Security – Part A

Which of the following is true regarding Amazon RDS encryption?

Which of the following is a feature of Amazon S3 server-side encryption?

Correct Answer: B It encrypts data at rest with AES-256 encryption.

Explanation:Amazon S3 server-side encryption uses AES-256 encryption to encrypt data at rest. It does not use client-side encryption with AWS KMS-managed keys, nor does it encrypt data in transit using SSL/TLS. Although it is possible to use a user-defined encryption key, it is not a feature of Amazon S3 server-side encryption.

Option A is incorrect because Amazon S3 server-side encryption does not use client-side encryption with AWS KMS-managed keys.
Option C is incorrect because Amazon S3 server-side encryption does not encrypt data in transit using SSL/TLS.
Option D is incorrect because while it is possible to use a user-defined encryption key, it is not a feature of Amazon S3 server-side encryption.

A data scientist wants to use AWS CloudHSM to generate random numbers for cryptographic operations. Which of the following CloudHSM features should they use?

A data analyst wants to use AWS CloudHSM to store their encryption keys. Which of the following CloudHSM features should they use?

A data scientist wants to encrypt data on an EC2 instance using AWS KMS. Which of the following AWS KMS features should they use?

A data analyst wants to use AWS KMS to protect their data at rest on Amazon S3. Which of the following AWS KMS features should they use?

A data scientist is working on a project that requires the use of client-side encryption with a high level of security. Which of the following encryption approaches will best suit their needs?

A data analyst is working on a project that requires the use of client-side encryption. Which of the following encryption approaches will best suit their needs?

A data analyst needs to encrypt data stored in an Amazon EBS volume and is considering using server-side encryption with Amazon-managed keys (SSE-S3). Which of the following statements is true regarding SSE-S3?

A data analyst needs to encrypt data stored in an Amazon S3 bucket and is considering using server-side encryption with AWS KMS-managed keys (SSE-KMS). Which of the following statements is true regarding SSE-KMS?

A data analyst is working with a large dataset that contains sensitive customer data, and needs to mask some of the data fields to protect customer privacy. Which AWS service can the analyst use to meet this requirement?

A data analyst is working with sensitive customer data and needs to determine the encryption requirements for storing the data in an Amazon S3 bucket. The data should only be accessible by authorized users. Which AWS service can the analyst use to meet these requirements?

A data analyst needs to implement role-based access control for an Amazon Redshift cluster. Which of the following mechanisms should the analyst use to control access to the cluster?

A data analytics team wants to implement role-based access control for an Amazon S3 bucket. Which of the following mechanisms should the team use to control access to the bucket?

A data analyst needs to control access to an Amazon RDS database instance. Which of the following mechanisms should the analyst use to control traffic to and from the instance?

A data analyst needs to implement access control for a new Amazon EC2 instance. Which of the following mechanisms should the analyst use to control traffic to and from the instance?

A data analyst needs to implement column-level permissions for a particular table in Amazon Athena. Which of the following authorization methods should the analyst use?

A data analyst needs to implement table-level permissions for a particular database in Amazon Redshift. Which of the following authorization methods should the analyst use?

Which AWS service can be used to manage access to Amazon Redshift clusters?

Which of the following statements is true about Access Control Lists (ACLs) in Amazon S3?

Which of the following AWS services allows you to use tags to control access to resources?

Which of the following AWS services allows you to create policies that define who can access which resources within an AWS account?

Which of the following authentication methods can be used to grant temporary access to AWS resources?

Which of the following authentication mechanisms can be used to provide secure access to an Amazon RDS instance?

A data analytics team is using AWS Managed Microsoft AD for authentication of their AWS resources. Which of the following is an appropriate way to implement SSO for AWS resources using AWS Managed Microsoft AD?

A data analytics team wants to implement Single Sign-On (SSO) for their AWS resources. Which of the following authentication methods is appropriate for implementing SSO?

A data analytics team is implementing federated access for their AWS resources. They have decided to use OAuth 2.0 for this purpose. Which of the following is an appropriate authentication method for implementing federated access using OAuth 2.0?

A data analytics team wants to enable federated access for their AWS resources. They have decided to use Security Assertion Markup Language (SAML) for this purpose. Which of the following is an appropriate authentication method for implementing federated access using SAML?

Suppose a company wants to implement federated access for its AWS analytics environment. Which of the following is an appropriate authentication method for federated access?
A. AWS Identity and Access Management (IAM) user accounts
B. Web Identity Federation
C. AWS Single Sign-On (SSO)
D. Security Assertion Markup Language (SAML)

Correct Answer: C. AWS Single Sign-On (SSO)

AWS Single Sign-On (SSO) is an appropriate authentication method for federated access, as it allows users to sign in to the AWS environment using their existing credentials from their corporate directory. This enables organizations to manage user access and permissions centrally, reducing the administrative burden on IT teams.

Option A is incorrect: IAM user accounts are not an appropriate authentication method for federated access, as they require users to have an AWS account and associated credentials.
Option B is incorrect: Web Identity Federation is used to allow users to access AWS resources using credentials from third-party identity providers like Google, Facebook, or Amazon. It is not used for federated access.
Option D is incorrect: Security Assertion Markup Language (SAML) is a protocol used for exchanging authentication and authorization data between parties. While it is used in federated access scenarios, it is not an authentication method itself.

A company wants to implement federated access for its AWS analytics environment, but it also wants to ensure that users are only able to access resources based on their roles and responsibilities within the organization. Which of the following mechanisms is an appropriate authorization method to meet this requirement?

You are designing a data analytics solution on AWS for a company with multiple business units. The company wants to implement a single sign-on (SSO) solution for its employees to access the analytics solution. Which AWS service provides a managed SSO solution for AWS accounts and cloud applications?

Your company has a data analytics solution on AWS that uses multiple AWS services. You want to implement single sign-on (SSO) for your employees to access the solution. Which of the following is a common SSO standard that you can use to implement SSO for your AWS solution?

Which of the following is the most appropriate method to implement authentication for an Amazon S3 bucket?

Which of the following is the most appropriate method to implement authentication for an Amazon RDS instance?

Which of the following is the most appropriate method to implement authorization for an Amazon S3 bucket?

Which of the following is the most appropriate method to implement authorization for an Amazon EC2 instance?

Which of the following is an appropriate method to implement Access Control Lists (ACL) in AWS?

Which of the following AWS services can be used to implement Access Control Lists (ACL) for controlling access to S3 buckets?

Which AWS service allows you to implement table/column level permissions for your data in Amazon S3?

Which AWS service provides an SQL-based interface to grant or deny access to specific tables or columns in Amazon Aurora or Amazon Redshift?

Which AWS service allows you to implement access control mechanisms at the network level, such as security groups, to control traffic to and from your Amazon EC2 instances?

Which of the following statements accurately describes AWS security groups?

Which AWS service allows you to implement role-based access control mechanisms to control access to your AWS resources?

Which of the following statements accurately describes role-based access control?

Which of the following data types require encryption in transit and at rest for compliance with data protection regulations?

Which of the following techniques should be used to mask data in a development environment that contains personally identifiable information (PII)?

Which of the following is an example of server-side encryption for data at rest in an AWS environment?

Which of the following AWS services provides automatic server-side encryption for data at rest by default?

What is an example of a client-side encryption approach in an AWS environment?

Which of the following AWS services supports client-side encryption by default for data stored in it?