Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS SA Associate > Security and IAM > Flashcards

Security and IAM Flashcards

1
Q

You have built a severless mobile app for which you need to federate and generate temporary credentials to access an S3 bucket. What two technologies could you use?

A

Cognito and STS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the use of Cognito Synch (AKA AppSynch)?

A

Synchronises calls from a MOBILE device to Cognito

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the maximum size of data that can be encrypted by KMS per call (NOT data at rest on S3)

A

4KB - If you need KMS to encrypt environment variables or user data, this must be less than 4Kb

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the difference between a resource based policy and assuming an IAM role?

A

When you assume an IAM role you give up your own IAM permissions for the duration of the role assumption. When you are using a resource based policy, your IAM permissions remain unchanged

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What CAN’T a security group reference? IP Address, CIDR block, DNS, another security group

A

A DNS cannot be referenced

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

You have been granted access (IAM) to an AWS parameter store and can retrieve an encrypted password. However when you try to decrypt the password, you get an error. Why?

A

IAM will get you access to the store - but you also need IAM permissions to KMS for decryption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which service allows you to issue temporary security credentials to allow access to AWS resources - Cognito, SSO or STS?

A

STS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

You have a policy set up for S3 which has been assigned to a role called ‘S3SecGroup’. The policy contains the line Action:”S3:ListBucket” against a specified ARN. When you run an S3 LS in the CLI you get an access denied error - why?

A

The policy for ListBucket specifies the name of the bucket - you can only ls INSIDE the specified bucket. You cannot ls all buckets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

For a security group, what are the defaults for In and Outbound traffic? Are there exceptions?

A

All inbound traffic is denied, all outbound traffic is allowed. It You can’t deny in a security group - but for everything EXCEPT SSH there is no specific allow rule for inbound.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

In Identity federation, is user management inside or external to AWS. Why would we use identity federation

A

Identity management is external to AWS. A trust relationship must be created between AWS and the provider. You would do this if you had a social media app for example that required access to AWS resources. You want the social media provider to manage the identities rather than creating millions of IAM accounts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Can secrets in AWS secrets manager be accessed from other accounts?

A

Yes - unlike a parameter store secrets manager can be accessed from other accounts. This is useful if two accounts need to share the same secret

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Can you specify allow and deny rules for:

  • A security Group
  • A NACL
A

A Security group allows you to specify ALLOW rules only.

A NACL allows you to specify ALLOW and DENY

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

When configuring the AWS CLI on an EC2 instance should you provide your access key and secret access key?

A

No. Your access and secure access key should never be deployed on any AWS resources. IAM resources should always be used instead.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

You get a timeout when connecting to an instances via ssh on 22. Why?

A

Inbound to 22 is not setup in the security group.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

There are 2 policies that need to be enacted to give a user access to KMS. One is an IAM policy allowing API calls to KMS. What is the other.

A

A Key policy allowing the user access to the key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Can an IAM user belong to multiple groups?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Can a security group be applied to multiple instances?

A

Yes. Each instance or ENI must have at least 1 security group.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

How can you test a policy you have setup without executing it

A

AWS IAM Policy simulator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the function of a service control policy in AWS Organisations?

A

It allows for the white listing or blacklisting of specified AWS resources for specific organisational accounts. SCP’s are tree structured and support inheritence. If something is denied at a higher level, and something at a lower level is branched from that, such ans an OU then the resource for that OU will also be denied

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Should you store AWS credentials in application code? What is best practice for this?

A

No. Best practice is that credentials should be inherited from mechanisms above - for AWS services this should always be IAM.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Can you reference one security group with another?

A

Yes. You can allow inbound traffic to an instance by specifying the group in an inbound rule. This means all instances calling tonto the machine belonging to that group will be authorised. his means you don’t need to specify IPs

22
Q

If you switch regions or deploy another VPC combination, do you need to create another security group?

A

Yes. Security groups are locked to a REGION or VPC combination. A reference can exist across PEERED VPCs, but they must be peered.

23
Q

When using the SDK to interact with AWS components, what is the recommended way to manage credentials in a secure fashion?

A

Default Credential Provider Chain

24
Q

Which services offer perfect forward security? ELB, S3, Cloud Trail, Cloud Front, EC2, GovCloud? (2)

A

ELB and Cloudfront

25
Q

Is IAM global or regional?

A

IAM is global. Once an IAM user, group policy is setup it is globally available in your account.

26
Q

In AWS KMS can the client/customer download or access the client master key (CMK)?

A

No

27
Q

Where do you define:

a) A Group
b) A Security Group

A

Groups are defined in IAM. Security groups are defined in networking.

28
Q

What are the 4 components of IAM in AWS?

A

Users, Groups and Roles and Policies

29
Q

In terms of AWS security - what acts as an INSTANCE level firewall?

A

A security group. Security groups exist outside of the instance meaning that blocked traffic will never make it to the EC2 instance

30
Q

For IAM, is the principal

  1. The resource whose access is being defined
  2. The user or entity to which access is assigned
A

2: The principal is the user or entity for which access is being assigned

31
Q

Which AWS tool can be used to identify vulnerabilities in/on AWS Ec2 Instances?

A

AWS Inspector

32
Q

What are the advantages of using AWS SSO rather than the assume role API in terms of creating a login mechanism for your application?

A

If you are using the assume role API you will need to manage integrations between the identity store and a login portal that you will probably need to create. There is less overhead using SSO as the identity manager and login portal is provided for you. You can also get credentials for one or more accounts

33
Q

Which AWS tool can help identify inappropriate use of AWS credentials or the presence of malware by examining AWS VPC logs?

A

AWS Guard Duty

34
Q

You have an Ec2 instance in a security group. You try to connect and receive a “Connection Refused”. Why?

A

The application is not responding or up. In this case the SG has allowed the traffic through but the app is not listening on the port

35
Q

For a cognito user pool - does cognito provide the ability to Authenticate AND Authorize?

A

Cognito user pools authenticate only. They do not authorise. I.e they specify who you are, but not what you can do. Your app must do that.

36
Q

Should you use the root aws user for engaging in admin tasks?

A

No. Create an IAM user and attached the aws managed admin policy

37
Q

How do you ensure that each ECS task has permissions it needs to access its required AWS resources and ONLY those resources?

A
  1. First you create an IAM role for the EC2 instance to be able to interact with the ECS service
  2. Each ECS task then has an IAM task role assigned to it enabling access to the resources it needs via the TaskRoleARN.
38
Q

What is envelope encryption?

A

With envelope encryption, the key used to encrypt the message is itself encrypted with another key. The other key is the client master key managed by AWS KMS

39
Q

If you have 2 policies attached to a user, one allowing full Ec2 access and another permitting IAM access but denying EC2 access - can the user launch an Ec2 instance? Why, Why not?

A

The user will NOT be able to launch an Ec2 instance as we have one policy allowing full Ec2 access - BUT we have another which explicitly denies. deny will always take precedent over an allow

40
Q

Can you either create or import you own keys into KM S

A

Yes. There is a cost though. $1/month for a imported key or $0.03/1000 calls for a created key

41
Q

Do you need to implement any custon changes to API gateway to use cognito user pools to authenticate?

A

No. API GW can verify automatically from a cognito user pool. No custom implementation is required

42
Q

Should you use you access_key or secret_acess_key when configuring the CLI on an Ec2 instance?

A

No. This is a security risk. you should attach an IAM role to the instance instead

43
Q

When using IAM authentication to connect to a DB:

  • Where are the tokens generated
  • How long are they valid?
A

AWS Credentials, and 15 minutes

44
Q

There are 3 ways to secure the API Gateway, what are they?

A

IAM
Lambda Authorizer
Cognito User Pools

45
Q

You have an application which calls an S3 bucket. Currently, this is authenticating against the bucket using environment variables. What are the variables and what could you do differently?

A

AWS_ACCESS_KEY_ID
AWS_SECRET_ACCESS_Key
IAM roles would be much more secure.

46
Q

What is the AWS parameter store? How would you setup a password structure for a dev and a prod database in parameter store?

A

Allows for the storing of parameters - encrypted or plain text - in an easier to access way than KMS, KMS is used to encrypt parameters, and parameters are defined by a path structure. I.e.:
my-db/dev/password
my-db/prod/password

47
Q

Which sort of IAM policy would you use to grant cross account access?

A

Resource

48
Q

Which AWS Directory service allows for MFA?
SimpleAD
AD Connector
AWS Managed MS AD

A

AWS Managed MS AD

49
Q

In AWS AD Connector, where are your users managed?

A

They are managed on the on-prem AD infrastructure, you don’t have the ability to manage users within AD connector

50
Q

Which AWS Directory service functions as a proxy between your on-premise AD and AWS services?

A

AD Connector

51
Q

Which AWS AD service establishes a trust relationship with you On premise AD?

A

AWS Managed MS AD

52
Q

What is the difference between AWS IAM Access Advisor and IAM Access Analyzer?

A

Access Advisor is used to help identify unused IAM roles based on the last accessed time stamp
Access Analyzer is used to identify resources in your account that are shared with External entities

AWS SA Associate (21 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions