AWS Cloud Practitioner Flashcards
1
Q
What is public cloud?
A
Computing services offered by third-party providers over the public Internet
2
Q
What is hybrid cloud?
A
A cloud setup where you have some data on prem and some in the cloud
3
Q
What type of expense is cloud computing?
A
With cloud services we reduce our trade capital expense (CAPEX) in exchange for higher operational expense (OPEX)
4
Q
What does Iaas stand for?
A
Infrastructure as a service.
5
Q
What is an example of Iaas in AWS?
A
EC2
6
Q
What does Paas stand for?
A
Platform as a service. Paas removes the need to manage underlying infrastructure.
7
Q
What is an example of Paas in AWS?
A
Elastic beanstalk
8
Q
What does Saas stand for?
A
Software as a service. A completed product that will be run and managed by the provider.
9
Q
What is an example of Saas in AWS?
A
Rekognition
10
Q
What are the 3 AWS pricing fundamentals?
A
You pay for compute time, you pay for data stored in the cloud and you pay for data transfer out of the cloud (data transfer into the cloud is free)
11
Q
What is a region in AWS?
A
A physical location containing a cluster of data centres which are divided into Availability Zones (AZs).
12
Q
What are four things you should take into account when choosing an AWS region?
A
Compliance with data governance, proximity to customers, available services within a region and pricing.
13
Q
What is an AZ in AWS?
A
Availability Zone. Each AZ within a region is one or more discrete data centres.
14
Q
How are AZs organised in a region?
A
They are separated from each other so they’re less likely to all be affected by a disaster.
15
Q
What standard defines what is AWS’s responsibility and what is the user’s responsibility?
A
The shared responsibility model.
16
Q
What does IAM stand for?
A
Identity and Access Management
17
Q
What should you use your AWS root account for?
A
You should only use the root account to perform a few account and service management tasks (for example, creating other accounts).
18
Q
What can IAM groups contain?
A
IAM groups contain users. They cannot contain other groups- although users can belong to multiple groups.
19
Q
What type of files are used to assign IAM permissions?
A
In IAM you assign permissions with JSON documents called policies.
20
Q
Which principle should you use when deciding on the permissions to grant an IAM user?
A
The least privilege principle. Don’t give anymore permissions than a user needs.
21
Q
What are tags, and what are they used for?
A
Tags are used to organise and track AWS resources. They are key-value pairs.
22
Q
What is within the IAM Policy Structure?
A
An optional SID (id), an effect (this dictates whether the policy allows or denies access), a principle (the user/account/group to which this policy applies), an action (a list of actions which this policy applies to- e.g., a ‘get’), a resource (list of resources which this action applies to- e.g., a bucket), and an optional condition (condition for execution)
23
Q
What is the name of the type of device you use for physical MFA?
A
Universal Second Factor
24
Q
What are the three ways in which you can access AWS?
A
The AWS Management Console, the AWS Command Line Interface (CLI) and AWS Software Developer Kit (SDK)
25
How do you generate AWS Access Keys?
Use the AWS Console.
26
What is the different between the AWS CLI and SDK?
The CLI allows you do work with AWS over the command line, SDK allows you to access AWS programmatically.
27
What does AWS SDK stand for?
AWS Software Developer Kit
28
What is AWS Cloudshell?
A terminal in the AWS management console in which you are automatically logged in as your user in your current region.
29
If you want AWS Services to perform actions on your behalf you need to assign them permissions using IAM Roles (T/F)
True
30
What is the name of the document which lists all of your account’s users and the status of their credentials?
IAM Credentials Report
31
What is the name of the document which shows the service permissions granted to a user and when those services were last accessed?
IAM Access Advisor
32
What is the correct policy for creating new AWS Users?
One AWS user = one physical user.
33
What is the correct policy for assigning permissions to a user?
Assign users to groups and permissions to groups.
34
Where do you find information on your AWS spending?
AWS Billing Dashboard
35
What does EC2 stand for?
Elastic Compute Cloud
36
What is bootstrapping in EC2?
Bootstrapping means running commands when a machine starts. This script is only run once, and it is used to automate boot tasks.
37
What is the name of the script which is run when we launch an EC2 instance?
The EC2 User Data Script
38
What are examples of EC2 base images?
AWS Linux and Ubuntu
39
What are EC2 instance types?
EC2 Instance types represent different amounts of memory, different CPUs &c.
40
An EC2 instance is named m5.2xLarge. What information do we know about it?
‘m’ is the name of its instance class (‘general purpose’), ‘5’ is its instance generation, ‘2xLarge’ is its size within the instance class.
41
You have a machine learning project. What is the best type of EC2 instance to use for it?
A compute optimised EC2 instance.
42
You have a project which needs a high performance database. What is the best type of EC2 instance to use for it?
A memory optimised EC2 instance.
43
You have a noSQL database project. What is the best type of EC2 instance to use for it?
A storage optimised EC2 instance.
44
What do you use to control traffic in and out of EC2 instances?
Security groups.
45
You create an EC2 security group. What are the rules for reusing it?
Security groups can be attached to multiple instances but they are locked to a region. If you want to go into another region you have to create a new security group.
46
What are the default EC2 security group rules?
All inbound traffic is blocked, all outbound traffic is allowed.
47
What rules do EC2 security groups support?
EC2 security groups only support allow rules.
48
What is AWS EC2 Instance Connect?
Amazon EC2 Instance Connect is a simple and secure way to connect to your instances using Secure Shell (SSH)
49
What are On-Demand EC2 Instances?
EC2 Instances that you pay for with no long-term commitments. They are good for short workloads. You pay by the second.
50
What are Reserved EC2 Instances?
You can purchase a Reserved Instance for a one-year or three-year commitment. They are good for long term workloads (like databases) and are cheaper than On-Demand Instances.
51
What are Convertible Reserved EC2 Instances?
Convertible Reserved Instances are a type of Reserved Instance that can be exchanged for new instance types, new tenancies, and new operating systems as circumstances change. They are good for long workloads with flexible instances.
52
What are Spot EC2 Instances?
A Spot Instance is an instance that uses spare EC2 capacity that is available for less than the On-Demand price. These are good for short workloads and are cheap, but you may lose your instances.
53
What are Dedicated Hosts EC2 Instances?
An Amazon EC2 Dedicated Host is a physical server with EC2 instance capacity fully dedicated to your use. This is good if you have compliance requirements.
54
What are Dedicated EC2 Instances?
Dedicated Instances are Amazon EC2 instances that run in a virtual private cloud (VPC) on hardware that's dedicated to a single customer.
55
What are EC2 Capacity Reservations?
On-Demand Capacity Reservations enable you to reserve compute capacity for your Amazon EC2 instances in a specific Availability Zone for any duration. Capacity Reservations mitigate against the risk of being unable to get On-Demand capacity in case there are capacity constraints.
56
What does EBS stand for?
Elastic Block Store. Elastic Block Store is an high-performance block-storage service designed for EC2.
57
What is an EBS Volume?
An Amazon EBS volume is a block-level storage device that you can attach to your instances. After you attach a volume to an instance, you can use it as you would use a physical hard drive.
58
What are the rules for moving and reusing EBS Volumes?
A volume can only be mounted to one instance at a time (unless you are willing to do some complicated things). They can be moved between EC2 Instances easily, provided those instances are within the same AZ. To move volumes between AZs you need to snapshot them.
59
Which attribute is used to control EBS volume behaviour when an EC2 Instance terminates?
The ‘delete on termination’ attribrute.
60
What are the default rules for EBS volume behaviour on EC2 Instance termination?
By default the EC2 instance’s root volume will be deleted, but no other EBS volumes will be.
61
What is an EBS snapshot?
A ‘backup’ of the contents of a volume.
62
What does it mean to archive a snapshot?
Moving a snapshot to ‘archive tier’ makes its storage 75% cheaper, but it takes 24 to 75 hours to retrieve it.
63
What does AMI stand for?
Amazon Machine Image
64
What does an AMI do?
An Amazon Machine Image is a master image for the creation of EC2 instances in AWS. You can create an AMI from a existing EC2 instance. They are built for a specific region.
65
What are the three types of AMI that you can use to launch instances from?
Public AMI (AWS provided), your own AMI (made and maintained by you) and AWS Marketplace AMIs
66
What do you use EC2 Image Builder for?
EC2 Image Builder is used to automate the creation of VMs or container images. AMIs are one of the types of images you can create with Image Builder, and Image Builder allows you to automate the creation, maintenance and validation of AMIs.
67
What AWS EC2 tool would you use if you need a high-performance hardware disk?
EC2 instance store. Instance stores lose their storage if they’re stopped- they’re good for buffer/cache/scratch storage. There is a risk of data loss if the hardware fails, and backups are your responsibility.
68
What does EFS stand for?
Elastic File System
69
What does NFS stand for?
Network File System
70
What service does EFS provide?
It is a Network File System which is accessible across multiple AZs (via EFS mount targets). It is expensive, compared with EBS.
71
What is EFS-IA?
Elastic File System Infrequent Access. If you enable EFS-IA within a lifecycle policy, EFS will automatically move your files to a cheaper infrequent access store if they go unused for a long time.
72
What is Amazon Fsx?
Fsx is used to launch 3rd party high performance file systems on AWS. There is an Fsx for windows and lustre (“linux” + “cluster” = “lustre”).
73
What is vertical scalability?
Vertical scalability means that you can increase the size of an instance.
74
What is horizontal scalability?
Horizontal scalability means that you can increase the number of instances for your application.
75
What is high availability?
High availability indicates that you running you application in at least two availability zones. High availability goes hand in hand with horizontal scaling.
76
What is elasticity?
Once a system is scalable, elasticity means there will be some ‘auto-scaling’, so that a system can scale based on load. This allows you to optimise costs.
77
What are load balancers?
A load balancer is a service which forwards internet traffic to multiple servers downstream. This allows you to spread load across multiple downstream instances. You can expose a single point of access (DNS) to your application and seamlessly handle failures downstream.
78
What are the location rules for load balancers?
You can use a load balancer across multiple AZs.
79
What does ELB stand for?
Elastic Load Balancer.
80
What does an ELB do?
Elastic Load Balancer is a managed service which handles the maintenance of your load balancers. Elastic Load Balancing scales your load balancer as your incoming traffic changes over time.
81
Which load balancer type handles HTTP/HTTPS routing?
Application load balancer
82
Which load balancer type is used for ultra high performance and handles UPP and TCP routing?
Network load balancer
83
Which load balancer type is best for security and intrusion detection?
Gateway load balancer
84
What does ASG stand for?
Auto scaling group
85
What is an ASG used for?
Auto scaling groups are designed to scale in and out (aka add and remove EC2 instances) to match your application’s load. You set a minimum and maximum number of machines and a desired capacity and your ASG will automatically register new instances to your load balancer when needed. It will also replace unhealthy instances.
86
Which ASG strategy requires you to change the application scale yourself?
Manual scaling
87
Which ASG strategy allows you to change the application scale according to demand?
Dynamic scaling
88
Which ASG strategy allows you to change the application scale based on an event?
Simple/ step scaling. An example of an event is a cloudwatch alarm being triggered.
89
Which ASG strategy allows you to set an average scale for your application?
Target tracking scaling (e.g., ‘I want ASG CPU to stay around 40%’)
90
Which ASG strategy allows you to scale based on a schedule?
Scheduled scaling
91
Which ASG strategy allows you to scale based on a learned pattern?
Predictive scaling (use machine learning to predict traffic ahead of time, and automatically provision EC2 instances ahead of time)
92
What does S3 stand for?
Amazon Simple Storage Service
93
How are files and directories described in Amazon S3?
Files are objects, directories are buckets.
94
What are the location rules for S3 buckets?
S3 Buckets are defined at the region level.
95
What are the size constraints for S3 objects?
If you try to upload objects larger than 5TB, you will need to do this with a multi part upload.
96
What user based policy can you use to secure your S3 bucket?
IAM policies can be used to dictate which API calls are allowed for a specific AWS User.
97
Which common S3 policy can be used to create bucket-wide access rules?
Bucket policies.
98
Which S3 policy can be used to create object specific access rules?
Object Access Control List
99
If you know that none of your S3 buckets should ever be public, what is the easiest way to set this?
You can set this rule at the account level.
100
At what level do you set versioning in S3?
S3 file versioning is set at the bucket level
101
What does CRR stand for?
Cross region replication
102
What does SRR stand for?
Same region replication
103
What is CRR useful for?
Compliance, lower latency access, replication across accounts
104
What is SRR useful for?
Log aggregation, live replication between prod and test accounts
105
Which two methods can you use to move between S3 storage classes?
You can move manually, or by using S3 lifecycle configurations
106
Which S3 storage class is best for general purpose use?
S3 Standard
107
Which S3 storage class is best for data which is infrequently accessed but still needs rapid retrieval?
S3 Infrequent Access. Standard infrequent access is used for disaster recovery. One zone infrequent access is used for backups of on-prem data, or data you can recreate.
108
Which S3 storage class is best for big data analytics?
S3 Standard
109
Which S3 storage class is best for gaming apps?
S3 Standard
110
Which S3 storage class is best for low cost storage (e.g., for archiving and backup)?
S3 Glacier Storage.
111
What is the fastest S3 storage class for archiving?
S3 Glacier Instant Retrieval.
112
What is the flexible S3 storage class for archiving?
S3 Glacier Flexible Retrieval (which includes expedited, standard and bulk tiers).
113
What is the cheapest S3 storage class for archiving?
S3 Glacier Deep Archive
114
Which S3 storage tool can you use to move between storage classes automatically?
S3 Intelligent Tiering
115
What are the three S3 Encryption options?
No encryption, server-side encryption (file is encrypted after it is received) and client-side encryption (use encrypts objects before uploading it)
116
What are the AWS Snow Family used for?
The AWS Snow Family are portable devices to collect and process data at the edge and to migrate data in and out of AWS.
117
When should you make use of a snowball device for uploading data to AWS?
When it would take you more than a week to upload your data to the cloud directly.
118
How much data can be stored on a snowball edge?
80TB
119
How much data can be stored on a snowcone?
8TB
120
How can you use your Amazon Snowcone to send data to AWS over the internet?
Connect it to the web and use AWS DataSync to send your data
121
How much data can be stored on a snowmobile?
It has up to 100PB useable
122
What do you install to your on prem servers to allow them to transfer data to your Snowball device?
Snowball client
123
What service can you use to manage your snow family devices?
AWS OpsHub
124
Which AWS service can you use to bridge between on-prem and cloud data?
AWS Storage Gateway
125
What does RDS stand for?
Relational Database Service
126
What is RDS used for?
Relational Database Service is a managed DB service for using SQL.
127
What is the name of the relational database service which was built by AWS to be optimised for the cloud ?
Amazon Aurora
128
Which RDS DB replication pattern is used to create readable copies of your database?
Read replicas. With this pattern you create up to 5 read replicas of your DB. Writes are still done to the main DB.
129
Which RDS DB replication pattern is used to create a failover copy of your DB?
Multi AZ. Read and writes still go to the main DB- the DB copy is only used if there is a disaster which takes out the main DB.
130
Which RDS DB replication pattern is used to create readable copies of your database between regions?
Multi Region. Similar to ‘read replicas’ pattern. Reads are done to the DB replica in your region, but writes are done to the main DB. There is a replication cost for copying the DB between regions.
131
What is elasticache used for?
A managed DB for caching. This helps take the load of the DB for read intensive workloads.
132
What is AWS’s NoSQL DB service?
DynamoDB
133
Which is DynamoDB Accelerator?
A fully managed in-memory cache for DynamoDB
134
How can you make a DynamoDB table accessible with low latency across multiple regions?
You can set up global tables. This allows you to have two way DB replication- both reads and writes happen to the DB copy in your region. This is then replicated everywhere. This is active-active replication.
135
Which AWS database specialises in analytics?
Redshift
136
How is AWS’s analytics DB different to its other DBs?
With redshift, data is loaded every hour, not continuously. It is high performance, and has an SQL interface for it to be queried.
137
What does Amazon EMR stand for?
Elastic Map Reduce.
138
What is Amazon EMR used for?
It is used to analyse and process big data. It’s good for data processing, machine learning &c.
139
Which AWS service is used to perform analytics against S3 objects?
Amazon Athena
140
Which AWS service is used to create interactive dashboards?
Amazon Quicksight
141
What is AWS's equivalent of MongoDB?
DocumentDB (this is very similar to DynamoDB, but it isn’t Serverless- it is compatible with MongoDB)
142
What is AWS's graph database?
Amazon Neptune. A social network is a good use case for a graph database.
143
What does Amazon QLDB stand for?
Amazon Quantum Ledger Database. A ledger is a book for recording financial transactions. It’s immutable, and used to review the history of all the changes made to your application data over time.
144
What is the difference between Amazon QLDB and Amazon Managed Blockchain?
With Amazon QLDB there’s no decentralisation, in accordance with financial regulation rules
145
What is AWS's blockchain service called?
Amazon Managed Blockchain. It is used to join public blockchain networks or to create your own scalable private network.
146
What is AWS Glue used for?
Glue is used to prepare and transform data for analytics. You can prep data for, for example, Redshift.
147
What does DMS stand for?
Database Migration Service. This allows you to migrate from one DB type to another.
148
What does ECS stand for?
Elastic Container Service.
149
What is ECS used for?
Elastic Container Service is used to launch docker containers on AWS. You must provision and maintain the infrastructure for then.
150
What is Fargate used for?
Fargate is a managed service for launching docket containers. It is similar to ECS but it’s Serverless and you don’t need to provision instances yourself.
151
What does ECR stand for?
Elastic Container Registry.
152
What is ECR used for?
Elastic Container Registry is a private docker registry where you can store your docker images.
153
How is Lambda pricing done?
Pay per request and compute time.
154
What is API Gateway used for?
API Gateway is used for building Serverless APIs. It provides the client with the rest API gateway used to connect to the API. Used to create, publish, maintain, monitor and secure APIs.
155
What is AWS Batch used for?
AWS Batch is used to do computing batch jobs. A batch job is a job with a start and end. Batch jobs are defined as docker images and run on ECS. Pretty much anything that can be run on ECS can be run on batch.
156
What is Amazon Lightsail used for?
Amazon Lightsail is very useful for people with little AWS experience. It’s a simpler alternative to using many individual services and can be used to launch a simple web app. It has limited AWS integration.
157
What is CloudFormation used for?
CloudFormation is used to instantiate multiple services at once (e.g., a security group, 2 EC2 instances etc). It’s done with infrastructure as code. It also makes it easy to replicate an architecture.
158
What CloudFormation tool can you use to visualise your resources and relations?
CloudFormation Stack Designer
159
What does CDK stand for?
Cloud Development Kit
160
What is CDK used for?
Cloud Development Kit allows you to define your cloud infrastructure using a familiar coding language (e.g., Python rather than YAML). This is then compiled into a CloudFormation template. This makes it possible to deploy infrastructure and app runtime code together
161
What is Elastic Beanstalk used for?
Elastic Beanstalk is a service for deploying and scaling web applications and services. Upload your code and Elastic Beanstalk automatically handles the deployment—from capacity provisioning, load balancing, and auto scaling to application health monitoring.
162
How is Elastic Beanstalk pricing done?
Elastic Beanstalk is free but you pay for the underlying instance.
163
What is CodeDeploy used for?
CodeDeploy automates software deployments. It works with EC2 and on-prem servers. Servers and instances have to be provisioned ahead of time with the CodeDeploy agent.
164
What is AWS's version of GitHub?
CodeCommit.
165
What does AWS CodeBuild do?
CodeBuild allows you to build your code in the cloud. It compiles source code, runs tests, and produces packages that are ready to be deployed (by CodeDeploy, for example). It can retrieve code from CodeCommit.
166
What does AWS CodePipeline do?
CodePipeline allows you to orchestrate the steps to have code pushed to prod. It is the basis is for CI/CD.
167
What does AWS CodeArtefact do?
CodeArtefact is a secure artefact (dependancy) management tool for software development. It works with common dependency tools such as nvm, npm, gradle etc.
168
What does AWS CodeStar do?
CodeStar is a unified UI to easily manage software development activities in one place. It gives you a nice dashboard and handles all the other code services for you.
169
What does AWS Cloud9 do?
Cloud9 is a cloud IDE. It allows for pair programming.
170
What does AWS SSM stand for?
AWS Systems Manager.
171
What does AWS SSM do?
AWS Systems Manager helps you manage EC2 and on-prem systems at scale. It gives you operation insights about the state of the infrastructure.
172
What does AWS SSM Session Manager do?
AWS SSM Session Manager allows you to start a secure shell on your EC2 and on-prem servers. It’s another way to access these servers or instances securely.
173
What does AWS OpsWorks do?
Non-AWS tools Chef and Puppet help you to perform server config automatically. In response, AWS OpsWorks was made to allow you to use Chef and Puppet in the cloud. It’s an alternative to AWS SSM, which you would only use if you were already using Chef and Puppet.
174
What is a global application?
An app that is deployed in multiple regions
175
What is an edge location?
Edge locations are data centres designed to deliver services with the lowest latency possible. They’re located in central locations (e.g. within cities), and you cannot actually deploy to them. They’re generally used for caching, and connecting more quickly to the AWS global network.
176
What is a point of presence?
An edge location
177
What is a DNS?
Domain Name System
178
What does Route 53 do?
Route 53 is AWS’s managed DNS (Domain Name System) service.
179
What does AWS’s simple routing policy do?
The simple routing policy has no health checks. The domain name is passed to Route 53 and an IP is returned.
180
What does AWS’s weighted routing policy do?
With a weighted routing policy we assign ‘weights’ to our EC2 instances and Route 53 assigns a corresponding level of traffic to each one as a form of load balancing. With this policy we get health checks.
181
What does AWS’s latency routing policy do?
With a latency routing policy we get routing based on which server is going to give us the lowest latency. With this policy we get health checks.
182
What does AWS’s failover routing policy do?
With a failover routing policy we have a primary EC2 instance and a failover one. If the primary fails a health check, we are routed to the second.
183
What does CDN stand for?
Content Delivery Network. Cloudfront is an example of a Content Delivery Network.
184
What does Cloudfront do?
Cloudfront is a Content Delivery Network. Cloudfront improves read performance by caching content at edge locations. Because Cloudfront provides excellent read performance, it is particularly good for static content that must be available everywhere.
185
How can Cloudfront be set up to handle DDoS attacks?
Cloudfront can also be integrated with Shield and AWS WAF (Web Application Firewall) to protect against DDoS attacks. Using Shield, attack traffic can be geographically isolated and absorbed using the capacity in edge locations close to the source. With WAF you can define custom security rules (also called web ACLs) that contain a set of conditions, rules, and actions to block attacking traffic.
186
What is the best use case for S3 Cross Region Replication?
With S3 Cross Region Replication, each region must be set up individually. In comparison with Cloudfront, S3 Cross Region Replication doesn’t use caching or the Global Edge Network. It’s best for dynamic content that needs to be available at low latency in a few regions.
187
What is S3 Transfer Acceleration?
S3 Transfer Acceleration is used to transfer files to an AWS edge location which will forward the data to an S3 bucket in the target region making use of an optimised network path. This increases transfer speeds.
188
What does AWS Global Accelerator do?
AWS Global Accelerator allows you to leverage the AWS internal network to send data through edge locations and optimise the route to your application. Global Accelerator provides two global static public IPs that act as a fixed entry point to your application endpoints. There’s no caching.
189
What are AWS Outposts?
AWS Outposts are on premises server racks which AWS will setup and manage for you within your other on-prem infrastructure. They will come with AWS Services pre loaded.
190
What does AWS Wavelength do?
AWS Wavelength embeds AWS compute and storage services within 5G networks, providing mobile edge computing infrastructure for developing, deploying, and scaling ultra-low-latency applications.
191
What are AWS Local Zones?
AWS Local Zones allows you to add extra AZs to your region in order to improve your geographic proximity to your users.
192
What does it mean to have an ‘active-passive’ regional architecture?
With an active-passive architecture, users in one region can read and write locally (the active region) and users in another region can only read locally (the passive region). The users in the passive region therefore have a higher write latency.
193
What is the difference between ‘synchronous app communication’ and ‘asynchronous/event-based app communication’?
Apps which communicate synchronously talk directly to one another. Apps which communicate asynchronously communicate via a queue of events. Synchronous applications can experience problems if there are sudden spikes in traffic. In an async setup, the two applications are decoupled.
194
What does Amazon SQS stand for?
Simple queue service.
195
What does Amazon SQS do?
Simple queue service is Serverless service designed to decouple applications. A producer application sends data into the Simple queue service. This data can be read by one or multiple consumer applications, which pull messages from the queue. Once our consumers are done processing the message they will delete the message from the queue. Consumer applications can share work.
196
What is Amazon Kinesis used for?
Amazon Kinesis allows you to collect, process, and analyze real-time streaming data. It is useful for big data streaming.
197
What does Amazon SNS stand for?
Amazon Simple Notification Service
198
What is Amazon SNS used for?
Amazon Simple Notification Service makes it possible to get an application to send a message to many receivers without writing multiple direct integrations. Your producer application communicates with an SNS topic. The consumer applications can then subscribe to your topic to receive all the published messages.
199
What is Amazon MQ used for?
Amazon Simple Notification Service and Simple Queue Service are ‘cloud native’ services. If you are running on-prem you may not want to reengineer your app to use them- instead, you can use Amazon MQ. Amazon MQ is a managed message broker service for RabbitMQ and ActiveMQ. It doesn’t scale as well as SNS and SQS, and should only be used if you don’t want to reengineer something preexisting.
200
What does CloudWatch metrics do?
CloudWatch metrics provides metrics for every AWS service. You can use it to create a CloudWatch metrics dashboard. You are also able to create custom metrics.
201
What do CloudWatch alarms do?
CloudWatch alarms are used to trigger notifications for any metrics. You can choose a period in which to evaluate an alarm. Alarm states are OK, INSUFFICIENT_DATA, and ALARM.
202
What does CloudWatch logs do?
CloudWatch Logs enables you to centralize the logs from all of your systems, applications, and AWS services that you use. You can choose log retention and monitor logs in real time.
203
What does Amazon Eventbridge do?
With Eventbridge you can react to events in AWS. These include cron jobs and reacting to events on the different AWS event buses. You can, for example, trigger a lambda to run every hour.
204
What type of events end up on AWS’s Default Event Bus?
Events which have happened within AWS Services
205
What type of events end up on AWS’s Partner Event Bus?
Events which have happened within AWS partner services (like zendesk or datadog)
206
What type of events end up on AWS’s Custom Event Bus?
Events which have happened within your custom AWS integrations
207
What does CloudTrail do?
Cloudtrail is a service which provides governance, compliance and audit for your AWS account. It is enabled by default, and contains a history of all events/API calls made by your account. This includes activity in the console and your services. You can put these logs in Cloudwatch logs or S3.
208
What does AWS X-Ray do?
X-Ray provides visual analysis of your application. Debugging is very difficult with a distributed system- X-Ray shows you visually where in the app things are going wrong. This allows us to troubleshoot bottlenecks, pinpoint service issues and to work out if we are meeting Service Level Agreements. We can also identify users who are impacted.
209
What does AWS CodeGuru do?
CodeGuru is ML powered service that does automated code reviews and gives performance recommendations
210
What does AWS CodeGuru Reviewer do?
AWS CodeGuru Reviewer analyses your code when you commit it to find issues.
211
What does AWS CodeGuru Profiler do?
AWS CodeGuru Profiler gives recommendations about app performance during runtime. It also gives recommendations pre-prod. It supports java and python, It can help decrease compute costs, identify objects using up memory and do anomaly detection.
212
What does AWS Service Health Dashboard do?
Service Health Dashboard shows you information about the health of all AWS regions and services. You can subscribe to an RSS feed of the information and see historical data. This is not personalised information- it is a general resource.
213
What does AWS Personal Health Dashboard do?
Personal Health Dashboard is like Service Health Dashboard except it provides alerts and guidance when AWS is experiencing events which impact you. It also helps you plan for future scheduled activities that might be disruptive.
214
What does VPC stand for?
Virtual Private Cloud
215
What is an Amazon VPC?
A Virtual Private Cloud is a private network for you to deploy resources in. It’s linked to a specific region.
216
What is a subnet?
A subnet is a range of IP addresses in your Virtual Private Cloud. A subnet must reside in a single Availability Zone. After you add subnets, you can deploy AWS resources in your Virtual Private Cloud.
217
What is the difference between a public subnet and a private subnet?
Public subnets are accessible from the internet and private ones are not. Services are more secure in private subnets.
218
What do we use VPC route tables for?
We use VPC route tables to define which subnets are public and which are private.
219
What do VPC Internet gateways do?
VPC Internet Gateways allow our VPC to connect to the internet. There will be a route between our public subnets and our Internet Gateway.
220
What do VPC NAT Gateways and NAT Instances do?
NAT Gateways are managed by AWS and NAT Instances are managed by you. They allow instances in private subnets to access the web while remaining private. The NAT Gateway/Instance will be in the public subnet.
221
What does a Network ACL do?
A network ACL is a firewall which controls traffic to and from a VPC subnet. The NACL has ALLOW and DENY rules which are attached at the subnet level.
222
What are VPC Flow Logs?
VPC Flow Logs are a log of all IP traffic going through your interfaces. These logs help you to troubleshoot connectivity issues and can be exported to S3/Cloudwatch.
223
What is VPC Peering?
VPC Peering allows you to connect 2 VPCs privately using AWS’s network. This makes them behave as if they were the same VPC network. For this to work, the VPCs must not have overlapping IP ranges.
224
What does VPC Endpoint do?
VPC endpoint enables creation of a private connection between VPC and supported AWS services without requiring an internet gateway, a NAT device or a public network. This gives better security and lower latency.
225
What does VPC Endpoint Gateway do?
Gateway endpoints provide reliable connectivity to Amazon S3 and DynamoDB without requiring an internet gateway or a NAT device for your VPC.
226
What does AWS PrivateLink do?
AWS PrivateLink is a secure way to expose a VPC to 1000s of other VPCs. Peering is another way to connect VPCs but it doesn’t scale and isn’t very secure.
227
How do you set up AWS PrivateLink?
To connect two VPCs with PrivateLink, you need to set up a Network Load Balancer on the producer VPC and an Elastic Network Interface on the consumer VPC. For every new consumer you need a new PrivateLink.
228
What are the two options you have to connect an on-prem data centre VPN (virtual private network) to an AWS Cloud VPC?
Option one is a site-to-site VPN- the connection is auto encrypted but it goes over the public internet. Option two is a Direct Contact (DX)- you can use a Direct Contact to establish a physical connection between your on-prem server and AWS. This is more expensive and takes time to set up but is private.
229
What does AWS Client VPN do?
AWS Client VPN is a managed VPN service that allows you to securely access your AWS resources and resources in your on-premises network (e.g. on your computer). With Client VPN, you can access your resources from any location using an OpenVPN-based VPN client. This will allow you to connect to your EC2 instance over a private IP, just as if you were in the private VPC network- this goes over the public web.
230
What does AWS Transit Gateway do?
Managing many VPC connections can be difficult. Transit Gateway exists to solve this- all connections go through transit gateway, making it possible to connect hundreds of VPCs.
231
What does Amazon Rekognition do?
Amazon Rekognition is used to recognise objects, people and text in images and videos using ML. It can do facial analysis and facial search to do user verification and people counting.
232
What does Amazon Transcribe do?
Amazon Transcribe converts speech to text. You can automatically remove personally identifiable information (PII) using redaction. It also supports automatic language identification for multi language audio.
233
What does Amazon Polly do?
Amazon Polly turns text to speech using deep learning.
234
What does Amazon Translate do?
Amazon Translate is a language translation tool.
235
What does Amazon Lex do?
Amazon Lex allows you to convert speech to text. It also uses Natural Language Understanding to recognise the intent of text and callers. It can help to build chat bots and call centre bots.
236
What does Amazon Connect do?
Amazon Connect receives calls- it is a cloud based virtual contact centre. It can integrate with other customer relationship systems.
237
What does Amazon Comprehend do?
Amazon Comprehend is used for Natural Language Processing (NLP). It uses ML to find insights and relationships in text. It can understand the content and tone of text, and can organise text files by content.
238
What does Amazon Sagemaker do?
Amazon Sagemaker allows dev to build ML models. To do this you need to build ML models, train and tune them, and apply them.
239
What does Amazon Forecast do?
Amazon Forecast uses ML to do accurate forecasts. It takes in data in an Amazon S3 bucket and forecasts from it.
240
What does Amazon Kendra do?
Amazon Kendra is a document search service powered by ML. Kendra creates a knowledge index, allowing you to query the document using natural language. You can also fine tune your search with filters.
241
What does Amazon Personalize do?
Amazon Personalize is a ML service to build apps with real time personalised recommendations. With S3 and Personalize you can create a personalised API for your applications.
242
What does Amazon Textract do?
Amazon Textract extracts text, handwriting and data from any scanned document using AI and ML. It can read and process any kind of document.
243
How do Cloudfront and Route 53 provide DDoS protection?
If you are ready to scale, that will provide you with DDoS protection. They can also be integrated with WAF and Shield.
244
Are you allowed to test your Amazon infrastructure by launching a DDoS attack against it? (True/false)
False
245
What are the two points at which data encryption happens?
Encryption happens at rest (i.e. in storage &c), and in transit (i.e., while being transferred).
246
What does Amazon KMS stand for?
Key Management Service
247
What does Amazon KMS do?
The Key Management Service manages encryption keys for us. Some encryption is opt-in and some is automatic.
248
What does CloudHSM do?
CloudHSM provisions encryption hardware for us and you manage your encryption keys yourself. It is called CloudHSM after the hardware we’re using, which is called an HSM (Hardware Security Module).
249
What are the four types of KMS keys?
Customer Managed keys (created, managed and used by the customer), AWS Managed keys (managed on the customer’s behalf by AWS- used by AWS Services), AWS Owned keys (you can’t view these keys- they are keys that protect resources in your account) and Cloud HSM keys (keys generated from your CloudHSM hardware)
250
What does ACM stand for?
AWS Certificate manager
251
What is ACM used for?
AWS Certificate manager lets you easily provision and deploy SSL/TLS Certificates. It is used to provide in flight encryption for HTTPS sites.
252
What is AWS Secrets Manager used for?
AWS Secrets Manager is used for storing secrets. It has the capacity to force the rotation of certificates every x days. It is primarily meant for RDS (Relational Database Service) integration.
253
What does AWS Artefact do?
AWS Artefact is a portal which gives you access to AWS compliance docs and AWS agreements. These can be used for internal audit and compliance.
254
What does AWS GuardDuty do?
AWS GuardDuty allows you to do intelligent threat discovery to protect your AWS account. It uses ML and anomaly detection, and looks at your AWS logs. Eventbridge rules can be set up so that you are notified of findings.
255
What does AWS Inspector do?
Amazon Inspector automatically discovers workloads, such as Amazon EC2 instances, containers, and Lambda functions, and scans them for software vulnerabilities and unintended network exposure. It reports findings to AWS Security hub and provides a vulnerability risk score.
256
What does AWS Config do?
AWS Config helps with auditing and recording compliance on your AWS resources. It helps record configurations and changes over time.
257
What does AWS Macie do?
Amazon Macie is a data security and data privacy service which uses ML and pattern matching to discover and protect sensitive data in AWS. It helps alert you to personally identifiable information (PII).
258
What does AWS Security Hub do?
AWS Security Hub is the centralised security tool for AWS accounts to manage security and automate security checks. It aggregates alerts and summarises findings.
259
What does Amazon Detective do?
Amazon Detective analyses security issues and suspicious activities and attempts to discover the root cause. It makes use of ML and graphs.
260
What are some examples of abusive or prohibited behaviour which should be reported to AWS?
Spam, port scanning, DDoS, hosting questionable or copyrighted content. This is for anything with an AWS-owned IP.
261
What does Amazon Organisations do?
Amazon Organisations allows you to centrally manage multiple AWS accounts. The main account is the master account. This service allows consolidated billing, meaning you can make savings. You can also automate AWS account creation. You should enable CloudTrail on all accounts and send logs to central S3 account.
262
What does SCP stand for?
Service Control Policies.
263
What does SCP do?
Service Control Policies allow you to white or blacklist IAM actions. This is applied at the OU (Organisational Unit) or account level.
264
What does AWS Control Tower do?
AWS Control Tower is an easy way to set up and govern a secure compliant multi-account AWS environment based on best practices. It runs on top of AWS Organisations.
265
What is the cheapest way for EC2s in the same region but not the same AZ to communicate?
Using a Private IP. Public and Elastic IPs are more expensive and slower. Communicating between EC2 instances in the same AZ is free.
266
What is AWS Compute Optimiser used for?
AWS Compute Optimiser allows you to reduce costs and improve performance by recommending optimal AWS resources for your workloads. It uses ML. Recommendations can be exported to S3.
267
What is AWS Billing Dashboard used for?
AWS Billing Dashboard gives you a high level understanding of your bills.
268
What are cost allocation tags used for?
Cost allocation tags allow us to explore costs on a deeper level, and to group costs. Tags are also used for organising resources and to create resource groups.
269
What is the Cost and Usage Report used for?
The AWS Cost and Usage report contains the most comprehensive set of AWS cost and usage data available. It can be broken into hourly and daily line items and can be integrated with Athena.
270
What is Cost Explorer used for?
The cost explorer allows you to visualise and manage AWS costs and usage time. You can create custom reports and choose an optimal savings plan. You can also forecast costs 12 months ahead.
271
What is Billing Metric data used for and what service is it associated with?
When you enable the monitoring of estimated charges for your AWS account, the estimated charges are calculated and sent several times daily to CloudWatch as metric data. Billing metric data is stored in the US East (N. Virginia) Region and represents worldwide charges. An alarm triggers when your account billing exceeds the threshold you specify.
272
What is AWS Budgets used for?
With AWS Budgets you can create a budget and send an alert when your cost (actual or projected) exceeds the budget. You can also set budgets for other metrics like usage.
273
What does AWS Trusted Advisor do?
AWS Trusted Advisor provides recommendations that help you follow AWS best practices by evaluating your account. It runs checks and tells you if you are passing the checks or not.
274
What are the 5 categories which Trusted Advisor provides recommendations on?
Cost optimization, Performance, Security, Fault tolerance and Service quotas
275
What do you get with the AWS Basic Support plan?
24x7 access to customer service, forums etc; 7 core Trusted Advisor checks; AWS Personal Health Dashboard.
276
What do you get with the AWS Developer Support plan?
On top of basic support you get business hours emails to Cloud Support Associates, Unlimited technical support cases with 1 primary contact and response times that depend on the problem’s severity.
277
What do you get with the AWS Business Support plan?
The Business support plan is intended for Production workloads. On top of developer support you get 24x7 access to cloud engineers, full Trusted Advisor checks, unlimited technical support cases with unlimited contacts and response times that take into account prod problems.
278
What do you get with the AWS Enterprise On-Ramp Support plan?
The Enterprise On-Ramp support plan is intended for Production or Business Critical workloads. On top of business support you get Infrastructure Event Management, Technical Account Managers, Concierge Support Team and response times that take into account business critical problems.
279
What do you get with the AWS Enterprise Support plan?
The Enterprise support plan is intended for Business Critical workloads. On top of enterprise on-ramp support you get access to pro-active reviews, workshops, deep dives and a designated Technical Account Manager.
280
What does AWS STS stand for?
AWS Security Token Service.
281
What does AWS STS do?
AWS Security Token Service is a behind the scenes service. It enables you to request temporary, limited-privilege credentials for AWS Identity and Access Management (IAM) users or for users you authenticate. You configure the expiration period.
282
What does Amazon Cognito do?
Amazon Cognito provides identity for potentially millions of web and mobile app users. Individuals using your product should not be IAM users. Cognito integrates with Facebook and Google to provide auth.
283
What does AWS Directory Service do?
AWS Directory Service extends Microsoft’s Active Directory, allowing you to establish trust with your on-prem active directory. Microsoft Active Directory is found on any Windows server with Active Directory Domain Services, and it stores information about objects on the network
284
What does AWS IAM Identity Centre do?
IAM Identity Centre provides one login for all your AWS Accounts in AWS Organisations.
285
What does Amazon Workspaces do?
Amazon Workspaces is a DaaS (Desktop as a Service) solution to easily provision windows or linux desktops. It is a virtual desktop.
286
What does Amazon AppStream 2.0 do?
Amazon Appstream 2.0 is similar to Amazon Workspaces except it just gives you a single application rather than a full desktop. It allows you to stream an application to any computer via the browser without provisioning infrastructure
287
What is the name of Amazon’s service for creating and running VR and 3D applications?
Amazon Sumerian
288
What does AWS IoT core do?
AWS IoT (internet of things) core allows you to create a network of internet-connected devices that are able to collect and transfer data. It also makes it easy to connect IoT devices to the cloud.
289
What does Amazon Elastic Transcoder do?
Amazon Elastic Transcoder is used to convert files stored in S3 into media files which are in the format required by consumer playback devices (e.g. the format required by a phone).
290
What does AWS AppSync do?
AWS AppSync allows you to store and sync data across mobile and web apps in real time. It creates serverless GraphQL and Pub/Sub APIs that simplify application development through a single endpoint to securely query, update, or publish data.
291
What does AWS Amplify do?
AWS Amplify provides a set of tools and services which help you to develop and deploy web and mobile apps. You can manage auth, storage and APIs from one place making use of existing AWS Services, making it similar to Elastic Beanstalk, but for web and mobile applications. Set up in Amplify Studio.
292
What does AWS Device Farm do?
AWS Device Farm is a service that tests your web and mobile apps against browsers, mobile devices and tablets to fix issues. It runs these tests concurrently.
293
What does AWS Backup do?
AWS Backup is a service to manage and automate backups across AWS Services. It supports on-demand and schedules backups, and point-in-time recovery.
294
What is a ‘backup and restore’ recovery strategy?
The ‘backup and restore’ disaster recovery strategy is the cheapest one. Your ‘backup and restore’ backups do not run- you store your application’s data, and the application will not be back up and running until you restore you data to the right location.
295
What is a ‘pilot light’ recovery strategy?
The ‘pilot light’ disaster recovery strategy involves running the core/critical functions of your application in your backup with minimal setup. To recover your application you need to upgrade your database type and start your application servers- however core functionality is always read to go.
296
What is a ‘warm standby’ recovery strategy?
The ‘warm standby’ disaster recovery strategy involves having a full version of the application ready to go, but at minimum size. You can increase the size to recover your application.
297
What is a ‘multi site’ or ‘hot site’ recovery strategy?
Having a ‘hot site’ disaster recovery strategy means having a full version of the site at full size ready to go. This is the most expensive choice.
298
What is AWS Elastic Disaster Recovery used for?
AWS Elastic Disaster Recovery (DRS) is a service which allows you to quickly recover your on prem and cloud based servers into AWS. It facilitates continuous block-level replication of your servers to allow better recovery.
299
What does AWS DataSync do?
AWS DataSync allows you to move large amounts of data from on-prem to AWS. After the first full load replication tasks are incremental and can be scheduled hourly, daily or weekly.
300
What does the AWS Application Discovery Service do?
If you are moving from on-prem to the cloud you need a migration plan. For this you need to understand your on-prem data centre. The AWS Application Discovery Service helps with that. With it you can do ‘agentless discovery’, which is for config and performance history, and ‘agent-base discovery’ which is for system config and system performance.
301
What does AWS Application Migration Service do?
AWS Application Migration Service makes it easier to move from on-prem servers to AWS. With this you can do a ‘lift and shift’ rehosting solution, simplifying the process of migrating.
302
What does AWS Fault Injection Simulator do?
AWS Fault Injection Simulator is a service for running fault injection experiments on AWS workloads. We stress the app by creating disruptive events (e.g. a sudden increase in CPU or memory), and observing how the system responds so we can make improvements.
303
What do AWS Step functions do?
AWS Step Functions allow you to build a Serverless visual workflow. You can create workflows with parallelisation, sequences, conditions, time outs and error handling. You can also implement a human approval feature for your workflows.
304
What is AWS Ground Station used for?
AWS Ground Station allows you to control satellite communications, and process and scale satellite operations.
305
What is AWS Pinpoint used for?
AWS Pinpoint is a two way marketing communications service. Amazon SNS (Amazon Simple Notification Service) and SES (Simple Email Service) require you to manage each message’s audience, content and delivery schedule. Much more of Pinpoint is automated and it makes use of templates. Pinpoint supports email, SMS, voice &c and communications can be personalised.
306
What are the 6 pillars of the AWS Well Architected Framework?
Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization and Sustainability.
307
What are the core concepts of Operational Excellence in AWS?
The operational excellence pillar focuses on running and monitoring systems, and continually improving processes and procedures. Key topics include automating changes, responding to events, and defining standards to manage daily operations. Use CloudFormation to perform operations as code. Anticipate failures.
308
What are the core concepts of Security in AWS?
The security pillar focuses on protecting information and systems. Key topics include confidentiality and integrity of data, managing user permissions, and establishing controls to detect security events. Enable traceability. Automate best security practices. Run simulations. Reduce or eliminate the need for direct access to data.
309
What are the core concepts of Reliability in AWS?
The reliability pillar focuses on workloads performing their intended functions and how to recover quickly from failure to meet demands. Key topics include distributed system design, recovery planning, and adapting to changing requirements. Automatically recover from failures. Scale horizontally. Stop guessing capacity and use autoscaling.
310
What are the core concepts of Performance Efficiency in AWS?
The performance efficiency pillar focuses on structured and streamlined allocation of IT and computing resources. Key topics include selecting resource types and sizes optimized for workload requirements, monitoring performance, and maintaining efficiency as business needs evolve. Experiment more often and be aware of all AWS Services.
311
What are the core concepts of Cost Optimisation in AWS?
The cost optimization pillar focuses on avoiding unnecessary costs. Key topics include understanding spending over time and controlling fund allocation, selecting resources of the right type and quantity, and scaling to meet business needs without overspending. Use CloudWatch to measure overall efficiency.
312
What are the core concepts of Sustainability in AWS?
The sustainability pillar focuses on minimizing the environmental impacts of running cloud workloads. Key topics include a shared responsibility model for sustainability, understanding impact, and maximizing utilization to minimize required resources and reduce downstream impacts. Establish goals. Maximise utilisation. Use managed services as they automate best practices.
313
What does the AWS Well Architected Tool do?
The AWS Well Architected Tool allow you to look up questions about Well Architected practices based on your workload.
314
What is ‘right sizing’?
Right sizing means choosing the best instance type for your needs. Choose something smaller and scale upwards rather than choosing something large as default.
315
What are AWS Partner Solutions?
AWS Partner Solutions are automated vetted deployments which help you deploy popular technologies to AWS according to AWS best practices
316
What is AWS Knowledge Centre?
AWS Knowledge Centre is an AWS Q&A common questions web portal.
317
What is AWS IQ?
AWS IQ helps you quickly find a professional to help with your AWS project. The tool includes video conferencing, contract management and billing.
318
What is AWS re:post?
AWS re:post is AWS’s AWS specialist stack overflow.
