Font size
S
M
L
XL
WorksheetsAWS Security 02 cnetbuild
Total questions: 60
Worksheet time: 15hrs 0mins
Name
Class
Date
1.
Which of the following is a valid type of IAM Policy
a)
All of these
b)
AWS Managed Policies
c)
Customer Managed Policies
d)
Inline Polices
2.
A Power User can do everything accept access identify management
a)
true
b)
false
3.
An Admin User can touch everything accept
a)
billing
b)
identity management
c)
cloudwatch
d)
CloudHSM
4.
Power Users are part of which policy?
a)
All of these
b)
AWS Managed Policies
c)
Customer Managed Policies
d)
Inline Polices
5.
You are concerned that AWS might make a policy change that could break something. What would you use
a)
Customer Managed Policies
b)
AWS Managed Policies
c)
Inline Policy
d)
None of these
6.
You want to create a policy to apply to one person
a)
inline policy
b)
customer managed policy
c)
aws managed policy
d)
none of these
7.
S3 Bucket Policy can be attached to
a)
S3 Bucket
b)
Users
c)
EC2 Instances
d)
All of these
8.
You created a policy using policy generator but when you try to add that policy, you get an error. Why?
a)
Add /* to the resource
b)
Policy generator is outdated
c)
The ARN is wrong
d)
You need to specity S3 as the resource
9.
How do you overrride an explicit deny?
a)
You can't
b)
Explicity Allow
c)
Use an Allow at the user level
d)
Use an Amazon Policy
10.
You would like to apply access to an individual file in S3. What would you use?
a)
S3 ACL in the CLI
b)
IAM Policies
c)
S3 Bucket Policies
d)
S3 ACL in the console
11.
Bucket policies are limited to __ in size
a)
20 kb
b)
20 mb
c)
10 kb
d)
10 mb
12.
When an S3 request is made, the authorize decision depends on which
a)
A union of all these answers
b)
IAM Policies
c)
S3 Bucket Policies
d)
S3 ACL
13.
T/F with Least-Privilege, decisions always default to Deny
a)
true
b)
false
14.
If no method specifies an allow, the request will be __ by default
a)
Denied
b)
Allowed
15.
To determine polict conflicts, look for all the policies and
a)
All of these
b)
first, look for a deny. If found? Denied. Done
c)
Second, look for an allow. If found, allow. Done.
d)
Third, if neither first or second, it is denied
16.
Forcing S3 to use SSL (HTTPS) is done with
a)
Bucket Policy
b)
ACL
c)
AIM Policy
d)
Amazon Certificate Manager (ACM)
17.
How do you tell S3 to use SSL with the Policy JSON? ___ if Condition Bool is ___
a)
Deny, AWS:Secure Transfort is false
b)
Allow, AWS:Secure Transport is False
c)
Deny, AWS:Secure Transport is True
18.
By default, S3's cross region replication uses SSL and you do not need to create any policies to turn on SSL
a)
true
b)
false
19.
Using Cross Region Replication for S3, you can replicate from a source to __
a)
One destination only
b)
Multiple Destinations
20.
S3 Cross Region Replication does/does not require versioning to be enabled
a)
does
b)
does not
21.
What S3 Bucket access would allow someone to set up Cross Region Replication?
a)
Either of these answers
b)
Admin Access
c)
Read and Read_ACP
d)
None of these
22.
Security best practice for S3 Cross Region Replication says __ to the destination
a)
Use a dedicated account with only replication rights
b)
Use an admin account
c)
Use a dedication account with R/W rights
d)
Use a dedicated account with replication and delete rights
23.
When you turn on S3 Cross Region Replication, any existing objects in the bucket will replicate
a)
false
b)
true
24.
S3 Cross Region Replication will replicate which of the following
a)
All of these
b)
Object Metadata
c)
Object ACL Updates
d)
Object Tags
e)
Delete Marker
25.
S3 Cross Region Replication will replicate all encrypted files except those encrypted with __
a)
Customer provided keys (SSE-C)
b)
KMS (explicitly enabled)
c)
Amazon S3 managed keys (SSE-S3)
d)
None of these
26.
If you delete a version of a file, S3 Cross Region Replication will/will not replicate that deletion
a)
will not
b)
will
27.
T/F Versioning must be enabled for S3 Cross Region Replication
a)
true
b)
false
28.
T/F Best practice is to replicate CloudTrail logs using S3 Cross Region Replication
a)
true
b)
false
29.
You have a custom URL and want CloudFront to use an SSL for that URL. What must you do?
a)
Import the custom cert with Amazon Credential Manager (ACM) in US-East-1 Region
b)
Add the cert to the S3 Bucket Policy
c)
Use the default CloudFront Cert
d)
Import it into IAM using the API
e)
Use an Elastic Load Balancer Certificate in the US-East-1 region
30.
You noticed public access to the CloudFront logs. How do you lock that down?
a)
All of these
b)
First, Edit CloudFront Origin
c)
Second, select Restrict Bucket Access=yes
d)
Third Create new identy (or use existing
e)
Fourth, update the bucket policy to allow read
31.
You set up CloudFront to use SSL to access the logs. Upon testing access to the logs, you receive an SSL error. Why?
a)
Custom SSL Cert isn't in ACM in US-East-1
b)
Custom SSL Cert isn't in ACM Global
c)
Custom SSL Cert isn't on the S3 Bucket Policy
d)
You are using the Default CloudFront Cert
32.
PreSign URLs are used to access S3 content. They can be created by using which
a)
All of these
b)
SDK
c)
CLI
d)
Neither of these
33.
By default, an S3 PreSigned URL will exist for
a)
1 hour
b)
30 seconds
c)
30 minutes
d)
360 seconds
34.
An S3 PreSigned URL will exist for a limited amount of time. To define that time, what option do you add to the presign creation command?
a)
--expires-in
b)
--expires-on
c)
--expires-with
d)
--expires
35.
When using Security Token Service (STS) users come from where
a)
All of these
b)
Federation (ex Active Directory)
c)
Web Identity Federation (OpenID)
d)
Cross AWS Account Access
36.
With Security Token Service, Federated users __ be a user in IAM
a)
do not need to be
b)
must
37.
When you connect Active Directory to AWS using STS, it uses which
a)
SAML
b)
All of these
c)
JSON
d)
XML
38.
This is a service that allows you to take an identity from Point A and join it (federate it) to Point B)
a)
Identity Broker
b)
Identity Store
c)
Identities
d)
Federation
39.
This is a service like Active Directory, Facebook, Google, etc
a)
Identity Store
b)
Identity Broker
c)
Identities
d)
Federation
40.
When STS is called upon, it returns which of the following
a)
All of these
b)
Access Key
c)
Secret Access Key
d)
Token
e)
Duration (Token Lifetime)
41.
What is the maximum STS token lifetime?
a)
36 hours
b)
1 hour
c)
2 hours
d)
8 hours
42.
A user enters their active directory credentials into a web application. That is sent to the identity broker. What does the identity broker do?
a)
Confirms the credentials with AD (LDAP)
b)
Checks the credentials with STS
c)
Returns a temporary token
d)
Establishes AIM credentials
43.
An identity broker confirmed credentials with LDAP and and calls STS. What does STS do?
a)
All of these
b)
Confirms the IAM policy for the request
c)
Creates a token
d)
Returns an access and secret key
e)
Resturns a token and token duration
44.
Your web app needs to access S3 using AD credentials. It obtained an STS token and sends it to S3. What does S3 do?
a)
Confirm with IAM that the credentials have access
b)
Confirms the IAM policy for the request
c)
Returns a temporary token
d)
Confirms the credentials with AD (LDAP)
45.
A web application will access S3 and will use AD credentials. What are the high level steps?
a)
1.LDAP 2.STS 3.IAM
b)
1.STS 2.IAM 3. LDAP
c)
1. IAM 2.LDAP 3.STS
d)
1.LDAP 2.IAM 3. STS
46.
Web Identity Federation is provided through which AWS service
a)
Cognito
b)
STS
c)
Configure
d)
KMS
47.
T/F Amazon Cognito is recommended for all mobile applications AWS Services
a)
true
b)
false
48.
Cognito provides which of the following
a)
All of these
b)
Sign-up
c)
Sign-in
d)
guest user access
49.
With Cognito, users can sign in directly or indirectly via an Open ID
a)
User Pools
b)
Identity Pools
c)
Identity Broker
d)
Identity Store
50.
With Cognito, you can create unique identitifies for users and authenticate them with identity providers
a)
Identity Pools
b)
User Pools
c)
Identity Broker
d)
Identity Store
51.
T/F Cogninto User Pools uses Jason (JWT) Tokens
a)
true
b)
false
52.
Cognito exchanges JWT tokens for __
a)
AWS Credentials
b)
AIM policies
c)
S3 Bucket Policies
d)
SAML Credentials
53.
Which is a good use case of Glacier
a)
both answers
b)
WORM archive
c)
Data retention policies
d)
neither answer
54.
T/F In Glacier, files are stored in Archives, and Archives are stored in Vaults
a)
true
b)
false
55.
You can combine multiple AWS Accounts into an __ that can be managed centrally
a)
Organization
b)
Domain
c)
Broker
d)
Federation
56.
AWS Organizations allow you to organize your accounts into __
a)
OUs
b)
User Pools
c)
Directories
d)
Containers
57.
In AWS Organizations, what would you use to restrict actions that users can do
a)
Permission Boundary
b)
User Pools
c)
Directories
d)
Containers
58.
___ is used to centrally control the use of AWS services in an organization
a)
Service Control Policy
b)
OU's
c)
User Pools
d)
Directories
59.
When evaluating access control for an AWS Organization, which takes precidence
a)
Service Control Policy
b)
User Permissions set up within an account
60.
T/F A Permission Boundary for an AWS Organization can be used to restrict the root account
a)
true
b)
false
Reset
