Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Developer Certification > AWS Security & Encryption > Flashcards

AWS Security & Encryption Flashcards

1
Q

How do you prevent a man in the middle attack?

A

Encryption in Flight (SSL) - SSL certificates allow for HTTPS encryption. Data is encrypted before sending and decrypted after receiving.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

How does a server protect data?

A

Server side encryption at rest - data is encrypted after being received by the server, and decrypted before being sent. This encryption is enabled by a data key, and is a separate process to SSL.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How can a client protect data?

A

Client side encryption - data is encrypted by the client and never decrypted by the server - instead is is decrypted by a receiving client

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How can you analyse KMS Key usage?

A

Can audit KMS Key usage using CloudTrail

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What type of KMS keys do AWS services that are integrated with KMS use?

A

Symmetric keys (AES-256)
- Single encryption key used for both encryption and decryption
- Never get access to the KMS Key unencrypted - must call KMS API to use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How would you allow encryption by users outside of AWS, who can’t call the KMS API?

A

Asymmetric keys (RSA & ECC key pairs)
- Public (encrypt) and Private (decrypt) pairs
- Public key is downloadable, but cannot access the private key unencrypted

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How would you move an encrypted EBS volume across regions?

A

Would need to create a snapshot of the volume, then reencrypt with a different KMS key (KMS keys cannot be used across regions).
- Move the new snapshot across and restore.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How can you control access to KMS keys?

A

KMS Key Policies - similar to bucket policy, except default access for a key with no policy is no access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the default key policy, and when is it created?

A

Created if you don’t provide a specific key policy
- complete access to the key to the root user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How can you allow cross-account access of a KMS key?

A

Create a custom key policy and allow access for specific account

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the max size limit for KMS encryption via the Encrypt API?

A

4kb

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How do you encrypt > max size limit for Encrypt API?

A

Use Envelope Encryption using the GenerateDataKey API (generates a unique symmetric data key - DEK - and returns a plaintext copy of the DEK along with a copy encrypted using the CMK you specify)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What calls should you use for envelope encryption - for both ‘now’ and ‘in the future’?

A

GenerateDataKey for ‘now’
GenerateDataKeyWithoutPlaintext for ‘in the future’

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How would you avoid getting a ThrottlingException for KMS?

A
  • Reduce number of calls via Exponential Backoff
  • For GenerateDataKey, cache the DEK (caching is available through the Encryption SDK)
  • Request a Request Quota increase through API or AWS support
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How can you reduce the number of KMS calls made by S3?

A

Use SSE-KMS encryption
- A ‘S3 bucket key’ is generated, and is used to encrypt KMS objects with new data keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the architectural difference between KMS and CloudHSM?

A

KMS - AWS manages the software for encryption
CloudHSM - AWS provisions encryption hardware (Hardware Security Module)

17
Q

What is a use case for CloudHSM?

A

SSE-C : server side encryption with customer owned keys. the HSM is using customer keys entirely.

18
Q

What is a high level functional difference between KMS and CloudHSM?

A

HSM uses IAM permissions to perform CRUD operations on an HSM Cluster, and CloudHSM Software is used to manage the keys and users.
- KMS performs all of the above using IAM permissions

19
Q

Describe the CloudHSM flow for encrypting and EBS Volume, and give a benefit of this setup.

A
  • Configure a KMS Custom Key Store with CloudHSM
  • Associate the EBS volume with the Custom Key Store

The Custom Key Store logs key usage to CloudTrail

20
Q

What is the purpose of SSM Parameter Store?

A

Secure storage for configuration and secrets

21
Q

How can you access parameters from the SSM Parameter store?

A

GetParameters or GetParametersByPath API

22
Q

What is a key difference between the standard and advanced parameter tiers?

A

Max size of a param: 4KB for standard, 8kb for advanced

23
Q

What are some features of Parameter Policies? What tier is this available to?

A
  • Assign TTL to a parameter to force update or delete of sensitive data
  • Can assign multiple policies at a time.

Advanced Tier only

24
Q

What service would you use to store secrets that are regularly rotated for security?

A

AWS Secrets Manager
- Can force rotation of secrets on a schedule
- Secrets are encrypted using KMS

25
Q

How do Multi-Region Secrets work?

A

Replicate secrets across regions
- Secrets Manager keeps read replicas in sync with the primary Secret

26
Q

How can you automatically generate a managed password for RDS & Aurora with CloudFormation?

A

Under Resources.{ClusterName}.Properties, add ManageMasterUserPassword: true
- This will generate an admin password for the DB and automatically create a Secret for this password within Secrets Manager.

27
Q

How can you generate a secret with a dynamic reference for RDS & Aurora with CloudFormation?

A

Define the secret under Resources (AWS::SecretsManager::Secret), and pass that in as a dynamic reference to the DB Instance definition (for username and password)
- Also have to link the declared Secret to the DB instance (AWS::SecretsManager::SecretTargetAttachment)

28
Q

Give some differences between SSM Parameter Store and Secrets Manager

A

Secrets manager provides automatic rotation of secrets by invoking Lambda (generates a new password for the specified service, and stores the password in Secrets manager), and KMS encryption in mandatory.
- Parameter Store has no secret rotation, and encryption is optional

29
Q

How can you replicate Rotation of parameters in Parameter Store?

A

Set up CloudWatch events to invoke Lambda every 30 days and update the desired parameter.

30
Q

How can you encrypt CloudWatch Logs with KMS keys?

A

Encryption is enabled at the log group level, by associating a CMK with a log group
- Must use the CloudWatch Logs API, cannot use the console
- associate-kms-key (if log group already exists) or create-log-group, providing the key as a param

Note: Key Policy must allow the key to be associated with CloudWatch

31
Q

How can you store secrets within a CodeBuild?

A

Don’t store secrets in env. variables as plaintext.
- Configure the env. variables to pull in value from Parameter Store or Secrets Manager

32
Q

What is an option for storing/processing highly sensitive data within AWS?

A

Nitro Enclaves - isolated compute environment for Personally Identifiable Information (PII), healthcare, financial…
- Fully isolated machines that only run authorized (signed) code
- Use cases: securing private keys, processing credit cards

33
Q

How can Parameter Store enable you to keep track of changes to parameters?

A

Parameter Store provides version tracking of configurations/secrets

AWS Developer Certification (27 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions