Security Flashcards
Server side encryption means that the data is sent encrypted to the server first
False
In server side encryption, only the encryption happens on the server. Where does the decryption happen?
- The Server
- The Client
The Server
We need to gain access to a Role in another AWS account. How is it done?
- We should ask for them to create a user for us
- We should ask for them to send us access key
- We should use the STS service to gain temporary credentials
We should use the STS service to gain temporary credentials
You have a mobile application and would like to give your users access to their own personal space in Amazon S3. How do you achieve that?
Use Cognito Identity Federation
You need an encryption service that supports asymmetric encryption schemes. Which service could you use?
CloudHSM
We’d like to encrypt 100MB of data client side before uploading it to S3. We should use
Envelope Encryption
You would like to ensure data is encrypted client side before being sent to Kinesis. What should you use?
You must create custom code
Which technology allows you to access the AWS service from your private subnets without the need to have an outgoing internet connection?
VPC Endpoints
What do you need to attach to an IoT rule’s engine action to ensure it’s capable of sending data directly into Kinesis?
An IAM role
Which of the following statement is wrong?
- DynamoDB Streams cannot be encrypted
- DynamoDB security is done through IAM
- Users must be created within DynamoDB
- DynamoDB supports only table creation, not database creation
Users must be created within DynamoDB (The entire security in DynamoDB is managed through IAM, we don’t need to create users within DynamoDB (unlike RDS))
Which of the following services is accessed through a VPC Endpoint of type Interface ?
- Kinesis
- DynamoDB
- S3
Kinesis
What security mechanism does not exist for RDS?
- KMS at rest encryption
- CloudHSM at rest encryption
- SSL encryption
- Transparent Data Encryption
CloudHSM at rest encryption
You would like to deploy a Lambda function to privately access your RDS database. Under the default options, your Lambda function cannot reach your RDS database due to a network issue. How can you resolve it?
Deploy your Lambda function in your VPC
Which statement about EMR security is incorrect?
- You can SSH into your cluster nodes.
- EMRFS supports S3 encryption
- Apache Ranger is packaged within EMR
- EMR supports LUKS encryption
- EMR supports Kerberos
- There are two security groups assigned between your different cluster nodes
Apache Ranger is packaged within EMR (If you choose to use Ranger, it must be installed externally from your EMR cluster. Recommended read: https://aws.amazon.com/blogs/big-data/best-practices-for-securing-amazon-emr/)
Which of the following login is not supported by Kibana?
- Using and IAM user
- Using Cognito
- Using an email / password combination
Using an email / password combination
Which at rest encryption is not supported by Redshift?
- KMS
- CloudHSM
- External HSM
- LUKS
LUKS (this is for EMR)
Your users are federated using the web identity provider amazon.com. What does the following policy do?
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Effect": "Allow",
"Resource": ["arn:aws:s3:::mybucket/${www.amazon.com:user_id}/*"]
}
]
}Allow users federated through amazon.com to upload and download objects from a bucket that is named after their username
Someone has deleted your Redshift cluster and you would like to find out who or what it was. How can you do it?
Use CloudTrail
You have enabled encryption for your Redshift cluster and loaded 7 TBs of data into the cluster. It turns out that encryption was not required on this cluster after all. You want to make a change and ensure that the cluster is not encrypted. What are your options? (Choose 2)
- Restore from the latest snapshot.
- Delete the KMS managed keys.
- Unload the data into S3 and reload it into a cluster that is not encrypted.
- Create a new cluster that is not encrypted and reload the data.
- Check the decrypt checkbox in the Redshift modification options.
- Unload the data into S3 and reload it into a cluster that is not encrypted.
- Create a new cluster that is not encrypted and reload the data.
(Once you enable encryption for a Redshift cluster upon launch, you can cannot then change it to an unencrypted cluster. You’ll have to unload the data and reload the data into a new cluster with your new encryption setting. Alternatively, if you still have the data in S3 or other supported source, then load the data into a new cluster with your new encryption setting. When you encrypt a Redshift cluster, data blocks and system metadata are encrypted for the cluster and its snapshots.)
Which of the following mechanisms work together to encrypt data at rest on instance store volumes and EBS volumes? (Choose 2)
- TrueCrypt
- Open-source HDFS Encryption
- LUKS
- DriveCrypt
- Open-source HDFS Encryption
- LUKS
Your organization is going to use EMR with EMRFS. However, your security team requires that you both encrypt all data before sending it to S3 and that you maintain the keys. Which encryption option should be used?
- CSE-KMS
- SSE-S3
- CSE-Custom
- SSE-KMS
-CSE-Custom
(In this case, you would use CSE-Custom, where you would encrypt the data before sending it to S3 and also manage the client-side master key. The other encryption options available are: S3 Server-Side Encryption (SSE-S3), S3 manages keys for you; Server-Side Encryption with KMS–Managed Keys (SSE-KMS), S3 uses a customer master key that is managed in the Key Management Service to encrypt and decrypt the data before saving it to an S3 bucket; Client-Side Encryption with KMS-Managed Keys (CSE-KMS), the EMR cluster uses a customer master key to encrypt data before sending it to Amazon S3 for storage and to decrypt the data after it is downloaded.)
True or False: AWS Key Management Service supports both symmetric and asymmetric encryption.
False
(The Key Management Service supports symmetric encryption only. Symmetric encryption is when the same keys are used to perform encryption and decryption.)
Which of the following are not characteristics of CloudHSM? (Choose 2)
- Usage-based pricing
- Supports symmetric and asymmetric encryption
- Highly available and durable
- Customer-managed root of trust
- Single-tenancy
- Usage-based pricing
- Highly available and durable
(Usage-based pricing and high availability/durability are characteristics of the Key Management Service.)
True or False: When using a hardware security module with Redshift, you can only use CloudHSM.
False
(You can use either an on-prem HSM or you can use CloudHSM, or both, to ensure high-availability and access to the keys. Further information: http://docs.aws.amazon.com/cloudhsm/latest/userguide/configuring-ha.html)
