Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

.๐’œ๐’ฒ๐’ฎ ๐’ž๐‘’๐“‡๐“‰๐’พ๐’ป๐’พ๐‘’๐’น ๐’Ÿ๐‘’๐“‹๐‘’๐“๐‘œ๐“…๐‘’๐“‡ > Section 18: AWS Security & Encryption: KMS, Encryption SDK, SSM Parameter Store, IAM & STS > Flashcards

Section 18: AWS Security & Encryption: KMS, Encryption SDK, SSM Parameter Store, IAM & STS Flashcards

1
Q

What is encryption in flight?

A

Encryption where data is encrypted before sending and decrypted after receiving

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is necessary for encryption in fligth?

A

An HTTPS endpoint (SSL Certificate)

SSL Encryption / Decryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What does encryption in flight prevents?

A

MITM attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What does MITM stand for?

A

Man In The Middle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

When and where is data encrypted when using server side encryption at rest?

A

Data is encrypted after being received by the server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

When using SSE, data is _____ before being sent.

A

decrypted

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the necessary thing that allows the server to encrypt data?

A

A key (usually a data key)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Who is responsible for the management of encryption keys?

A

You decide, usually a key management service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

When and where is data encrypted when using client side encryption?

A

Data is encrypted by the client before being sent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

When using client side encryption, does the server ever decrypt the data?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

When using client side encryption, where will the data be decrypted?

A

By a receiving client

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What approach/process can you utilize to encrypt large data client side?

A

Envelope Encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the result of data encryption?

A

Cyphertext

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is cyphertext?

A

Ciphertext is encrypted text transformed from plaintext using an encryption algorithm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How to go from cyphertext to plaintext?

A

Convert cyphertext to plaintext by decrypting it with a key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What does AWS KMS stand for?

A

AWS Key Management Service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What does AWS KMS make easy to do?

A

Create and manage cryptographic keys and control their usage across a wide range of AWS services and in your own applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is AWS KMS integrated with for authorization?

A

IAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the maximum amount of data that KMS can encrypt?

A

4 KB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What can you do if you need to encrypt more than 4 KB of data?

A

Use envelope encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What do you need to do to give access to a key stored in KMS to someone?

A

Make sure the Key Policy allows the user

Make sure the IAM Policy allows the API calls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What can you use to audit key usage?

A

CloudTrail

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the three types of Customer Master Keys available in KMS?

A

AWS Managed Service Default CMK
User Keys created in KMS
User Keys imported

24
Q

What is the cost of User Keys created in KMS?

A

1$/month

25
Q

What is the cost of User Keys imported in KMS?

A

1$/month

26
Q

What must imported keys be?

A

Must be 256-bit symmetric keys

27
Q

How much $ does KMS charge for API calls?

A

0.03$ / 10 000 calls

28
Q

What does KMS do first when receving Encrypt and Decrypt API calls?

A

Check IAM permissions

29
Q

What SDK helps us using the Envelope Encryption?

A

AWS Encryption SDK

30
Q

What API do we first need to call when we want to encrypt data using the envelope encryption process?

A

GenerateDataKey API

31
Q

What does the GenerateDataKey API returns us?

A

Plaintext data key and

Encrypted data key

32
Q

What should we do with the plaintext data key received from the GenerateDataKey API?

A

Encrypt our data client side and then discard the plain text data key right away

33
Q

What does DEK stand for?

A

Data Encryption Key

34
Q

What should we do first when we receive an envelope data?

A

Call the Decrypt API with the encrypted DEK

35
Q

What does the Decrypt API returns us when we pass it an encrypted key?

A

The plaintext DEK which has been decrypted using CMK

36
Q

What should we do first when we receive the plaintext DEK after calling the Decrypt API?

A

Client side decryption using the plaintext DEK

37
Q

What is the AWS Parameter Store?

A

Secure storage for configuration and secrets

38
Q

What does the Parameter Store leverages for secrets?

A

Seamless Encryption using KMS

39
Q

What does SSM provide for posterity?

A

Version tracking

40
Q

What are the two API that allows us to retrieve configurations/secret from SSM?

A

GetParameters

GetParametersByPath

41
Q

What does GetParametersByPath API returns us?

A

All the parameters within a certain path, for example:

/my-app/dev/

could return us

/my-app/dev/db-url
/my-app/dev/db-password

42
Q

What the main benefit of using AWS SSM?

A

Capability of rotation of secrets every X days

43
Q

Is it okay to grant a policy with โ€œ * โ€œ access to a service?

A

NO!

44
Q

What is the best practice for on premise server to get AWS credentials?

A

Call STS to obtain temporary security credentials

45
Q

Should ECS Tasks have their own role?

A

YES

46
Q

What environment variable should you use to tell ECS that a Task has its own role?

A

ECS_ENABLE_TASK_IAM_ROLE=true

47
Q

How should you go about creating a role for an AWS service?

A

Create the role and assign least-privileged permissions (policies)

48
Q

What is the best practice for providing cross account access?

A

Define an IAM Role for another account to access
Define which AWS accounts can access this IAM Role
Use AWS STS to retrieve credentials and impersonate the IAM role you have access to

49
Q

What is the API to use to retrieve credentials and impersonate an IAM Role?

A

AssumeRole API

50
Q

What are the available durations for temporary credentials to stay enabled?

A

15 minutes to 1 hour

51
Q

What are the three steps of the IAM authorization model?

A
  1. If there is an explicit DENY, then DENY
  2. If there is an explicit ALLOW, then ALLOW
  3. Else DENY
52
Q

How are IAM Policies and S3 Bucket Policies evaluated when user tries an action on bucket?

A

The UNION of IAM Policies and S3 Bucket Policies will be evaluated

53
Q

What are dynamic Policies with IAM?

A

Policies which utilises Policy variables

54
Q

How would you assign each user of your organization a โ€œfolderโ€ in a common S3 bucket?

A

By creating a dynamic policy with the ${aws:username} variable to define which S3 โ€œfolderโ€ a user can access?

55
Q

What should dynamic policies affecting multiple users be assigned to?

A

Groups

56
Q

What are the three types of Policies in AWS IAM?

A

AWS Managed Policies
Customer Managed Policies
Inline Policies

57
Q

What is the preferred type of Policy to follow best practices?

A

Customer Managed Policy

.๐’œ๐’ฒ๐’ฎ ๐’ž๐‘’๐“‡๐“‰๐’พ๐’ป๐’พ๐‘’๐’น ๐’Ÿ๐‘’๐“‹๐‘’๐“๐‘œ๐“…๐‘’๐“‡ (26 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions