Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS > AWS Certified Cloud Practitioner 2020 > Flashcards

AWS Certified Cloud Practitioner 2020 Flashcards

1
Q

What are the Six Advantages of Cloud Computing?

A
  1. Trade fixed expense for variable expense
  2. Benefit from massive economies of scale
  3. Stop guessing capacity
  4. Increase speed and agility
  5. Stop spending money running and maintaining data centers
  6. Go global in minutes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is Infrastructure as a Service (IaaS)?

A

Infrastructure as a Service (IaaS) contains the basic building blocks for cloud IT and typically provides access to networking features, computers (virtual or on dedicated hardware), and data storage space.

e.g. EC2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is Platform as a Service (PaaS)?

A

Platform as a Service (PaaS) removes the need for your organization to manage the underlying infrastructure (usually hardware and operating systems) and allows you to focus on the deployment and management of your applications.

e.g. Elastic Beanstalk, Amazon Lightsail

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is Software as a Service (SaaS)?

A

Software as a Service (SaaS) provides you with a completed product that is run and managed by the service provider.

e.g. GMail

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What does Public Cloud mean?

A

A cloud-based application is fully deployed in the cloud and all parts of the application run in the cloud.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What does Hybrid cloud mean?

A

A hybrid deployment is a way to connect infrastructure and applications between cloud-based resources and existing resources that are not located in the cloud.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What does On-premises cloud mean?

A

The deployment of resources on-premises, using virtualization and resource management tools, is sometimes called the “private cloud.”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What defines an AWS Region?

A
  1. An AWS Region is a physical location in the world where we have multiple Availability Zones. Each Availability Zone is isolated, but the Availability Zones in a Region are connected through low-latency links.
  2. Each Amazon Region is designed to be completely isolated from the other Amazon Regions.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is an Availability Zone?

A
  1. Availability Zones consist of one or more discrete data centers, each with redundant power, networking, and connectivity, housed in separate facilities. These Availability Zones offer you the ability to operate production applications and databases that are more highly available, fault tolerant, and scalable than would be possible from a single data center.
  2. Each Availability Zone is designed as an independent failure zone.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

AWS Cloud Compliance supports what standards

A
  • SOC 1/ISAE 3402, SOC 2, SOC 3
  • FISMA, DIACAP, and FedRAMP
  • PCI DSS Level 1
  • ISO 9001, ISO 27001, ISO 27017, ISO 27018
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Why choose a particular AWS region?

A
  1. Data sovereignty laws - where can the data legally be kept?
  2. Latency to end users
  3. Availability of AWS services in the region
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What support plans exist?

A
  1. Basic - free
  2. Developer - 29/mo, scales
  3. Business - 100/mo, scales
  4. Enterprise - 15k/mo, scales - Get a TAM (Technical Account Manager)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which support plan gets you a TAM?

A

Enterprise - 15k/mo, scales

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is CloudWatch?

A
  1. All about performance (analogy is personal trainer)
  2. Can monitor most of AWS
  3. Monitors your AWS resources and the applications they run
  4. Can create alarms which trigger notifications
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What Cloudwatch monitoring periods exist for EC2?

A

Every 5 minutes by default

Every 1 minute for detailed monitoring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Is IAM global or regional?

A

Global

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

3 ways user can access AWS

A
  1. AWS management console
  2. Command Line Interface (CLI) - requires access key ID and secret access key
  3. Amazon SDK
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

IAM policies are which format?

A

JSON

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

IAM policies are applied in what structure?

A

Groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

IAM best practices

A
  1. Only use root account to create other accounts
  2. 1 user = 1 human, no phantom users
  3. Always place users in groups and apply policies at the group level
  4. Strong password policies
  5. Always use MFA
  6. Use roles to access other AWS services
  7. Use access keys for programmatic access to AWS
  8. Use IAM credential reports to audit
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is AWS credential reports?

A

Audit the permissions of users/accounts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

S3 suited for what storage uses?

A

Object-based storage, for flat files (Not suitable for an OS)
Files can be 0-5TB in size
Unlimited storage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Namespace of S3 buckets?

A

universal namespace!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

How to know if S3 upload successful?

A

HTTP 200

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

S3 data consistency model

A

read after write consistency for puts of new objects

eventual consistency for overwrite puts and deletes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Where are S3 buckets stored? Where can they be accessed?

A

Buckets do exist in regions, but can be accessed globally

Can replicate bucket in one region to bucket in another region using cross region replication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

How does S3 scale?

A

S3 scales automatically to meet demand

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is S3 Transfer acceleration?

A

upload to edge location in your region, propagated to other regions using the AWS backbone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is an Edge location?

A

place where content is cached for fast access (think CloudFront)

Note: you can also write (put an object) to an edge location (i.e. Transfer Acceleration)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is the best practice for S3 access control?

A

S3 bucket policies or IAM policies are recommended for access control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What are the S3 storage classes?

A

Amazon S3 Standard (S3 Standard)
Amazon S3 Intelligent-Tiering (S3 Intelligent-Tiering)
Amazon S3 Standard-Infrequent Access (S3 Standard-IA)
Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA)
Amazon S3 Glacier Instant Retrieval
Amazon S3 Glacier Flexible Retrieval (Formerly S3 Glacier)
Amazon S3 Glacier Deep Archive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Characteristics of S3 standard

A

Low latency and high throughput performance
Designed for durability of 99.999999999% of objects across multiple Availability Zones
Resilient against events that impact an entire Availability Zone
Designed for 99.99% availability over a given year
Backed with the Amazon S3 Service Level Agreement for availability
Supports SSL for data in transit and encryption of data at rest
S3 Lifecycle management for automatic migration of objects to other S3 Storage Classes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Characteristics of Amazon S3 Intelligent-Tiering (S3 Intelligent-Tiering)

A
  • Automatically moves data to the most cost-effective tier
    Frequent, Infrequent, and Archive Instant Access tiers have the same low-latency and high-throughput performance of S3 Standard
  • The Infrequent Access tier saves up to 40% on storage costs
  • The Archive Instant Access tier saves up to 68% on storage costs
  • Opt-in asynchronous archive capabilities for objects that become rarely accessed
  • Deep Archive Access tier has the same performance as - Glacier Deep Archive and saves up to 95% for rarely accessed objects
  • Designed for durability of 99.999999999% of objects across multiple Availability Zones and for 99.9% availability over a given year
  • Backed with the Amazon S3 Service Level Agreement for availability
  • Small monthly monitoring and auto tiering charge
  • No operational overhead, no lifecycle charges, no retrieval charges, and no minimum storage duration
  • Objects smaller than 128KB can be stored in S3 Intelligent-Tiering but will always be charged at the Frequent Access tier rates, and are not charged the monitoring and automation charge.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Characteristics of Amazon S3 Standard-Infrequent Access (S3 Standard-IA)

A
  • Infrequent access, but require rapid access - lower fee, but charged a retrieval fee
  • Same low latency and high throughput performance of S3 Standard
  • Designed for durability of 99.999999999% of objects across multiple Availability Zones
  • Resilient against events that impact an entire Availability Zone
  • Data is resilient in the event of one entire Availability Zone destruction
  • Designed for 99.9% availability over a given year
  • Backed with the Amazon S3 Service Level Agreement for availability
  • Supports SSL for data in transit and encryption of data at rest
  • S3 Lifecycle management for automatic migration of objects to other S3 Storage Classes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Characteristics of Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA)

A
  • Low cost, do not require multiple availability zone data resilience
  • Same low latency and high throughput performance of S3 Standard
  • Designed for durability of 99.999999999% of objects in a single Availability Zone†
  • Designed for 99.5% availability over a given year
  • Backed with the Amazon S3 Service Level Agreement for availability
  • Supports SSL for data in transit and encryption of data at rest
  • S3 Lifecycle management for automatic migration of objects to other S3 Storage Classes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Characteristics of Amazon S3 Glacier Deep Archive

A

Data retrieval in milliseconds with the same performance as S3 Standard

Designed for durability of 99.999999999% of objects across multiple Availability Zones

Data is resilient in the event of the destruction of one entire Availability Zone

Designed for 99.9% data availability in a given year

128 KB minimum object size

Backed with the Amazon S3 Service Level Agreement for availability

S3 PUT API for direct uploads to S3 Glacier Instant Retrieval, and S3 Lifecycle management for automatic migration of objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Characteristics of Amazon S3 Glacier Flexible Retrieval (Formerly S3 Glacier)

A

Competitive with costs of on-prem solutions

Designed for durability of 99.999999999% of objects across multiple Availability Zones

Data is resilient in the event of one entire Availability Zone destruction

Supports SSL for data in transit and encryption of data at rest

Ideal for backup and disaster recovery use cases when large sets of data occasionally need to be retrieved in minutes, without concern for costs

Configurable retrieval times, from minutes to hours, with free bulk retrievals

S3 PUT API for direct uploads to S3 Glacier Flexible Retrieval, and S3 Lifecycle management for automatic migration of objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Characteristics of Amazon S3 Glacier Deep Archive

A

Designed for durability of 99.999999999% of objects across multiple Availability Zones

Lowest cost storage class designed for long-term retention of data that will be retained for 7-10 years

Ideal alternative to magnetic tape libraries

Retrieval time within 12 hours

S3 PUT API for direct uploads to S3 Glacier Deep Archive, and S3 Lifecycle management for automatic migration of objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is S3 Outposts?

A

store your S3 data on premises

S3 Object compatibility and bucket management through the S3 SDK

Designed to durably and redundantly store data on your Outposts

Encryption using SSE-S3 and SSE-C

Authentication and authorization using IAM, and S3 Access Points

Transfer data to AWS Regions using AWS DataSync

S3 Lifecycle expiration actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Characteristics of Amazon S3 Glacier Instant Retrieval

A

Data retrieval in milliseconds with the same performance as S3 Standard

Designed for durability of 99.999999999% of objects across multiple Availability Zones

Data is resilient in the event of the destruction of one entire Availability Zone

Designed for 99.9% data availability in a given year

128 KB minimum object size

Backed with the Amazon S3 Service Level Agreement for availability

S3 PUT API for direct uploads to S3 Glacier Instant Retrieval, and S3 Lifecycle management for automatic migration of objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

How does S3 versioning work?

A

Stores all versions of an object, even if you delete

Great for backup

Versioning can be suspended, but not disabled; existing versions remain

Integrates with lifecycle rules

Can require MFA in order to delete

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

How can you restrict S3 bucket access?

A

Bucket policies

Object policies

IAM policies to users and groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Characteristics of CloudFront

A

Amazon’s CDN

Origin - The origin of the files

Distribution - collection of edge locations

First user forces a download of the file from origin to edge location - stays in cache until TTL (default is 24 hours in seconds)

2 types

  • web distribution
  • RTMP - used for media streaming (like Adobe Flash) - not used much anymore

You can clear cached objects, but you will be charged for it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Name common compute services

A

EC2 - Secure and resizeable compute capacity (virtual servers) in the cloud

Lightsail - Easy-to-use cloud platform that offers you everything you need to build an application or website

Lambda - Run code without thinking about servers. Pay only for the compute time you consume.

Batch - Fully managed batch processing at any scale

Elastic Beanstalk - Easy-to-use service for deploying and scaling web applications and services

Serverless Application Repository - quickly deploy code samples, components, and complete applications for common use cases such as web and mobile back-ends, event and data processing, logging, monitoring, IoT, and more.

AWS Outposts - Run AWS infrastructure and services on premises for a truly consistent hybrid experience

EC2 Image Builder - Build and maintain secure Linux or Windows Server images

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What are the EC2 types?

A

On Demand: Pay fixed rate by the hour or by the second

Reserved: Includes a capacity reservation, but with a significant discount on the hourly rate. 1 or 3 year contract terms. Max discount for longest time and paying immediately

Spot: Bid a price (per hour) for an instance capacity. Greater savings if you have flexible start and end times

Dedicated Hosts: Physical EC2 server dedicated for your use. Reduced costs when you use your existing server-bound software licenses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What’s an EC2 AMI?

A

AMI (Amazon Machine Image) - e.g. VM snapshot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

How do we design for failure in EC2?

A

“Everything fails all of the time” - we need to design for failure as a natural occurrence

Have one EC2 instance in each availability zone - so failure in one AZ won’t drop your app.

Use ALB or ELB to route

Use auto scaling group

48
Q

How do you pay for partial hours for EC2 Spot instances?

A

If you terminate mid hour, you pay full hour

If AWS terminates mid hour, you don’t pay for the hour

49
Q

When to use EC2 Dedicated hosts?

A

Useful when regulatory requirements exist

Useful when licensing restrictions exist

50
Q

What are Security Groups?

A

Virtual firewalls in the cloud - need to open ports in order to use them

51
Q

What’s VPC?

A

Virtual Private Cloud

your own “data center in the cloud”

Can create a hardware VPN connection between corporate network and VPC - to extend your corporate data center

52
Q

What is AWS Direct Connect?

A

Private hardware connection between AWS and your data center

Can be more reliable and have better bandwidth than the Internet

VPN over Direct Connect: better security - encrypted

53
Q

What is EBS?

A

“virtual disk in the cloud”

virtual storage volumes (block devices) that can be attached to EC2 instances

Attach, then create a filesystem, database, etc.

Placed in specific availability zones

Automatically replicated within AZ to protect from failure

Perfect for OSes, databases

Can be resized, but not as easily/automatically as EFS

54
Q

What EBS Types?

A

SSD

  • GP2: General purpose SSD - balance price and performance
  • IO1: Provisioned IOPS SSD - high performance

Magnetic

  • ST1: Throughput optimized HDD - low cost, frequent access, throughput intensive
  • SC1: Cold HDD - lowest cost HDD for less frequent access
  • Magnetic: previous generation
55
Q

What Load Balancer Types?

A

Application Load Balancers

Network Load Balancers

Gateway Load Balancer

Classic Load Balancers

56
Q

What is EC2 auto scaling?

A

Automatically add EC2 instances to scale an application

Based on an AMI (e.g. VM snapshot)

57
Q

When to choose Application Load Balancer?

A

Not free

Layer 7

Choose an Application Load Balancer when you need a flexible feature set for your applications with HTTP and HTTPS traffic. Operating at the request level, Application Load Balancers provide advanced routing and visibility features targeted at application architectures, including microservices and containers.

58
Q

When to choose Network Load Balancer?

A

Extreme performance, Static IP addresses

Choose a Network Load Balancer when you need ultra-high performance, TLS offloading at scale, centralized certificate deployment, support for UDP, and static IP addresses for your applications. Operating at the connection level, Network Load Balancers are capable of handling millions of requests per second securely while maintaining ultra-low latencies.

59
Q

When to choose Gateway Load Balancer?

A

Choose a Gateway Load Balancer when you need to deploy and manage a fleet of third-party virtual appliances that support GENEVE.

60
Q

When to choose Classic Load Balancers?

A

Test & dev

Low cost

61
Q

What is Lambda pricing?

A

Number of requests - 1M free, then $0.20 per 1M after
Execution time, memory
- time code executes to nearest 100ms.
- price depends on amount of memory you allocate to your function

62
Q

Lambda characteristics

A

Event driven compute service

Triggered by several options - e.g. S3 drops, etc.

Run your code in response to HTTP requests using Amazon API Gateway or API calls made using AWS SDKs

Can use version control

Scales automatically - Lambda scales out, not up

Lambda functions are independent (stateless)

63
Q

What is shared responsibility in Lambda?

A

I’m responsible for my code and the language version I’m using

AWS responsible for hardware

64
Q

Lamdba supported languages

A

Node.js

Java

Python

C#

Go

PowerShell

65
Q

Supported RDS engines

A

MS SQLServer

MySQL

PostgreSQL

Oracle

Aurora

  • Amazon’s DB - compatible with MySQL and postgresql
  • 6 copies of data spread across 3+ AZs

MariaDB

66
Q

RDS characteristics

A

Not free

SQL/OLTP (Online transaction processing)
- A single transaction

Not for OLAP (Online analytics processing) - see Red Shift

Multi-AZ for disaster recovery, failover
Read-replicas for performance

Write to primary database

Read from up to 5 read replicas

67
Q

What is DynamoDB?

A

Amazon’s NoSQL

68
Q

What is Red Shift?

A

Business intelligence or Data warehousing
OLAP: Online analytics processing

Analytics on a whole database

Examples: Cognos, SQL Server Reporting Services, Oracle Hyperion, SAP NetWeaver, etc.

NOT for OTLP (Online transaction processing)

69
Q

What is ElastiCache

A

“Application caching”

Web service fronting an in-memory cache

Web applications access this instead of disk-based databases

Supported engines

  • Redis
  • Memcached
70
Q

What is Amazon Neptune

A

Amazon’s graph database

Scalable, high availability

71
Q

What is Route 53?

A

Amazon’s DNS solution

Register a domain name

Global in scope, similar to IAM and S3

Policies

  • Failover routing
  • Latency-based routing
72
Q

What is Elastic Beanstalk?

A

A way to deploy and manage AWS resources as an orchestrated manner if you don’t know a lot about AWS - like a wizard

Free

Limited in what it can provision and not programmable

“easy-to-use service for deploying and scaling web applications and services developed with Java, .NET, PHP, Node.js, Python, Ruby, Go, and Docker on familiar servers such as Apache, Nginx, Passenger, and IIS.”

Handles capacity provisioning, load balancing, scaling, application health monitoring

73
Q

What is CloudFormation

A

Same concept as Elastic Beanstalk, but for people who know what they’re doing in AWS.

Free

Can provision almost any AWS service and is completely programmable

Turns your infrastructure into code

74
Q

Good alternative to saving your credentials using aws configure to access AWS services

A

Create an IAM role with specific permissions policies

Attach that role to the EC2 instance that you want to perform the authorized operation from. The permissions change immediately - no need to reboot.

Perform the authorized operation. It will work by virtue of the attached role.

In this way, you don’t need to keep your access key and secret access key on the EC2 instance

75
Q

What AWS services are global?

A

IAM

Route 53

CloudFront

SNS

SES

76
Q

Is S3 regional or global?

A

Regional, but viewed globally

77
Q

What is Snowball?

A

Snowball - a huge disk (50 or 80 TB)
- How you can make massive uploads to S3 by borrowing disks from Amazon returning to them with the data

Snowball Edge
- Same as Snowball, but with a computer as well that can run lamdba

78
Q

What is Storage Gateway?

A

Similar to Snowball, but stays on prem

A way to cache files on-prem so you don’t lose files if you lose connectivity to AWS

79
Q

What AWS services are on-prem?

A

Snowball - a huge disk (50 or 80 TB)

Snowball Edge

Storage Gateway

CodeDeploy

Opsworks

IoT GreenGrass

80
Q

What is AWS CodeDeploy?

A

AWS CodeDeploy is a fully managed deployment service that automates software deployments to a variety of compute services such as Amazon EC2, AWS Fargate, AWS Lambda, and your on-premises servers.

81
Q

What is AWS Systems Manager?

A

Manage an EC2 “fleet” (e.g. yum install .... to each machine in fleet)

Piece of software installed on each VM to connect to Systems Manager

Can manage inside AWS and on prem

Run Command used to install, patch, and uninstall software

Integrates with CloudWatch to give dashboard of entire estate

Create Resource Groups

  • Can create based on “Tag query”
  • Can apply automation to all resources in a Resource Group at the same time (e.g. stop all EC2 instances in Resource Group at once)
82
Q

What is Service Health Dashboard?

A

Access the status for all AWS services

83
Q

What is Personal Health Dashboard?

A

Access the status for my AW.

AWS Personal Health Dashboard provides alerts and guidance for AWS events that might affect your environment.

84
Q

What is Global Accelerator?

A

create accelerators to improve availability and performance of applications for local and global users

direct traffic to optimal endpoints over the AWS global network

uses Amazon’s dedicated network rather than the Internet to overcome Internet congestion, etc.

improves internet user performance by up to 60%

85
Q

What is EFS?

A

Elastic File System

file storage service for EC2

automatically resizes with need

multiple EC2 instances can access at the same time

think centralized file server or content management system

86
Q

What is the difference between AWS Budgets and AWS Cost Explorer?

A

Budgets: Plan for costs before they occur

Cost Explorer: Explore costs after they’ve occurred

87
Q

What is consolidated billing?

A

Combines resources billed to activate economies of scale (volume discounts)!

Consolidated Billing enables you to see a combined view of AWS costs incurred by all accounts in your department or company, as well as obtain a detailed cost report for each individual AWS account associated with your paying account.

Only 20 linked accounts allowed (soft limit - can increase)

Best practice: Paying account should be used for billing purposes only.

88
Q

What is CloudTrail?

A

Think “audit”

Monitors API calls in the AWS platform

Per AWS account and is enabled per region

Everytime we do something, CloudTrail logs it.

Best practice - use a separate account for logging

  • Turn on CloudTrail in the paying account
  • Create an S3 bucket with a bucket policy that allows cross-account access
  • Turn on CloudTrail in the other accounts and use the bucket in the paying account
89
Q

What is AWS Landing Zone (now AWS Control Tower)?

A

Sets up a multi-account AWS environment at the click of a button

Typically used by large enterprises with multiple AWS accounts

Creates accounts that conform to company policies

90
Q

What is Security Hub?

A

Gives a comprehensive view of your security alerts across multiple AWS accounts - thousands!

Inputs from GuardDuty, Inspector, Macie, IAM Access Analyzer, Firewall Manager, etc.

91
Q

What do I do when I have compromised AWS creds?

A

Determine what resources those creds have access to

Invalidate creds that have been compromised

Consider invalidating any temporary security creds that might have been issues using the compromised creds

Restore appropriate access

Review access to your AWS account

92
Q

What is AWS Simple Monthly Calculator?

A

easy-to-use online tool that enables you to estimate the monthly cost of AWS services for your use case based on your expected usage.

93
Q

What is AWS Total Cost of Ownership Calculator?

A

Compare costs for AWS vs. owned on-premise

94
Q

What is AWS Artifact?

A

place to find compliance documents

AWS has some responsibilities, developer has some responsibilities - See AWS Shared Responsibility Model

95
Q

What is the AWS Shared Responsibility model?

A

AWS manages security “of the cloud”

Security “in the cloud” is customer’s responsibility

96
Q

How does AWS feel about me doing pen testing?

A

AWS customers are welcome to carry out security assessments or penetration tests against their AWS infrastructure without prior approval for 8 services:

  • EC2, NAT gateways, ELB
  • RDS
  • CloudFront
  • Aurora
  • API Gateway
  • Lambda
  • Lightsail
  • Elastic Beanstalk

Unsupported

  • DDoS-ing yourself
  • DNS zone walking
  • Port flooding
  • Protocol flooding
  • Request flooding
97
Q

What is Amazon GuardDuty?

A

Uses ML algs to monitor and protect AWS account

Notifies of weird/anomalous behavior

30 day trial

Input data includes

  • CloudTrail logs
  • VPC Flow logs
  • DNS logs

Operates on single AWS account

98
Q

What is WAF?

A

Web application firewall

Layer 7 firewall

Put firewall in front of load balancer

99
Q

What is AWS Shield?

A

DDoS protection service

“Standard” turned on automatically

“Advanced” - optional - $3k/month

100
Q

What is AWS Inspector?

A

automated service that helps improve security and compliance of apps deployed on AWS

looks for vulnerabilities or deviations from best practices

install on EC2 instances

101
Q

What is AWS Trusted Advisor?

A

online resource to help reduce cost, increase performance, and improve security by optimizing your AWS environment

real time guidance

advise on cost optimization, performance, security, fault tolerance

looks at all AWS account

Categories of checks

  • Cost optimization
  • Performance
  • Security
  • Fault tolerance
  • Service limits
102
Q

What is AWS Config?

A

Monitors configuration of AWS resources in AWS account

103
Q

What is AWS Key Management Service (KMS)?

A

Manages master keys

For S3, database password

On shared hardware

Integrated with most AWS services

Regional

104
Q

What is AWS CloudHSM?

A

Dedicated hardware security module (HSM)

Does all AWS KMS does and more

FIPS 140-2 Level 3

Single tenant

Can be clustered across multi-AZ

105
Q

What is AWS Parameter Store?

A

serverless storage for configuration and secrets

can be stored using KMS or plaintext

TTL to expire supported

free

10K parameters per account

106
Q

What is AWS Secrets Manager?

A

Does all Parameter Store does and more

Not free; charged per secret stored and per 10K API calls

Can automatically rotate secrets

Apply the new key/password in RDS for you

Generate random secrets

107
Q

What is Athena?

A

interactive query service that makes it easy to analyze data in Amazon S3 using standard SQL

Pay per query / per TB scanned

No need for ETL

Use cases

  • Query log files in S3 (e.g. ELB logs, S3 access logs, etc.)
  • Generate business reports
  • Analyse AWS cost and Usage reports
  • Run queries on click-stream data
108
Q

What is Macie?

A

Uses AI (ML and NLP) to discover, classify, and protect sensitive data in S3 (like PII)

Dashboards, reporting, alerts

Works with data stores in S3

Can analyze CloudTrail logs

Great for PCI-DSS and preventing ID theft

109
Q

What is Lex?

A

powers Amazon Alexa

Used to build conversational chatbots powered via voice or text

110
Q

What is Polly?

A

Text to life-like voice

Can use an accent - lots of different voices

111
Q

What is Transcribe?

A

Speech to text

112
Q

What is Rekognition?

A

Images to tags/text

Upload an image and Rekognition will tell you what it thinks the image is - with a certain degree of confidence

113
Q

What is a Subnet?

A

A range of IP addresses in your VPC

114
Q

What is an ACL?

A

Access control list (ACL) – use a network ACL to provide additional security in a subnet. The default subnet ACL allows all inbound and outbound traffic.

115
Q

What is a Route Table?

A

Contains a set of routes that AWS uses to direct the network traffic for your VPC. You can explicitly associate a subnet with a particular route table. By default, the subnet is associated with the main route table.

AWS (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions