Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

SAP-C02 > Udemy > Flashcards

Udemy Flashcards

1
Q

Which IAM approach aligns with AWS best practices and principle of least privilege?

A

IAM roles with permissions and assigned to IAM entity (user).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the function of AWS App Mesh?

A

Application Level Networking (Service to Service Communication); End-to-End Visibility

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which AWS Storage solution is POSIX (iSCSI) compatible?

A

AWS Storage Gateway Volume Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Does EFS support POSIX

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is Fault Injection Service used for?

A

Experiments to improve application performance, observability and resilience. Helps determine recovery actions from failure scenarios.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is a role in IAM

A

A short term credential that grants authority (or denial) of activities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a policy?

A

Set of authorizations that can be assigned to a user or orle.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the four types of policies?

A

AWS Managed, Customer Managed, Inline, and Resource Based

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the function of Access Advisor?

A

To see what is granted and when it was last accessed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the function of Access Analyzer?

A

To check resources that are shared with an external entity (e.g. Cross Account Policy Conditions)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What’s a key differential between IAM Role & Resource Based Policy in regard to cross-account access (re: permissions)?

A

If you assume a role, you give up your original permissions and take the permissions of the role. If you use a resource policy, the original principal doesn’t give up permissions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the two IAM areas that permission boundaries apply to?

A

Users and Roles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a permission boundary?

A

Defines maximum permission an IAM entity can get

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are two use cases for IAM Permission boundary?

A

Delegate responsibilities to non admins, allow developers to grant rights to themselves

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How does IAM Access Analyzer help decide if access is appropriate?

A

By defining a zone of trust and anything outside of that would be a finding/issue.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What function inside IAM Access Analyzer can help write a policy and how does it make that suggestion?

A

IAM Access Analyzer Policy Generation which is built on activity based on CloudTrail

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is STS and what is it’s function?

A

Security Token Service. Allows to get credentials/role for a period of time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What benefit does STS provide in terms of security?

A

You have to explicitly grant permissions to assume the role you want and the user has to actively switch. Can lockdown assuming role only if MFA is configured, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How would STS help/work in a Dev/Prod environment?

A

Devs would have an account in the DEV account but then be able to assume a role in the production account that provides less privleges; STS would return these temporary credentials.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How can IAM access analyzer help govern your zone of trust?

A

Shows which resources are exposed and when they were last accessed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the “Confused Deputy” and how can you avoid it?

A

It’s essentially a man in the middle attach facilitated by the external account using the same role name; you can avoid it by using External ID secret.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the aws:PrincipalTag in regard to IAM?

A

You can pass a tag with an API call to get a certain set of rights based on that tag via STS (e.g. Department=HR)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Give five important APIS for STS (this is pure memorization)

A

AssumeRole
AssumeRolewithSAML
AssumeRoleWithWebIdentity [identity provider]
GetSessionToken (MFA/Root)
GetFederationToken (obtain temporary creds for federated user)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are six ways to do identity federation in AWS (pure memorization)?

A

SAML 2.0 [ADFS]
Custom Identity Broker
Web Identity Federation (w/o Cognito)
Web Identity Federation (w/ Cognito)
Web Identity Federation (IAM Policy)
SSO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

How does AD and AWS Directory Services interact?

A

They are both basically AD but one is onprem and one is at AWS (think of it as AWS Managed AD)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

AWS Managed Microsoft AD: does this allow trust relationships to your own onprem AD?

A

Yes.

27
Q

What are the three kinds of AD forest trust between AWS Managed AD and on-prem AD?

A

AWS -> OnPrem; OnPrem -> AWS; AWS <-> OnPrem

28
Q

Two benefits to AWS managed AD are: automated ______ and _________ (hint: DR)

A

Backups & Multi-region replication

29
Q

AD Connector: What is it?

A

Gateway Proxy to redirect AWS AD to onprem AD, but is basically useless if connection is down.

30
Q

What is the AWS service for AD called and when would you want to use it?

A

Simple AD with limited functionality; it can be small to large (5000-5000 users) it is compatible with MSFT AD but much simpler and smaller (lower cost/lower scale).

31
Q

SCPs do not affect _____________ roles.

A

Service-linked

32
Q

What is an SCP and how is it used?

A

Service Control Policy. Establishes rules/authorities at master/organizational level and that is propagated down other members of the organization.

33
Q

What is the IAM Policy Evaluation Order (pure memorization)?

A

Deny, Org SCP, Resource Based, Identity Based, IAM Permission Boundary, Session Policy

34
Q

What is the purpose of aws:TagKeys in an IAM policy?

A

To restrict or allow based on the presence or value of a particular tag.

35
Q

What’s the difference between “ForAllValues” and “ForAnyValue” and where might this apply.

A

These are conditional IAM policy statements. ForAll indicates that all key conditions need to be try. ForAny says that at least one must true.

36
Q

aws:RequestedRegion allows SCPs to do what?

A

Deny/Allow activity based on what region the user is using (e.g. only allow stuff to happen in us-east-1)

37
Q

What is IAM Identity Center and how might it be used?

A

Successor to AWS SSO; integrates with AD/Entry and can be used to do policy administration from an organizational level.

38
Q

What is ABAC?

A

Attribute Based Access Control. Essentially grants permissions based on user attributes.

39
Q

What is AWS Control Tower?

A

Old way of setting up and governing multi-account AWS environment. Can establish guardrails, etc.

40
Q

What is RAM and what is it used for?

A

Resource Access Manager (RAM). Share resources with other AWS accounts. Use with applications w/n same trust boundary or a high degree of interconnected applications. Used to avoid resource duplication;

41
Q

AWS prefers which two main identity methods to gain access to Console? ___________ & ___________

A

AWS SSO and Cognito

42
Q

What are the three Guardrail levels enforced by Control Tower?

A

Mandatory (required)
Strongly Recommended (based on best practices)
Elective (optional)

43
Q

What are two resources ARM cannot share?

A

Security groups and default VPC

44
Q

What are three examples of resources that ARM can manage (pure memorization) [there are a ton]? And which one is primarily shared (exam based question).

A

VPC subnets, AWSTransit Gateway and Route53. VPCs are commonly shared via RAM.

45
Q

What is a managed prefix list and why it might be used?

A

Resource Access Manager (RAM) related item that deals with having grouping different subnet prefixes that could be shared to different security groups or route tables. (example: Prefix A with 10.0.0.0/16; and 192.168.0.0/24)

46
Q

True/False: RAM can share Route 53 Outbound Resolver.

A

True

47
Q

Why would you use RAM to manage Route53 Outbound Rules?

A

Centrally Manage and share among different accounts

48
Q

Which of these is not supported for integration with IAM Identity Center? EC2 Windows, Business Cloud Apps (O365), EC2 Linux, SAML2.0

A

EC2 Linux

49
Q

What are two things CloudTrail logs?

A

History of events and API Calls

50
Q

What are Management Events in regard to CloudTrail?

A

Operations performed on resources

51
Q

S3 Object Activity and AWS Lambda Execution are what type of CloudTrail Event?

A

Data

52
Q

What function does CloudTrail Insights serve?

A

Creates a baseline of events and detects unusual activity/anomolies.

53
Q

What’s the default retention period of Cloud Trail and what should you do if you want to keep them longer?

A

90 days. Send them off to S3 to analyze with Athena

54
Q

What would you use this methodology for: CloudTrail -> CW Logs -> Metric Filters -> CW Alarm -> SNS

A

To leverage multiple AWS services to send an eMail when there is an unusual situation

55
Q

What is an Organizational CloudTrail?

A

Created in management account, children account send up to mgmt (consolidated trails)

56
Q

CloudTrail can take up to ____ minutes to get items delivered. If you want a faster reaction time, use:

A
  1. EventBridge.
57
Q

What is another way to refer to encryption at AWS?

A

Key Management Service (KMS)

58
Q

What is the difference between symmetric (AES-256) and Aymmetric (RSA/ECC Key pairs)?

A

Symmetric is necessary for envelope encryption (data & key are both encrypted); asymmetric is using the public key (encrypt) and private key (decrypt); used for encryption outside AWS

59
Q

How often are AWS Managed keys rotated?

A

Once annually.

60
Q

What is an External Key Material Origin?

A

You import key material into the KMS key (you manage it). Can’t be used with Custom Key Store and key cannot be auto rotated.

61
Q

What is an HSM and why might you want to use it?

A

Hardware Security Module. Physical system that manages encryption/keys. If you need high security.

62
Q

True/False: Multi-Region Keys are global.

A

False. They are created in a primary and then replicated to the different regions.

63
Q
A

SAP-C02 (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions