Examius
🇮🇳 AWS Certified Solutions Architect – Associate · flashcards
AWS Certified Solutions Architect – Associate Identity, Access Management & Security Flashcards
51 question-and-answer cards covering Identity, Access Management & Security as it is examined in AWS Certified Solutions Architect – Associate. 24 of them are printed below, taken from across the deck — no signup, no paywall on the preview.
24 sample cards from the Identity, Access Management & Security deck
Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.
What are the types of KMS keys based on who manages them?
AWS managed keys (created and managed by AWS for a service, e.g., aws/s3), customer managed keys (created and fully controlled by you, supporting rotation and key policies), and AWS owned keys (owned/used by AWS across accounts, not visible to you).
What is the difference between symmetric and asymmetric KMS keys?
Symmetric KMS keys use a single 256-bit key for both encryption and decryption and never leave KMS unencrypted. Asymmetric KMS keys use a public/private key pair for encrypt/decrypt or sign/verify, where the public key can be downloaded and used outside AWS.
What is envelope encryption in KMS?
Envelope encryption is encrypting data with a data key (data encryption key), then encrypting that data key with a KMS key. The encrypted data key is stored alongside the data; KMS is only called to decrypt the data key, which is efficient for large data.
What is automatic key rotation in KMS and how often does it occur?
For customer managed symmetric keys, KMS can automatically rotate the cryptographic backing material once a year (rotation period is configurable). The key ID stays the same and old material is retained so previously encrypted data can still be decrypted.
What controls access to a KMS key?
A key policy (the primary, mandatory resource-based access control on the key), optionally combined with IAM policies and grants. Without a key policy granting access, even account admins cannot use the key.
What is encryption in transit and how is it typically implemented in AWS?
Encryption in transit protects data moving over networks, typically using TLS/SSL (HTTPS). AWS provides it via ACM certificates on load balancers/CloudFront, TLS endpoints on services, and VPN/Direct Connect with encryption.
What is encryption at rest and give examples of AWS at-rest encryption options?
Encryption at rest protects stored data. Examples: S3 server-side encryption (SSE-S3, SSE-KMS, SSE-C), EBS volume encryption, RDS encryption, and DynamoDB encryption, most integrating with KMS.
What are the server-side encryption options for Amazon S3?
SSE-S3 (Amazon S3-managed keys, AES-256, now the default), SSE-KMS (AWS KMS keys, adds auditing and key control), DSSE-KMS (dual-layer KMS encryption), and SSE-C (customer-provided keys where AWS does encryption but does not store the key).
What is AWS Certificate Manager (ACM) used for in the context of encryption in transit?
ACM provisions, manages, and renews SSL/TLS certificates used to enable HTTPS on integrated services like Elastic Load Balancing, CloudFront, and API Gateway. Public ACM certificates are free and auto-renew.
What is AWS Secrets Manager?
Secrets Manager securely stores, retrieves, and manages secrets (database credentials, API keys, tokens). Its key differentiator is built-in automatic rotation of secrets using Lambda functions, with native rotation support for several AWS database services.
What is AWS Systems Manager Parameter Store?
Parameter Store provides hierarchical, secure storage for configuration data and secrets as parameters. Standard parameters are free; SecureString parameters can be encrypted with KMS. It does not have native automatic secret rotation.
When should you choose Secrets Manager over Parameter Store?
Choose Secrets Manager when you need automatic secret rotation, cross-account secret access, or generated credentials for databases. Choose Parameter Store for general configuration values and simpler/cheaper secret storage without built-in rotation.
What is the cost difference between Secrets Manager and Parameter Store?
Secrets Manager charges per secret per month plus per API call (no free tier). Parameter Store standard parameters are free; advanced parameters and higher-throughput API usage incur charges.
What is AWS CloudHSM?
CloudHSM provides dedicated, single-tenant hardware security modules (FIPS 140-2 Level 3) in your VPC where you have full, exclusive control of the keys. AWS cannot access your keys, making it suitable for strict compliance requirements.
What is the key difference between AWS KMS and AWS CloudHSM regarding tenancy and control?
KMS is a multi-tenant, AWS-managed service where AWS manages the HSM infrastructure (FIPS 140-2 Level 2/3 for some operations). CloudHSM is single-tenant dedicated hardware you fully control, where AWS has no access to your keys.
Which AWS service provides intelligent threat detection by analyzing logs like VPC Flow Logs, DNS logs, and CloudTrail?
Amazon GuardDuty, a managed threat detection service that uses machine learning and threat intelligence to detect malicious or unauthorized behavior.
What is Amazon Inspector used for?
Amazon Inspector is an automated vulnerability management service that continually scans EC2 instances, container images in ECR, and Lambda functions for software vulnerabilities (CVEs) and unintended network exposure.
What is Amazon Macie?
Amazon Macie is a data security service that uses machine learning and pattern matching to discover, classify, and protect sensitive data (such as PII) stored in Amazon S3.
What is AWS WAF and at what layer does it operate?
AWS WAF (Web Application Firewall) protects web applications at Layer 7 (application layer) by filtering HTTP/HTTPS requests using rules for SQL injection, cross-site scripting, rate limiting, geo-blocking, and more. It attaches to CloudFront, ALB, API Gateway, and AppSync.
What is AWS Shield Standard versus AWS Shield Advanced?
Shield Standard is free, automatically protecting all AWS customers against common Layer 3/4 DDoS attacks. Shield Advanced is a paid service adding enhanced DDoS protection, 24/7 DDoS Response Team (DRT) access, real-time visibility, and DDoS cost protection (bill credits).
Which combination of services would you use to protect a web application from both DDoS and application-layer attacks?
Use AWS Shield (Standard or Advanced) for DDoS protection at Layers 3/4 and AWS WAF for application-layer (Layer 7) filtering, typically fronted by CloudFront.
What is AWS CloudTrail and what is its role in auditing and governance?
CloudTrail records API calls and account activity across AWS as event logs, providing an audit trail of who did what, when, and from where. It is essential for security analysis, compliance, and operational troubleshooting.
What is AWS Config used for in governance?
AWS Config continuously records and evaluates the configuration of AWS resources, tracks changes over time, and uses Config Rules to assess compliance against desired configurations, supporting auditing and governance.
What is AWS Security Hub?
AWS Security Hub is a centralized cloud security posture management service that aggregates, normalizes, and prioritizes security findings from services like GuardDuty, Inspector, Macie, IAM Access Analyzer, and partner tools, and runs automated compliance checks against standards (e.g., CIS, PCI DSS, AWS Foundational Security Best Practices).
What this deck covers
The Identity, Access Management & Security deck follows the AWS Certified Solutions Architect – Associate Identity, Access Management & Security syllabus — 4 chapters and 15 topics — so questions land on material that is genuinely examinable rather than trivia around it. That works out to roughly 12.8 cards per chapter.
Answers are written to be recallable, not just readable — averaging about 230 characters, which is long enough to carry the reasoning and short enough to say out loud.
A deck like this earns its keep on the second and third pass. Read the syllabus first so you know the shape of the subject, then use the cards to find the specific facts that have not stuck.
Identity, Access Management & Security flashcards FAQ
How many Identity, Access Management & Security flashcards are in this AWS Certified Solutions Architect – Associate deck?
51 cards. This page previews 24 of them, sampled evenly across the deck so you can judge the difficulty before installing anything.
Are these AWS Certified Solutions Architect – Associate flashcards free?
Yes. The preview here is free to read with no signup, and the full 51-card deck is free inside the Examius app.
What do the Identity, Access Management & Security cards cover?
They follow the AWS Certified Solutions Architect – Associate Identity, Access Management & Security syllabus — 4 chapters and 15 topics — so the questions track what is actually examinable.
How should I use these flashcards?
Read the syllabus first so you know the shape of the subject, then drill the deck. Examius schedules each card with spaced repetition, so cards you keep missing come back sooner and ones you know drift further apart.