AWS Developer Dominio 2: Seguridad

Which tool helps you audit an IAM policy to identify allowing and denying access to a particular resource?

• IAM Policy Simulator

• IAM Profile Control

• IAM Control Simulator

• IAM Access Simulator

Wich element of an IAM Policy is optional, and allows to control when the included permissions are effective?

• Statment ID (Sid)

• ID

• Action

• Condition

What is not possible way to athenticate a principal via IAM?

• User name and password

• Access Key

• Access Key/Session Token

• Service Account

Security and compliance is a shared responsibility between AWS and the customer. Which of the following activities are the resposibility of the customer while using AWS Cloud services? (Choose all thar apply)

• To able to stop unauthorized access to the physical data center

• Make sure the servers have been kept up to date

• Setting up networking firewall rules

• Encryption of sensitive data at rest

• Management of user credentials via IAM

A company is using Amazon API Gateway for its REST APIs in an AWS account. The security team wants to allow only IAM users from another AWS account to access the APIs.

Which combination of actions should the security team take to satisfy these requirements? (Select TWO.)

• Create an IAM permission policy and attach it to each IAM user. Set the APIs method authorization type to AWS_IAM. Use Signature Version 4 to sign the API requests.

• Create an Amazon Cognito user pool and add each IAM user to the pool. Set the method authorization type for the APIs to COGNITO_USER_POOLS. Authenticate using the IAM credentials in Amazon Cognito and add the ID token to the request headers.

• Create an Amazon Cognito identity pool and add each IAM user to the pool. Set the method authorization type for the APIs to COGNITO_USER_POOLS. Authenticate using the IAM credentials in Amazon Cognito and add the access token to the request headers

• Create a resource policy for the APIs that allows access for each IAM user only.

• Create an Amazon Cognito authorizer for the APIs that allows access for each IAM user only. Set the method authorization type for the APIs to COGNITO_USER_POOLS.

Answer explanation

A, D - A resource policy can be used to grant API access to one AWS account to users in a different AWS account using Signature Version 4 (SigV4) protocols.

A company is using a Redshift cluster to store their data warehouse. There is a requirement from the Internal IT Security team to encrypt data for the Redshift database. How can this be achieved?

• Encrypt the EBS volumes of the underlying EC2 Instances.

• Use AWS KMS Customer Default master key.

• Use SSL/TLS for encrypting the data.

• Use S3 Encryption.

A customer wants to create a stream of EBS Volumes in AWS. The data on the volume is required to be encrypted at rest. How can this be achieved?

• Create an SSL Certificate and attach it to the EBS Volume.

• Use KMS to generate encryption keys which can be used to encrypt the volume.

• Use CloudFront in front of the EBS Volume to encrypt all requests.

• Use EBS Snapshots to encrypt the requests.

The security policy of an organization requires an application to encrypt data before writing to the disk. Which solution should the organization use to meet this requirement?

• AWS KMS API

• AWS Certificate Manager

• API Gateway with STS

• IAM Access Key

Your IT Security department has mandated that all data on EBS volumes created for underlying EC2 Instances needs to be encrypted. Which of the following can help achieve this?

• AWS KMS

• AWS Certificate Manager

• API Gateway with STS

• IAM Access Key

Amazon Cognito supports web identify federation trhough _.

• Custom sign-in code or own user identities

• A configuration check for rules that deny access to specific ports

• Facebook, Google and Amazon

• A AWS user group