Font size
WorksheetsAWS Certified Solutions Architect Associate Exam Chapter 6
Total questions: 87
Worksheet time: 44mins
Which domain is focused on in Chapter 6 of the AWS Certified Solutions Architect Associate Exam guide?
Domain 1: Design Secure Architectures
Domain 2: Define Performant Architectures
Domain 3: Specify Secure Applications and Architectures
Domain 4: Design Cost-Optimized Architectures
What are the key objectives covered in Chapter 6 of the AWS Certified Solutions Architect Associate Exam guide?
Design secure access to AWS resources, Design secure workloads and applications, Determine appropriate data security controls.
Implement Elastic Load Balancing, Auto Scaling, and AWS storage solutions.
Define AWS network architecture, and AWS deployment and management services.
Optimize AWS service costs and ensure efficient resource utilization.
What does IAM stand for in the context of AWS?
Internal Account Management
Identity and Access Management
Integrated Application Module
Instantaneous Automated Mechanism
What are IAM identities sometimes described as?
Subscribers
Principals
Delegates
Executors
Which AWS service allows temporary access to AWS resources using an external service such as Kerberos, Microsoft Active Directory, or LDAP?
AWS Direct Connect
AWS Identity Federation
AWS Security Token Service
AWS Access Manager
What can be attached to IAM identities to define the way they interact with AWS resources?
Security Groups
Elastic IPs
Policies
Subnets
Which of the following is NOT listed as a key aspect of managing IAM identities?
Creating policies to control principals' actions
Managing keys or tokens for identity verification
Providing single sign-on solutions
Encrypting data storage on AWS
What is the one identity that comes with every new AWS account?
Administrator
IAM user
Root user
Guest user
What is the effect of an IAM policy that is not explicitly allowed by a policy?
It is implicitly allowed
It is ignored
It is explicitly denied
It is implicitly denied
What is the default action for resources that are not explicitly mentioned in an IAM policy?
They are allowed access by default
They are denied access by default
They are logged for review
They are flagged for administrative action
What can the "Deny" effect in an IAM policy be used to do?
Allow access to all resources
Allow access to no resources
Single out specific resources that should remain off-limits
Grant administrative privileges
Which AWS service is associated with IAM policies?
Amazon EC2
Amazon S3
Amazon VPC
Amazon RDS
What format is used to write IAM policies?
XML
YAML
JSON
SQL
What is the maximum number of managed policies that can be associated with a single IAM identity according to the text?
5
10
15
20
What will AWS always do in case of a conflict between two policies associated with a single identity?
AWS will allow the action in question.
AWS will deny the action in question.
AWS will ask for user confirmation.
AWS will disable the conflicting policies.
Which of the following is NOT listed as a way to protect your root account?
Delete any access keys associated with root.
Assign a long and complex password for the root account.
Use root to perform administration operations.
Enable multifactor authentication (MFA) for the root account.
What should you do before locking down the root account, as suggested in the text?
Create a regular user and assign it the AdministratorAccess policy.
Delete all existing IAM identities.
Disable multifactor authentication for all users.
Increase the number of managed policies for the root account.
Which ability does the AdministratorAccess holder lack that even an AdministratorAccess policy does not grant?
The ability to create or delete account-wide budgets.
The ability to enable MFA Delete on an S3 bucket.
The ability to assign policies to other users.
The ability to create new IAM identities.
What is the purpose of enabling MFA for the root account according to the text?
To send short-lived authentication codes to applications on preset mobile devices to confirm a user's identity.
To update the root login to a more complex password.
To store the password safely after logging in as root.
To create a new user in the IAM Dashboard.
What should you attach to a new user in the IAM Dashboard to allow them to create, edit, and delete S3 buckets?
AmazonS3ReadOnlyAccess policy
AmazonS3FullAccess policy
AmazonEC2FullAccess policy
AmazonS3LimitedAccess policy
What should you do to test if everything is working after assigning an IAM policy to a new user?
Update the password for console access.
Launch an EC2 instance to see if the request is denied.
Generate X.509 certificates.
Create a new S3 bucket.
Which of the following is NOT a security setting that can be managed from the My Security Credentials page?
Updating a password for console access.
Activating or managing MFA.
Launching an EC2 instance.
Generating X.509 certificates to encrypt SOAP requests.
What is the primary reason for regularly retiring older access keys according to best practices?
To comply with AWS Identity and Access Management (IAM) policies
To reduce the risk of the keys being compromised
To improve the performance of the applications
To comply with new AWS software updates
Which AWS CLI command can be used to determine if any applications are still using an old key?
aws iam get-user
aws iam list-access-keys
aws iam get-access-key-last-used
aws s3 ls
What should you do if you have unused AWS access keys and have no plans to use them in the future?
Share them with other users
Keep them for archival purposes
Deactivate or delete them
Rotate them immediately
What is the first step in the key rotation protocol for your own applications?
Update your application settings to point to the new keys
Deactivate the old keys
Generate a new access key for each of your users
Monitor your applications for a few days
How long after an access key has not been used does it make good sense to retire it, as suggested by best practices?
After 30 days
After 60 days
After 90 days
After 120 days
What is the first step in creating an AWS access key according to Exercise 6.3?
Enter aws configure at your local command line
Delete the old keys
Create a new AWS access key and save both the access key ID and secret access key somewhere secure
Create separate profiles for each new access key
What command allows you to add a new AWS access key to your AWS CLI configuration?
aws s3 ls --profile account2
aws configure --profile account2
aws delete key
aws create key
What can you do with the '--profile' argument when running the 'aws configure' command?
Delete your current AWS access key
List your S3 buckets
Create separate profiles to manage multiple keys in parallel
Upload a local file using the AWS CLI
After creating a new AWS access key, what operation is suggested to try out using the AWS CLI and your new key?
Deleting the key you just created
Listing your S3 buckets and then uploading a local file
Creating a new IAM user
Configuring a new AWS CLI profile
What is the purpose of creating separate IAM groups for different classes of users?
To delete each user account more efficiently
To ensure all users have the same level of access
To apply one set of changes for just the developers and another for the admins
To make it more time-consuming to manage permissions
What is the minimum number of IAM users you should have in your account before creating an IAM group according to Exercise 6.4?
1
2
3
No minimum number is specified
What should you attach to a new IAM group as per Exercise 6.4?
At least two policies
At least one policy
No policies are required
User passwords
After adding two users to an IAM group, what should you confirm according to Exercise 6.4?
That the users can access all AWS services
That the users can change their own passwords
That the users have administrative access
That the users can delete the group
What should you do after deleting the group or changing its policies as per Exercise 6.4?
Confirm that your users can still access the group
Confirm that your users can no longer update their passwords
Create a new IAM role
Add more users to the group
What is an IAM role primarily used for?
To permanently assign a set of permissions to a user
To provide a temporary identity for accessing resources
To manage user passwords and login credentials
To create a permanent link between two AWS accounts
Which AWS service provides a prebuilt managed role to pull data from ECR in order to pull container images?
Amazon EC2
Amazon S3
Amazon ECS
Amazon IAM
How long does an IAM role (which by default expires after 12 hours) typically allow federated authentication service users to access resources?
6 hours
12 hours
24 hours
48 hours
How many categories of trusted entities can you define when creating a new IAM role?
2
3
4
5
What are the two important functions provided by Amazon Cognito to mobile and web app developers?
User data encryption and application data caching
User sign-up and sign-in, and access to other services via identity pools
Automated user authentication and server management
Data backup services and user activity tracking
What common feature do Amazon Cloud Directory and Cognito share according to the text?
They both provide temporary security tokens.
They both use AWS Security Token Service (STS).
They both store and leverage hierarchical data like lists of an organization's users or hardware assets.
They both simplify the administration of encryption keys and authentication secrets.
What is the main goal of AWS Managed Microsoft AD as described in the text?
To provide a time-limited security token service
To handle large stores of data and integrate them into AWS operations
To have Active Directory control the way Microsoft SharePoint, .NET, and SQL Server-based workloads run
To simplify the administration of encryption keys and authentication secrets
What does AWS Single Sign-On (SSO) allow you to provide users with?
Streamlined billing and cost management
Streamlined authentication and authorization through an existing Microsoft Active Directory
Streamlined data storage and retrieval services
Streamlined deployment of AWS resources
Which AWS service is fully managed and helps in creating and managing your encryption keys?
AWS Secrets Manager
AWS Single Sign-On
AWS Key Management Service (KMS)
AWS Identity and Access Management (IAM)
For what purpose is AWS Secrets Manager primarily used?
To manage identity authentication to AWS services using IAM roles
To provide a managed service for data replication and software updates
To manage encryption keys for AWS services
To manage and rotate credentials for accessing third-party services or databases
How does AWS KMS integrate with AWS CloudTrail?
By providing a user interface for key management
By managing IAM user groups and roles
By recording all key-related events for regulatory compliance purposes
By automating the credential rotation process
What does HSM stand for in AWS CloudHSM?
Hardware Security Module
High-Speed Module
Hybrid Service Model
Hosted Storage Management
What is one typical goal of AWS CloudHSM?
To increase the load on web servers
To off-load the burden of generating, storing, and managing cryptographic keys from web servers
To provide a backup service for data storage
To enhance the graphical user interface of web applications
Which of the following is NOT a use case for AWS CloudHSM according to the AWS documentation?
Keys stored in dedicated, third-party validated HSMs under your exclusive control
Federal Information Processing Standards (FIPS) 140-2 compliance
High-performance in-VPC cryptographic acceleration
Automated data backup and recovery services
What does AWS RAM allow you to do?
It allows you to perform cryptographic operations.
It allows you to manage access to your resources.
It allows you to create new web servers.
It allows you to encrypt communication with the HSM.
What is the purpose of AWS RAM resource shares?
To create and administer parallel resources for each user
To ensure that only the resource owner can access the resource
To make a single copy or set available to everyone who needs access
To restrict access to resources to a particular AWS region
Which AWS CLI command is used to create a new user named Steve?
aws iam get-user --user-name steve
aws iam create-user --user-name steve
aws iam update-user --user-name steve
aws iam delete-user --user-name steve
How can you confirm that a new user named Steve has been created using AWS CLI?
aws iam create-user --user-name steve
aws iam update-user --user-name steve
aws iam get-user --user-name steve
aws iam delete-user --user-name steve
What does the AmazonEC2ReadOnlyAccess policy allow an assignee to do with EC2 resources?
Modify EC2 instances
Describe EC2 instances
Launch new EC2 instances
Terminate EC2 instances
Which AWS CLI command is used to attach a policy to a user by supplying the policy's Amazon Resource Name (ARN)?
aws iam list-policies
aws iam get-user-policy
aws iam attach-user-policy
aws iam create-user-policy
What is the effect of the actions listed in the AmazonEC2ReadOnlyAccess policy JSON format?
Deny
Allow
NotApplicable
ConditionalAllow
Which of the following services is NOT included in the AmazonEC2ReadOnlyAccess policy actions?
EC2
Elastic Load Balancing
CloudWatch
S3
What command is used to return the names of any existing keys associated with a specified username in AWS?
aws iam create-access-key
aws iam delete-access-key
aws iam list-access-keys
aws iam update-access-key
What should be done with the AWS account root user to ensure security?
It should be used for day-to-day account operations.
It should be locked down and not used for day-to-day account operations.
It should be associated with overlapping access needs.
It should be authenticated using AWS Key Management Service (KMS) only.
Which AWS service is NOT mentioned as a means to authenticate identities (including users, groups, and roles)?
AWS Key Management Service (KMS)
AWS Secrets Manager
AWS CloudHSM
AWS Direct Connect
What is a recommended practice for managing IAM users with overlapping access needs?
Assign them temporary IAM roles as needed.
Use the root user to manage their permissions.
Create individual IAM policies for each user.
Avoid using IAM groups for permission management.
How should access keys be managed according to the best practices mentioned in the document?
They should be shared among users to simplify management.
They should be rotated at set intervals and unused keys should be deleted.
They should be stored in a public repository for easy access.
They should be used indefinitely without regular audits.
What can you use IAM administration tools to enforce in terms of account access security?
Encryption of data at rest
Strong passwords and MFA
Network firewall settings
Database partitioning
What does AWS Cognito allow you to manage?
Server configurations
Application's users
Data backup schedules
Cloud storage limits
What does Managed Microsoft AD apply to in AWS?
Active Directory domains to compatible applications in your VPC
Encryption keys for AWS S3
Load balancing for EC2 instances
Monitoring rules for AWS CloudWatch
What do both AWS Cognito and Managed Microsoft AD permit regarding identities?
Single sign-on for AWS accounts
Federated identities
Local user groups
Cross-region replication
Which of the following is the greatest risk posed by using your AWS account root user for day-to-day operations?
There would be no easy way to control resource usage by project or class.
There would be no effective limits on the effect of an action, making it more likely for unintended and unwanted consequences to result.
Since root has full permissions over your account resources, an account compromise at the hands of hackers would be catastrophic.
It would make it difficult to track which account user is responsible for specific actions.
You're trying to create a custom IAM policy to more closely manage access to components in your application stack. Which of the following syntax-related statements is a correct description of IAM policies?
The Action element refers to the way IAM will react to a request.
The * character applies an element globally—as broadly as possible.
The Resource element refers to the third-party identities that will be allowed to access the account.
The Effect element refers to the anticipated resource state after a request is granted.
Which of the following will—when executed on its own—prevent an IAM user with no existing policies from launching an EC2 instance? (Choose three.)
Attach no policies to the user.
Attach two policies to the user, with one policy permitting full EC2 access and the other permitting IAM password changes but denying EC2 access.
Attach a single policy permitting the user to create S3 buckets.
Attach the AdministratorAccess policy.
Associate an IAM action statement blocking all EC2 access to the user’s account.
Which of the following are important steps for securing IAM user accounts? (Choose two.)
Never use the account to perform any administration operations.
Enable multifactor authentication (MFA).
Assign a long and complex password.
Delete all access keys.
Insist that your users access AWS resources exclusively through the AWS CLI.
To reduce your exposure to possible attacks, you’re auditing the active access keys associated with your account. Which of the following AWS CLI commands can tell you whether a specified access key is still being used?
aws iam get-access-key-used --access-key-id
aws iam --get-access-key-last-used access-key-id
aws iam get-access-key-last-used access-last-key-id
aws iam get-access-key-last-used --access-key-id
Which of the following is the greatest benefit of organizing your users into groups for AWS account administration?
It enhances security by consolidating resources.
It simplifies the management of user permissions.
It allows for quicker response times to service interruptions.
It simplifies locking down the root user.
During an audit of your authentication processes, which of the following is not considered a trusted entity in the context of IAM roles?
A web identity authenticating with Google
An identity coming through a SAML-based federated provider
An identity using an X.509 certificate
A web identity authenticating with Amazon Cognito
Which AWS service provides virtual hardware devices for managing encryption infrastructure that's FIPS 140-2 compliant?
AWS CloudHSM
AWS Key Management Service
AWS Security Token Service
AWS Secrets Manager
What is the best tool for authenticating access to a VPC-based Microsoft SharePoint farm?
Amazon Cognito
AWS Directory Service for Microsoft Active Directory
AWS Secrets Manager
AWS Key Management Service
What is the function of Amazon Cognito identity pools?
Gives your application users temporary, controlled access to other services in your AWS account
Adds user sign-up and sign-in to your applications
Incorporates encryption infrastructure into your application life cycle
Delivers up-to-date credentials to authenticate RDS database requests
An employee with access to the root user on your AWS account has just left your company. Since you can't be 100 percent sure that the former employee won't try to harm your company, which of the following steps should you take? (Choose three.)
Change the password and MFA settings for the root account.
Delete and re-create all existing IAM policies.
Change the passwords for all your IAM users.
Delete the former employee’s own IAM user (within the company account).
Immediately rotate all account access keys.
You need to create a custom IAM policy to give one of your developers limited access to your DynamoDB resources. Which of the following elements will not play any role in crafting an IAM policy?
Action
Region
Effect
Resource
Which of the following are necessary steps for creating an IAM role? (Choose two.)
Define the action.
Select at least one policy.
Define a trusted entity.
Define the consumer application.
Which of the following uses authentication based on AWS Security Token Service (STS) tokens?
Policies
Users
Groups
Roles
What format must be used to write an IAM policy?
HTML
Key/value pairs
JSON
XML
If you need to allow a user full control over EC2 instance resources, which two of the following must be included in the policy you create? (Choose two.)
A. "Target": "ec2:*"
B. "Action": "ec2:*"
C. "Resource": "ec2:*"
D. "Effect": "Allow"
E. "Effect": "Permit"
What is the function of Amazon Cognito user pools?
A. Gives your application users temporary, controlled access to other services in your AWS account
B. Adds user sign-up and sign-in to your applications
C. Incorporates encryption infrastructure into your application life cycle
D. Delivers up-to-date credentials to authenticate RDS database requests
Which of the following best describe the “managed” part of AWS Managed Microsoft AD? (Choose two.)
A. Integration with on-premises AD domains is possible.
B. AD domain controllers are launched in two availability zones.
C. Data is automatically replicated.
D. Underlying AD software is automatically updated.
Which of the following steps are part of the access key rotation process? (Choose three.)
A. Monitor the use of your new keys.
B. Monitor the use of old keys.
C. Deactivate the old keys.
D. Delete the old keys.
E. Confirm the status of your X.509 certificate.
What tool will allow an Elastic Container Service task to access container images it might need that are being maintained in your account’s Elastic Container Registry?
A. An IAM role
B. An IAM policy
C. An IAM group
D. An AIM access key
