Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

ag-AWS S3 - SAA-C02 > KMS > Flashcards

KMS Flashcards

1
Q

What type of service is KMS? (regional, AZ, global)

A

Regional

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Is KMS private or public?

A

KMS is a public service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Where can KMS be accessed from?

A

Anywhere, it resides in the AWS public zone.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the main operations that KMS can perform?

A

Create, store and manage keys.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Can KMS handle both, symmetric and asymmetric keys?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Can keys leave KMS?

A

Never

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What US security standard is KMS compliant to?

A

FIPS 140-2 (L2). Some features complaint to L3.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a CMK?

A

It is a customer master key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is CMK used for?

A

Cryptographic operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is max data that a CMK can encrypt/decrypt?

A

4KB of data in size

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the attributes of a CMK?

A

Key ID, key policy, description, state and creation date.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a DEK?

A

Data encryption keys are keys generated by KMS from a CMK to encrypt data larger than 4 KB in size.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Is the use of CMKs tracked? And DEKs?

A

CMKs yes, DEKs no.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Are DEKs stored in KMS?

A

No, they are discarded one provided to a service or user.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is used to decrypt a DEK?

A

The same CMK that was used to create him

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

DEK - architecture encryption

A
  1. DEK is generated
  2. Data is ecrypted with plaintext version of the DEK
  3. Plaintext version of the DEK is discarded.
  4. Encrypted DEK is stored with encrypted data.
17
Q

DEK - architecture decryption

A
  1. The encrypted DEK is provided to KMS
  2. KMS returns the decrypted version of the DEK
  3. You can use the plaintext version of the DEK to decrypt the data.
18
Q

Can you extract a CMK?

A

No, CMKs never leave KMS in the region they are stored in.

19
Q

How are all the interactions with CMK done?

A

Via the KMS API

20
Q

Who can create AWS managed CMKs?

A

Only AWS creates them automatically when a service needs to use KMS

21
Q

Who creates customer managed CMKs?

A

A customer, they are created explicitly.

22
Q

Can you edit the Key policy of a CMK?

A

Only for Customer managed CMKs.

23
Q

What is the only type of CKM that allows you to modify its key policy?

A

Customer managed CMKs.

24
Q

Which CMKs can be used to allow other AWS accounts access to CMK to perform operations?

A

Customer managed CMKs.

25
Q

How often are AWS managed CMKs rotated?

A

every 1095 days (3 years)

26
Q

Are AWS managed CMKs rotated by default?

A

Yes.

27
Q

Do Customer managed CMKs rotate by default?

A

No, but if enabled they rotate every year.

28
Q

What is the content of CMKs?

A

Current backing key.

Previous backing keys (result of rotation)

29
Q

Are you allowed to create aliases for KMS keys?

A

Yes

30
Q

What are the geographical limitations of KMS key aliases?

A

Each alias is created in a region. There could be multiple regions using the same alias but the keys would be different.

31
Q

What are key policies?

A

They are a kind of resource policy that is attached to CMKs.

32
Q

How many key policies can a CMK have?

A

only one

33
Q

What is one of the most important thing to consider about key policies and permissions?

A

KMS has to be explicitly told that keys trust the AWS account that they are in.

34
Q

Describe how can an IAM user have permissions to interact with a KMS key?

A

You always need a key policy in place so the key trusts the account and so that the account can manage it by applying IAM permission policies to IAM users in that account.

Key -> account –> IAM –> IAM users.

ag-AWS S3 - SAA-C02 (12 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions