Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Cloud Architect > Module 9: Securing application, user and data access > Flashcards

Module 9: Securing application, user and data access Flashcards

1
Q

Why is it difficult to manage users when assigning individual rights ?

A

Each change, team growth, new access, policy… needs to be manually updated by an admin.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What mechanism makes it easier to manage users?

A

Create groups based on job function.The policy is attached to the group not the user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Can a user belong to multiple groups ?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Can a group belong to another group ?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How can group be granted permissions ?

A

By using access control policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Groups do not have security credentials and cannot access web services directly. They exist solely to make it easier to manage user permissions.
TRUE or FALSE ?

A

TRUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What take precedence if two rules conflict ?

A

The most restrictive rule takes precedence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What does it mean if i see the term RBAC in the context of managing permissions ?

A

Role-Based Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the role based access control?

A

Create a policy and attach it to an entity (user group or role). Traditionally permissions are defined based on job function.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What does it mean if I see ABAC in the context of managing permissions

A

Attribute Based permissions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are attribute based permissions ?

A

Permissions based on attributes (key-value paris called tags).
More flexible than policies, allows to manage granular permissions, highly scalable and fully auditable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the pre-requisite of a clean ABAC ?

A

Correct Tagging

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is an identity federation ?

A

An agreement between a Service provider and an identity provider. (Like connect with facebook, or connect with apple)
IdP is identity provider, SP is the service provider.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are AWS service supporting identity federation

A

AWS IAM
Aws IAM Identity center
AWS Security Token Services
Amazon Cognito

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is IAM Identity center ?

A

A service to create or connect identities and manage access centrally

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is AWS Security Token Service?

A

It’s a web service to request temporary limited priviledge credentials. Can be used by users or applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is AWS Organizations?

A

A service that helps you centrally manage and govern multiple AWS accounts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is a Service Control Policy (SCP)?

A

SCPs allow administrators to control permissions for accounts in an AWS Organization, applying restrictions across accounts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How can AWS SSO simplify access management across multiple accounts?

A

WS SSO (Single Sign-On) enables users to log in once and gain access to all assigned accounts and applications without needing multiple credentials.

20
Q

What is a primary advantage of using AWS Control Tower?

A

It automates the setup of a multi-account environment following AWS best practices.

21
Q

How does IAM role switching work in a multi-account setup?

A

Users in one AWS account assume a role in another account to gain temporary, limited access without creating additional IAM users.

22
Q

What is the purpose of tagging AWS resources across accounts?

A

ags help track resource usage, apply policies, and simplify management across accounts

23
Q

Why is it important to use separate accounts for different environments (e.g., dev, test, prod)?

A

To enforce isolation and reduce the risk of unintended impacts across environments

24
Q

What feature of AWS Organizations ensures billing is centralized?

A

Consolidated billing aggregates costs across accounts, simplifying billing and enabling volume discounts.

25
Q

Can SCPs grant permissions?

A

No, SCPs only restrict permissions; they cannot grant permissions beyond what IAM allows.

26
Q

What is the benefit of enabling AWS CloudTrail across all accounts?

A

Ensures centralized logging of API activities for security and compliance monitoring.

27
Q

What service can be used to manage encryption keys in AWS?

A

AWS Key Management Service (KMS).

28
Q

What is server-side encryption (SSE)?

A

Encryption that AWS performs on your behalf when storing data in services like S3, RDS, or EBS.

29
Q

What is the difference between SSE-S3, SSE-KMS, and SSE-C?

A

SSE-S3: Managed by AWS with default keys.
SSE-KMS: Uses customer-managed keys via AWS KMS.
SSE-C: Customer provides and manages encryption keys.

30
Q

How does client-side encryption differ from server-side encryption?

A

Data is encrypted by the client before being sent to AWS, ensuring AWS only stores encrypted data.

31
Q

What is an AWS CMK?

A

Customer Master Key used in KMS to encrypt and decrypt data securely.

32
Q

How can you ensure encryption at rest for S3 objects?

A

By enabling default encryption at the bucket level or applying encryption settings to individual objects.

33
Q

What AWS service automatically encrypts data stored in a database?

A

Amazon RDS can automatically encrypt databases using KMS keys.

34
Q

How is EBS volume encryption enabled?

A

By enabling encryption when creating a volume or enforcing it using an account-level default.

35
Q

What is envelope encryption?

A

Encrypting data keys with a master key (like KMS CMK), which in turn encrypts the actual data.

36
Q

Can you encrypt data in transit and at rest simultaneously?

A

Yes, by using TLS for in-transit encryption and KMS or server-side encryption for data at rest.

37
Q

What is the purpose of AWS Identity and Access Management (IAM)?

A

To control access to AWS resources securely by defining policies and roles.

38
Q

What does Amazon Cognito provide for application developers?

A

User authentication, authorization, and user pool management for web and mobile apps.

39
Q

What is AWS WAF and its use case?

A

AWS Web Application Firewall protects web applications from common exploits like SQL injection and cross-site scripting.

40
Q

How does AWS Shield enhance security?

A

AWS Shield provides DDoS protection for applications running on AWS.

41
Q

What does AWS Secrets Manager manage?

A

Storage, retrieval, and rotation of sensitive information like database credentials and API keys.

42
Q

What is the use of AWS Certificate Manager (ACM)?

A

Simplifies provisioning, managing, and deploying SSL/TLS certificates for secure communications.

43
Q

How does Amazon Macie protect sensitive data?

A

By using machine learning to discover, classify, and protect sensitive data like PII stored in S3.

44
Q

What is AWS Config used for in security?

A

Ensures resource configurations comply with governance and compliance rules

45
Q

How does AWS CloudTrail improve application security?

A

By logging all API requests, enabling audit trails for activity analysis.

46
Q

What AWS service can manage permissions boundaries?

A

IAM allows setting permissions boundaries to restrict the maximum permissions a role or user can have.

AWS Cloud Architect (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions