Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Certified Developer > Domain 2: Security > Flashcards

Domain 2: Security Flashcards

1
Q

What is IAM?

A

Identity Access Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the IAM Identities and how are each of them used?

A

Users: Represents a person or service who uses IAM to interact with AWS

Groups: A collection of IAM users

Roles: An identity with permission policies that determine what the identity can and cannot do in AWS. Can be assumed by a user, federated user or a service.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the AWS policy types?

A

AWS Managed Policy - AWS managed policies that are designed to provide permissions for many common use cases

AWS Customer Managed Policy - Customer managed policies that can be assigned to a user/group/role

Inline policies - A policy that’s embedded in an IAM user, group or role

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the format of an IAM Policy document?

A

JSON

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How is access managed on an EC2 level?

A

Security Groups - A stateful “virtual” firewall for incoming and outgoing traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the default behaviour of Security Group rules?

A

All outbound traffic permitted and all inbound traffic is blocked

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Can you block traffic with Security Groups?

A

No - Security Group rules are permissive only

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Security Groups are stateful. What does this mean?

A

If you send a request from the instance the request and response for that request is permitted regardless of inbound/outbound security rules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is AWS KMS?

A

AWS Key Management Service - Centralized control of cryptographic keys used to protect your data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a CMK? (Within KMS)

A

Customer Master Key - Encrypting/decrypting data up to 4 KB which is used to generate/encrypt/decrypt the data key which is then used to encrypt/decrypt your data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How is the CMK used with envelope encryption?

A

A data key is generated from the CMK, this key is then used to encypt/decrypt your data. The (CMK encrypted) data key can be stored alongside the encrypted file to be used to easily encrypt/decrypt the large files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What the the KMS AWS CLI commands?

A

aws kms encrypt # Encrypt up to 4 kB
aws kms decrypt # Decrypt up to 4 kB
aws kms re-encrypt # Decrypt a file and encrypts it without saving the file to memory, can be used for re-encrypting with a new CMK

aws kms enable-key-rotation # Rotate your CMK on an annual basis

aws kms generate-data-key # Generate data key for encrypt/decrypt for files above 4 kB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Can you used AWS CMKs in crypto ops directly?

A

No - this is managed by AWS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Are KMS encryption keys regional or global?

A

Regional - Keys are only stored in the region in which they are created and used, you cannot transfer CMKs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are NACLs?

A

Network Access Control List: A layer of security that acts as a firewall for controlling traffic in and out of a subnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the NACL default rules?

A

Allows all inbound and outbound traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Are NACLs stateful or stateless?

A

Stateless - Which means responses are allowed to inbound traffic are subject to the rules for outbound traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Does S3 block public permissions by default?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is a VPC endpoint?

A

A logical entity within a VPC that allows connectivity only to S3, it helps prevent traffic traversing the internet and speed up requests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are the different ways S3 bucket access is manged?

A

IAM Policies: Allow S3 operations at the IAM level

S3 bucket policies: Allows access at the bucket level

Access Control Lists (ACLs): A sub resource that’s attached to every S3 bucket and object - generally a legacy concept

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is AWS System Manager Parameter Store?

A

A secure service to create, store and manage parameters with values, great for storing sensitive data such as passwords

It uses AWS KMS on the backend

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is AWS CloudTrail?

A

A web service that records activity made on your account: IP, when, what resource, how it was changed, whether it was denied or not. Great for auditing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are CIDR blocks?

A

An IP addressing scheme which represents a group of IP addresses. Used in subnets, routing tables etc.

  1. 0.0.0/32 matches only 10.0.0.0
  2. 0.0.0/24 matches 10.0.0.0 - 10.0.0.255
  3. 0.0.0/16 matches 10.0.0.0 - 10.0.255.255
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the secure way to share objects with S3?

A

Granting temporary access with a presigned URL and giving them out to a client

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

How to ensure server-side encryption for all objects stored in a bucket?

A

Add a bucket policy that denies permissions to upload an object unless the request includes the:
“x-amz-server-side-encryption” header

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are the S3 encryption options?

A

SSE-S3 (Server Side Encryption S3)

SSE-KMS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

How can you test whether a policy document works?

A

IAM Policy Simulator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is AWS Cognito?

A

An AWS Identity broker you to easily allow users to sign-up and sign in to your app

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is the Web Identity Federation?

A

Allows users of your app to sign in using a well-known external provider (Amazon, Google etc)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

How does AWS Cognito work?

A

The user authenticates against a “user pool” (or user directory) and once authenticated obtains JWT.

