Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS (Deep Dive) > AWS KMS > Flashcards

AWS KMS Flashcards

1
Q

Is AWS KMS Free to use?

A

No, You pay for each key you store and each API call.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

How can I control who accesses AWS KMS?

A

AWS KMS service has the same IAM access control as other services in AWS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How can I control who can use the CMK keys created by AWS KMS?

A

A CMK can have an access control policy attached to it, this access control policy enables restriction to happen.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

what is a symmetric data key?

A

It is used to encrypt large blocks of data and is the same key for encryption and decryption, AES 256 is symetricencryption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is asymmetric encryption?

A

It is public and private key encryption where the a public key is share with people to encrypt data. Good for small amounts of data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is envelope encryption?

A

This is where you encrypt plane text data with a key and ten encrypt the key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a CMK

A

Is is a customer master key, used to encrypt and decrypt unto 4k of data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Is KMS a global or regional service?

A

It is a regional service.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Is the CMK a logical or real key?

A

It is a logical key, the reason for this is keys can be rotated and old keys kept until data is deleted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a data key?

A

Is a key generated by HSM under CMK, returned as plane and encrypted

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a permission?

A

A permission is a policy attached to a CMK and defines who/what can access the CMK.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the hierarchy of the keys for KMS?

A 
Domain Key 
HBK
Domain encrypts HBK and produced EKT
EKT is stord in CMK
CMK is stored in external durable storage form HSM
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a HBK?

A

It is a HSM backed keys, it is a key generated in the HSM and never leaves the HSM unencrypted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the EKT?

A

Is the HBK thet gets encrypted under the domain key and and is exported from the HSM into the CMK, CMK is resident in durable storage outside the hSM.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is CDK

A

It is a customer data keys, encrypted under CMK.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

I have an on-prem application that I want to use envelope encryption with, I need this to be highly secure and FIPS complaint, what are my options?

A

You could used AWS KMS and the KMS SKD to encrypt you key using the CMK.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What dose the CMK consist of?

A

EKS which are encrypted HBK thet were generated in the HSM and encrypted under the domain key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Can I used my own Key with KMS and how dose this work?

A

Yes you can use your own key, you import they material into KMS and this key materiel is used for HBK, HBK gets encrypted under domain key and stored in logical CMK.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

I need a key to encrypt some data, what should I used?

A

Call GenerateDataKey API, this will create a data key they is encrypted under the CMK, you can get back bot encrypted and plane text versions of this key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

I need to encrypt large amounts of data in my application, what options do I have?

A

You can used the AWS KMS SDK, it can be used to encrypt large amounts of data, it used KMS,

21
Q

I would like to have a more hand off approach to key management, what options do i have?

A

You can use KMS and have it automatically rotate the keys for you. This will involve KMS creating new HBK under the domain key to be come new EKS and stored in the logical CMK. These new keys will be used after creation and onl EKS will still be kept in the CMK to decrypt the data thet was encrypted.

22
Q

As part of corporate policy, I need to have KMS keep audit logs, what options do i have?

A

KMS is looked with CloudTrail, CloudTrail tracks all access to the KMS API.

23
Q

What are the 3 use cases KMS used for encrypting data?

A
  • Use API to encrypt data (Key)
  • Use AWS service that use KMS to encrypt data.
    Use The AWS SDK to encrypt data.
24
Q

What is envelope encryption?

A

Is is when you used another key (master) to encrypt a key.

25
Q

What is a customer key store?

A

You can create a CloudHSM and have KMS use it. Master keys created in the CloudHSM never leave it in plane text.

26
Q

When should I use KMS with CloudHSM?

A

When I want to manage the fife cycle of Master Keys.

If keys have to ve on a valid FIPS 140-2 level 3 device.

27
Q

What do you pay for with KMS?

A

You pay for each CMK and the number of API calls. You also pay as new keys are created from key rotation. Keys are charged at $1 a Key and for API calls 0.03 per 10K API calls.

28
Q

Whet regions are keys stored in?

A

They are stored only in the region they are created in.

29
Q

Do KMS keys get an ARN?

A

Yes each CMK in KMS get sits own ARN, this cna be used to refer to the key.

30
Q

When you create a CMK, is key rotation automatically turned on?

A

No, you have to enable this on a per key basis.

31
Q

Can I delete a key immediately?

A

No you have to wait between 7 - 30 days for key to be deleted, this is a safe guard.

32
Q

When we look at KMS what are the types of access control available?

A

We have IAM to control access to the KMS service, we also have Key (MMK) policies to control access to the CMK’s.

33
Q

Is KMS a regional or global service?

A

Regional.

34
Q

How does KMS create a data key?

A

KMS creates a data key by first generating a hardware baked key, encrypting this key and storing it in the CMK . The HBK is encrypted under the domain key and stored in the CMK as EKT.

35
Q

Will KMS manage your data keys?

A

No, one the data keys are handed over you have to manage them on your own, you have both the plain text and encrypted key, normally we encrypt some data and discard the plain text key and keep the encrypted key. Letser when we want to unencrypt the data we ask KMS to unencrypt the encrypted key using the KMS stored CMK, we then use this key to unencrypt the data.,

36
Q

What are the two types of CMK’s?

A

Customer-managed and AWS Managed CMKs.

37
Q

How often are customer-managed keys rotated by default?

A

Once every 3 years, but you can select to have this done every year.

38
Q

What is the difference between a customer and was managed CMK’s

A

When AWS creates a key as part of an AWS service like e S3, it is an AWS managed key. When you create a key through the portal or CLI then it is a customer managed key.

39
Q

Why would I use a customer-managed key?

A

Many AWSservices allow you to select a key to use for encryption, you can generate and manage your own KMS key and have the AWS service use it.

40
Q

What happens when CMK key rotation takes place?

A

A new HBK is created and encrypted using the domain key and placed in the CMK, the existing key is still stores as it will be used for old data decryption.

41
Q

I have a requirement for audit logs for KMS, what are my options?

A

Use CloudTrail.

42
Q

What are the FIPS that KMS supports?

A

FIPS 140-2

43
Q

I require an industry standards API interface for HSM, what are my options?

A

KMS does not support industry standards API interface, HSM would be a better option.

44
Q

Can CMKS leave the KMS service?

A

No they never leave the KMS service.

45
Q

What is the size of the data I can pass to KMS to have encrypted using the CMK?

A

4K

46
Q

How can I ensure only the users I want can use the CML?

A

CMKs have access control policies you can use to restrict who has access.

47
Q

How do I reference a CMK?

A

Each CMK get an ARN

48
Q

Can I use the KMS service globally?

A

No, each KMS is in a region as it is a regional service.

AWS (Deep Dive) (90 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions