Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

AWS SA PRO 2022 > Cantrill Questions > Flashcards

Cantrill Questions Flashcards

1
Q

Generates temporary credentials (sts:AssumeRole)

A

Security Token Service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

____ expire and do not belong to the IAM identity

A

Security Token Service (STS) generated credentials (they are temporary!)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Security Token Service (STS) temporary credentials are requested by?

A

AWS (IAM role) or external (web identity federation)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Each Region has a default AWS Service Quota although some services can be ____

A

per account

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

You should use SAML 2.0 when you currently use an Enterprise ID like MS AD or if the directory is ___ compatible?

A

SAML 2.0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Single Source of Truth or > 5000 users

A

SAML 2.0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

NACL’s are stateful or stateless?

A

STATELESS. Request and Response are seen differently

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What network security mechanism only impacts data crossing a subnet boundary?

A

NACL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What network security mechanism can ALLOW or DENY network traffic based on IP address?

A

NACL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Each subnet can only have one NACL (default or custom) however, NACL can be associated with many ______?

A

subnets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What security mechanism is STATEFUL and detects requests and response traffic automatically?

A

VPC Security Groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What security mechanism features no ability to explicitly DENY?

A

VPC Security Groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are VPC Security Groups attached to? Subnets, EC2 instances, or ENI’s?

A

ENI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Using this service, connections enter at the Edge, essentially moving the AWS network closer, using Anycast IP’s

A

Global Accelerator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

An AWS site to site VPN can be HA, if

A

you design it that way

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the two ends of an AWS site to site VPN?

A

Virtual Private Gateway (VGW) and Customer Gateway (CGW)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the max speed for an AWS site to site VPN?

A

1.25 GBps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

subnets can be associated to one _____ only

A

route table (default or custom)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

DX (Direct Connect) physical connection port can only be used with what type of cable?

A

single mode fiber

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are the proper port settings for the DX (Direct Connect) physical connection port?

A

Auto-Negotiation DISABLED, port speed and FULL DUPLEX

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What routing protocol (and auth) does the customer DX router need to support for DX (Direct Connect) connections?

A

BGP and BGP MD5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Private VIF are used to access how many VPC’s?

A

1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

1 Private VIF = how many VPC’s and how many VGW’s?

A

1 VPC and 1 VGW in the same region as the DX

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

How many private prefixes can you advertise over a private VIF?

A

100

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

______ provides private connectivity between VPCs, AWS services, and on-premises applications, securely on the Amazon network

A

AWS PrivateLink

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What needs to be done in order to make AWS PrivateLink HA?

A

Deploy multiple endpoints in each AZ

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Does AWS PrivateLink use iPv6?

A

Nope

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Can you access AWS PrivateLink via Direct Connect, VPC peering and/or site to site VPN?

A

Yeahhhh

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

____ provides access to public AWS resources such as S3 and DynamoDB from within a private subnet

A

gateway endpoint

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Are gateway endpoints HA across AZ’s?

A

Yes no config needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

If you access a resource via a gateway endpoint, what mechanism controls your level of access?

A

the endpoint policy, such as an s3 bucket policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

are gateway endpoints regional only?

A

yes, no cross regional services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Are interface endpoints HA?

A

no you need one interface endpoint per VPC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

can you use network security groups with interface endpoints?

A

yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What services can be accessed using a VPC Gateway Endpoint?

A

S3 & DynamoDB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

How to add encryption over a DX (Direct Connect)?

A

via a PUBLIC VIF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Is PrivateDNS used with interface endpoints or gateway endpoints?

A

interface endpoints

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What type of directory can aws workspaces integrate with?

A

Simple AD, Microsoft AD, and AD Connector

39
Q

If you want to utilize Workspaces and have a security regulatory restriction and can not have any directory information stored within AWS, what type of directory should you run in AWS?

A

Directory Connector

40
Q

What configures the role of credentials from federated to AWS using IAM roles

A

Cognito identity pool

41
Q

What type of file system should you use if users need to be able to use VSS for self or user driven file restores?

42
Q

What is a native file system accessible over SMB?

43
Q

What is a native file system accessible over NFS?

44
Q

Does FSx support NTFS permissions and DFS?

45
Q

What is a high performance windows file system, also good for POSIX

A

FSx for Lustre

46
Q

What file system mounts on linux and is shared across many EC2 instances?

47
Q

S3 server-side encryption with customer-provided encryption keys

48
Q

S3 server-side encryption with Amazon S3-managed encryption keys

49
Q

S3 server-side encryption with customer master encryption keys (CMK) stored in AWS key management service

50
Q

Can a NAT gatewy tolerate the failure of an AZ?

51
Q

Can an Internet Gateway (IGW) withstand the failure of many AZ’s in a region?

52
Q

What is AWS’s SIEM product?

53
Q

What is an AWS service that monitors configurations?

A

AWS Config

54
Q

What AWS service is used for scanning EC2 and EC2 instance OS for vulnerabilities?

A

AWS Inspector

55
Q

AWS Inspector host assessment is agentless or requires an agent?

56
Q

AWS Inspector network assessment is agentless or requires an agent?

57
Q

KMS is a regional and public or private service?

58
Q

Keys never leave KMS, KMS provides ______ level of FIPS

A

FIPS 140-2 (L2)

59
Q

What provides a true single tenant hardware security module?

60
Q

What security standard does Cloud HSM meet?

A

FIPS 140-2 Level 3

61
Q

If you see, PKCS#11, JCE (java cryptography extensions) and CryptoNG (CNG) libraries, think ____?

62
Q

Does CloudHSM integrate nativley with AWS services?

63
Q

Can CloudHSM be used to offload SSL/TLS prociessing tasks from web servers?

64
Q

What security service should be used to enable transparent data encrytion (TDE) for Oracle DB’s?

65
Q

What security service should be used to protect private keys for an issuing CA?

66
Q

ACM (Certificate Manager) can generate or import certs, if generated, the cert will ____, if imported, customer is responsible for the _____

A

Auto-renew, Renewing the certs

67
Q

ACM issued certs can be depoyed for supported services only (not EC2), name two:

A

CloudFront & ALB

68
Q

True/False: ACM is a regional service and certs cannot leave their region?

69
Q

One exception to the rule of deploying ACM certs regionally, is this AWS service ____. When configuring ACM for this service, you must choose this particular AZ _____

A

CloudFront, AWS-EAST-1

70
Q

AWS Secrets Manager supports automatic rotation, what service performs this rotation?

71
Q

Does Secrets Manager autoamtically inegrate with some AWS services like RDS?

72
Q

VPC flow logs are used for packet capture?

A

No, they capture packet metadata

73
Q

Name two destinations where VPC flow logs can be sent?

A

S3 or CloudWatch

74
Q

Service provides DDOS protections

A

AWS Shield

75
Q

What are two services that Shield Standard (free) protects?

A

Route53 & CloudFront

76
Q

How much does AWS Shield Advanced cost?

77
Q

What additonal services can Shield Advaned protect outside of CloudFront and R53?

A

EC2, ELB & Global Accelerator

78
Q

What AWS Shield service level provides for insurance and a DDOS repsonse team from AWS?

A

Shield advanced

79
Q

What service protects against SQL injections and cross site scripting?

80
Q

When creating a WAF, you first create a Web Access ____ _____ which can integrate with:

A

Control List (WEBACL), integrates with ALB, API Gateway and cloudfront

81
Q

Can CMK’s and KMS be used to encrypt data?

82
Q

Do AWS managed CMK’s support key rotation?

A

Yes, once every 3 years, cannot be changed or disabled

83
Q

Do customer managed CMK’s support key rotation?

A

Yes, can be enabled for 1 year

84
Q

Can CMK’s be migrated between regions?

85
Q

Can imported CMK’s be rotated?

86
Q

When evaluating permissions in AWS, does it matter if an ALLOW or DENY comes from an inline or managed policy?

87
Q

Is a Master Account affected by SCP’s?

88
Q

What happens to the source data in Athena when used for adhoc querying?

89
Q

What S3 related setting defines a way for client web applications that are loaded in one domain to interact with resources in a different domain?

A

CORS cross origin resource sharing

90
Q

What security mechanism are atached to ENI’s, can explictly ALLOW and are stateful?

A

Security Groups

91
Q

What security mechanism can explictly ALLOW and DENY and can be attached to subnets?

92
Q

If you need the apex of a domain to point to an ALB, what type of R53 record?

93
Q

What are Configured to have one subnet in each AZ in the region by default?

94
Q

What are Configured to have one subnet in each AZ in the region by default?

AWS SA PRO 2022 (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions