AWS IAM

Which of the following are managed using IAM (choose 2)

• A. Multi-Factor Authentication

• B. Bucket Policies

• C. Billing Reports

• D. Roles

• E. Security Groups

Answer explanation

MFA + Roles

IAM is used to manage users and their access to AWS, and AWS service, as well as access from one AWS resource to another including: Users, Groups, Roles, Access Policies, API Keys, Password Policies, Multi-Factor Authentication.

Security groups are manged through EC2 or VPC services.

Which user has no permission by default?

• EC2 user

• IAM user

• Root user

• Service user

IAM policy documents are written in which format?

• XML

• HTML

• JSON

• YAML

An IAM policy consists of one or more statements. A statement in an IAM Policy consists of the following, EXCEPT:

• Action

• Principal

• Effect

• Version

What is a proper definition of an IAM Role?

• IAM users in multiple user groups

• Permissions for users to perform actions

• An IAM entity that defines a set of permissions for making requests to AWS services and will be used by an AWS service

• An IAM entity that defines username and password

The security policy of an organization requires an application to encrypt data before writing to the disk. Which solution should the organization use to meet this requirement?

• AWS KMS API

• API Gateway with STS

• AWS Certificate Manager

• IAM Access Key

Answer explanation

Option B is incorrect – The AWS Certificate Manager can be used to generate SSL certificates to encrypt traffic in transit, but not at rest.

Option C is incorrect – It is used for issuing tokens while using the API gateway for traffic in transit.

Option D is used for secure access to EC2 Instances.

A customer wants to create a stream of EBS Volumes in AWS. The data on the volume is required to be encrypted at rest. How can this be achieved?

• Create an SSL Certificate and attach it to the EBS Volume.

• Use KMS to generate encryption keys which can be used to encrypt the volume.

• Use CloudFront in front of the EBS Volume to encrypt all requests.

• Use EBS Snapshots to encrypt the requests.

Answer explanation

Option A is incorrect since SSL helps to encrypt data in transit.

Option C is incorrect because it also does not help in encrypting the data at rest.

Option D is incorrect because the snapshot of an unencrypted volume is also unencrypted.

Which Amazon service assesses your AWS cloud for security vulnerabilities?

• • AWS CloudTrail

• Amazon Inspector

• • AWS Config

• • AWS CloudHSM

Answer explanation

Amazon Inspector automatically scans applications against AWS best practices to assess vulnerabilities. Admins can then act on Inspector's assessment reports, using AWS security tools to shore up weaknesses. The API-driven Inspector service fits within a DevSecOps approach as well, helping ensure fast, secure app deployments.

What is the main purpose of AWS Key Management Service (KMS)?

• • To allow administrators to manage keystrokes within their cloud

• • To automate passwords for repeated entry on the same terminal

• To enable administrators to establish and manage data encryption through an automated process
  

• • To provide a more user-friendly version of AWS IAM

  
  

Answer explanation

AWS KMS enables admins to establish encryption control from a centralized location. The service uses two levels of encryption: The data key encrypts each resource or piece of data, and the customer master key enables admins to import their own key material, instead of trusting KMS. Admins access KMS through the AWS IAM console, software development kit or command-line interface.