Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS - Solutions Architect > IAM & Organizations > Flashcards

IAM & Organizations Flashcards

1
Q

What does IAM stand for?

A

IAM just stands for identity access management and essentially it allows you to manage users and their level of access to the AWS console.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the root account?

A

Well, this is just the email address you use to sign up for AWS. So the root account has full administrative access to AWS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

If you’re asked in the exam how to go ahead and secure the root account?

A

Always remember to turn on multi-factor authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a best practice for assign user permissions?

A

To inherit permissions through groups.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the principle of least privilege?

A

This is where you only assign a user the minimum amount of privileges they need to do their job.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

If you ever see a scenario question where it talks about making your username and password the same as when you log in the morning to your AWS account, what is that called?

A

That’s called federation–Active Directory Federation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

True/False. IAM is universal and does not apply to regions.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are default user permissions?

A

Users do not have any permissions when their accounts are created.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is programmatic access?

A

Access key ID and secret access keys are used for programmatic access to the AWS console. You only get the view this information once and it is during creation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a best practice for IAM user accounts?

A

Enabling MFA and enabling a password rotation policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What type of identity objects can be created in IAM?

A

IAM lets us create 3 different types of identity objects:
Users, Groups,Roles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are Users?

A

Identities which represent humans or applications that need access to our account.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are Groups?

A

Collection of related users e.g. development team, finance, or HR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are Roles?

A

Can be used by AWS services, or for granting external access to our account.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How many access keys can a user have?

A

0-2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are ARNs?

A

Amazon Resource Names. ARNs uniquely identify AWS resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Why do we use ARNs?

A

They are used when it’s necessary to unambiguously identify a resource across all of AWS such as in IAM policies, Amazon Relational Database Service (Amazon RDS) tags, and API calls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the format of an ARN?

A

arn:partition:service:region:account-id:resource-id

arn:partition:service:region:account-id:resource-type/resource-id

arn:partition:service:region:account-id:resource-type:resource-id

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the components of an ARN?

A

Partition
Service
Region
Account-id
Resource-type
Resource-id

20
Q

What is an ARN Partition?

A

A partition is a group of AWS Regions. Each AWS account is scoped to one partition.

21
Q

What is an ARN Service?

A

The service namespace that identifies the AWS product.

22
Q

What is an ARN Region?

A

The Region code, us-east-2 for example.

23
Q

What is an ARN Account ID?

A

The name of the AWS account that owns the resource (minus any hyphens).

24
Q

What is an ARN Resource Type?

A

The type of resource such as vpc for a virtual private cloud (VPC).

25
Q

What is an ARN Resource ID?

A

The resource identifier. This could be the name, ID, or resource path.

26
Q

What is AWS CloudTrail?

A

AWS CloudTrail monitors and records account activity across our AWS infrastructure.

This can help us to detect developer misconfigurations and malicious actors.

27
Q

What does CloudTrail log?

A

Where – Source IP Address
When – EventTime
Who – User, UserAgent
What – Region, Resource, Action

28
Q

True/False. It’s important to note that CloudTrail is a real-time service.

A

False. It’s important to note that CloudTrail is NOT a real-time service. It often takes several minutes for account activity to appear in CloudTrail.

29
Q

What is the max number of IAM Groups a User can have?

A

Users can be members of up to 10 IAM Groups.

30
Q

What is the hardlimit for the max number of users in a Group?

A

There isn’t a hard limit for the number of users in a particular group (except indirectly a limit of 5,000 because of 5,000 being the maximum number of IAM users in a single AWS account).

31
Q

How many Groups can an AWS Account have?

A

An account can have up to 300 groups (though this number can sometimes be increased by contacting AWS support).

32
Q

True/False. Groups can be nested.

A

False. Groups cannot be nested.

33
Q

How many types of policies can be attached to an IAM role?

A

Trust Policy — Controls which identities can assume that role.
Permissions Policy — Controls which actions and resources the role can use.

34
Q

What is an IAM Policy?

A

A policy is an object in AWS that can be associated with an identity or resource to define their permissions.

35
Q

What is an Identity-based policy in IAM?

A

Identity-based policies are attached to an IAM user, group, or role. These policies let you specify what that identity can do (its permissions).

36
Q

How can Policies be created?

A

Policies can be be specified using policy documents created using JSON.

37
Q

True/False. It’s important to note that the precedence for permissions is deny-allow-deny.

A

True. This precedence is important for when permission effects clash.

For example, if an explicit deny clashes with an explicit allow, the deny will take precedence.

If an explicit allow clashes with an implicit deny, however, then the allow would take precendence.

38
Q

True/False. When setting permissions for identities in AWS we can use AWS managed policies, customer managed policies, or inline policies.

A

True.

39
Q

What is an AWS Managed Policy?

A

An AWS managed policy is a standalone policy that is created and administered by AWS.

In this context, standalone policy means that the policy has its own Amazon Resource Name (ARN) that includes the policy name.

40
Q

What is the benefit of AWS managed policies? What is a downside?

A

The benefit of AWS managed policies is that they are designed to provide permissions for many common use cases.

The downside is that they cannot be customized.

41
Q

What are Customer Managed Policies?

A

Standalone policies that you administer in your own AWS account are referred to as customer managed policies.

By attaching the policy to an entity, we give that entity the permissions that are defined in the policy.

42
Q

What are Inline Policies?

A

Inline policies are policies that are embedded in an IAM identity.

43
Q

What is an AWS Organization?

A

AWS Organizations is a global service that allows us to manage multiple AWS accounts.

44
Q

What is the main benefit of using AWS Organizations?

A

The main benefit of using AWS Organizations is that it offers consolidated billing and we can enjoy price benefits from aggregated usage (volume discounts).

45
Q

What are Organization Units?

A

Organization Units are a group of AWS accounts within an organization. One Organization Unit can contain other Organizations Units — thus creating a hierarchy.

46
Q

What are SCPs?

A

Service Control Policies (SCPs) are a type of policy used inside of organizations to manage permissions in one’s organization. Permissions aren’t actually granted by SCPs. What SCPs offer instead is a type of guardrail on the actions that an account’s administrator can delegate to IAM users and roles inside of the affected accounts.

47
Q

True/False. In essence, what an account is actually able to do is the intersection between what is allowed by the SCP and what is allowed by the IAM/resource-based policies.

A

True.

AWS - Solutions Architect (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions