Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Solutions Architect Professional > Security, Identity & Compliance > Flashcards

Security, Identity & Compliance Flashcards

1
Q

Where can you apply SCPs

A

At the OU or Account level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which roles are not affected by SCPs

A

Service-linked roles because they enable other AWS services to integrate with AWS Organizations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the default permissions on Organization OUs

A

Does not allow anything by default. SCP must have an explicity Allow from the root to each OU.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

In which order does IAM policies are evaluated

A
  1. SCP
  2. Resource-based policies
  3. Identity-based policies
  4. IAM permissions boundaries
  5. Session policies
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How can you restrict specific tags on resources

A

Using the aws:TagKeys on IAM policies condition. Or using SCP condition aws:RequestTag/key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

AWS Organizations - Tag Policies

A

Ensure consistent tags defineing keys and their allowed values

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are AI Services opt-out policies

A

Is an Organization policy to avoid you content to be stored or used by AWS AI Services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

AWS IAM identity Center

A

One login for all:
1. AWS accounts in Organizations
2. Business Cloud Applications
3. SAML2.0 enabled applications
4. EC2 Windows Instances

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

IAM Identity Center Permission Set

A

Grant access to a user or group in a list of target AWS accounts or OUs within your Organization. Creates corresponding IAM roles in each account and attaches the policies specified

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

AWS IAM Identity Center

Attribute-Based Access Control

A

Fine grained permissions based on users attributes. Define permissions once, then modify access by changing the attributes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

AWS Config Aggregators

A

Collects configuration data from multple accounts:
1. Individual accounts aggregator
2. Organization aggregator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

AWS Config rules for global services

A

Should be created in a sigle region to avoid duplicate copies and save costs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Auto-enable feature in Security Hub

A

Automatically enable Security Hub in all existing and future Organization accounts, and designating a central account as the administrator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

AWS Firewall Manager

Common Security Group Policy

A

You can centrally configure and manage SGs across all your accounts in Organizations, while still allowing developers to deploy specific SG rules

They are mapped to specific tags

Blogs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

AWS Firewall Manager perrequisites

A
  1. Use AWS Organizations
  2. Designate one ccount as the administrator
  3. Enable AWS Config for all the accounts
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

AWS Control Tower

A

Easy way to set up and govern a secure and compliant multi-account AWS environment based on best practices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

AWS Control Tower

Account Factory

A

Create pre-approved baselines and configurations to automate account provisioning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

AWS Control Tower

Guardrails

A

Detect and remediate policy violations:
1. Preventive - SCPs
2. Detective - AWS Config

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Resource Access Manager

Sharing VPC Subnets

A

Allow to have all resources launched in the same subnet
1. Cannot view, modify or delete resources in other accounts
2. Can communicate between resources in the same VPC
3. Security Groups from other accounts can be references

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Resource Access Manager

Managed Prefix List

A

A set of one or more CIDR blocks that you can reference in SGs and Route Tables.

21
Q

Resource Access Manager

Route53 Outbound Resolver

A

Scale forwarding rules of your DNS in multiple accounts and VPCs

22
Q

CloudTrail

Insights

A

Detect Unusual Activity. Analyzes normal management to create a baseline and then continuosly analyzes write events to detect patterns.

23
Q

Integrate IAM Access Analyzer findings into Security Hub

A

Can be directly integrated by enabling the integration setting in IAM Access Analyzer. Ensures that finding are automatically pushed to Security Hub.

24
Q

Amazon Detective

A

Analyze, investigate and quickly identify the root cause of potential security issues or suspicious activity.

25
Q

Parameter Store

Parameters Policies

A

Allow to assign a TTL to a parameter to force updating or deleting sensitive data such as passwords

26
Q

RDS

Transparent Data Encryption

A

Available for Oracle and SQL Server. Automatically encrypts data before it is written to storage, and automatically decrypts data when the data is read from storage.

27
Q

Server Name Indication

A

Solves the problem of loading multiple SSL certificates onto one web server (to serve multiple websites). Only works for ALB, NLB and CloudFront.

28
Q

Amazon Detective

Role session analysis

A

Provide visibility to role usage, cross-account role assumption, and any role chaining activities performed across multiple accounts.

29
Q

Add accounts to AWS Organizations

A
  1. Invite existing AWS accounts to join your organization from the management account
  2. Creating a member account in an organization with AWS Organizations
30
Q

Where does ACM loads SSL certificates?

A
  • Load Balancers
  • CloudFront distributions
  • APIs on API Gateways
31
Q

Cloud HSM

SSL Offloading

A
  1. The server sends certificate.
  2. The client generates a premaster secret and encrypts it with the server’s public key
  3. To decrypt the client’s premaster secret, the server sends it to the HSM. The HSM uses the private key and then it sends the premaster secret to the server.
  4. For the rest of the session, all messages sent between the client and the server are encrypted with derivatives of the master secret.

ssl offload overview

32
Q

S3 pre-signed URLs

A

Users given a pre-signed URL inherit the permissions of the person who generated the URL for GET / PUT

33
Q

IAM Access Information

A

IAM provides last accessed information to help you identify unused permissions so that you can remove them.

34
Q

IAM

Create SAML Identity Provider

A
  1. Get the SAML metadata document from your IdP.
  2. Add a provider and assign an IAM role to give external user identities permissions to access AWS resources in your account.
  3. You must tell the IdP about AWS as a service provider. This is called relying party trust between your IdP and AWS.
  4. Configure SAML assertions for the authentication response
35
Q

S3 Access Points

A

Create unique access control policies for each access point to easily control access to shared datasets. Any access point can be restricted to a VPC.

36
Q

S3 Multi Region Access Point

A

Provide a global endpoint for routing S3 request traffic between regions. Consider factors like network congestion and the location of the request to dynamically route your requests to the closest copy of your data.

37
Q

S3 Object Lambda Access Point

A

Add code to S3 GET, LIST, and HEAD requests to modify and process data as it is returned to an application. Reduces the need to create and store derivative copies of your data or to run proxies.

Transforming Objects

38
Q

Amazon Cognito Identity Pools

A

Provide temporary AWS credentials for users who are guests and for users who have been authenticated and received a token.

39
Q

Amazon Cognito User Pools

A

User directory for web and mobile app authentication and authorization.

40
Q

An Amazon Cognito user pool and identity pool used together

A
  1. Your app user signs in through a user pool and receives OAuth 2.0 tokens.
  2. Your app exchanges a user pool token with an identity pool for temporary AWS credentials.
  3. Your app assigns the credentials session to your user
41
Q

IAM

OIDC Federation

A

Exchange a JWT for temporary security credentials in AWS that map to an IAM role with permissions to use specific resources in your AWS account.

42
Q

Which rules can be managed with AWS Firewall Manager?

A
  1. WAF Rules
  2. Shield Advanced
  3. Security Groups
  4. Network Firewall
  5. Route53 resolver DNS Firewall
43
Q

Amazon Inspector

Where you can run automated security assessments?

A
  1. EC2 instances with SSM
  2. Container Images on ECR
  3. Lambda Functions
44
Q

AWS Config Rules

A

Audit and record compliance of resources. Does not prevent actions from happening.
* Remediation can be through AWS SSM automations

45
Q

Amazon GuardDuty

A

Intelligent Threat Discovery from CloudTrail Events Logs, VPC Flow Logs and DNS Logs

46
Q

IAM Conditions

A
  • aws:SourceIp: Restrict the client IP
  • aws:RequestedRegion
  • ec2:ResourceTags: Restrict based on tags
  • aws:MultiFactorAuthPresent
  • aws:PrincipalOrgID: Limit to member accounts of an organization
47
Q

AWS Security Hub

A

Central security tool to manage security across several AWS accounts and automate security checks

48
Q

Sources for Security Hub

A
  • Macie
  • GuardDuty
  • Inspector
  • Config
  • Firewall Manager
  • IAM Access Analyzer
  • Systems Manager
  • Health

AWS Solutions Architect Professional (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions