Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Spark > KMS > Flashcards

KMS Flashcards

1
Q

What is AWS Key Management Service?

A

AWS KMS is a managed service that makes it easy for you to create and control the customer master keys (CMKs)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are CMKs?

A

Customer Master Keys are encryption keys that are used to encrypt your data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

AWS CMKs are protected by ________

A

Hardware security modules (HSMs)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How to track the use of CMKs for auditing, regulatory and compliance needs?

A

KMS is integrated with CloudTrail to log the use of CMKs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

CloudTrail delivers the log files to ________

A

Amazon S3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is Symmetric CMK?

A

Symmetric CMK represents single 256 bit secret encryption key that never leaves KMS unencrypted. To use symmetric CMK you must call AWS KMS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is Asymmetric CMK?

A

Asymmetric CMK represents mathematically related public key and private key pair, where the private key never leaves AWS KMS unencrypted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Where can Asymmetric CMKs be used?

A

Asymmetric CMKs can be used for encryption/decryption or signing/verification but not for both.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How is the asymmetric key used?

A

You can use public key within AWS KMS by calling AWS KMS API operations or download public key and use it outside of AWS KMS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is Symmetric Data key?

A

Symmetric data key is a symmetric encryption key that is used to encrypt data outside of KMS. The Symmetric data key is protected by Symmetric CMK in AWS KMS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is Asymmetric Data key?

A

An asymmetric data key is an RSA or elliptic curve (ecc) key pair that consists of public key and private key where the private key is protected by symmetric CMK in AWS KMS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is AWS recommendation for using RSA and Elliptical Curve key usages?

A

AWS KMS recommends to use Elliptical Curve (ECC) keys for signing and use RSA keys for encryption and decryption, but not both. However AWS KMS cannot enforce restrictions on the use of data key pairs outside of AWS KMS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

When you create a Customer Master Key in KMS, by default you get a _________

A

Symmetric CMK

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Symmetric keys are used in _________ encryption

A

Symmetric, which means the same key is used for encryption and decryption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

___________ keys are good choice? (Symm/Asymm)

A

Symmetric

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

AWS Services that are integrated with KMS use ________ CMKs and does not support encryption with _________ CMKs

A

Symmetric; Asymmetric

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

If your case requires encryption outside of AWS, by users that cannot access KMS, ___________ keys are good choice.

A

Asymmetric CMKs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

If you are creating a CMK to encrypt the data stored and managed in AWS, use ______________ key.

A

Symmetric CMKs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the Asymmetric keys that KMS support?

A
  1. RSA CMKs

2. Elliptic Curve (ECC) CMKs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are RSA CMKs

A

A CMK with RSA is used for for encryption and decryption or signing and verification (but not both). AWS KMS supports several key lengths for different security requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is Elliptic Curve (ECC) CMK?

A

A CMK with an elliptic curve key pair for signing and verification. AWS KMS supports several commonly-used curves.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

The type of CMK that you create depends largely on ____________

A

how you plan to use the CMK, your security requirements, and your authorization requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Use a ___________ for most use cases that require encrypting and decrypting data.

A

symmetric CMK

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

The symmetric encryption algorithm that AWS KMS uses is __________

A

fast, efficient, and assures the confidentiality and authenticity of data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Symmetric Key supports authenticated encryption with ______________

A

additional authenticated data (AAD)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

If your use case requires encryption outside of AWS by users who cannot call AWS KMS, __________ are a good choice.

A

asymmetric CMKs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

To sign messages and verify signatures, you must use an_________

A

asymmetric CMK.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

To perform public key encryption, you must use ___________;
__________key specs cannot be used for public key encryption.

A

asymmetric CMK with an RSA key spec; Elliptic curve (ECC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

The Decrypt operation fails if the data was encrypted under a public key from a CMK with a key usage of ________

A

SIGN_VERIFY.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

_______ CMKs only support encryption and decryption.

A

Symmetric

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

AWS KMS does not store, manage, or track your _____ keys.

A

data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

By default, ______ creates the key material for a CMK

A

AWS KMS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

How to extract, export, view, or manage/delete the key material that is generated by AWS KMS

A

You cannot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

You can create the key material for a CMK in the ________ associated with an ________

A

AWS CloudHSM cluster; AWS KMS custom key store.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

_______ let you encrypt data in one AWS Region and decrypt it in a different AWS Region.

A

multi-Region CMKs,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

the CMK includes metadata, such as its _________

A

key ID, creation date, description, and key state.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

AWS KMS supports three types of CMKs:

A
  1. Customer Managed CMKs
  2. AWS Managed CMKs
  3. AWS Owned CMKs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What are Customer managed CMKs

A

Customer managed CMKs are CMKs in your AWS account that you create, own, and manage. You have full control over these CMKs,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What are AWS managed CMKs

A

AWS managed CMKs are CMKs in your account that are created, managed, and used on your behalf by an AWS service that is integrated with AWS KMS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What are AWS owned CMK

A

AWS owned CMKs are a collection of CMKs that an AWS service owns and manages for use in multiple AWS accounts. Although AWS owned CMKs are not in your AWS account, an AWS service can use its AWS owned CMKs to protect the resources in your account.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

You can use_________ to generate, encrypt, and decrypt data keys.

A

symmetric customer master keys (CMKs)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

You must use and manage ______ keys outside of AWS KMS.

A

data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

AWS KMS cannot use a ________ key to encrypt data

A

data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

_______ are asymmetric data keys that consist of a mathematically-related public key and private key.

A

Data key pairs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

_________ are designed to be used for client-side encryption and decryption, or signing and verification outside of AWS KMS.

A

Data Key Pairs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

To generate a cryptographic signature for a message, use the ______ key in the data key pair. Anyone with the _____ key can use it to verify that the message was signed with your private key and that it has not changed since it was signed.

A

private; public

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What is a custom key store?

A

A custom key store is an AWS KMS resource that is associated with hardware security modules (HSMs) in a AWS CloudHSM cluster that you own and manage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

How do you create and manage CMKs in HSMs

A

When you create an AWS KMS customer master key (CMK) in your custom key store, AWS KMS generates a 256-bit, persistent, non-exportable Advanced Encryption Standard (AES) symmetric key in the associated AWS CloudHSM cluster. This key material never leaves your HSMs unencrypted. When you use a CMK in a custom key store, the cryptographic operations are performed in the HSMs in the cluster.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

___________ act as names for your AWS KMS customer master keys (CMKs).

A

Key identifiers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What are the types of Key identifiers?

A
  1. Key ARN
  2. Key ID
  3. Alias ARN
  4. Alias Name
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What is Key Material?

A

Key material is the secret string of bits used in a cryptographic algorithm.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

If you use AWS KMS key material, you can enable _________ of your key material.

A

automatic rotation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

y default, each CMK has _________ key material.However, you can create a set of _________with the same key material.

A

unique ; multi-Region keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

When you create a CMK with an ______ key material origin, the CMK has no key material. Later, you can import key material into the CMK.

A

External

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

When you use imported key material, you need to ____________

A

secure and manage that key material outside of AWS KMS, including replacing the key material if it expires.

56
Q

The _______ determines whether the CMK is symmetric or asymmetric, the type of key material in the CMK, and the encryption algorithms or signing algorithms you can use with the CMK.

A

key spec

57
Q

_________ is a CMK property that determines whether a CMK is used for encryption and decryption -or- signing and verification. You cannot choose both.

A

Key usage

58
Q

Using a CMK for more than one type of operations makes the product of both operations _________

A

more vulnerable to attack.

59
Q

What is Envelope encryption?

A

When you encrypt your data, your data is protected, but you have to protect your encryption key. One strategy is to encrypt it. Envelope encryption is the practice of encrypting plaintext data with a data key, and then encrypting the data key under another key.

60
Q

The top-level plaintext key encryption key is known as the ___________

A

master key.

61
Q

Master keys stored in AWS KMS, _____________

A

Customer master keys (CMKs)

62
Q

How to encrypt the same data under multiple master keys

A

Envelope Encryption

63
Q

How to combine the strengths of multiple algorithms?

A

Envelope Encryption

64
Q

All AWS KMS cryptographic operations with symmetric CMKs accept an ___________

A

encryption context

65
Q

What is Encryption Context?

A

An optional set of key–value pairs that can contain additional contextual information about the data.

66
Q

WS KMS uses the encryption context as ____________ to support authenticated encryption.

A

additional authenticated data (AAD)

67
Q

You cannot specify an encryption context in a cryptographic operation with an ________ CMK.

A

asymmetric

68
Q

When you create a CMK, you determine who can use and manage that CMK. These permissions are contained in a document called the _______

A

Key Policy

69
Q

You cannot edit the key policy for an ___________

A

AWS managed CMK.

70
Q

What is a grant?

A

A grant is a policy instrument that allows AWS principals to use AWS KMS customer master keys (CMKs) in cryptographic operations.

71
Q

hen authorizing access to a CMK, grants are considered along with __________

A

key policies and IAM policies.

72
Q

Grants are often used for _______ permissions

A

temporary; because you can create one, use its permissions, and delete it without changing your key policies or IAM policies.

73
Q

The primary way to manage access to your AWS KMS CMKs is with __________

A

policies

74
Q

In AWS KMS, you must attach _________ to your customer master keys (CMKs). These are called __________

A

resource-based policies ; key policies.

75
Q

You can control access to your CMKs in these ways:

A
  1. Use the key policy
  2. Use IAM policies in combination with the key policy
  3. Use grants in combination with the key policy
76
Q

A policy is a document that describes a set of permissions. The following are the basic elements of a policy.

A
  1. Resource
  2. Action
  3. Effect
  4. Principal
77
Q

In a key policy, you use _________, which effectively means “this CMK.”

A

“*” for the resource

78
Q

A key policy applies _____________

A

only to the CMK it is attached to.

79
Q

What is Condition Key

A

Another policy element called a condition key to specify the circumstances in which a policy takes effect.

80
Q

To support attribute-based access control (ABAC), AWS KMS provides______ that control access to a customer master key (CMK) based on its ________

A

condition keys; tags and aliases

81
Q

The default key policy (SDK, API, CLI) has one policy statement that gives the _________ full access to the CMK and ________ in the account to allow access to the CMK.

A

AWS account (root user) that owns the CMK; enables IAM policies

82
Q

You can use IAM policies, along with _______________, to control access to your customer master keys (CMKs) in AWS KMS.

A

key policies, grants, and VPC endpoint policies

83
Q

To use an IAM policy to control access to a CMK,_______ must give the account permission to use IAM policies

A

the key policy for the CMK

84
Q

All CMKs must have a ___ policy. ____ policies are optional.

A

key ; IAM

85
Q

How to control access to multiple CMKs and provide permissions for the operations of several related AWS services.

A

IAM policies

86
Q

_______ can create CMKs, use and manage the CMKs they create, and view all CMKs and IAM identities.

A

Power users

87
Q

You can use an _________ to give IAM principals in your account the permissions of a power user.

A

AWS managed policy

88
Q

Key administrators who don’t have permission to change key policies or create grants can control access to CMKs if they have permission to __________

A

manage tags or aliases.

89
Q

What are global keys?

A

AWS defines global condition keys, a set of policy conditions keys for all AWS services that use IAM for access control.

90
Q

. You can use global condition keys in AWS KMS _________

A

key policies and IAM policies.

91
Q

Grants are commonly used by AWS services that integrate with AWS KMS to __________

A

encrypt your data at rest.

92
Q

How is a grant created and deleted?

A

The service creates a grant on behalf of a user in the account, uses its permissions, and retires the grant as soon as its task is complete.

93
Q

Each grant controls access to _______. The CMK_____________account.

A

just one CMK; can be in the same or a different AWS

94
Q

Number of grants on each CMK

A

50000

95
Q

You can use a grant to ____access and not ______

A

allow; deny

96
Q

To bypass eventual consistency and use the grant immediately, use ________. It is not used after it is consistent

A

Grant token

97
Q

You can use ______ to allow principals in a different AWS account to use a CMK.

A

grants

98
Q

Grants for symmetric CMKs cannot allow ___________

A

the Sign, Verify, or GetPublicKey operations

99
Q

Grants for asymmetric CMKs cannot allow _________

A
  1. operations that generate data keys or data key pairs
  2. operations related to automatic key rotation,
  3. operations related to imported key material
  4. operations related to CMKs in custom key stores.
100
Q

What is a Grant constraint?

A

A condition that limits the permissions in the grant. Currently, AWS KMS supports grant constraints based on the encryption context in the request for a cryptographic operation.

101
Q

What is Grant ID?

A

The unique identifier of a grant for a CMK.

102
Q

What is grant token

A

A grant token is unique, non-secret, variable-length, base64-encoded string that represents a grant.

103
Q

What is Grantee principal?

A

The identity that gets the permissions specified in the grant.

104
Q

A grant must have _____ principal/s

A

atleast one

105
Q

Grantee principal can be

A

User (including federated) or role

106
Q

What does retire a grant mean?

A

It mean to terminate a grant.

107
Q

What is a retiree principal?

A

Principal who can retire a grant.

108
Q

What is revoke a grant

A

‘Key Administrator’ terminating a grant.

109
Q

Each set of related multi-Region keys has the same ____________, so you can encrypt data in one AWS Region and decrypt it in a different AWS Region without re-encrypting or making a cross-Region call to AWS KMS.

A

key material and key ID

110
Q

You must manage each multi-Region key _________, including creating aliases and tags, setting their key policies and grants, and enabling and disabling them selectively. (independently/Dependently)

A

independently

111
Q

Multi-Region keys are ______(global/not global)

A

not global

112
Q

You ______ convert an existing single-Region key to a multi-Region key (can/cannot )

A

cannot

113
Q

When you replicate, AWS KMS creates a ________ in the specified Region with the _____________

A

replica key ; same key ID and other shared properties as the primary key.

114
Q

Related multi-region key ARNs (Amazon Resource Names) differ only in the __________

A

Region field

115
Q

Additional considerations for multi-Region keys include

A
  1. Synchronizing shared properties
  2. Changing the primary key
  3. Deleting multi-Region keys
116
Q

For multi-region keys, You can enable and disable automatic key rotation only on a __________

A

primary key.

117
Q

You ______ a replica key even if its primary key and all related replica keys are disabled.(can use/ cannot use)

A

can use

118
Q

The following are the shared properties of multi-Region keys.

A 
1. Key ID
2, Key Material
3. Key Origin
4. Key Spec
5. Key Usage
6. Automatic Key rotation
119
Q

Because it is destructive and potentially dangerous to delete a CMK, AWS KMS requires you to set a waiting period of _______. The default waiting period is _______

A

7 – 30 days; 30 days.

120
Q

Also, you cannot enable ______ for a CMK with imported key material. However, you can ________ a CMK with imported key material.

A

automatic key rotation ; manually rotate

121
Q

AWS KMS supports custom key stores backed by __________

A

AWS CloudHSM clusters.

122
Q

When you create an AWS KMS customer master key (CMK) in a custom key store, _______ generates and stores _______ key material for the CMK in__________ that you own and manage.

A

AWS KMS; non-extractable; an AWS CloudHSM cluster

123
Q

When you use a CMK in a custom key store, the cryptographic operations are performed in the_________

A

HSMs in the cluster.

124
Q

You might consider creating a custom key store if your organization has any of the following requirements:

A
  1. Key material cannot be stored in a shared environment.
  2. Key material must be subject to a secondary, independent audit path.
  3. The HSMs that generate and store key material must be certified at FIPS 140-2 Level 3.
125
Q

When you create customer master keys (CMKs) in an AWS KMS custom key store, you view and manage the CMKs in _________

A

AWS KMS and AWS CloudHSM

126
Q

You can create ________ CMKs with key material generated by AWS KMS in your custom key store. (asymmetric /symmetric )

A

symmetric

127
Q

While the custom key store is disconnected, ______ cannot access it, and users cannot use the CMKs in the custom key store for cryptographic operations.

A

AWS KMS

128
Q

AWS KMS does not support the following AWS KMS features in custom key stores.

A
  1. Asymmetric keys
  2. Asymmetric Data keys pairs
  3. Imported key material in CMKs
  4. Automatic Key rotation
  5. Multi-region keys
129
Q

A _______ is a secure location for storing cryptographic keys.

A

key store

130
Q

The default key store in ________

A

AWS KMS

131
Q

When you create an AWS KMS CMK in your custom key store, AWS KMS generates a ________key in the associated AWS CloudHSM cluster. T

A

256-bit, persistent, non-exportable Advanced Encryption Standard (AES) symmetric

132
Q

Every AWS KMS custom key store is associated with _________

A

one AWS CloudHSM cluster.

133
Q

Each AWS CloudHSM cluster can be associated with ___________ custom key store/s

A

only one custom key store.

134
Q

The HSM cluster must be initialized and active, and it must be in the same AWS account and Region as the __________

A

AWS KMS custom key store.

135
Q

To create CMKs in the custom key store, its associated cluster it must contain at least _____ HSMs. All other operations require ____ HSMs.

A

two active; only one

136
Q

You specify the cluster when you create the custom key store, and you ________ change it. (can/cannot). However, you can substitute any cluster that shares a
____________ with the original cluster.

A

cannot; backup history

Spark (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions