Quizz 1 Gameday AWS Security Advanced

Which of the following statements about policy documents are true?

• The Effect field of your policy document has 3 possible actions: Allow, Deny, and Explicit Deny

• An explicit deny overrides an allow

• You can attach identity-based policies to the root user

• AWS recommends assigning policies to individual users

A security engineer is configuring a new website that is named example.com. The security engineer wants to secure communications with the website by requiring users to connect to example.com through HTTPS.
Which of the following is a valid option for storing SSL/TLS certificates?

• Custom SSL certificate that is stored in AWS Key Management Service (AWS KMS)

• Default SSL certificate that is stored in Amazon CloudFront

• Custom SSL certificate that is stored in AWS Certificate Manager (ACM)

• Default SSL certificate that is stored in Amazon S3

Which of the following statements describes the principle of least privilege?

• Only assigning a user the minimum amount of permissions that they need to do their job

• Giving a user full permission to most services

• Giving a user too few permissions

• Standardizing permissions across all users in your company

A security engineer creates an Amazon S3 bucket policy that denies access to all users. A few days later, the security engineer adds an additional statement to the bucket policy to allow read-only access to one other employee. Even after updating the policy, the employee sill receives an access denied message.
What is the likely cause of this access denial?

• The ACL in the bucket needs to be updated

• The IAM policy does not allow the user to access the bucket

• It takes a few minutes for a bucket policy to take effect

• The allow permission is being overridden by the deny

What are the MOST secure ways to protect the AWS account root user of a recently opened AWS account? (Choose two.)

• Use the AWS account root user access keys instead of the AWS Management Console

• Enable multi-factor authentication for the AWS IAM users with the AdministratorAccess managed policy attached to them

• Use AWS KMS to encrypt all AWS account root user and AWS IAM access keys and set automatic rotation to 30 days

• Do not create access keys for the AWS account root user; instead, create AWS IAM users

• Enable multi-factor authentication for the AWS account root user

Which of the following statements about policy documents are true?

• The Effect field of your policy document has 3 possible actions: Allow, Deny, and Explicit Deny

• An explicit deny overrides an allow

• You can attach identity-based policies to the root user

• AWS recommends assigning policies to individual users

What would you use AWS Artifact for?

• For configuring and managing security in a single pane of glass

• For viewing all your security alerts from services like Amazon GuardDuty, Amazon Inspector, Amazon Macie, and AWS Firewall Manager

• For getting the compliance-related information that matters to you, such as AWS security and compliance reports or select online agreements

• For providing authentication, authorization, and user management for your web and mobile apps without the need for custom code

Which of the following services can you use to automate the process of storing, creating, and updating passwords for your applications and RDS instances?

• AWS Identify and Access Management (IAM)

• AWS Systems Manager Parameter Store

• AWS Key Management Service (KMS) Password Manager

• AWS Secrets Manager

If you have an AWS KMS-encrypted Elastic Block Storage (EBS) attached to a running Amazon EC2 instance whose KMS key has been deleted, how can you recover the data?

• EBS encryption can only use AWS SSE, not AWS KMS

• You cannot recover data from a deleted KMS key, even if the instance is running

• You cannot delete a KMS key that is being used with EBS encryption

• Simply attach a new EBS volume to the instance that is encrypted with a different AWS KMS key. Migrate the data to the new volume

How do you manage permissions for multiple users at once using AWS Identity and Access Management (IAM)?

• EC2 security groups

• Roles

• Policies

• Groups