Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Exam Prep > AWS Security Flashcards > Flashcards

AWS Security Flashcards

1
Q

How do you ensure Kinesis Data Streams data is encrypted in Transit?

A

Use the ‘StartStreamEncryption’ API

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the new name for Amazon Kinesis Data Analytics for Apache Flink?

A

Amazon Managed Service for Apache Flink

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What’s tricky about thinking about access vs trust when establishing one-way trust relationships between on-prem AD and AWS?

A

The direction of the trust relationship is the opposite of the direction of access.

I.e. if you extend an outgoing trust from AWS to on-prem AD, this grants access from AD to AWS, not the other way around.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How can you prevent user access to EC2 metadata?

A

Disallow it using IAM or SCPs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Between the master account users and member account users in a multi-account GuardDuty setup, who can generate sample findings?

A

Both member and master account users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Between the master account users and member account users in a multi-account GuardDuty setup, who upload and manage trusted IP and threat lists?

A

Master account users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Between the master account users and member account users in a multi-account GuardDuty setup, who can archive findings?

A

Master account users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What does this principle refer to in a KMS Key policy:

“Principal”: {
“AWS”: “arn:aws:iam::111122223333:root”
},

A

Any user in the account can be granted access via IAM.

“root” in this case of key policies is not referring to the root user of the account.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Does log file integrity validation automatically enable encryption?

A

No.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What’s the most efficient way to encrypt CloudTrail logs with customer managed keys?

A

Use server-side encryption with AWS KMS–managed keys (SSE-KMS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is envelope encryption?

A

where you encrypt plaintext data with a data key and then encrypt the data key with a top-level plaintext master key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What form of data encryption provides an audit trail which shows who used the encryption key?

A

Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS)

(NOT a feature of S3-managed keys)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How can you encrypt data before it is sent to a DynamoDB table, with full customer control of the encryption keys?

A

Configure the DynamoDB table to enable customer-managed CMK server-side encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

In a KMS key policy, what is the difference between the ‘aws:sourceVpce’ condition and the ‘aws:sourceVpc’ condition?

A

the former is to specify a specific vpc endpoint, the latter is to specify the whole vpc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

If a principle is granted access to an S3 bucket via the bucket policy, but not their IAM policy, do they have access to the bucket?

A

Yes. As long as there’s no explicit deny in any policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Linux EC2: What is the path of CloudWatch Logs Agent log file (used for log propagation troubleshooting)?

A

/var/log/awslogs.log

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What type of encryption is provided by SSE-S3 encryption?

A

AES-256

18
Q

How can you allow outbound traffic from ephemeral ports?

A

allow outbound traffic on ports 1024 – 65535

19
Q

When should you allow outbound traffic from ephemeral ports?

A

When you want to enable the connection to a service running on an instance

20
Q

What are the two resource-based access control mechanisms of KMS?

A

key policies and grants.

21
Q

(3) Which types of KMS keys do not grant automatic rotation?

A

KMS keys in custom key stores
Asymmetric KMS keys
KMS keys that have imported key material

22
Q

Which AWS services can offer SSL/TLS cipher suites for Perfect Forward Secrecy?

A

Amazon CloudFront and Elastic Load Balancers

23
Q

How do you prevent EC2 instances from using Amazon-provided DNS in a VPC?

A

Set the ‘enableDnsHostnames’ and ‘enableDnsSupport’ attributes in the VPC to false

24
Q

How could you dynamically reference a secrets manager secret called ‘password’ from a cloudformation script?

A

{{resolve:secretsmanager:AppKey:SecretString:password}}

25
Q

How can you ensure several applications have their own programmatic access control permissions on a CMK?

A

Configure each application to use a grant on the KMS CMK which will add or remove specific access controls on the CMK.

26
Q

Auto-scaling application:

How can you securely allow multiple domains to serve SSL traffic over the same IP address.

A
  1. CloudFront
  2. SSL Certificate from ACM
  3. Enable Server Name Indication (SNI)
27
Q

Which Oubound Port does Simple Email Service (SES) use to send traffic?

A

port 587

28
Q

How can you inspect the IAM permissions of a user before and after a security event?

A

Using Config.

29
Q

How can you detect and delete old access keys?

A

the ‘GenerateCredentialReport’ API

CloudWatch cannot monitor access key age.

30
Q

Cognito: Is it User Pool or Identity Pool?

A

Identity Pool, dummy.

31
Q

When adding additional authenticated data to a call to decrypt with KMS, what allows you to require additional information?

A

‘EncryptionContext’

32
Q

What is the most cost-effective solution for storing 1000s of parameters for individual IoT Devices, while keeping access to these parameters independently auditable?

A

Systems Manager Parameter Store - Standard Parameters.

33
Q

What provides protection against common attack patterns, such as SQL injection, DDoS or cross-site scripting?

A

AWS WAF

34
Q

How do you automatically act on a Config finding?

A

Using a Remediation action.

35
Q

KMS how can you return only the encrypted copy of a unique data key?

A

GenerateDataKeyWithoutPlaintext

36
Q

What are two methods for doing custom packet inspection on outgoing EC2 traffic? (2)

A
  1. Proxy software on an EC2, and route all traffic through it
  2. A host-based agent on each EC2 instance
37
Q

What can be used to bound the maximum policies a principle can grant to another principle?

A

Permissions Boundaries

38
Q

How long do you have to reverse a Glacier vault lock?

A

24 hours

39
Q

How do you edit a vault lock policy that was initiated less than 24 hours ago? (2)

A
  1. initiate the ‘abourt-vault-lock’ api
  2. ‘initiate-vault-lock’ after editing
40
Q

How do you define a specific cloudfront distro as the principle in your bucket policy?

A

Principal: ‘cloudfront.amazonaws.com’

Condition:
“StringEquals”: {
“AWS:SourceArn”: “arn:aws:cloudfront::AccountID:distribution/E27LVI50CSW06W”
}

41
Q
A

AWS Exam Prep (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions