Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Developer > AWS 12, 13, 14 > Flashcards

AWS 12, 13, 14 Flashcards

1
Q

What is the Origin Access Identity in CloudFront?

A

It is a special CloudFront user that has access to origins for CloudFront;
We configure the S3 bucket permissions so that CloudFront can use the OAI to access the files in your bucket;
Generally we would want to restrict access to our S3 origin so that only the OAI has access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

EC2 Instances MUST be public when using them with CloudFront, true or false?

A

True. Unless we introduce an ALB. Then the ALB can be public and the EC2 instances can be private.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the major difference between CloudFront and S3 CRR?

A

S3 Cross Region Replication is read only and great for dynamic content that needs to be available at low-latency in few regions;
CloudFront files are cached for a TTL (maybe a day) and is great for static content that must be available everywhere;
Also note that in S3 CRR, files are copied to a different bucket, so users would still need to know that URL (or possibly use Route53?)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a common strategy for maximizing cache hits in CloudFront?

A

We can separate Dynamic and Static content distributions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the Viewer Protocol Policy in CloudFront?

A

It sits between the client and the edge location. It redirects HTTP to HTTPS or requires use of HTTPS only. Suggested is a redirect.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the Origin Protocol Policy in CloudFront for HTTP or S3?

A

Sits between the Edge Location and Origin. Either set HTTPS only or Match Viewer, which keeps the request of the client.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

S3 Bucket “websites” support HTTPS, true or false?

A

False. If you want to support HTTPS access you can use CloudFront to serve a static website hosted on Amazon S3.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Setting a CloudFront Origin Access Identity sets up a bucket policy for S3 bucket, however, we can keep the Block Public Access settings up for the bucket. How?

A

CloudFront hits the origin (S3 Bucket) from Amazons private network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the difference between a signed cookie and signed URL in CloudFront?

A

Signed URL gives access to individual files and signed cookies give access to multiple files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How long should a signed URL be valid for?

A

For shared content, make it short. For private content you can make it much longer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

CloudFront is deploying in front of an HTTP origin. After updating your HTTP app, the users still see the old website. What should you do?

A

Invalidate the distribution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the three container management platforms?

A

ECS, Fargate, EKS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a task definition in ECS? What is some information it contains?

A 
Metadata in JSON form to tell ECS how to run a Docker Container;
Image Name;
Port binding for Container and Host;
Memory and CPU Required;
Env variables;
Launch type to use;
Logging configuration;
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

We created a container that cannot communicate to any other AWS services. What is a probable reason?

A

We did not add a task role

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is portMapping in ECS?

A

It will take the network calls that go through the Host network port number (e.g. 8080) and route them to the Container network port number (e.g. 80)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

For a specific service in ECS, we updated our desired tasks from 1 to 2. Yet no new tasks were launched, as Desired tasks was 2 but Running tasks was 1. How do we fix this?

A

We need to scale the instances. We can do this by going to the Auto Scaling Group behind our instances and update the desired capacity to 2. This is under the assumption that we are only allowing one task to one instance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is a Task in ECS?

A

This is a running container with the settings defined in the Task Definition. It can be thought of as an “instance” of a task definition.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

We get the error ‘[AWS Service] was unable to place a task because no container instance met all of its requirements.”, and that its already using a port required by the task. How can we fix this?

A

We can add container instances to a cluster or reduce the number of desired tasks. However, it is preferable to use an Application Load Balancer with dynamic port mapping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is Dynamic Port Mapping?

A

Dynamic Port Mapping allows you to run multiple tasks over the same host using multiple random host ports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is a service in ECS?

A

A service enables you to run and maintain a specified number of instances of a task definition simultaneously in an Amazon ECS cluster

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

We have updated a task definition in ECS. However, we don’t see the changes when we interact with the instances. What is a possible reason?

A

We need to make sure that we update the service with the new task definition version as well.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

You have created a load balancer for your ECS service to use. What must you do with the security group attached to the cluster?

A

We must make sure that we can allow all traffic from the ALB security group that we created for Dynamic Port Mapping.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is the Amazon ECS Container Instance IAM Role?

A

It allows the Container instances that run the ECS container agent to make calls to ECS on your behalf. The IAM role and policy allow the service to know the agent belongs to you.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is ECR?

A

It is a private Docker image repository within your AWS account

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

If you have permission errors to ECR, what could be the reason?

A

You need IAM permissions to access ECR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

**What is the AWS CLI v1 login command for ECR?

A

$(aws ecr get-login –no-include-email –region eu-west-1)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

**What is the AWS CLI v2 login command for ECR?

A

aws ecr get-login-password –region eu-west-1 | docker login –username AWS –password-stdin 1234567890-dkr.ecr.eu-west-1.amazonaws.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What are the four commands to push a docker image to ECR?

A

Login to ECR and Docker;
Build the Docker image;
Tag the image (get it ready for a push specifying the source);
Push the image up

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What allows ECS and the Container instances to pull and run the docker images from ECR?

A

It is the IAM role that AWS recommends we give to the ECS containers

30
Q

What is Fargate?

A

{{answer}}

31
Q

How does an EC2 Instance Profile come into play between EC2 and ECS/ECR?

A

The Instance Profile will be attached to the EC2 instance. The ECS agent that is attached to the EC2 profile then uses the IAM role to make calls to ECS and ECR.

32
Q

How does IAM, the Container instance and tasks work together?

A

You can grant permissions to the applications in the tasks containers that are running on an instance that you have. Perhaps one is reaching out to S3 and another one interacting with EC2. You provide these tasks roles to give these permissions. You define them in the task definition.

33
Q

What is the general idea behind ECS Tasks Placement?

A

When a service scales in or out, ECS must determine what task to either shut down or get launched. This is only with regards to a task associated with EC2, not Fargate.

34
Q

What is the four step strategy for when Amazon ECS places tasks?

A

Identify the instances that satisfy the CPU, memory, and port requirements in the task definition;
Identify the instances that satisfy the task placement constraints;
Identify the instances that satisfy the task placement strategies;
Select the instances for task placement

35
Q

What is the Binpack task placement strategy?

A

Place tasks based on the least available amount of CPU or memory. Fill up an EC2 instance before creating another one.

36
Q

What is the Spread task placement strategy?

A

Place the task evenly based on the specified value. For example, spread on the EC2 instances across AZs.

37
Q

What are the ECS task placement constraint options?

A

distinctInstance: Place each task on a different container instance

memberOf: Place tasks on container instances that satisfy an expression. For example tasks should only get placed on t2 instances.

38
Q

ECS service scaling uses the EC2 Auto Scaling, true or false?

A

False. EC2 Auto Scaling and Capacity Providers is instance level. ECS service scaling is at the task level.

39
Q

You want multiple containers of the same type on EC2 instances. How do we architect this?

A

Me must not specify a host port and use an ALB with dynamic port mapping. Remember that the EC2 instance security group must allow traffic from the ALB on all ports.

40
Q

How do you integrate CloudWatch with ECS?

A

Set up logging at the task definition level. The EC2 instance profile needs correct IAM permissions

41
Q

Which ECS config must you enable in /etc/ecs/ecs.config to allow your ECS tasks to endorse IAM roles?

A

ECS_ENABLE_TASK_IAM_ROLE

42
Q

You are running a web application on ECS, the Docker image is stored on ECR, and trying to launch two containers of the same type on EC2. The first container starts, but the second one doesn’t. You have checked and there’s enough CPU and RAM available on the EC2 instance. What’s the problem?

A

The host port is defined in the task definition. Set that to 0 and enable Dynamic Port Mapping.

43
Q

You would like to run 4 ECS services on your ECS cluster, which need access to various services. What is the best practice?

A

Create 4 ECS task roles and attatch them to the relevant ECS task definition.

44
Q

What are the three components of Elastic Beanstalk?

A

Application, application version, and environment name

45
Q

When we create an Elastic Beanstalk environment with a load balancer, we get two security groups? What are they?

A

One is for the load balancer and the other is for the instances, which only accepts calls from the load balancer

46
Q

Deleete

A

Delete

47
Q

What is the All at Once deployment option Elastic Beanstalk?

A

Deploy all instances in one go. Fastest, but instances aren’t available to serve traffic for a bit

48
Q

What is Rolling Update deployment option Elastic Beanstalk?

A

Updates a few instances at a time (bucket), and then moves onto the next bucket once the first bucket is healthy

49
Q

What is Rolling Update with Additional Batches deployment option Elastic Beanstalk?

A

Spins up new instances to move the batch

50
Q

What is the Immutable deployment option Elastic Beanstalk?

A

Spins up new instances in a new ASG, deploys versions to these instances, and then swaps all the instances when everything is healthy

51
Q

What is a downside of Rolling Update (with batch) deployment?

A

Long deployment

52
Q

Which deployment option for Elastic Beanstalk has the highest cost and longest deployment?

A

Immutable

53
Q

Which three EB deployment options are recommended for Prod environments?

A

Immutable and Rolling with Batch and Traffic Splitting

54
Q

What is Blue/Green deployment?

A

It is when we have two identical production environments. We deploy to either Blue or Green to test and then we switch traffic to which environment is the new version. If problems arise, we can quickly deploy out the old version and fix bugs.

55
Q

Which deployment option for Elastic Beanstalk has downtime if the deployment fails?

A

All at Once

56
Q

What is Traffic Splitting deployment option for Elastic Beanstalk?

A

We can specify a percentage of traffic that gets sent to a new application version and the amount of time we would like to monitor its health.

57
Q

What is a Beanstalk lifecycle policy? How can we prevent data loss?

A

Beanstalk can have at most 1000 versions. Setting a lifecycle policy can help phase out old versions. Based on time and space. We can configure an option so that it does not delete source bundle in S3.

58
Q

What are .ebextensions files?

A

They are configuration files to configure your environment and customize the AWS resources that it contains. They are YAML or JSON formatted but have a .config file extension.

59
Q

We clone an Elastic Beanstalk environment that has an RDS database configured and running. The data is migrated over true or false?

A

False. Data is lost but configuration is kept.

60
Q

After creating an Elastic Beanstalk environment, we cannot change the ELB type, true or false?

A

True. You can still change the ELB types settings however.

61
Q

We need to change the ELB type of our Elastic Beanstalk environment. We can go ahead and clone it and change the LB configuration, true or false.

A

False. We need to migrate (create new environment without LB but same configuration), to a new environment, deploy to the new environment, and then CNAME swap or Route 53 update.

62
Q

What is the best architecture concerning Elastic Beanstalk and RDS databases in Production?

A

We do not want to provision an RDS database with Beanstalk in prod. The RDS lifecycle is tied to the Beanstalk lifecycle. Instead we should separately create the RDS instance and provide our EB application a connection string.

63
Q

How do we decouple RDS from Elastic Beanstalk?

A

We create a snapshot of RDS DB;
Go to the RDS console and protect the RDS database from deletion;
Create a new Elastic Beanstalk environment, without RDS, point your application to existing RDS;
Perform a CNAME swap or Route 53 update;
Terminate the old environment (RDS will not be deleted);
Since RDS will stay, need to delete CloudFormation stack;

64
Q

True or false, a single docker on an Elastic Beanstalk application utilizes RDS?

A

False. Only EC2

65
Q

What one of two things must we provide for single Docker container in Elastic Beanstalk?

A

Dockerfile or a dockerrun.aws.json v1 (points to an already built Image)

66
Q

What do we need to provide to set up a Multi Docker Container in Elastic Beanstalk?

A

Dockerrun.aws.json (v2). This is used to generate the ECS task definition.

67
Q

What is the ECS Capacity Provider?

A

A Capacity Provider help determine the allowed usage of resources for each task. When we create a service, we can choose a Capacity Provider (our CP strategy) instead of Fargate or EC2 to determine how tasks are placed.

68
Q

You would like your Elastic Beanstalk environment to expose an HTTPS endpoint instead of an HTTP endpoint in order to get in-flight encryption between your clients and your web servers. What must be done to setup HTTPS on Beanstalk?

A

Add a secure listener in the .ebextensions in a .config file

69
Q

You are looking to perform a set of repetitive and scheduled tasks asynchronously. Which Elastic Beanstalk environment should you setup?

A

Set up a Worker environment and a cron.yaml file

70
Q

What is the difference between a task placement strategy and a task placement constraint?

A

A placement strategy is a best attempt at placing or terminating tasks on services. A placement constraint is a more hard-nosed rule on where a task can get placed.

AWS Developer (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions