Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

AWS SA PRO 2022 > Cantrill Questions > Flashcards

Cantrill Questions Flashcards

1
Q

Generates temporary credentials (sts:AssumeRole)

A

Security Token Service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

____ expire and do not belong to the IAM identity

A

Security Token Service (STS) generated credentials (they are temporary!)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Security Token Service (STS) temporary credentials are requested by?

A

AWS (IAM role) or external (web identity federation)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Each Region has a default AWS Service Quota although some services can be ____

A

per account

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

You should use SAML 2.0 when you currently use an Enterprise ID like MS AD or if the directory is ___ compatible?

A

SAML 2.0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Single Source of Truth or > 5000 users

A

SAML 2.0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

NACL’s are stateful or stateless?

A

STATELESS. Request and Response are seen differently

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What network security mechanism only impacts data crossing a subnet boundary?

A

NACL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What network security mechanism can ALLOW or DENY network traffic based on IP address?

A

NACL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Each subnet can only have one NACL (default or custom) however, NACL can be associated with many ______?

A

subnets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What security mechanism is STATEFUL and detects requests and response traffic automatically?

A

VPC Security Groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What security mechanism features no ability to explicitly DENY?

A

VPC Security Groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are VPC Security Groups attached to? Subnets, EC2 instances, or ENI’s?

A

ENI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Using this service, connections enter at the Edge, essentially moving the AWS network closer, using Anycast IP’s

A

Global Accelerator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

An AWS site to site VPN can be HA, if

A

you design it that way

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the two ends of an AWS site to site VPN?

A

Virtual Private Gateway (VGW) and Customer Gateway (CGW)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the max speed for an AWS site to site VPN?

A

1.25 GBps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

subnets can be associated to one _____ only

A

route table (default or custom)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

DX (Direct Connect) physical connection port can only be used with what type of cable?

A

single mode fiber

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are the proper port settings for the DX (Direct Connect) physical connection port?

A

Auto-Negotiation DISABLED, port speed and FULL DUPLEX

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What routing protocol (and auth) does the customer DX router need to support for DX (Direct Connect) connections?

A

BGP and BGP MD5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Private VIF are used to access how many VPC’s?

A

1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

1 Private VIF = how many VPC’s and how many VGW’s?

A

1 VPC and 1 VGW in the same region as the DX

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

How many private prefixes can you advertise over a private VIF?

A

100

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
______ provides private connectivity between VPCs, AWS services, and on-premises applications, securely on the Amazon network
AWS PrivateLink
26
What needs to be done in order to make AWS PrivateLink HA?
Deploy multiple endpoints in each AZ
27
Does AWS PrivateLink use iPv6?
Nope
28
Can you access AWS PrivateLink via Direct Connect, VPC peering and/or site to site VPN?
Yeahhhh
29
____ provides access to public AWS resources such as S3 and DynamoDB from within a private subnet
gateway endpoint
30
Are gateway endpoints HA across AZ's?
Yes no config needed
31
If you access a resource via a gateway endpoint, what mechanism controls your level of access?
the endpoint policy, such as an s3 bucket policy
32
are gateway endpoints regional only?
yes, no cross regional services
33
Are interface endpoints HA?
no you need one interface endpoint per VPC
34
can you use network security groups with interface endpoints?
yes
35
What services can be accessed using a VPC Gateway Endpoint?
S3 & DynamoDB
36
How to add encryption over a DX (Direct Connect)?
via a PUBLIC VIF
37
Is PrivateDNS used with interface endpoints or gateway endpoints?
interface endpoints
38
What type of directory can aws workspaces integrate with?
Simple AD, Microsoft AD, and AD Connector
39
If you want to utilize Workspaces and have a security regulatory restriction and can not have any directory information stored within AWS, what type of directory should you run in AWS?
Directory Connector
40
What configures the role of credentials from federated to AWS using IAM roles
Cognito identity pool
41
What type of file system should you use if users need to be able to use VSS for self or user driven file restores?
FSx
42
What is a native file system accessible over SMB?
FSx
43
What is a native file system accessible over NFS?
EFS
44
Does FSx support NTFS permissions and DFS?
Yes
45
What is a high performance windows file system, also good for POSIX
FSx for Lustre
46
What file system mounts on linux and is shared across many EC2 instances?
EFS
47
S3 server-side encryption with customer-provided encryption keys
(SSE-C)
48
S3 server-side encryption with Amazon S3-managed encryption keys
(SSE-S3)
49
S3 server-side encryption with customer master encryption keys (CMK) stored in AWS key management service
SSE-KMS
50
Can a NAT gatewy tolerate the failure of an AZ?
Nope
51
Can an Internet Gateway (IGW) withstand the failure of many AZ's in a region?
Yes
52
What is AWS's SIEM product?
GuardDuty
53
What is an AWS service that monitors configurations?
AWS Config
54
What AWS service is used for scanning EC2 and EC2 instance OS for vulnerabilities?
AWS Inspector
55
AWS Inspector host assessment is agentless or requires an agent?
agent
56
AWS Inspector network assessment is agentless or requires an agent?
agentless
57
KMS is a regional and public or private service?
Public
58
Keys never leave KMS, KMS provides ______ level of FIPS
FIPS 140-2 (L2)
59
What provides a true single tenant hardware security module?
Cloud HSM
60
What security standard does Cloud HSM meet?
FIPS 140-2 Level 3
61
If you see, PKCS#11, JCE (java cryptography extensions) and CryptoNG (CNG) libraries, think ____?
CloudHSM
62
Does CloudHSM integrate nativley with AWS services?
No
63
Can CloudHSM be used to offload SSL/TLS prociessing tasks from web servers?
Yes
64
What security service should be used to enable transparent data encrytion (TDE) for Oracle DB's?
CloudHSM
65
What security service should be used to protect private keys for an issuing CA?
CloudHSM
66
ACM (Certificate Manager) can generate or import certs, if generated, the cert will ____, if imported, customer is responsible for the _____
Auto-renew, Renewing the certs
67
ACM issued certs can be depoyed for supported services only (not EC2), name two:
CloudFront & ALB
68
True/False: ACM is a regional service and certs cannot leave their region?
True
69
One exception to the rule of deploying ACM certs regionally, is this AWS service ____. When configuring ACM for this service, you must choose this particular AZ _____
CloudFront, AWS-EAST-1
70
AWS Secrets Manager supports automatic rotation, what service performs this rotation?
Lambda
71
Does Secrets Manager autoamtically inegrate with some AWS services like RDS?
Yes
72
VPC flow logs are used for packet capture?
No, they capture packet metadata
73
Name two destinations where VPC flow logs can be sent?
S3 or CloudWatch
74
Service provides DDOS protections
AWS Shield
75
What are two services that Shield Standard (free) protects?
Route53 & CloudFront
76
How much does AWS Shield Advanced cost?
3k/month
77
What additonal services can Shield Advaned protect outside of CloudFront and R53?
EC2, ELB & Global Accelerator
78
What AWS Shield service level provides for insurance and a DDOS repsonse team from AWS?
Shield advanced
79
What service protects against SQL injections and cross site scripting?
WAF
80
When creating a WAF, you first create a Web Access ____ _____ which can integrate with:
Control List (WEBACL), integrates with ALB, API Gateway and cloudfront
81
Can CMK's and KMS be used to encrypt data?
Yes, 4KB
82
Do AWS managed CMK's support key rotation?
Yes, once every 3 years, cannot be changed or disabled
83
Do customer managed CMK's support key rotation?
Yes, can be enabled for 1 year
84
Can CMK's be migrated between regions?
No
85
Can imported CMK's be rotated?
No
86
When evaluating permissions in AWS, does it matter if an ALLOW or DENY comes from an inline or managed policy?
No
87
Is a Master Account affected by SCP's?
No
88
What happens to the source data in Athena when used for adhoc querying?
Nothing
89
What S3 related setting defines a way for client web applications that are loaded in one domain to interact with resources in a different domain?
CORS cross origin resource sharing
90
What security mechanism are atached to ENI's, can explictly ALLOW and are stateful?
Security Groups
91
What security mechanism can explictly ALLOW and DENY and can be attached to subnets?
NACL
92
If you need the apex of a domain to point to an ALB, what type of R53 record?
A Alias
93
What are Configured to have one subnet in each AZ in the region by default?
VPC
94
What are Configured to have one subnet in each AZ in the region by default?
VPC

AWS SA PRO 2022 (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions