Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS CSA Associate Level > IAM > Flashcards

IAM Flashcards

1
Q

What does IAM stand for?

A

Identity Access Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Is IAM a global service?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How is the root account created? Should it be used or shared?

A

The root account is created by default. It should NEVER be used or shared.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are users?

A

End users within an organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are groups?

A

Groups are a collection of users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Can groups contain other groups?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Do users have to belong to a group?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

True/False: Users can only belong in one group

A

False, users can belong to multiple groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are IAM policies?

A

IAM policies define permissions for an action regardless of the method that you use to perform the operation. For example, if a policy allows the GetUser action, then a user with that policy can get user information from the AWS Management Console, the AWS CLI, or the AWS API.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Who can be assigned JSON documents aka ‘policies’?

A

Users and Groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the least privilege principle?

A

Don’t give more permissions than a user needs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What does the IAM policy structure consist of?

A

Version, Id, and Statement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What does the IAM policy statement consist of?

A

Sid, Effect, Principal, Action, Resource, Condition

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

In AWS IAM policy statement, what does Sid stand for and what is it?

A

Sid = Statement ID
Sid is an identifier for the statement. Sid not always present.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

In AWS IAM policy statement, what does the Effect show?

A

the Effect shows whether the statement allows or denies access
(Allow, Deny)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

In AWS IAM policy statement, what does the principal show?

A

the account/user/role to which the policy is applied to

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

In AWS IAM policy statement, what does the resource show?

A

the Resource shows a list of resources to which the actions applied to

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

In AWS IAM policy statement, what does the Condition show?

A

the Condition shows the conditions for when the policy is in effect (optional…not always present in the statement)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are some requirements that you can add when setting up a password policy to create stronger passwords?

A

Set a min password length, require specific character types (i.e upper/lower case, numbers, non-alphanumeric), allow ALL IAM users to change their passwords, set a password expiration & require users to change it, prevent password re-use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What does MFA stand for?

A

Multi-Factor Authentication

21
Q

Why should MFA be implemented?

A

To protect your Root Accounts and IAM users. Users who have access to your account can change configurations and/or delete resources

22
Q

How does MFA work?

A

MFA = password you know + security device you own

23
Q

What is the main benefit of an MFA?

A

If a password is stolen or hacked the account is not compromised

24
Q

What are the types of MFA devices?

A

virtual MFA device, universal 2nd factor (U2F) security key, hardware key fob mfa device, hardware key fob mfa device AWS GovCloud

25
Q

What are 2 types of virtual MFA devices?

A

Google authenticator (phone only) and Authy (mult-device)

26
Q

True/False Virtual MFA devices can support multiple tokens on a single device

A

True

27
Q

What is an example of a Universal 2nd Factor (U2F) Security Key?

A

YubiKey by Yubico (a third party vendor)

28
Q

True/False U2F’s such as YubiKey by Yubico can support multiple root and IAM users using a single security key

A

true

29
Q

What is an example of a hardware key fob mfa device?

A

Gemalto

30
Q

What is an example of a hardware key fob MFA device for AWS GovCloud (US)?

A

SurePassID

31
Q

How many options do you have to access AWS?

A

3

32
Q

How can you access AWS?

A

AWS Management Console (protected by password + MFA), AWS CLI (protected by access keys), AWS Software Developer Kit/SDK (for code: protected by access keys)

33
Q

Where are access keys generated?

A

through the AWS console

34
Q

Who manages users’ access keys?

A

Users manage their own access keys

35
Q

True/False Access keys should be shared

A

False

36
Q

True/False Access Key ID is similar to a username

A

True

37
Q

True/False The secret access key is similar to a password

A

True

38
Q

What is the AWS CLI?

A

a tool that enables you to interact with AWS services using commands in you command-line shell

39
Q

What does AWS Command Line Interface provide?

A

Direct access to the public APIs of AWS services and an alternative to the AWS Management console

40
Q

What is the AWS SDK?

A

AWS Software Development Kit. Enables you to access and manage AWS services programmatically.

41
Q

What does an IAM role do?

A

assign permissions to AWS services to perform actions on your behalf

42
Q

Give examples of common IAM roles?

A

EC2 Instance Roles, Lambda Function Roles, Roles for CloudFormation

43
Q

What are two IAM security tools?

A

IAM Credentials Report (account level), IAM Access Advisor (user level)

44
Q

What does a credential report show?

A

a report that lists all your account’s users and the status of their various credentials

45
Q

What does the IAM access advisor show?

A

the service permissions granted to a user and when those services were last accessed

46
Q

How can IAM access advisor be used?

A

to revise policies

47
Q

What are the AWS IAM best practices?

A

1.) don’t use the root user except for AWS account setup
2.) one physical user = one AWS user
3.) create a strong password policy
4.) use & enforce the use of MFA
5.) create & use roles for giving permissions to AWS services
6.) use access keys for programmatic access (CLI/SDK)
7.) audit permissions of your account with the IAM credentials report
8.) never share IAM users and Access Keys

48
Q

What is a policy?

A

a JSON doc that outlines permissions for users or groups

AWS CSA Associate Level (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions