Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

SA PRO > Advanced Permissions & Accounts > Flashcards

Advanced Permissions & Accounts Flashcards

1
Q

What happens when the (sts:AssumeRole*) is used?

A

It generates temporary credentials

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What do access keys contain?

A

Access Key ID and Secret Access Key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is Access Key ID?

A

Public Part

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is Secret Access Key

A

Private Part

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What happens to temporary credentials?

A

They Expire

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Do temporary credentials belong to the identity?

A

No they dont

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How are temp credentials requested?

A

By an identity (AWS or External)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Can you invalidate temporary credentials?

A

No, they expire when they expire

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What happens when you change permission policy?

A

It effects everyone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

So how do you revoke permissions?

A

Adding conditional element

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Denying access to anyone who assumed a role before an date and time is called what?

A

Conditional element

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Identifying how many statements make up a policy document is what part of breaking down a statement?

A

Part 1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Breaking down the policy is the same regardless of what?

A

How short or long policy is

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

A policy statement is either a?

A

A single or list of statments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How can you tell if you have a single statement?

A

It has one or more curly braces

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How can you tell if you have a list of statements?

A

It has square brackets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Identifying what a statement does is what part of breaking down a statement?

A

The 2nd part

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Every statement has an effect, what are they and in what order?

A

DENY/Allow/Default Deny

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What does Wildcard mean?

A

All objects & paths

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

A statement in effect if certain conditions are met is what?

A

Conditional Block

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Deny Policies are normally accompanied by what? Since by default no effect is auto deny

A

An Allow policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What matches anything not listed inside its component

A

Any NOT operation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What should you look for first on a policy?

A

Not Operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What effects the maximum number of permissions an IAM User or Role has?

A

Permissions Boundary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What effects the maximum number of permissions an IAM User or Role can receive?
Permissions Boundary
26
Any permissions outside the boundaries are what?
Not in effect
27
IAM permissions Boundaries only impact what?
Identity Permissions
28
If IAM Permissions Boundaries only Impact Identity Permissions, What policy applies in Full Effect?
Resource Policies
29
What does AWS check for first when Evaluating Policy Logic?
Explicit Deny
30
What comes after Explicit Deny in Policy Logic Evaluation?
SCPs
31
What comes after SCPs in Policy Logic Evaluation?
Resource Policies
32
What comes after Resource Policies in Policy Logic Evaluation?
Permission Boundaries
33
What comes after Permission Boundaries in Policy Logic Evaluation?
Session Policies
34
What comes after Session Policies in Policy Logic Evaluation?
Identity Policies
35
What effect does Policy Evaluation Logic look for when moving through each policy in each step
Deny Allow Deny
36
What allows you to share resources between AWS Accounts?
AWS Resource Access Manager
37
Do products need to support Resource Access Manager? True or False
True
38
Who does AWS Resource Access Manager share with?
Principals, Accounts, OUs or Organizations
39
Shared Resources are what to accounts, principals. OUs and Organizations?
Visible and Accessed Natively in UI
40
Are you charged for using ( RAM ) ?
No, only the service cost
41
AZs Rotate physical locations and may not be same AZ as someone else. True or False?
True
42
Why is hard to coordinate resources between accounts in performance or HA perspective?
Because of AZ Rotation
43
What do AZs use which is consistent across account and can be used for different accounts and shared infrastructure deployments?
AZ ID
44
What does the 2 parts of example USE-AZ1 broken down tell you?
Region and AZ number
45
What does the Owner do in AWS Resource Access Manager?
Create share and provide name
46
Does the Owner of Resource Access Manager retain ownership?
Yes
47
What principal does the Owner of RAM define to share with?
AWS Account or ORG
48
What does enabling sharing in ORG within RAM do?
Automatically accept invite
49
What do non org account in RAM have to do manually?
Accept Invites
50
What does a created VPC in RAM provide to other accounts?
Shared Infrastructure Services
51
VPC Owners create and manage the VPC & Subnets and then what?
Share to participants
52
What cant Participants do within a VPC?
Provision but cant modify or delete
53
What can't VPC owners do within RAM if participant adds resources?
Modify or delete resources
54
Some Resources in RAM can be shared with any account and some with org accounts only/ True or False?
True
55
What defines how much of a thing you can use inside an AWS account?
AWS Service Quota
56
Each service has a default region Quota True or False
True
57
Most service quota can't be increased True or False?
False
58
Some services have a per account quota True or False?
True
59
Some services can't increase quota because of?
Architecture impacts
60
Higher increases in quota means?
more process and time needed
61
How do you predefine service quotas that can be used as a template for other accounts?
Quota request template
62
How does quota request template help?
Reduces admin overhead
63
How do you set an alert that you are approaching your quota limit?
Using CloudWatch alarm
64
Can you access service quota using the command line?
Yes
65
Who owns an object that is uploaded to a bucket?
The account who uploaded
66
What is the legacy method of S3? | Buckets are owned by the PROD account. Objects owned by account that PUTS object in bucket
ACL
67
What grants account to external Identities. | Objects owned by account which PUTS; can use account IDS and IAM Users with resource policy
Bucket Policy
68
Who owns the bucket and object when you assume Role with IAM and operate as an identity in that account?
The account owner

SA PRO (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions