Review Deck Flashcards
(142 cards)
1
Q
Amazon Macie
A
AI/ML security service that helps prevent data loss by automatically discovering, classifying, and protecting sensitive data stored in Amazon S3.
Machine Learning to recognize sensitive data (e.g., PII, intellectual property, etc.), assigns a business value, and provides visibility into where this data is stored and how it is being used in your organization.
Macie continuously monitors data access activity for anomalies, and delivers alerts when it detects risk of unauthorized access or data leak.
Macie can detect global access permissions set on sensitive data, detect upload of API keys inside source code, and verify data is stored and accessed according to customer compliance standards.
2
Q
Lambda@Edge
A
Lets you run Lambda functions to customize the content that CloudFront delivers, executing the functions in AWS locations closer to the viewer. Lambda@Edge functions run in response to CloudFront events, without provisioning or managing servers.
3
Q
You can use Lambda functions to change CloudFront requests and responses at the following points:
A
– After CloudFront receives a request from a viewer (viewer request)
– Before CloudFront forwards the request to the origin (origin request)
– After CloudFront receives the response from the origin (origin response)
– Before CloudFront forwards the response to the viewer (viewer response)
4
Q
HTTP 504
A
Gateway timeout error, usually results when a server is down.
5
Q
Amazon MQ
A
Message broker that supports industry-standard APIs and protocols so you can switch from any standards-based message broker without rewriting messaging code in existing applications.
6
Q
TRUE/FALSE: Step Scaling & Simple Scaling both require you to create CloudWatch alarms.
A
TRUE
7
Q
Step Scaling & Simple Scaling both require you to define whether to…
A
…add or remove instances, and how many, or set the group to an exact size.
8
Q
Step Scaling and Simple Scaling policies Both require you to…
A
…specify the high and low thresholds for the alarms.
9
Q
Simple vs Step Scaling Policies
A
The main difference is the step adjustments you get with step scaling policies. Step adjustments increase or decrease capacity of an Auto Scaling group based on the size of the alarm breach.
10
Q
Target Tracking Scaling Policy
A
Increase or decrease capacity of an Auto Scaling group based on a target value for a specific metric, adding/removing capacity to keep the metric at/near the specified target value.
In addition, a target tracking scaling policy also adjusts to changes in the metric due to a changing load pattern.
Helps resolve over-provisioning of your resources.
11
Q
Suspend and Resume scaling…
A
…is used to temporarily pause scaling activities triggered by scaling policies and scheduled actions.
12
Q
Cooldown periods…
A
…help to prevent the initiation of additional scaling activities before the effects of previous activities are visible.
13
Q
This policy must wait for a scaling activity or health check replacement to complete and a cooldown period to expire before responding to additional alarms.
A
Simple Scaling
14
Q
Use cases for signed URLs:
A
– RTMP distribution–signed cookies aren’t supported for RTMP distributions
– Restrict access to individual files
– Use when cookies aren’t supported by users’ clients
15
Q
Use cases for signed cookies:
A
– Provide access to multiple restricted files
– To avoid changing existing URLs
16
Q
Match Viewer
A
An Origin Protocol Policy which configures CloudFront to communicate with your origin using HTTP or HTTPS, depending on the protocol of the viewer request. CloudFront caches the object only once even if viewers make requests using both HTTP and HTTPS protocols.
17
Q
Field-Level Encryption…
A
…allows secure user-submitted uploads of sensitive information to a web server.
18
Q
TRUE/FALSE: To use signed urls will require changes to existing urls?
A
TRUE
19
Q
TRUE/FALSE: Amazon RDS provides metrics in real time for the operating system (OS) that your DB instance runs on.
A
TRUE
20
Q
Two ways you can view metrics for an RDS DB instance:
A
- By using the console
2. View Enhanced Monitoring JSON output from CloudWatch Logs in a monitoring system of your choice
21
Q
By default, Enhanced Monitoring metrics are stored in the CloudWatch Logs for…
A
…30 days
22
Q
To modify the amount of time the metrics are stored in the CloudWatch Logs…
A
…change the retention for the RDSOSMetrics log group in the CloudWatch console.
23
Q
Why are CloudWatch and Enhanced Monitoring Metrics different?
The differences can be greater if your DB instances use smaller instance classes, because then there are likely more virtual machines (VMs) that are managed by the hypervisor layer on a single physical instance. Enhanced Monitoring metrics are useful when you want to see how different processes or threads on a DB instance use the CPU.
A
CloudWatch gathers metrics about CPU utilization from the hypervisor for a DB instance, and Enhanced Monitoring gathers metrics from an agent on the instance. Because the hypervisor does additional work CloudWatch accounts for that in its CPU usage calculation.
24
Q
TRUE/FALSE: You can use CloudWatch to monitor CPU Utilization of a database.
A
False–although you can use CloudWatch to monitor CPU Utilization of a database instance, it will not provide CPU bandwidth usage or total memory consumed by each database process.
25
TRUE/FALSE: CPU% and MEM% metrics are readily available in the Amazon RDS console.
FALSE
26
CloudTrail Event
The record of an activity in an AWS account.
27
CloudTrail activities can be...
...an action taken by a user, role, or service that is monitorable by CloudTrail.
28
CloudTrail events provide a history of...
...API and non-API account activity in AWS Management Console, AWS SDKs, command-line tools, and other AWS services.
29
Two types of events that can be logged in CloudTrail:
Management events and data events.
30
What events will CloudTrail log by default?
By default, CloudTrail will log management events, but not data events.
31
TRUE/FLASE: A CloudTrail trail can be applied only to a single region.
FALSE--CloudTrail trails can be applied to all regions or a single region.
32
What is considered best practice when creating a CloudTrail trail?
It is considered best practice to create a trails that apply to all regions in the AWS partition you are working.
33
What is the default region setting when you create a trail in the CloudTrail console?
All regions
34
Global services... , events are delivered to any trail that includes global services, and are logged as occurring in US East (N. Virginia) Region.
AWS Identity and Access Management (IAM), AWS STS, Amazon CloudFront, and Route 53 (and maybe others...)
35
CloudTrail can be used to log events most events with the multi-region setting enabled, however...
...it will only cover activity occurring in regional services (EC2, S3, RDS etc.), not global services.
36
In order for CloudTrail to log activity occurring in global services, you have to add what events parameter in your AWS CLI command?
--include-global-service--
37
Amazon Elastic File System (EFS)...
...provides simple, scalable, elastic file storage for use with AWS Cloud services and on-premises resources, and when mounted on Amazon EC2 instances, EFS provides a standard file system interface and access semantics, which seamlessly integrate with existing applications and tools.
38
Can multiple EC2 instances access EFS simultaneously? And what is the benefit?
Yes, when used by multiple EC2 instances, EFS can serve as a common data source and shared file system for multiple workloads and applications on separate EC2 instances, making file sharing much faster.
39
Can multiple EC2 instances share the same EBS Volumes? Across AZs?
Yes, EC2 instances can share EBS volumes, but no, they cannot share EBS volumes across AZs. However, EC2 instances can share an EFS across AZs.
40
Is S3 the best choice for file storage?
No, is mainly used for “object storage”, and S3 does not provide the notion of “folders” too.
41
If you create or update a Lambda function that uses environment variables, does AWS Lambda encrypt them automatically? If so, how?
Yes, The first time you create or update Lambda functions that use environment variables in a region, a default service key is created for you automatically within AWS KMS. This key is used to encrypt environment variables.
42
Can you use the default KMS key to encrypt environment variables after a Lambda function is created?
No, you must create your own KMS key and choose it instead of the default key. The default key will give errors. Creating a new key also offers more flexibility, including the ability to create, rotate, disable, and define access controls, and to audit the encryption keys used to protect your data.
43
Network Access Control List (ACL)...
...is an optional layer of security that acts as a firewall, controlling traffic in and out of a VPC network, protecting one or more subnets. A network ACL is great for temporary or ad hoc protection, because you can easily add and remove restrictions in a matter of minutes.
44
Can IAM policies control network traffic in/out of a VPC?
No
45
TRUE/FALSE: Adding a rule to a security group can control inbound/outbound VPC network traffic?
FALSE, security groups act as firewalls at the instance-level. Adding a rule to a security group cannot influence traffic in/out of a VPC.
46
Storage Gateway (file gateway)...
...is both a service and a virtual software appliance deployed into an on-premises environment as a virtual machine (VM) using VMware ESXi, Microsoft Hyper-V, or Linux Kernel-based Virtual Machine (KVM) hypervisor. It serves as a file interface into S3, allowing customers to store and retrieve objects using industry-standard protocols, e.g., Network File System (NFS) and Server Message Block (SMB).
47
With a file gateway, you can:
– store and retrieve files directly using the NFS version 3 or 4.1 protocol.
– store and retrieve files directly using the SMB file system version, 2 and 3 protocol.
– access data directly in S3 from any AWS Cloud application or service
– manage S3 data using lifecycle policies, cross-region replication, and versioning
48
Storage Gateway supports which storage standards?
S3 Standard, Amazon S3 Standard-Infrequent Access, Amazon S3 One Zone-Infrequent Access and Amazon Glacier
49
TRUE/FALSE: Lifecycle policies work with storage gateway file shares?
TRUE--Objects stored in any storage class can be transitioned/archived to Glacier using a Lifecycle Policies. Although you can write directly to S3, lifecycle policies are recommended.
50
A DynamoDB stream is...
...an ordered flow of information about changes to items in an Amazon DynamoDB table. When you enable a stream on a table, DynamoDB captures information about every modification to data items in the table.
51
Whenever an application creates, updates, or deletes items in a table, DynamoDB Streams...
...writes a stream record with the primary key attribute(s) of the items that were modified.
52
A DynamoDB stream record...
...contains information about a data modification to a single item in a DynamoDB table. You can also configure streams so that stream records capture additional information, such as the “before” and “after” images of modified items.
53
DynamoDB and Lambda
Amazon DynamoDB is integrated with AWS Lambda so that you can create triggers—pieces of code that automatically respond to events in DynamoDB Streams. With triggers, you can build applications that react to data modifications in DynamoDB tables.
54
If you enable DynamoDB Streams on a table...
...you can associate the stream ARN with a Lambda function that you write. New records appear in the stream immediately after a table item changes. AWS Lambda invokes the Lambda function synchronously when it detects new stream records. The Lambda function can perform any actions you specify, such as sending a notification or initiating a workflow.
55
By default, DynamoDB Streams must be...
Enabled
56
FSx for Windows File Server...
...is Windows, Linux, and macOS accessible, fully managed Windows file servers and native Windows file system with the features, performance, and compatibility to easily lift and shift enterprise applications to the AWS Cloud. Thousands of compute instances and devices can access a file system concurrently.
57
FSx for Windows File Server...
...provides fully managed Microsoft Windows file servers, backed by a fully native Windows file system. FSx offers features, performance, and compatibility ideal for lift and shift to the AWS Cloud. It is accessible from Windows, Linux, and macOS compute instances and devices. Thousands of compute instances and devices can access a file system concurrently.
58
Server Message Block (SMB) protocol...
...is a network file sharing protocol that allows applications on a computer to read/write to files and request services from server programs in a computer network. The SMB protocol can be used on top of its TCP/IP protocol or other network protocols.
59
AWS Resource Access Manager (RAM)...
...enables you to easily and securely share AWS resources with any AWS account or within your AWS Organization. You can share AWS Transit Gateways, Subnets, AWS License Manager configurations, and Amazon Route 53 Resolver rules resources with RAM.
60
Single Sign-On (SSO) approach to temporary access...
Authenticating users in an organization’s network, and then providing them access to AWS without creating new AWS identities for them and requiring separate credentials.
61
AWS STS supports...
...open standards like Security Assertion Markup Language (SAML) 2.0, which is compatible with Microsoft AD FS, allowing organizations to leverage existing Microsoft Active Directory. You can also use SAML 2.0 to manage your own solution for federating user identities.
62
Amazon WorkDocs...
...provides users the ability to create, edit, and share content, and stored centrally on AWS, the content is accessible from anywhere on any device.
63
TRUE/FALSE: WorkDocs integrates directly with S3.
FALSE--There is no direct integration between WorkDocs and S3. WorkDocs is simply a managed content creation service.
64
A security group...
...acts as a virtual firewall at the instance-level--NOT the subnet-level--to control inbound and outbound traffic.
65
Per CIDR notation, /32 denotes... and the /0 refers to...
...one IP address...the entire network.
66
SSH protocol uses...
...TCP and port 22.
67
Amazon S3 is...
...object storage built to store/retrieve any amount of data from anywhere on the Internet that offers high durability, availability, performance, security, and virtually unlimited scalability at very low cost. S3 is also highly flexible, allowing users to store any volume or type of data; read data a million times or only for emergency disaster recovery; build a simple FTP app or a sophisticated web app; etc.
68
S3 Transfer Accelerator...
...can speed up content transfers to/from S3 as much as 50-500% for long-distance transfer of larger objects.
69
How long does it take for data to reach the destination bucket using s3 cross-region replication?
15 minutes
70
How long does it take, end-to-end, to transfer up to 80 TB of data into AWS Snowball Edge?
About one week
71
A Site-to-Site VPN is...
...used to establish a secure connection between an on-premises network and Amazon VPC.
72
Aurora Global Database is...
...designed for globally distributed applications, allowing a single Amazon Aurora database to span multiple AWS regions. It replicates data with no impact on database performance, enables fast local reads with low latency in each region, and provides disaster recovery from region-wide outages.
73
Aurora Global Database supports...
...sub-1-second storage-based replication latency.
74
Cross-Region Disaster Recovery is...
...a feature of Aurora Global Database that allows an assigned database in a secondary to be promoted to take over read/write capabilities in less than, in the event of an unplanned outage.
75
DynamoDB is...
...AWS's NoSQL database.
76
Global Accelerator is...
...a networking service that simplifies traffic management and improves application performance.
77
Hot storage refers to...
...the storage that keeps frequently accessed data ( hot data ).
78
Warm storage refers to...
...the storage that keeps less frequently accessed data ( warm data ).
79
Cold storage refers to...
...the storage that keeps rarely accessed data ( cold data ).
80
In terms of pricing, the colder the data...
...the cheaper it is to store, and the costlier it is to access when needed.
81
Amazon FSx For Lustre is...
...a high-performance file system for fast processing of workloads. Lustre is a popular open-source parallel file system which stores data across multiple network file servers to maximize performance and reduce bottlenecks.
82
Amazon FSx for Windows File Server...
...is a fully managed Microsoft Windows file system with full support for the SMB protocol, Windows NTFS, Microsoft Active Directory ( AD ) Integration.
83
Elastic File System (EFS) is...
...a fully-managed file storage service that makes it easy to set up and scale file storage in the Amazon Cloud.
84
CloudTrail is...
...a service that enables governance, compliance, operational auditing, and risk auditing of an AWS account. CloudTrail enables logging, continuous monitorinmg, and retention of account-wide AWS infrastructure activity. CloudTrail is enabled by default on account creation. AWS account activity is recorded as a CloudTrail event. Recent events are easily viewed in the CloudTrail console "Event History".
85
CloudTrail provides event history of...
...AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, API calls, and other AWS services. This event history simplifies security analysis, resource change tracking, and troubleshooting.
86
AWS X-Ray...
...helps debug and analyze microservices applications with request tracing to find the root cause of issues and poor performance.
87
Redshift Spectrum is...
...a feature of Redshift that enables queries and analysis of all data in Amazon S3 using the open data formats already in use, with no data loading or transformations needed.
88
Amazon Aurora Serverless is...
...an on-demand, auto-scaling configuration for Amazon Aurora. An Aurora Serverless DB cluster is a DB cluster that automatically starts up, shuts down, and scales up or down its compute capacity based on an application’s needs. Aurora Serverless provides a relatively simple, cost-effective option for infrequent, intermittent, sporadic or unpredictable workloads.
89
Aurora Serverless is good for unpredictable, sporadic workloads, because...
...it automatically starts up, scales compute capacity to match your application’s usage and shuts down when it’s not in use.
90
A non-Serverless DB cluster for Aurora is called a...
...provisioned DB cluster.
91
In the provisioned DB cluster Aurora model... works well when...
...users define DB instance class size and create Aurora Replicas to increase read throughput. When workload changes, the user can modify the DB instance class size and change the number of Aurora Replicas...the database workload is predictable, because you can adjust capacity manually based on the expected workload.
92
Aurora serverless is best when...
...workloads are intermittent and unpredictable, when heavy traffic may last a few minutes or it may last hours, or there may be long periods of light or no activity (e.g., retail websites with intermittent sales events, databases used for reports as-needed, dev/test environments, applications with uncertain requirements).
93
With Aurora Serverless...
...users can create a database endpoint without specifying the instance class size. Setting the minimum and maximum capacity, the database endpoint connects to a proxy fleet that routes the workload to a fleet of auto scaling resources. Connections are continuous as Aurora Serverless scales based on specified capacity limits.
94
TRUE/FALSE: With Aurora Serverless, database client applications need to change to use the proxy fleet.
FLASE
95
Aurora Serverless scales rapidly, because...
...it uses a pool of “warm” resources that are always ready for service requests.
96
Why is Aurora Serverless storage and processing decoupled?
To allow processing to scale down to zero, so accounts only pay for storage when compute isn't needed.
97
DynamoDB Global table is primarily used for...
...for massively scaled, global applications requiring a fully managed, multi-region, multi-master database with fast, local, read/write performance.
98
Amazon Redshift is...
...best used for online analytical processing (OLAP) and not for online transactional processing (OLTP).
99
Concurrency Scaling is...
...a Redshift feature that automatically and elastically scales a Redshift cluster's query processing power to ensure consistently fast performance for hundreds of concurrent queries.
100
AWS WAF is tightly integrated with...
...CloudFront, the Application Load Balancer (ALB), API Gateway, and AppSync – services commonly used for content delivery to websites and applications.
101
When using WAF with CloudFront...
...rules run in all AWS Edge Locations, located around the world closer to end-users so the added security doesn't compromise security. Requests are blocked before they reach web servers.
102
When using WAF on regional services, (e.g., Application Load Balancer, API Gateway, and AppSync)...
...rules run in the same region and can be used to protect both internet-facing and internal resources.
103
WAF rate-based rules...
...track the rate of requests from each originating IP address and trigger action on IPs with request rates exceeding a specified limit, which is set as the number of requests per 5-minute time span. This type of rule can be used to block temporarily requests from an IP address sending excessive requests.
104
What are the two types of web ACL rules a user can create?
Regular and Rate-Based
105
How will an Auto Scaling Group scale resources in, using the default termination policy?
If using multiple AZs instances will be terminated in the AZ with the most running instances. If more than one AZ have the same number of instances, scale in will favor the AZ with instances running the oldest launch configuration.
106
The Amazon S3 notification feature...
...allows users to setup notifications in response to certain events in an S3 bucket.
107
To enable SNS notifications on an S3 bucket...
...add a notification configuration to identify the events S3 should publish and destinations S3 should send those notifications, and store the configuration in the notification sub-resource associated with a bucket.
108
S3 supports the following event publication destinations:
– Simple Notification Service (SNS) topic
– Simple Queue Service (SQS) queue
– Lambda
109
The SNS fanout scenario is...
...when a message published to an SNS topic is replicated and pushed to multiple endpoints, such as SQS, HTTP(S) endpoints, or Lambda functions, which allows parallel asynchronous processing.
110
S3 Bucket SNS Use Case
An application publishes a message to an SNS topic when an order is placed, then all subscribed SQS queues receive identical notifications of the order. EC2 instances attached to the SQS queues process the order.
111
In a scenario where multiple teams need to be notified of S3 bucket activity...
...a combination of SNS and SQS can be used. The SNS message fanout feature allows multiple SQS queues to subscribe to an SNS topic, so when SNS receives an event notification, it will publish the message to both subscribers.
112
TRUE/FALSE: S3 event notifications can go to multiple destinations (e.g., SNS topics, SQS queues).
FALSE--S3 event notifications are designed to be delivered to one destination only; event notifications will not go to more than one destination. SNS receives event notifications and republishes them to resources subscribed to the relevant SNS topic.
113
SNS FIFO topics and SQS FIFO queues are used to...
...provide strict message ordering and message deduplication. SNS and SQS FIFO capabilities work together, acting as a fully managed service that integrates distributed applications that require near-real-time data consistency.
114
TRUE/FALSE: SQS polls SNS.
FALSE--SQS can't poll SNS, SQS queues are configured to subscribe to SNS topics.
115
DynamoDB Accelerator (DAX) is...
...a fully managed, highly available, in-memory cache that can reduce DynamoDB response times from milliseconds to microseconds, even at millions of requests per second.
116
AWS Device Farm is...
...an app testing service that lets you test and interact with your Android, iOS, and web apps on many devices at once, or reproduce issues on a device in real time.
117
DynamoDB Auto Scaling is primarily used to...
...automate capacity management for your tables and global secondary indexes.
118
Relational Databases are best for what types of workloads?
E.g., ad hoc queries; online analytical processing
119
DynamoDB is best for what types of workloads?
E.g., web-scale applications like social networks, gaming platforms, media sharing, and IoT
120
The relational data model requires...
...well defined schemas that normalize data in tables, organizing variables in rows and columns.
121
The DynamoDB data model...
...is schema-less. Each table has a primary key to uniquely identify each data element, but non-key attributes should not share any similar constraints. DynamoDB can manage structured or non-structured data, including JSON documents.
122
SQL stands for...
...Structured Query Language
123
RDBs are optimized for...
...storage, so performance depends on the disk subsystem. Performance is optimized by managing queries, indexes, and table structures.
124
DynamoDB is optimized for...
...compute, so performance is a function of the hardware and network latency, but it's a managed service, so customer applications are insulated from these implementation details.
125
Scaling RDbs is most easily achieved by...
...migrating to faster hardware, or it is also possible to leverage a distributed system and configuring tables to span across multiple hosts, but RDbs have constraints on the number and size of files, limiting scalability.
126
DynamoDB is designed to scale out using...
...distributed hardware clusters, which allows for increased throughput w/o impacting latency. Customers simply specify throughput requirements and DynamoDB allocates resources to meet those requirements. There are no limits on the number of table items or the total size of a table.
127
Relational database systems do not scale well because:
– Normalize data and stores multiple tables and require multiple queries to write to disk
– Generally incur performance costs of ACID-compliant transaction systems
– Use expensive joins to reassemble required views of query results
128
DynamoDB scales well because:
– Its schema flexibility lets DynamoDB store complex hierarchical data within a single item
– Composite key design lets it store related items close together on the same table
129
Is DynamoDB totally schemaless?
No, the very definition of a schema is just the model or structure of data. Data in DynamoDB has a structure.
130
API Gateway is...
...a fully managed service that makes publishing, maintaining, monitoring, and securing APIs easier at any scale, using AWS Management Console to create APIs that act as the “front door” for applications to access data, business logic, or functionality from back-end services. API Gateway handles all tasks involved in accepting and processing up to hundreds of thousands of concurrent API calls, including traffic management, authorization and access control, monitoring, and API version management.
131
API Gateway throttling limits...
API Gateway provides throttling at multiple levels, including global and by service call, that can be set for standard rates and bursts. For example, API owners can set a rate limit of 1,000 requests per second for a specific method in their REST APIs, and also configure Amazon API Gateway to handle a burst of 2,000 requests per second for a few seconds.
132
Customers can subscribe to Shield Advanced for...
...increased protection against attacks targeting applications running on EC2, ELB, CloudFront, and Route 53 resources, beyond the network and transport layer protections that come with Standard. Shield Advanced provides additional detection and mitigation against large and sophisticated DDoS attacks, near real-time visibility into attacks, integration with AWS WAF, 24×7 access to the AWS DDoS Response Team (DRT), and protection against charges caused by DDoS related spikes in EC2, ELB, CloudFront, and Route 53 resource activity.
133
Firewall Manager is mainly used to...
...simplify your AWS WAF administration and maintenance tasks across multiple accounts and resources.
134
AWS WAF can help block common attack patterns against a VPC such as...but it is not enough to mitigate...
...SQL injection or cross-site scripting...sophisticated DDoS attacks, for which customers should use Shield Advanced.
135
The custom key store feature in KMS...
...combines the control provided by CloudHSM with KMS's ease of integration, allowing customers to configure and maintain a CloudHSM cluster authorized for use by KMS as a dedicated key store into which KMS will generate key material, so the key material will never be exposed as plaintext.
136
AWS CloudHSM is...
...a fully managed cryptographic service for creating and maintaining hardware security modules (HSMs) in the AWS environment.
137
HSMs are...
...computing devices that process cryptographic operations and provide secure storage for cryptographic keys.
138
Use CloudHSM to...
...offload SSL/TLS processing for web servers, protect private keys linked to an issuing certificate authority (CA), or enable Transparent Data Encryption (TDE) for Oracle databases.
139
HSMs in CloudHSM can perform a variety of cryptographic tasks, including:
- Generate, store, import, export, and manage cryptographic keys, including symmetric keys and asymmetric key pairs
- Use symmetric and asymmetric algorithms to encrypt and decrypt data
- Use cryptographic hash functions to compute message digests and hash-based message authentication codes (HMACs)
- Sign data (including code signing) and verify signatures
- Generate secure random data
140
Keys generated in AWS KMS are protected by...
...FIPS 140-2 validated cryptographic modules
141
TRUE/FALSE: KMS custom key store feature is suitable to enable a customer to audit the use of their keys independent of AWS KMS or AWS CloudTrail.
TRUE
142
RDS events only provide...but data-modifying events (INSERT, DELETE, UPDATE) can be...
...operational events such as DB instance events, DB parameter group events, DB security group events, and DB snapshot events...using native functions or stored procedures.