These JWT are then exchanged with the “identity pool” for temporary AWS credentials to access the apps AWS resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

How does AWS Cognito keep data in sync across devices?

A

Push data is used to sync data across multiple devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is an AWS User Pool?

A

User directory in AWS Cognito with sign-in/sign-up functionality which you can authenticate via:

  • Web Identity Federation
  • Directly with your App
  • Other SAML identity providers (like a companies organization)

It is also has other authentication features such as phone verification, MFA etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What are Identity Pools?

A

Provide temporary AWS credentials for users who are guests or for users who have a token

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is AWS SSO?

A

AWS Single Sign-On - Easy to centrally manage SSO access to all your AWS accounts and their permissions. Great for leveraging existing corporate identities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is AWS STS?

A

AWS Security Token Service (STS) enables you to request temporary credentials.

E.g.
aws sts assume-role # Return a set of temporary security credentials that you can use to access AWS resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What do temporary AWS security credentials consist of?

A

Access Key ID, secret access key and a security token

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What do AWS security credentials consist of?

A

Access key ID and a secret access key

38
Q

How does AWS cross-account access work to give access to production resources from a developer account?

A
  1. Create the policy on the production account
  2. Create an “Another AWS account” role type with the policy defined above
  3. On the developer account add the policy to allow assume role as production account
  4. On the developer account you should be able to assume on the production account for the role defined in step 2
39
Q

How can you configure a lambda function to access resources in a VPC?

A
  1. Add AWSLambdaVPCAccessExecutionRole AWS managed policy to the functions execution policy
  2. Configure the function to include a security group, subnet and VPC for it to access
40
Q

What are lambda policies?

A

Resource-policies - Permit other AWS Roles permission to invoke your lambda function

Execution role - Permit your lambda function to access other AWS resources

41
Q

What is CORS & why is it needed?

A

Cross-Origin Resource Sharing - A way for client-web applications that are loaded from one domain to interact with another domain. The browser will block this kind of resource sharing without configuration.

Common use-cases: Client downloading data from an S3 bucket or another AWS resource directly

42
Q

What is the limit for CMKs?

A

10000 CMKs per account per region

43
Q

How do IAM roles work securely?

A

IAM roles are based on temporary security tokens and are rotated automatically

44
Q

If a NACL or Security group is blocking a given request/response, what do you expect to happen?

A

Timeout error

45
Q

What is AWS Secrets Manager?

A

Stores key-value secrets and allows for automatic key rotation.

Key rotation can be done natively with AWS services AWS RDS, Redshift but you can also write lambda functions to do this

46
Q

What is AWS Shield?

A

A managed distributed DDos automatic protection service to safe guard your applications.

It works a layer 3/4 (network layer)

47
Q

What is AWS WAF?

A

AWS Web Application Firewall - A paid service that blocks specific traffic patterns. Operates at layer 7.

48
Q

What is AWS GuardDuty?

A

A threat detection service that continuously monitors multiple data sources for malicious activity.

49
Q

AWS Security Group default rules and rule behaviours?

A

No rule no traffic allowed.

Outbound default has a rule that permits all traffic.

Inbound default has no rules so no traffic permitted.

Can delete the outbound default rule so all outbound traffic blocked.

50
Q

Can you allow users which are not authenticated via aws cognito?

A

Yes - with authenticated access enabled

51
Q

Is there an aws kms call limit?

A

Yes

52
Q

What are IAM policy variables?

A

Use AWS Identity and Access Management (IAM) policy variables as placeholders when you don’t know the exact value of a resource or condition key when you write the policy.

53
Q

How do you decode authorization messages from a failed AWS command?

A

aws sts decode-authorization-message

54
Q

A customer wants to encrypt data at rest using AWS with it’s own key - what should it use?

A

AWS KMS and supply it with their own Customer Master Key

55
Q

A Lambda function requires access to an S3 bucket policy? What do you need to do?

A

Create an IAM role with permissions to access the S3 bucket and assign it the Lambda’s execution role.

Ensure the bucket policy also permits the Lambda function to access it (usually does unless Lambda is in another account).

56
Q

What is the structure of an S3 bucket policy?

A

Version - Usually a date
Statement - List of statements that contain the following

Effect: “Allow” or “Deny” access
Principle: IAM user/role
Resource: arn:aws:s3:::bucketname/root

57
Q

How to log in via AWS cli to get pull a docker image from ecr?

A

aws ecr get-login # Login to ecr via aws

docker pull

58
Q

What are the ways of controlling access to the CMK in KMS?

A

Key policies - Controls who can access the key, can also set IAM policies to allow access to the key

IAM policies - Has to be set within the key policies

59
Q

If an AWS Lambda function requires internet access and access to a private VPC how is this done?

A

Lambda functions can have access to the internet - however when associated with a VPC by default they no longer has access to the internet by default because they are within the private VPC.

To do this you need to configure an internet & NAT gateway to route traffic from the private VPC to the internet.

60
Q

What is the way of accessing AWS services from another developer machine?

A

Create a AWS user and with a secret access key and access key

61
Q

If you have an on-premise application outside of an AWS environment what is the best practice for permitting access?

A

Create an AWS User (a dedicated service account), restrict the source IP range of your clients and distribute the secret access key.

62
Q

If you have client-side code that requires credentials what is the best practice?

A

Using AWS STS to generate temporary credentials.

63
Q

How to encrypt messages at rest in SQS?

A

SSE encrypts messages at rest as soon as SQS receives them, the messages are only decrypted once they are sent to an authorized consumer.

This is done with AWS KMS.

Encryption must be enabled on the queue.

64
Q

What are IAM Policy conditions used for?

A

To specify the conditions when the given policy is in affect.

65
Q

What is AWS Systems Manager?

A

Allows one to visibly control your infrastructure on AWS.

66
Q

What is AWS API Gateway Lambda authorizer?

A

A Lambda function that you provide to control access to your API.

Great for third party authentication systems.

67
Q

Which security credentials can only be created by the AWS root user?

A

CloudFront Key Pairs

68
Q

Which security credentials can only be created by the AWS root user?

A

CloudFront Key Pairs

69
Q

What is SSE-S3?

A

Server-Side Encryption with Amazon S3-Managed Keys with AES-256

70
Q

What is SSE-KMS?

A

Server-Side Encryption with with CMKs stored in SSE-KMS but with some additional charges for extra features. E.g. an audit trail for when your CMK was used & by whom.

71
Q

What is SSE-C?

A

Server-Side Encryption with Customer-Provided Keys (SSE-C). The customer manages the encryption.

72
Q

What is the IAM Access Analyzer?

A

Helps you identify the resources that are shared with an external entity - it lets you identify unintended access to your resources/data.

73
Q

What are dedicated instances?

A

EC2 instances that run on h/w that’s dedicated to a single customer. Instances may share h/w with other instances of the same account but never other accounts.

74
Q

What are dedicated hosts?

A

Physical server that’s dedicated for your use. Costlier than the dedicated instances option.

75
Q

What AWS services can be used to deploy SSL/TLS server certificates?

A

AWS Certificate Manager & IAM

76
Q

What policy types only limit permissions but cannot grant permissions?

A

AWS Organizations Service Control Policy (SCP)
- Limits permissions that users/roles within the account but do not grant permissions

Permissions boundary
- Defines the maximum permissions that the IAM entity can grant to another user but does not grant.

77
Q

What are the 3 credential types supported by IAM for CodeCommit?

A

Git credentials, SSH Keys, AWS access keys

78
Q

What is a Trust Policy?

A

Defines the IAM principles that are allowed to assume this role.

79
Q

What MFA is not permitted for use with the root account?

A

SMS MFA

80
Q

Can Cognito authentication be used with CloudFront?

A

No, not directly you have to create a separate Lambda@edge function to accomplish this.

81
Q

What is the Access Adviser feature?

A

Helps you identify unused roles.

82
Q

What is Amazon Inspector?

A

an automated security assessment service.

83
Q

What is the difference between Cognito User pools and Cognito Identity pools?

A

Cognito User pools authenticates a given user (can be third party, defined user directory or SAML providers).

Cognito Identity pools defines how those users can obtain temporary AWS credentials to access AWS services.

84
Q

How do you prevent an unauthorized domain from using your content?

A

Only enable CORS for selected domains.

85
Q

index.html on bucket A refers to load.html on bucket B.

Which bucket must cors be enabled on to allow the resource to be loaded?

A

Bucket B

86
Q

Can you delegate access across accounts from different account partitions?

A

No

87
Q

You have two policies on a user - one allowing access the other denying? What is the result?

A

Access is denied.

88
Q

What is SAML?

A

Cognito can be used with SAML to configure an identity pool that can define the role assumed by the user.

89
Q

What encryption method will get rejected if it is not using HTTPS?

A

SSE-C Because it requires the customer to send the key with the request which will be considered compromised over HTTP

90
Q

What is the x-amz-server-side-encryption header for sse-kms and sse-s3?

A

sse-s3 is ‘AES256’

SSE-KMS is ‘aws:kms’

91
Q

How is aws CodeCommit encrypted?

A

With aws kms on the backend

AWS Certified Developer (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions