Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Security Certification > Data Protection > Flashcards

Data Protection Flashcards

1
Q

What is a CMK ?

A

A CMK is a customer or amazon managed key that is stored in a FIPS 140-2 Hardware Security Module (HSM)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Can you interact with the CMK outside of the KMS service ?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How can you interact with the CMK ?

A

API, CLI, Console and Code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the three common properties every CMK has ?

A

KeyId, Alias and ARN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the data key ?

A

This is a key thats derived from the CMK and is responsible for the actual cryptographic operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Can you use the data key outside of KMS ?

A

Yes - You can call the GenerateDataKey api call, save the data key to a file, base 64 decode it and use it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How can you scale KMS ?

A

Store datakey in memory, use multiple keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a CMK grant ?

A

It as a programatic way of giving a subset of the permissions contained in the key policy to a service or caller.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Are CMK grants automatically removed ?

A

No you must remove them after the operation that required them has finished.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Why use CMK grants ?

A

They are an easy non permanent way of giving access to a keys operations in a least privilege manner.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the default key policy ?

A

This is assigned to every key on creation and at its most basic gives the root user of the org kms:* in order to prevent lockout.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the division of responsibilities in KMS ?

A

There is a clear division between those that can administer the keys and those that can use them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Can you create a CMK grant for a CMK in a different account ?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Can CMK grants deny permissions ?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Why use a CMK grant token ?

A

With CMK grants there is eventual consistency when being deleted, created or used a grant token allows for immediate use and the effect to be immediate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the CMK grant limit per key ?

A

50000

17
Q

Can a CMK grant create a grant ?

A

Yes via kms:CreateGrant

18
Q

What is the danger of key deletion ?

A

Deleting a key means that you cannot decrypt information thats been encrypted with that key.

19
Q

What is a safer alternative to key deletion ?

A

Marking the key as disabled

20
Q

What are the key rotation properties of KMS ?

A

AWS managed keys are rotated every two years and for customer managed CMKs every one year.

21
Q

What is the kms:CallerAccount condition for ?

A

Controls which accounts have access to the keys permissions

22
Q

What is the kms:ViaService condition for ?

A

Controls which services have access to the keys permissions

23
Q

Can you have a dedicated HSM ?

A

Yes

24
Q

When a key is marked with a status of import what does this mean ?

A

That it doesnt have any key material

25
Q

What is the advantage of generating your own key material for KMS Keys ?

A

The ability to prove key material creation from an approved source that meets your randomness requirements
Use key material from your own infrastructure with AWS services
Gain the ability to expire key material or delete it or make it available again
Own the original copy of the key material outside of AWS for additional durability and disaster recovery

26
Q

Can you have a rotation policy of less that a year with a customer CMK ?

A

Yes by selectively adding and removing the key material.

27
Q

What key options are there for KMS ?

A

Amazon managed, Customer Managed, Externally created and then imported into KMS

28
Q

Can I modify an AWS managed key ?

A

No - It is created and managed by amazon you have no control over its naming or tagging or the permissions created

29
Q

Can I delete a key immediately ?

A

No you can only mark it for deletion between 7 and 30 days

30
Q

Can a key marked for deletion still be used for encryption ?

A

No

31
Q

What is an encryption context ?

A

A key value pair or pairs sent in the decryption operation that can be checked before the operation succeeds. It is recommended that this is not secret information because it is stored in clear text in cloudtrail as part of the request.

AWS Security Certification (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions