AWS Certified Solutions Architect Advanced > Advanced IAM > Flashcards

Advanced IAM Flashcards

(41 cards)

Study These Flashcards
1
Q

What does ARN stand for?

A

Amazon Resource Name

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the component syntax of an ARN?

A
  • All ARNs begin with **arn:partition:service:region:account\_id:**
    • If not applicable, section is empty (so you can see ::)
  • And end with a resource
    • resource
    • resource_type/resource
    • resource_type/resource/qualifier
    • resource_type/resource:qualifier
    • resource_type:resource
    • resource_type:resource:qualifier
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the major differences between the two types of IAM Policies?

A
  • Identity Policies
    • attached to an IAM user, group, or role
    • specify what an identity can do
  • Resource policies
    • attached to a resource
    • specify who can do what to the resource
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Do IAM policies take effect upon creation?

A

No. An IAM Policy has no effect until it is attached to a resource or role.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the basic format of an IAM policy document?

A
  • Version # (YYYY-MM-DD)
  • List of statements, each individual statement enclosed in {}
    • Each statement matches an AWS API Request​​​
    • Each statement has an Effect, either allow or deny
    • Each statement has A list of Actions with the effect, of the form *servicename:ActionName*
    • Each statement has a Resource the Action is against (in ARN form)
    • Idea: (Allow/Deny) Resource to do Actions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is an AWS API Request?

A

Any action you can perform against AWS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

If an IAM policy does not explicitly allow an API action, might it still be implicitly allowed?

A

No

If an action is not explicitly allowed, it is implicitly denied

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

In general, how does AWS reconcile multiple attached policies to the same user or resource?

A

AWS joins all applicable policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Suppose your IAM user has 2 policies, one of which explicitly denies access to all S3 buckets, the other of which explicitly allows access to a specific S3 bucket. Will this user be allowed to access to the specific S3 bucket?

A

No

An explicit deny overrides anything else in any other policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the purpose of AWS Permission Boundaries?

A
  • The idea is to prevent priviledge escalation or unnecessarily overbroad permissions
  • Controls maximum permissions an IAM policy can grant
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are some use cases for AWS Permission Boundaries?

A
  • Developers creating roles for Lambda functions
  • Application owners creating roles for EC2 instances
  • Administrators creating ad hoc users
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

In the context of IAM, what does RAM stand for?

A

Resource Access Manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the general use case of AWS Resource Access Management?

A
  • Resource Sharing between accounts
  • can be between individual accounts or within accounts in AWS Organizations
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which AWS Resources can I share using AWS Resource Access Management?

A
  • App Mesh
  • Aurora
  • CodeBuild
  • EC2
  • EC2 Image Builder
  • License Manager
  • Resource Groups
  • Route53
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What does SSO stand for?

A

Single Sign-On

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What does SAML stand for?

A

Security Assertion Markup Language

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the general use cases for AWS SSO?

Study These Flashcards
A
  • Centrally manage access to AWS Resources
  • Using existing identities to log in to AWS
  • Governing account-level permissions
  • SAML
18
Q

Suppose you have a fleet of EC2 instances, all joined to the same active directory domain. Do you need to manage the credentials on the individual EC2 instances?

Study These Flashcards
A

No

AWS Directory Service provides SSO to any domain-joined EC2 instance

19
Q

What is the purpose of AWS Directory Service?

Study These Flashcards
A

Connecting AWS resources with on-premises AD

20
Q

When using AWS Managed Microsoft AD, who is responsible for ensuring multi-AZ deployment?

21
Q

What does AD stand for?

Study These Flashcards
A

Active Directory

22
Q

What is Active Directory?

Study These Flashcards
A
  • On-premises directory service
  • Uses a Hierarchical database of users, groups, computers, organized in trees and forests
  • You apply group policies to help you manage users and devices on a network
23
Q

What is the key feature of AWS Managed Microsoft AD?

Study These Flashcards
A

AD Domain Controllers – to which you have exclusive access– running Windows Server that are reachable by applications in your VPCs,

24
Q

How does AWS Managed Microsoft AD ensure high availability?

Study These Flashcards
A
  • You get 2 DCs by default,
  • You can also add DCs for additional HA and Performance
25
When using AWS Managed Microsoft AD, who is responsible for backup operations?
**AWS**
26
When using AWS Managed Microsoft AD, who is responsible for ensuring you are on the most up-to-date version of the software?
**AWS**
27
When using AWS Managed Microsoft AD, who is responsible for scaling out domain controllers?
**You**
28
When using AWS Managed Microsoft AD, who is responsible for maintaining users, groups, and group policy objects?
**You**
29
Suppose you want to extend existing AD to your on-premises infrastructure. What tool might you use to do this?
**AD Trust**
30
When using AWS Managed Microsoft AD, who is responsible for any identity federation?
**You**
31
When using AWS Managed Microsoft AD, who is responsible for dealing with certificate authorities?
**You**
32
What is **AWS Simple AD**?
A standalone managed directory in the cloud used for Basic AD features
33
Does AWS Simple AD support trusts?
**No**
34
How many users can a small Simple AD handle?
**up to 500**
35
How many users can a large Simple AD handle?
**Up to 5000**
36
Does Simple AD allow you to join with on-premises AD?
**No, Simple AD does _not_ support trusts**
37
What is **AD Connector**?
* AD Connector is a **directory gateway (proxy) for on-premises AD**
38
What is **AWS Cloud Directory**?
* A _fully-managed_ **directory-based** **store** _for developers_ * Used in applications that implement org charts, course catalogs, device registries
39
What are **Amazon Cognito User Pools**?
* Managed User directory for SaaS Applications * sign-up and sign-in for web / mobile * typically used with **social media identities**
40
What does **SaaS** stand for?
**S**oftware **A**s **A** **S**ervice
41
What are the key benefits of AD Connector?
* Avoid cacheing information in the cloud * Allow on-premises users to log in to AWS using AD * Join EC2 instances to your existing AD domain * Scale across multiple AD connectors
AWS Certified Solutions Architect Advanced
flashcards
Decks in class (53)
# Cards
Brainscape helps you reach your goals faster, through stronger study habits.
© 2026 Bold Learning Solutions. Terms and Conditions