Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Sysops > Security > Flashcards

Security Flashcards

1
Q

What is the Shared Responsibility Model?

A

AWS is responsible for the infrastructure of the cloud

The customer for everything on the cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

IAM: What is the precedence of a policy item?

A

Per default everything is denied.
Only an explicit allow leads to an allow.
An explicit deny will always deny.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is Amazon Inspector?

A

Automatically assesses applications for vulnerabilities or deviations from best practices.
Gives out a detailed list sorted by severity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How are API calls secured?

A

API calls are signed by the AWS secret access key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How is EBS secured?

A

Access is restricted by the creating IAM account of IAM users with granted access.
EBS volumes are replicated in multiple locations but within the same AZ
Volumes and Snapshots can be encrypted (AES-256)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How does the Elastic LB handle requests?

A

For HTTPS requests the ELB generated short term session key between the server and the browser (using a long term session key)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Cloudfront: Can HTTPS be enforced?

A

Yes, HTTP requests will automatically be redirected

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

S3: What are the four options for data access?

A

IAM Policies
ACLs
Bucket Policies
Query String Authentification order

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

DynamoDB: How are requests secured?

A

The requester needs database and user permissions and every request needs to be signed using HMNAC-SHA-256.

The AWS SDK automatically uses it but HTTP Requests need to contain the signature in the header

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

RDS: How to secure the database?

A 
Access Control
Security Groups
Network isolation
Encryption
Create automatic backups and patches
Multi AZ Deployments
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

SNS: Who initially has access to a topic

A

Only the user who created the topic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

EMR: How are EMR Security Groups created?

A

One group the the master nodes and one for the slaves

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

EMR: Can the data be encrypted?

A

Data needs to be encrypted at rest in S3 and EMR needs a decryption step at the beginning of the process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

IAM: What is the default lifespan of a role?

A

12hrs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

IAM: How is a call with a temp. role structured?

A

The call is signed with the secret key and includes the access key and the security token

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is AWS Cognito?

A

Simplifies the task of authenticating users, storing, managing credentials and sycning data across platforms and devices.
It uses OAuth or OpenID

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are Amazon Workspaces?

A

Managed desktop service.
Connects users with Active Directory credentials via PCoIP to AWS.
The Data is shown via videostream and not with actual transmissions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

How many keys will each AWS Resource integrated with an AWS KMS (Key Management Service) receive by default?

A

1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which of these is the scope of use for an AWS KMS key?

A

All AWS KMS keys are region-specific, they will only work with the AWS Resources of the same region. The AWS KMS key will only be accessible within the region it was created.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

With AWS Trusted Advisor, how many core checks do all customers have access to?

A

All customers have access to 7 core checks with AWS Trusted Advisor. The 7 core checks are assessing S3 Bucket permissions, Security Group - specific ports unrestricted, IAM Use, MFA on the root account, EBS public snapshots, RDS public snapshots, and finally service limit checks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which of these is a required prerequisite to enabling MFA Delete on an S3 Bucket?

A

Versioning must be enabled to enable MFA Delete on an S3 Bucket. Only the root user may use MFA Delete.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Which of the following do WAF rules span?

A

The WAF rules span an AWS Region.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What AWS Service manages temporary credentials of IAM Roles?

A

STS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is an envelope key and which service does use it?

A

It encrypts the encryption key - it is used in SSE-KMS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is the parameter to enforce encryption of S3 PUT requests?

A

x-amz-server-side-encryption
SSE-S3: x-amz-server-side-encryption: AES256
SSE-KMS: x-amz-server-side-encryption: ams:kms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

At what point in time can you encrypt data or buckets in S3?

A

At any time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Which (one) AWS service protects against DDoS attacks?

A

AWS Shield

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Which services can be used to mitigate DDoS attacks?

A 
CloudWatch
Route53
CloudFront
ELBs
WAFs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What protection does WAF offer?

A
  • Block IP addresses
  • Block countries
  • Block certain header information
  • XSS protection in the request
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Which services does (not) WAF integrate?

A

yes: ALB, CloudFront, API Gateway
no: Classic/Network LBs (it needs to be application aware)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is AWS Artifact?

A

Repository for security and compliance documents

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

When does AWS allow SSL certs to be stored in IAM?

A

When the region is not supportes by the AWS Certification Manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

In which format can S3 Access Logs be encrypted?

A

SSE-S3 (not - KMS)

34
Q

KMS: What is the difference between symmetric and asymmetric encryption?

A

Symmetric: The same key is used for encrypting and decrypting the file. (is faster than Asymmetric)
Asymmetric: Two keys (public and private) are needed to decrypt a file. (Is more secure)

35
Q

KMS: Can the keys be used in all regions?

A

No, KMS is region specific

36
Q

KMS: What is the security issue left then rotating keys?

A

When the new key is created, this key will only be used for all new encryptions. Older files are still encrypted with the old key, so if that key is compromised those files can still be read.

37
Q

KMS: What is the flow to create encrypted data?

A

Key Management Service (KMS) to perform encryption. KMS uses Customer Master Keys (CMK) to create Data Encryption Keys (DEK), which enables data encryption across EBS and a range of AWS services.

38
Q

KMS: What is the full process to encrypt an EBS Volume?

A
  1. A volume is defined as ‘encrypted’ in EBS
  2. EBS calls KMS to request a Data Encryption Key
  3. KMS generates a DEK from the specified Customer Master Key
  4. The CMK encrypts the DEK
  5. The DEK is then stored on the encrypted EBS volume as metadata
  6. The EBS volume is then attached to an EC2 instance
  7. EC2 sends a ‘decrypt’ request to KMS with the encrypted DEK from the volume
  8. KMS decrypts the DEK into a plaintext DEK and sends it back to the EC2 instance
  9. EC2 stores the plaintext DEK in its hypervisor memory for as long as the EBS volume is attached to the instance
  10. EC2 uses the DEK to perform I/O encryption to the volume using the AES-256 algorithm
39
Q

How to encrypt an existing EBS volume?

A
  1. Create a snapshot
  2. Copy the snapshot with the “encryption” settings
  3. Create a new volume
40
Q

Can you encrypt all EBS Volumes?

A

Yes, that not all EC2 Instances support the encryption o the volume

41
Q

What are the tenancy and symmetry settings for KMS and HSM

A

KMS: Multi tenancy - symmetric encryption
HSM: Single tenant - asymmetric and symmetric

42
Q

S3: What is the scope of the “block public access” policy?

A

All regions, for all buckets/files, all existing and future buckets/files

43
Q

IAM: What is the Access Advisor?

A

Information on in the “Users” section

Shows when a service was last accessed, and with which policy

44
Q

S3: How can a customer key be used?

A

Only with the CLI / SDK

Generate the key and attach it on uploading the file

45
Q

Which features apply to both Secrets Manager and Parameter Store?

A
  • Can store credentials in hierarchical form
  • Integrated with Identity and Access Management
  • Supports encryption at rest using customer-owned KMS keys
46
Q

As an administrator, which of the following IAM tasks are critical to the security of your AWS environment?

A
  • The application of an IAM password policy
  • The activation of MFA on the root account
  • The deletion of root access keys
47
Q

What is AWS Backup?

A

AWS Backup is a centralised place to create backups of your EBS, RDS, and EFS resources. There is no additional cost for setting up backup plans and retention policies, and this is a managed service so it’s a perfect option to present to your manager

48
Q

You need to identify any S3 buckets that are public. Which AWS service can you use to quickly determine this?

A

AWS Config

49
Q

Why can’t I access an object that was uploaded to my Amazon S3 bucket by another AWS account?

A

The AWS account that uploads the object owns the object. This is true even when the bucket is owned by another account. To get access to the object, the object owner must explicitly grant the bucket owner access. (via the ACL e.g.)

https://aws.amazon.com/premiumsupport/knowledge-center/s3-bucket-owner-access/

50
Q

What services are integrated with WAF?

A

(Header knowing services)

CloudFront & Application Load Balancer

51
Q

What is special about DB Security Groups?

A

The only allow access to the database ports

52
Q

How to encrypt MySQL at rest?

A

RDS cannot handle encryption, it must be done by the application

53
Q

What should be done to prevent IP-Spoofing?

A

Nothing, EC2 instances cannot send spoofed traffic, because they cannot send traffic with a different source IP or MAC address.

54
Q

Which service allows using Microsoft Active Directory credentials
to authenticate to AWS?

A

AWS Single-Sign On (SSO)

55
Q

How many versions of a customer managed policy will IAM retain?

A

5

56
Q

What needs to be considered for outbound traffic on a NACL?

A

Usually all ports need to be allowed, because outbound traffic can come from ephemeral ports and not the same as the inbound.

57
Q

If a policy has been (accidentally) deleted, which service could still have the data?

A

CloudTrail

58
Q

What (keys/credentials) does the Security Token Service provide?

A
  1. Secret access key

2. Short-term credentials

59
Q

If a data key gets leaked, what action needs to be taken?

A

Nothing, the data key is encrypted.

Only if also the Customer Master Key got leaked, then an action needs to be taken.

60
Q

You just created a customer master key in KMS. What’s the earliest you can delete it?

A

7 days

61
Q

. You just imported a customer master key into KMS. What’s the earliest you can delete it?

A

Immediately

62
Q

Where are keys in a KMS custom key store stored?

A

CloudHSM

63
Q

What is the monthly service-level agreement for KMS?

A

99.9 percent

64
Q

What is the monthly service-level agreement for CloudHSM?

A

99.99 percent

65
Q

Is it necessary to create a new certificate if a load balancer in a different region is created?

A

Yes, because ACM is a regional service, you’d have to create a new certificate in the other
region

66
Q

What are the two options to encrypt data in DynamoDB?

A

Encrypt the data before writing it & Use an AWS managed KMS key.

It is not possible to use a customer managed key.

67
Q

You’ve configured an instance profile role but want to make sure other IAM users can’t
assume the role. Which actions should be taken?

A

Ensure the role’s trust policy doesn’t allow users to assume the role.

68
Q

Can the principal of a trust policy be a wildcard?

A

No, it can be an AWS service or a

principal in the same account or another account

69
Q

What happens to EC2 instances when a region is disabled?

A

They still run, generate costs and cannot be terminated.

The region needs to be activated again.

70
Q

What needs to be done in order to allow certain IAM users to be able to change their passwords?

A
  1. Identity-based to perform the
    iam:ChangePassword action.
  2. Specify the resource arn:aws:iam::account-id:user/
    ${aws:username}.
71
Q

What is a managed session policy?

A

When assuming a role, you can specify a managed session policy to restrict the
permissions granted to the session

72
Q

Which two policies can only restrict access?

A

Service control policies

Session policies

73
Q

Which service is responsible for:

  • Short term credentials
  • Long term credentials
  • Short term application secrets
  • storing encryption keys
A

STS
IAM
Secret Manager
KMS

74
Q

What is the only reason a root key can fail?

A

Different time settings on the workstation

75
Q

KMS: What are the two methods the Customer Master Key (CMK) can be created? And what are the differences?

A

AWS Managed

  • Named after the service the key is used for
  • Cannot be deleted
  • Cannot be used in roles
  • Automatically rotated every three years

Customer Managed

  • Custom name
  • Can be deleted/disabled
  • Can be used in roles
  • Rotated manually or once a year
76
Q

KMS: What are the steps to create a Customer managed key?

A
  • Name
  • Origin (KMS, External, CloudHSM)
  • Admin Access
  • User Access
77
Q

KMS: Who can have admin / user access?

A

IAM users & roles

78
Q

KMS: If the origin is “Custom key store” - what is necessary?

A

A CloudHSM cluster

79
Q

KMS: What are the two types of key specs for “sign and verify”?

A

RSA & ECC

80
Q

KMS: How is KMS priced?

A

$1/month for every key created

ca. 0.03$ per request (encrypt/decrypt)
ca. 0.15$ per signing
ca. 1000$/month per CloudHSM instance

Sysops (14 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions