Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Professional- AWS Solutions Architect > Security > Flashcards

Security Flashcards

1
Q

What is the shared responsibility model?

A

Defines customer and AWS’s role of security in the cloud

Customer- Responsible for security IN the cloud
AWS- Responsible for security OF the cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the principle of least privilege?

A

The principle that states that you give users (or services) nothing more than those privileges required to perform their intended function (and only when they need them)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the 4 security facets of the cloud?

A

1) Identity
2) Authentication
3) Authorization
4) Trust

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Define what the identity facet is? and provide an example…

A

Identify facet- Who are you?

e.g. Root account user, IAM user, temporary security credentials

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Define what the authentication facet is? and provide an example…

A

Prove that you are who you say you are…

e.g. MFA or client-side SSL certificate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Define what the authorization facet is? and provide an example…

A

Are you allowed to do this?

e.g. IAM policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Define what the trust facet is? and provide an example…

A

Do other entities that I trust say they trust you?

e.g. Cross account access, SAML-based federation and web identity federation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the 7 steps in a typical authentication flow (SAML)?

A

1) User-agent requests access from the service provider
2) The service provider tells the user-agent to request access from the identity provider
3) The user agent requests access from the identity provider
4) The identity provider says please authenticate e.g. password or SSL cert
5) User-agent provides password
6) The identity provider tells the service provider to let them in
7) The service provider tells the user agent it can access the service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is SAML 2.0? and can it be used to authorise and authenticate?

A

SAML 2.0 is an XML based standard for exchanging authorization and authentication identities between security domains.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is SAML 2.0 best suited for?

A

Single sign-on for enterprise users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is OAuth 2.0? and can it be used to authorise and authenticate?

A

OAuth 2.0 is a JSON web token (JWT) based standard for exchanging authorization NOT AUTHENTICATION

It works by issuing a token to a client. The application then validates the token with authorization server. Supports delegate access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is OAuth 2.0 best suited for?

A

Best suited for API authorization between apps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is OpenID connect? and can it be used to authorise and authenticate?

A

Identity layer built ontop of OAuth 2.0 adding AUTHENTICATION.

Uses REST/JSON message flows. Supports web clients, mobile clients and javascript clients

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is OpenID connect best suited for?

A

Single sign on for customers…. Think mobile apps!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

name 5 tools used for account management…

A

1) AWS organisations
2) Service control policies- Sub-account restrictions
3) Tagging
4) Resource groups
5) Consolidated billing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Name and describe 5 different account structures…

A

1) Identity account structure
2) Logging account structure
3) Publishing account structure (common repo for AMI, containers, code)
4) IT security account (consolidated security and logging)
5) Central IT account structure (define and share services and standardise assets)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is AWS organisations?

A

Policy-based management for multiple AWS Accounts. Accounts are split into organisational units. simplifies things!

e.g. HR, automotive, consumer products

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is consolidated billing?

A

A way to consolidate billing across multiple organisational units

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is consolidated security?

A

A way to consolidate security across multiple organisational units

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is a service control policy?

A

Service control policies (SCPs) are a type of organization policy that you can use to manage permissions in your organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is a security group? and what is meant by a default security group?

A

A virtual firewall for individual assets (e.g. EC2, RDS, AWS workspaces…)

Default SG:
Allows all inbound traffic from other instances associated with the default security group. The security group specifies itself as a source security group in its inbound rules.

Allows all outbound traffic from the instance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Does a security control inbound or outbound traffic or both? and which protocols are included?

A

Both!

TCP, UDP, ICMP or custom protocols

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

How are inbound rules defined?

A

By SOURCE IP, subnet or other security group

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

How are outbound rules defined?

A

By DESTINATION IP, subnet or other security group

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Is a security group stateful or stateless? and what does this mean?

A

Security groups are stateful — if you send a request from your instance, the response traffic for that request is allowed to flow in regardless of inbound security group rules. Responses to allowed inbound traffic are allowed to flow out, regardless of outbound rules.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is a NACL?

A

Network Access Control List

An additional level of security got a VPC that acts as a firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What traffic does the default NACL allow?

A

All inbound and outbound traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Are NACLs stateless or stateful? and what does this mean?

A

Stateless- means that outbound traffic simply obeys the outbound rules - no connection is maintained

29
Q

Why use both a SG and a NACL?

A

NACLs provide a good back up if you forget to apply a SG… part of the principle of least privilege!

30
Q

name and describe 5 AWS directory services…

A

1) AWS cloud directory- cloud native directory for access and control to Hierarchical data between applications
2) Amazon Cognito- Sign up and sign in functionality to scale with federation to public social media services
3) AWS directory service for Microsoft Active directory- AWS managed full Microsoft AD
4) AD connector- Allows on-prem users to log into their EXISTING AD and allows EC2 instances to join AD domain
5) Simple AD- Low scale, low cost AD implementation based on samba

31
Q

What scenario is best suited to… AWS Cloud directory

A

Cloud applications that need hierarchical data with complex relationships

32
Q

What scenario is best suited to… Amazon Cognito

A

Developing consumer apps or Saas- you don’t have to create your own sign in and sign off

33
Q

What scenario is best suited to… AWS directory service for Microsoft Active directory

A

Enterprises that want hosted Microsoft AD or you need LDAP for Linux apps

34
Q

What scenario is best suited to… AD connector

A

Single sign-on for on-prem employees and for adding EC2 instances to the domain

35
Q

What scenario is best suited to… Simple AD

A

Simple user directory or when you need LDAP compatibility

36
Q

What is the use case for choosing AD connector… (3 points)

A

1) Must have an existing AD
2) Have existing AD users that want access to AWS assets via IAM roles
3) Would like MFA via existing RADIUS-based MFA infrastructure

37
Q

What is the use case for choosing simple AD? (5 points)

A

1) Require a stand-alone AD based on SAMBA
2) Require support for user accounts, groups, group policies and domains
3) would like kerberts-based SSO
4) Don’t require MFA (not-supported)
5) Don’t require trust relationships

38
Q

What is the token vending machine (TVM) concept in AWS?

A

A common way to issue temporary credentials for mobile app development.

39
Q

What is anonymous TVM?

A

Used as a way to provide access to AWS services only. Does NOT store user identity

40
Q

What is identity TVM?

A

Used for registration and login and authorizations (outdated- use Cognito)

41
Q

What is AWS secrets manager?

A

A service to store passwords, encryption kets, API keys, SSH keys and PGP keys.

Alternative to storing passwords or keys in a “vault” either physical or virtual

42
Q

What benefit does AWS secret manager provide for databases?

A

Automatically rotates RDS database credentials for mySQL, Postgres and Aurora

43
Q

What are the 2 types of encryption? and provide examples…

A

1) Encryption at rest- encrypted where it is stored e.g. EBS, S3 and SQS
2) Encryption in transit- Encryption as it flows through a network or process such as SSL/TLS for HTTPS, or IPSEC for VPN connections

44
Q

What is the key management service used for?

A

Encryption key storage, management and auditing

Remember- Multi tenanted HA

Validated with many compliance schemes e.g. DCI DSS level 1 and FIPS

45
Q

How does KMS differ from secrets manager?

A

KMS is purpose-built for encryption key management

46
Q

What solution would you need if KMS was NOT robust (maybe needed single tenanted) enough for your requirements? also, define it…

A

CloudHSM- Dedicated hardware device, SINGLE tenanted unlike KMS and can be accessed via VPC peering. It is not HA though this must be managed by you.

47
Q

What is the drawback of CloudHSM?

A

Not integrated with many services like KMS, may need scripting.

48
Q

What is the cost model for CLoudHSM?

A

pay per hour, with no upfront cost. The classic version costs $5000

49
Q

What is certificate manager?

A

Encryption in transit service that allows you to provision, manage and deploy private and public SSL certificates.

50
Q

What are the benefits of using certificate manager?

A

1) Free public certificates to use within AWS
2) supports wild cards to cover all subdomains
3) Manages certificate renewal!

51
Q

What is phising?

A

Someone trying to get you to part with financial information

52
Q

What is a Distributed Denial Of Service attack (DDOS)?

A

A method compromising a system that overwhelms/exposes private information

53
Q

Name 2 common DDOS attacks… provide examples

A

1) Amplification or reflection attack- Bad actor spoofs a packet to manipulate the destination address e.g. MONLIST returning 600 last IP addresses overwhelms a target device
2) Application attack (layer 7)- A bad actor floods a device with lots of HTTP GET requests which slow or stop a web server

54
Q

What are the 5 best practices to reduce the risk of suffering from a DDOS attack? and which AWS service do these relate to?

A

1) Minimise your attack surface- NACLs, SG, VPC design
2) Scale to absorb attack- Autoscaling groups, AWS CloudFront and static web content S3. DynamoDB scales rapidly…
3) Safeguard exposed resources- Route53, WAF, AWS Shield
4) Learn normal behaviour- AWS guardDuty, CloudWatch
5) Have a plan!

55
Q

What is IDS? Active or passive?

A

Intruder Detection System- Watches the network to and systems for suspicious activity that might indicate someone is trying to compromise a system….

Passive

56
Q

What is IPS? Active or passive?

A

Intruder Prevention System- Tries to prevent exploits by sitting behind firewalls and scanning and analysing suspicious content for threats.

Active! Dynamically watching network

57
Q

What is CloudWatch? (5 points)

A

1) Logs events across AWS services… think operations
2) High-level comprehensive monitoring and eventing
3) Log form multiple accounts
4) Logs stored indefinitely
5) Alarms history kept for 14 days

58
Q

What is CloudTrial? (5 points)

A

1) Logs API activity across AWS services… think activities
2) Low-level… granular
3) Log from multiple accounts
4) Logs stored in S3 or CloudWatch indefinitely
5) No native alarming, but can use with CloudWatch alarms

59
Q

What is the service catalog?

A

Helps users organise AWS environment and is useful for central IT to put together services that are pre-defined and organised. Allows IT to have granular control over which users have access to which offerings

60
Q

What are the 3 types of constraints that can be applied in AWS catalog? describe…

A

1) Launch constraint- IAM role that service catalog assumes when an end-user launches a product
2) Notification constraint- Specifies the Amazon SNS topic to receive notifications about stack events
3) Template constraint- One or more rules that narrow allowable values an end-user can select

61
Q

Why would you want to use a launch constraint in AWS catalog?

A

Without a launch constraint the end-user must have ALL the permissions needed within their own IAM credentials

62
Q

Why would you want to use a notification constraint in AWS catalog?

A

So you can get notifications when products are launched or have problems

63
Q

Why would you want to use a template constraint in AWS catalog?

A

To adjust product attributes based on the choice a user makes (e.g. only allow certain instance types for DEV env)

64
Q

What happens if we share a catalog from the master account to a sub account?

A

The launch role is shared (the IAM role that launched the service on behalf of the user that requested it) so it will launch the service in the master account. To avoid this a local admin must override this by creating a local catalog and create a new launch constraint that uses a localised launch role.

65
Q

At what level are the launch constraints defined?

A

At the product level, not the portfolio level!

66
Q

What can you use a service control policy for?

A

To restrict the regions your organisation can use (for compliance reasons)

67
Q

When you cannot use secrets manager, what is the best way to store credentials?

A

Using an encrypted file on S3 and proving an IAM role with access to it assigned to the EC2 instance

68
Q

Can you configure CloudTrail to deliver log files from multiple regions to a single S3 bucket for a single account?

A

Yes

69
Q

Does Elasticache memchached offer native encryption?

A

Nope, but redis does!

Professional- AWS Solutions Architect (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions