Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS SA PRO 2022 > Cantrill Questions > Flashcards

Cantrill Questions Flashcards

1
Q

Generates temporary credentials (sts:AssumeRole)

A

Security Token Service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

____ expire and do not belong to the IAM identity

A

Security Token Service (STS) generated credentials (they are temporary!)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Security Token Service (STS) temporary credentials are requested by?

A

AWS (IAM role) or external (web identity federation)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Each Region has a default AWS Service Quota although some services can be ____

A

per account

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

You should use SAML 2.0 when you currently use an Enterprise ID like MS AD or if the directory is ___ compatible?

A

SAML 2.0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Single Source of Truth or > 5000 users

A

SAML 2.0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

NACL’s are stateful or stateless?

A

STATELESS. Request and Response are seen differently

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What network security mechanism only impacts data crossing a subnet boundary?

A

NACL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What network security mechanism can ALLOW or DENY network traffic based on IP address?

A

NACL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Each subnet can only have one NACL (default or custom) however, NACL can be associated with many ______?

A

subnets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What security mechanism is STATEFUL and detects requests and response traffic automatically?

A

VPC Security Groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What security mechanism features no ability to explicitly DENY?

A

VPC Security Groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are VPC Security Groups attached to? Subnets, EC2 instances, or ENI’s?

A

ENI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Using this service, connections enter at the Edge, essentially moving the AWS network closer, using Anycast IP’s

A

Global Accelerator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

An AWS site to site VPN can be HA, if

A

you design it that way

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the two ends of an AWS site to site VPN?

A

Virtual Private Gateway (VGW) and Customer Gateway (CGW)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the max speed for an AWS site to site VPN?

A

1.25 GBps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

subnets can be associated to one _____ only

A

route table (default or custom)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

DX (Direct Connect) physical connection port can only be used with what type of cable?

A

single mode fiber

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are the proper port settings for the DX (Direct Connect) physical connection port?

A

Auto-Negotiation DISABLED, port speed and FULL DUPLEX

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What routing protocol (and auth) does the customer DX router need to support for DX (Direct Connect) connections?

A

BGP and BGP MD5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Private VIF are used to access how many VPC’s?

A

1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

1 Private VIF = how many VPC’s and how many VGW’s?

A

1 VPC and 1 VGW in the same region as the DX

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

How many private prefixes can you advertise over a private VIF?

A

100

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

______ provides private connectivity between VPCs, AWS services, and on-premises applications, securely on the Amazon network

A

AWS PrivateLink

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What needs to be done in order to make AWS PrivateLink HA?

A

Deploy multiple endpoints in each AZ

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Does AWS PrivateLink use iPv6?

A

Nope

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Can you access AWS PrivateLink via Direct Connect, VPC peering and/or site to site VPN?

A

Yeahhhh

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

____ provides access to public AWS resources such as S3 and DynamoDB from within a private subnet

A

gateway endpoint

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Are gateway endpoints HA across AZ’s?

A

Yes no config needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

If you access a resource via a gateway endpoint, what mechanism controls your level of access?

A

the endpoint policy, such as an s3 bucket policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

are gateway endpoints regional only?

A

yes, no cross regional services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Are interface endpoints HA?

A

no you need one interface endpoint per VPC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

can you use network security groups with interface endpoints?

A

yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What services can be accessed using a VPC Gateway Endpoint?

A

S3 & DynamoDB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

How to add encryption over a DX (Direct Connect)?

A

via a PUBLIC VIF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Is PrivateDNS used with interface endpoints or gateway endpoints?

A

interface endpoints

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What type of directory can aws workspaces integrate with?

A

Simple AD, Microsoft AD, and AD Connector

39
Q

If you want to utilize Workspaces and have a security regulatory restriction and can not have any directory information stored within AWS, what type of directory should you run in AWS?

A

Directory Connector

40
Q

What configures the role of credentials from federated to AWS using IAM roles

A

Cognito identity pool

41
Q

What type of file system should you use if users need to be able to use VSS for self or user driven file restores?

A

FSx

42
Q

What is a native file system accessible over SMB?

A

FSx

43
Q

What is a native file system accessible over NFS?

A

EFS

44
Q

Does FSx support NTFS permissions and DFS?

A

Yes

45
Q

What is a high performance windows file system, also good for POSIX

A

FSx for Lustre

46
Q

What file system mounts on linux and is shared across many EC2 instances?

A

EFS

47
Q

S3 server-side encryption with customer-provided encryption keys

A

(SSE-C)

48
Q

S3 server-side encryption with Amazon S3-managed encryption keys

A

(SSE-S3)

49
Q

S3 server-side encryption with customer master encryption keys (CMK) stored in AWS key management service

A

SSE-KMS

50
Q

Can a NAT gatewy tolerate the failure of an AZ?

A

Nope

51
Q

Can an Internet Gateway (IGW) withstand the failure of many AZ’s in a region?

A

Yes

52
Q

What is AWS’s SIEM product?

A

GuardDuty

53
Q

What is an AWS service that monitors configurations?

A

AWS Config

54
Q

What AWS service is used for scanning EC2 and EC2 instance OS for vulnerabilities?

A

AWS Inspector

55
Q

AWS Inspector host assessment is agentless or requires an agent?

A

agent

56
Q

AWS Inspector network assessment is agentless or requires an agent?

A

agentless

57
Q

KMS is a regional and public or private service?

A

Public

58
Q

Keys never leave KMS, KMS provides ______ level of FIPS

A

FIPS 140-2 (L2)

59
Q

What provides a true single tenant hardware security module?

A

Cloud HSM

60
Q

What security standard does Cloud HSM meet?

A

FIPS 140-2 Level 3

61
Q

If you see, PKCS#11, JCE (java cryptography extensions) and CryptoNG (CNG) libraries, think ____?

A

CloudHSM

62
Q

Does CloudHSM integrate nativley with AWS services?

A

No

63
Q

Can CloudHSM be used to offload SSL/TLS prociessing tasks from web servers?

A

Yes

64
Q

What security service should be used to enable transparent data encrytion (TDE) for Oracle DB’s?

A

CloudHSM

65
Q

What security service should be used to protect private keys for an issuing CA?

A

CloudHSM

66
Q

ACM (Certificate Manager) can generate or import certs, if generated, the cert will ____, if imported, customer is responsible for the _____

A

Auto-renew, Renewing the certs

67
Q

ACM issued certs can be depoyed for supported services only (not EC2), name two:

A

CloudFront & ALB

68
Q

True/False: ACM is a regional service and certs cannot leave their region?

A

True

69
Q

One exception to the rule of deploying ACM certs regionally, is this AWS service ____. When configuring ACM for this service, you must choose this particular AZ _____

A

CloudFront, AWS-EAST-1

70
Q

AWS Secrets Manager supports automatic rotation, what service performs this rotation?

A

Lambda

71
Q

Does Secrets Manager autoamtically inegrate with some AWS services like RDS?

A

Yes

72
Q

VPC flow logs are used for packet capture?

A

No, they capture packet metadata

73
Q

Name two destinations where VPC flow logs can be sent?

A

S3 or CloudWatch

74
Q

Service provides DDOS protections

A

AWS Shield

75
Q

What are two services that Shield Standard (free) protects?

A

Route53 & CloudFront

76
Q

How much does AWS Shield Advanced cost?

A

3k/month

77
Q

What additonal services can Shield Advaned protect outside of CloudFront and R53?

A

EC2, ELB & Global Accelerator

78
Q

What AWS Shield service level provides for insurance and a DDOS repsonse team from AWS?

A

Shield advanced

79
Q

What service protects against SQL injections and cross site scripting?

A

WAF

80
Q

When creating a WAF, you first create a Web Access ____ _____ which can integrate with:

A

Control List (WEBACL), integrates with ALB, API Gateway and cloudfront

81
Q

Can CMK’s and KMS be used to encrypt data?

A

Yes, 4KB

82
Q

Do AWS managed CMK’s support key rotation?

A

Yes, once every 3 years, cannot be changed or disabled

83
Q

Do customer managed CMK’s support key rotation?

A

Yes, can be enabled for 1 year

84
Q

Can CMK’s be migrated between regions?

A

No

85
Q

Can imported CMK’s be rotated?

A

No

86
Q

When evaluating permissions in AWS, does it matter if an ALLOW or DENY comes from an inline or managed policy?

A

No

87
Q

Is a Master Account affected by SCP’s?

A

No

88
Q

What happens to the source data in Athena when used for adhoc querying?

A

Nothing

89
Q

What S3 related setting defines a way for client web applications that are loaded in one domain to interact with resources in a different domain?

A

CORS cross origin resource sharing

90
Q

What security mechanism are atached to ENI’s, can explictly ALLOW and are stateful?

A

Security Groups

91
Q

What security mechanism can explictly ALLOW and DENY and can be attached to subnets?

A

NACL

92
Q

If you need the apex of a domain to point to an ALB, what type of R53 record?

A

A Alias

93
Q

What are Configured to have one subnet in each AZ in the region by default?

A

VPC

94
Q

What are Configured to have one subnet in each AZ in the region by default?

A

VPC

AWS SA PRO 2022 (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions