Font size
WorksheetsAWS Certified Security Specialty Master Cheat Sheet Quiz
Total questions: 100
Worksheet time: 53mins
What is the purpose of AWS Artifact according to the AWS Certified Security Specialty Master Cheat Sheet?
It provides a list of AWS security services.
It is used for DNS validation.
It offers generic AWS compliance documents.
It allows export of the private key.
What is a characteristic of AWS Certificate Manager?
It validates DNS CA Authorization records first.
It allows export of the private key.
It is used for managing AWS user accounts.
It provides a list of AWS security services.
Which AWS service allows export of the private key?
AWS Artifact
AWS Certificate Manager with private CA
AWS Cloud Directory
AWS Certificate Manager with public standard
What is a limitation of AWS Certificate Manager's certificates?
They are not region-locked.
They can be issued instantly.
They are region-locked, unless CloudFront is used (with Virginia).
They do not support DNS validation.
What is CloudHSM advertised as suitable for?
General purpose encryption
When you have contractual/regulatory constraints
As a replacement for Active Directory
For unlimited SQL Server and Oracle database encryption
Which of the following is a feature of CloudHSM?
It is FIPS 140-2 Level 1 certified
It can be used for load balancing
It allows HSM users to authenticate with username and biometrics
It is FIPS 140-2 Level 3 certified
What is the monthly active user limit for the free tier of Cognito User Pools?
10k monthly active users
25k monthly active users
50k monthly active users
100k monthly active users
What does Cognito Identity Pools provide?
Permanent AWS credentials
Temporary AWS credentials
Unlimited API calls
Direct support for Active Directory
How does the API Gateway interact with Cognito?
It requires a separate identity pool
It has direct support for Cognito tokens
It only supports OAuth user tokens
It does not support Cognito at all
Which AWS service allows you to manage EC2 instances via group policies, among other features?
IAM
Guard Duty
Firewall Manager
AD Connector
What is the backend for Simple AD?
IAM
Samba
EC2
CloudFront
What does Guard Duty use to look for reconnaissance and instance compromise?
CloudTrail, VPC Flow Logs, and DNS Logs
WAF rules across CloudFront and ELB
Direct Connect or VPN
SNS topic and Lambda functions
For how long are Guard Duty findings available in the Guard Duty console?
30 days
60 days
90 days
120 days
What can Managed Microsoft AD do that Simple AD cannot?
Use a Samba backend
Join to an existing AD with trust relationships
Manage WAF rules across CloudFront
Look for EC2 instance compromise
Where can the credentials for EC2 instances be found?
http://127.0.0.1/latest/meta-data/iam/security-credentials/
http://169.254.169.254/latest/meta-data/iam/security-credentials/
http://192.168.1.1/latest/meta-data/iam/security-credentials/
http://localhost/latest/meta-data/iam/security-credentials/
What is required for a user to launch an EC2 instance?
iam:PassRole for the relevant roles
iam:CreateRole for the relevant roles
iam:AttachRole for the relevant roles
iam:DetachRole for the relevant roles
What type of policy grants a service the permissions it needs and has an immutable trust policy?
User access policy
Service linked role
Resource based policy
Identity based policy
What is the maximum number of managed policies that can be attached to a user/group/role?
5
10
15
20
What do permissions boundaries set in IAM?
The minimum permissions that an IAM entity can have
The default permissions that an IAM entity starts with
The maximum permissions that an identity-based policy can grant to an IAM entity
The exact permissions that an IAM entity is required to have
What does the "Null" operator in IAM policy conditions signify?
The key exists and is null
The key does not exist
The key exists and isn't null
The key is of null type
Which IAM policy element allows you to tag users and roles?
aws:PrincipalType
aws:RequestedRegion
aws:PrincipalTag
aws:sourceVpc
What is the purpose of the "aws:PrincipalOrgID" condition in IAM policies?
What does the "IfExists" operator return in IAM policy conditions?
True if the key exists and is null
True if the key does not exist
False if the key exists and isn't null
True if the key exists with multiple values
Which of the following is NOT a use case for policy variables in IAM?
To use in resource element conditions
To use string operators in conditions
To specify the requested AWS region
To control access based on time of access
What does NotPrincipal+Deny in an IAM policy act as?
A) A blacklist
B) A whitelist
C) A temporary credential
D) A user permission list
Which AWS service uses SAML assertions for federation to exchange for temporary credentials?
A) AWS SSO
B) AWS IAM
C) AWS Directory Service
D) AWS Access Advisor
Which of the following is a service that supports resource-based policies but does not support temporary credentials?
A) Amazon ECR
B) Amazon CloudFront
C) Amazon S3
D) AWS Lambda
Can temporary credentials be revoked once issued?
A) Yes, at any time
B) No, they cannot be revoked
C) Only if an IAM user created them
D) Only before they are used
What is included in temporary credentials to invalidate them when necessary?
A) A token as well as access key & secret key
B) A user permission list
C) A resource policy
D) A SAML assertion
What is NOT supported anymore as a multifactor authentication option in AWS?
SMS
U2F
Virtual TOTP
Hardware TOTP
Which AWS service provides predefined rules packages for network reachability and host configuration analysis?
KMS
Inspector
Cognito
STS
What is required for host configuration in AWS Inspector?
Agent
Key policies
Custom API
Federation
How does AWS KMS differ from standard IAM in terms of key policies?
KMS uses the same evaluation logic as IAM.
KMS allows any request if the key policy doesn't explicitly deny it.
KMS denies the request if the key policy doesn't allow it, regardless of identity policies.
KMS key policies are optional.
What is the default policy for API-created CMKs in AWS KMS?
Allows full access to all IAM identities
Allows kms:* for the account / root user
Allows all AWS services to manage the CMK
Denies all access by default
Which AWS service uses wrapped data keys with KMS for 'envelope encryption'?
CloudTrail
IAM
S3
EC2
What is the purpose of the kms:ViaService condition key in KMS policies?
To allow direct API use of CMKs
To prevent direct API use or block specific service use
To grant full access to all AWS services
To enable logging of CMK usage
What encryption algorithm do CMKs use in AWS KMS?
RSA-2048
SHA-256
AES-256
3DES
Where are CMKs stored in AWS KMS?
In a virtual private cloud (VPC)
In HSMs (140-2 level 2)
On AWS S3
In AWS EC2 instances
How many Customer Master Keys (CMKs) can you have per region?
500 CMKs
1000 CMKs
1500 CMKs
Unlimited
What does the custom key store use?
CloudTrail
CloudHSM
CloudWatch
S3
Can you import or automatically rotate keys in a custom key store?
Yes, both import and automatic rotation are possible.
No, neither import nor automatic rotation is possible.
Yes, but only automatic rotation is possible.
Yes, but only import is possible.
What is CloudHSM's compliance level?
Single tenant 140-2 level 1 HSM
Single tenant 140-2 level 2 HSM
Single tenant 140-2 level 3 HSM
Multi-tenant 140-2 level 3 HSM
What does Macie classify in S3?
Only Personal Health Information (PHI)
Only Personally Identifiable Information (PII)
Only regulatory documents
PII, PHI, regulatory documents, API keys, and secret key material
How many levels can Organizational Units (OUs) be nested up to in AWS Organizations?
3 levels
4 levels
5 levels
Unlimited levels
What does a full AWSAccess (allow *) policy automatically attach to in AWS Organizations?
To any new OUs
To the master account
To the root and new OUs
To all service-linked roles
Which AWS service allows the creation of an organizational trail to log events for all member accounts?
AWS Config
AWS CloudTrail
AWS Lambda
AWS CloudWatch
What is the maximum size limit for secrets (JSON documents) in AWS Secrets Manager?
64kb
128kb
256kb
4kb
For cross-account access to a secret in AWS Secrets Manager, what type of encryption is required at rest?
AWS managed CMK
Custom CMK
AES-256 encryption
SSL/TLS encryption
What is required for configuring rotation in AWS Secrets Manager?
Creating and assigning a role to a Lambda function with IAMFullAccess
Enabling multi-region support
Setting up a CloudFront distribution
Configuring AWS Shield Advanced
What is the primary use case for AWS Single Sign-On (SSO)?
To provide Layer 7 protection
To manage multi-account access with Organizations
To integrate with CloudFront for non-AWS origins
To generate findings against CIS standards
Which AWS service provides insights through collections and filters of findings?
Security Hub
Shield
SSO
IAMFullAccess
What does AWS Shield Standard offer?
Multi-account support
Findings from Guard Duty, Inspector, Macie
Integration into existing services and TCP/UDP protection
Management of multi-account access
Which of the following is not a feature of AWS Shield Advanced?
CloudFront integration
Global threat environment dashboard
AWS DDoS team support
Findings don't cross regions
What is the limit of permission sets that can be implemented as Roles in member accounts for SSO?
10
20
30
No limit
Which AWS service is used to create users and groups within SSO by default?
AWS Directory Service
Native directory
IAM identity provider
Managed AD
What is the default action if no rule matches in Web ACLs?
Allow
Block
Count
No default action
What type of rules can be managed from Marketplace sellers in WAF?
Conditions
Rate based rules
Normal rules
Managed rules
For CLI access, what does the SSO user portal provide?
Permanent credentials
Temporary credentials for the Roles you have access to
Direct access to the AWS Management Console
Full administrative permissions
What type of queries can Athena perform over data in S3?
SQL queries over XML data only
NoSQL queries over data in any format
SQL queries over data in S3 after defining a schema
SQL queries over encrypted data without a schema
Which AWS service integrates with Glue's Data Catalog and supports fine-grained permissions?
Redshift
Athena
CloudFront
Kinesis Firehose
What is charged per query in Athena?
Number of records returned
Fixed rate per query
Volume of data scanned
Time taken to execute the query
Which AWS service is better for querying smaller datasets without pre-processing?
Redshift
Athena
Elasticsearch Service
Glue
What does AWS Glue generate when selecting a data source and data target?
A report on the data quality
ETL code in Scala or Python
A visualization of the data
A backup of the source data
Which AWS service allows configuration of public or VPC endpoints and integrates with Kinesis Firehose, Logstash, or ES's index/bulk APIs?
Athena
Glue
Elasticsearch Service
CloudTrail
What is the purpose of Amazon Kinesis Data Firehose?
To manage delivery frequency with buffer size or interval
To ingest and analyze various data sources, notably logs
To configure an IAM role that it assumes to access e.g. S3 or Elasticsearch
To capture, transform, and load streaming data into Amazon S3, Amazon Redshift, Amazon Elasticsearch Service, and Splunk
Which AWS service allows subscribers to validate through a challenge message before receiving notifications?
SQS
SNS
Kinesis
Lambda
What is the main difference between the mechanisms of SNS and SQS?
SNS uses KMS for optional encryption, while SQS does not.
SNS has its own resource-based security policy, while SQS uses IAM policies.
SNS is a polling service, while SQS is a push service.
SNS is a push service, while SQS is based on polling.
What type of security policy does SQS have?
A resource-based security policy that predates IAM policies
An IAM policy that is similar to S3 policies
A queue-based security policy that is similar to Lambda policies
A subscription-based security policy that is similar to SNS policies
What does the LaunchPermission attribute of an AMI determine?
The encryption status of the AMI
Which accounts can use the AMI
The number of instances that can be launched at once
The region in which the AMI can be used
What is the purpose of key pairs in EC2?
To encrypt data at rest
To manage network access
To provide secure SSH access to instances
To control the execution role of tasks
What is the default encryption state for the instance store of an EC2 instance when it is stopped?
Encrypted with S3 SSE
Encrypted with host software disk encryption
Not encrypted
Encrypted with a customer-managed key
What is the default encryption method for images in the Elastic Container Registry (ECR)?
S3 SSE
AES-256
Customer-managed keys
No encryption
Which networking option allows tasks to get the host's network interface in Elastic Container Service (ECS)?
none
bridge
host
awsvpc
What can tasks in ECS send to CloudWatch?
Execution roles
Repository policies
Logs
AMIs
What network mode must be used with the Fargate launch type?
awsvpc
bridge
host
none
Which AWS service is Lightsail compared to in terms of being a competitor?
Azure
Google Cloud
DigitalOcean
IBM Cloud
What does Elastic Beanstalk provide a management wrapper around?
EC2, S3, EBS, RDS
VPC, IAM, Lambda, DynamoDB
EC2, IAM, CloudFront, S3
Lambda, API Gateway, S3, DynamoDB
What is the minimum logging capability that an execution role in AWS Lambda is assumed to have?
CloudWatch metrics
CloudWatch alarms
CloudWatch logs
CloudWatch events
What can the Beanstalk service role manage in other services?
Only application deployment
Only database instances
Only security groups
Instance profile - role used by instances to get the app, write logs, etc.
What is required for a console to update function policies automatically when adding a trigger in AWS Lambda?
The function must be in a VPC.
The function must have a logging layer included.
The triggering service must have access.
The function must be connected to an Application Load Balancer.
What does a role need in order to create network interfaces in each subnet of a VPC?
The VPC must be connected to an internet gateway.
The VPC must have ENI capacity and subnets must have spare IPs.
The VPC must have a NAT gateway.
The VPC must be integrated with WAF.
Which AWS service is integrated with Certificate Manager to terminate TLS?
VPC
Identity policies
Elastic Load Balancing (ELB)
AWS Lambda
What is a feature of the Application Load Balancer (ALB) in AWS?
It doesn't support Server Name Indication (SNI).
It can only use 2k RSA certificates.
It can have a Lambda function as a target.
It creates a network interface in a subnet in each AZ you choose.
Which of the following is not a feature of the Network Load Balancer (NLB) in AWS?
It is integrated with WAF.
It supports authentication with Cognito.
It doesn't support Server Name Indication (SNI).
It can enable access logging to an S3 bucket.
Which AWS service is mentioned as being able to potentially receive incident notification, but with another service being probably more appropriate?
Amazon S3
Amazon SES
Amazon SNS
Amazon KMS
What port is used for TLS SMTP connection as mentioned in the Simple Email Service (SES) section?
Port 443
Port 587
Port 25
Port 80
For the RDS database, what is the encryption at rest solution mentioned?
Standard AWS
KMS; TDE with SQL Server
CloudHSM
IAM identity policies
What type of encryption is used for DynamoDB according to the table?
Rooted at global RDS certs
Standard AWS
TDE with SQL Server
CloudHSM Classic
How is database authentication managed for DynamoDB as per the table?
per-engine user accounts - SQL
IAM only. Cognito
KMS
CloudTrail, excl.
According to the table, what is the audit method for RDS?
per-engine log files
KMS
CloudTrail, excl.
IAM identity policies
Which database uses ACM managed certificate, Redshift specific root for transport encryption?
Neptune
Aurora
Redshift
HTTPS endpoint
What does Neptune use for transport encryption?
Rooted at global RDS certs
ACM managed certificate
Publicly trusted Amazon root
KMS; CloudHSM Classic
Which service is used for encryption at rest in Aurora?
ACM
KMS
CloudHSM Classic
S3
How can you audit Aurora?
Using Console
With CloudWatch Logs
Through S3
By enabling IAM identity policy
What is the method of DB authentication for Redshift?
IAM identity policy mechanism
DB user accounts - SQL; IAM with custom drivers
User accounts; or a limited IAM identity policy mechanism
User accounts; or an IAM authenticated API to obtain short-lived passwords
Which database allows broad access if using IAM?
Redshift
Aurora
Neptune
HTTPS endpoint
What is the main resource in DynamoDB that requires access for full functionality?
Resource based policies
The table/
AmazonDynamoDBFullAccess
CloudWatch Logs
Which AWS service is used for optional encryption at rest in DynamoDB?
IAM
CloudTrail
KMS
Cognito
What type of permission model does RDS use for managing the database?
Resource based policies
Master user is created with the instance
Encryption at rest
VPC endpoint
What does 'RDS Encryption' cover?
Only the database
Database and CloudTrail logs
Database, backups, replicas, snapshots
Database and VPC endpoints
