLS server certificates?

A

AWS Certificate Manager and IAM

32
Q

Which is less expensive: SSM Parameter Store or Secrets Manager?

A

SSM Parameter Store

33
Q

What would you suggest for someone who wants to rotate their keys?

A

Secrets Manager

34
Q

How should you store secrets in CodeBuild?

A

DO NOT STORE THEM AS PLAINTEXT IN ENVIRONMENT VARIABLES

Use environment variables to reference parameter store parameters or secrets manager secrets.

35
Q

Are CloudTrail event log files encrypted by default?

A

Yes, with S3 Server-Side Encryption (SSE)

36
Q

KMS stores what types of keys?

A

Master keys (not data keys)

37
Q

KMS can be used with what AWS service to audit keys access history?

A

CloudTrail

38
Q

What are the primary resources in KMS?

A

Customer Master Keys (CMKs)

39
Q

What level of compliance does KMS have?

A

FIPS 140-2 Level 2 compliant

40
Q

What is the KMS command to turn on automatic key rotation?

A

> aws kms enable-key-rotation

only for symmetric keys

41
Q

What should you use to store database credentials?

A

Secrets Manager

It will store and automatically rotate your database credentials

42
Q

What should you use to block a single IP address?

A

NACL

43
Q

Are NACLs stateful or stateless?

A

Stateless (incoming rule will not be applied to outgoing)

44
Q

Are Security Groups stateful or stateless?

A

STATEFUL (if traffic is allowed inbound, it is also allowed outbound)

45
Q

Can a Security Group block a single IP address?

A

No. You cannot block specific IP addresses with Security Groups, for this you would need a Network Access Control List (NACL)

AWS - Dev Associate (22 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions