Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Developer > AWS S3 Bucket (9, 10, 11) > Flashcards

AWS S3 Bucket (9, 10, 11) Flashcards

1
Q

An S3 file has a full path of s3://my-bucket/my_folder/another_folder/my_file.txt … Which part of the path is the Key

A

The Key is my_folder/another_folder/my_file.txt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the max object size in S3? What is uploading max?

A

5TB; 5GB (recommended use multi-part upload after 100MB)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

S3 Versioning will overwrite the previous file, true or false?

A

False. S3 creates a new version

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Version ID for a file in a bucket is null, why?

A

We enabled versioning for the bucket after the object was added to the bucket

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How can you restore a deleted object in S3?

A

Delete the version with a Delete Marker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the 4 methods of encrypting objects in S3?

A

SSE-S3, SSE-KMS, SSE-C, Client Side Encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is SSE-S3 encryption for S3?

A

Encryption using keys handled & managed by Amazon s3; object is encrypted server side

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What header must be set for SSE-S3 encryption for S3?

A

“x-amz-server-side-encryption”: “AES256”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is SSE-KMS encryption for S3?

A

Encryption using keys handled & managed by KMS;

object is encrypted server side

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What header must be set for SSE-KMS encryption for S3?

A

“x-amz-server-side-encryption”:”aws:kms”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the SSE-KMS advantages?

A

User control and audit trail

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is SSE-C encryption for S3?

A

Server-side encryption using data keys fully managed by the customer outside of AWS;
Amazon S3 does not store the encryption key you provide;
HTTPS must be used and the encryption key must be provided in every request

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is client-side encryption for S3?

A

Clients must encrypt data themselves before sending to S3;

Clients must decrypt data themselves when retrieving from S3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What two options for default encryption does S3 bucket provide for you?

A

SSE-S3 and SSE-KMS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is User Based S3 security?

A

IAM policies - which API calls should be allowed for a specific user from IAM console

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a Resource Based Policy?

A

Bucket policies - bucket wide rules from the S3 console - allows cross account;
JSON based policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which encryption method for S3 Bucket requires you to use HTTPS?

A

SSE-C

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

How can an IAM principal access an S3 object?

A

If the user IAM permissions allow it OR the resource policy allows it AND there is no explicit deny;
An explicit deny takes precedence over the IAM permissions allowance;
A bucket policy does not need to be created as long as there is no explicit deny

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are 3 use cases for S3 bucket policy?

A

Grant public access;
Force objects to be encrypted at upload;
Grant access to another account (Cross Account)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How can MFA (Multi-Factor Authentication) be used in S3 Bucket?

A

It can be required to delete objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is a pre-signed URL used for in S3?

A

They are URLs that are only valid for a limited time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

You are getting a Forbidden when trying to upload a file on S3? What is a possible reason?

A

The bucket policy could be preventing it; e.g. files must be encrypted before/while uploading;
If it is a public upload, it could also be the Block Public Access settings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Users cannot access the object S3 URL with correct key path for your static website? What could be a cause?

A

When a bucket is created, it has the Block All Public Access option configured in the Block Public Access settings. You need to configure this and then create a Bucket Policy that allows users to Read the object (the static site object). Even if Block Public Access is turned off, you still need to create a Bucket Policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is an origin in CORS?

A

An origin is a scheme (protocol), host (domain) and port;

e.g. https://www.example.com (implied port is 443 for HTTPS, 80 for HTTP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is an example of when CORS would be needed?

A

Say we have a bucket that serves a website. That website then needs to call another bucket for a resource (say a picture). The other (cross origin) bucket will need to allow traffic calls from the origin website. We need to enable CORS in the cross origin bucket.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

How long is the read after write consistency time for deleting or updating objects to S3?

A

It is eventually consistent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Your client wants to make sure the encryption is happening in S3, but wants to fully manage the encryption keys and never store them in AWS. You recommend

A

SSE-C

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Your company wants data to be encrypted in S3, and maintain control of the rotation policy for the encryption keys. You recommend

A

SSE-KMS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Your company does not trust S3 for encryption and wants it to happen on the application. You recommend

A

Client Side Encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

The IAM permissions allows our users to read/write files in the bucket, yet we were not able to perform a PutObject API call. What is your assessment?

A

The IAM user has an explicit DENY in the bucket policy. Explicit DENY in an bucket policy will take precedence over the IAM permission

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

If you are installing AWS CLI, you use it and get the error aws: command not found; what is the problem?

A

The AWS executable is not in the PATH environment variable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is the wrong way of configuring credentials on EC2 for CLI?

A

Running aws configure in the EC2 instance is very insecure. Never put personal credentials on an EC2 machine. Only belong on personal computer. We should use an IAM Role attatched to an EC2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is the right way of configuring credentials on EC2?

A

Attach an IAM Role to an EC2 instance; EC2 instances will reach out to the AWS Account through the CLI and the AWS will check the credentials and permissions of the ROLE.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

How many IAM roles can an EC2 instance have at a time?

A

One, this is the instance profile

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is an inline policy in IAM?

A

It is a policy that is only attached to one identity (user, group, or role)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

How can we simulate AWS CLI commands without actually utilizing resources (and costing money)?

A

We can add option –dry-run to the command

37
Q

What are ways we tested policies and roles with IAM?

A

We can use the IAM Policy Simulator site and the AWS CLI –dry-run option

38
Q

What is the AWS CLI STS command line used for in debugging? What is the command?

A

It can decode error messages from API calls that fail;

aws sts decode-authorization-message --encoded-message {{value}}

39
Q

What command in the AWS CLI can we use to configure a non-default account? How would we access that accounts S3 storage?

A

aws configure --profile {{profile-name}}

aws s3 ls --profile {{profile-name}}

40
Q

What is the AWS CLI command without options to get an access key and session key for MFA?

A

aws sts get-session-token

41
Q

If you get a ThrottlingException intermittently for any AWS service, what should you do?

A

Use exponential backoff; exponential backoff is exponentially increasing the duration between retrying calls;
Must implement yourself if using the SDK API

42
Q

If we are getting consistent API Rate Limit errors what should we do?

A

Request an API throttling limit increase

43
Q

What is the order of the AWS CLI Credentials Provider Chain?

A 
Command line options;
Environment variables;
CLI credentials file;
CLI configuration file;
Container credentials;
Instance profile credentials
44
Q

What is the order of the SDK Credentials Chain?

A 
Environment variables;
System properties (only for Java?);
Default credential profiles file;
Amazon ECS container credentials;
Instance profile credentials;
45
Q

An application deployed to EC2 instance is using env variables with credentials from an IAM user to call the Amazon S3 API. The IAM user has S3FullAccess permissions.
An IAM Role and EC2 Instance Profile was created for the EC2 instance with access to only one S3 Bucket. The role had minimum permissions, yet the EC2 still had access to all S3 buckets. Why?

A

Environment variables have priority in the credentials chain. The application with SDK uses the env variables.

46
Q

What is Signature v4?

A

We must use this when sending requests to AWS through HTTP. If you use the CDK and CLI, these are signed from you;
Either as an HTTP header or in the URI as a query string

47
Q

I have an on-premise personal server that I’d like to use to perform AWS API calls?

A

I should run aws configure and put my credentials there. Invalidate them when I am done. You cannot attach IAM Role to a personal server.

48
Q

My EC2 Instance does not have the permissions to perform an API call to PutObject on S3. What should I do?

A

Attach a policy to the IAM Role on my EC2 Instance that authorizes it to do the API call

49
Q

I need my colleagues help to debug my code. When he runs the application on his machine, it’s working fine, whereas I get API authorization exceptions. What should I do?

A

Compare IAM policies. Do not share credentials and do not put personal credentials on the EC2 server.

50
Q

To get the instance id of my EC2 machine from the EC2 machine, the best thing is to…

A

Query the meta data at http://{{ip-address}}/latest/meta-data

51
Q

I’d like to deploy an application to an on-premise server. The server needs to perform API calls to Amazon S3. Amongst the following options, the best security I can achieve is…

A

Create an IAM user for the application and put the credentials into environment variables. here, it’s about creating a dedicated user for that application, as using your own personal credentials would blur the lines between actual users and applications.

52
Q

When I run the CLI on my EC2 Instances, the CLI uses the ______ service to get _____ credentials thanks to the IAM Role that’s attached.

A

meta data | temporary;

remember! user data is for ec2 instances starting

53
Q

I want to test whether my EC2 machine is able to perform the termination of EC2 instances. There is an IAM role attached to my EC2 Instance. I should

A

Use the IAM Policy Simulator OR the dry run CLI option

54
Q

Can EC2 Instances retrieve the IAM Role policy JSON document that’s attached to them using the CLI without any role attached?

A

No. You can retrieve the role name attached to your EC2 instance using the metadata service but not the policy itself

55
Q

I have received an authorization exception from my EC2 instance while performing an EC2 API call. I want to decode the cryptic message. How do I do it?

A

Use the STS decode-authorization-message API

56
Q

Which API call should be used to get credentials before issuing API calls against an MFA-protected API?

A

STS GetSessionToken

57
Q

A admin can enable MFA-Delete in a bucket, true or false.

A

False. Must be root account.

58
Q

How can we ensure encryption in S3 without a bucket policy?

A

Enable default encryption on the bucket

59
Q

It is good practice to set your app bucket as your logging bucket as well, true or false?

A

False. We will have to log the logs themselves and it will grow exponentially.

60
Q

What is CRR in S3 and what are it’s use cases?

A

Cross Region Replication;
Compliance for storing data in several safe locations;
Lower latency access for accounts or users in another region;
Replication across accounts

61
Q

What is SRR in S3 and what are it’s use cases?

A

Same Region Replication;

Log aggregation, live replication between production and test accounts

62
Q

For S3 replication, we added an object to Bucket 1, which was replicated in Bucket 2, but Bucket 3 did not replicate Bucket 2’s object. Why not?

A

There is no chaining for bucket replication.

63
Q

We want to upload an object in S3 to a pre-signed URL using the CLI but are getting errors. What could be the cause?

A

We must use the SDK. The CLI does not allow for uploading objects to pre-signed URL

64
Q

We want to generate a pre-signed URL from S3 in colinsbucket2020 for file picture.jpg for 5 minutes. What is the command from the CLI we would use?

A

aws s3 presign s3://colinsbucket2020/picture.jpg –expires-in 300 –region {{region}};
Region is needed or else can cause problems

65
Q

What are the S3 storage classes?

A 
Standard - General Purpose;
Standard - Infrequent Access (IA);
One Zone - Infrequent Access;
Intelligent Tiering;
Glacier;
Glacier Deep Archive;
66
Q

What is the difference between Standard IA and One Zone - IA for S3 bucket tier?

A

One Zone is in one AZ. So if that AZ was to go down, then the data would be lost.

67
Q

What two access tiers does S3 Intelligent Tiering move between?

A

S3 Standard and Standard IA

68
Q

What are the 3 retrieval options for Amazon Glacier?

A

Expedited (1 to 5 minutes);
Standard (3 to 5 hours);
Bulk (5 to 12 hours);

69
Q

What are the Amazon Glacier Deep Archive retrieval options?

A

Standard (12 hours)

Bulk (48 hours)

70
Q

What is the minimum storage duration for Glacier vs Glacier Deep?

A

Minimum storage for Glacier is 90 days. Minimum for Glacier Deep is 180 days

71
Q

What are transition actions in S3 Lifecycle rules?

A

It defines when objects are transitioned to another storage class

72
Q

What are expiration actions in S3 Lifecycle rules?

A

Configure objects to expire (delete) after some time;

Can be used to delete old versions or files if versioning is enabled

73
Q

Your application on EC2 creates images thumbnails after profile photos are uploaded to Amazon S3. These thumbnails can be easily recreated, and only need to be kept for 45 days. The source images should be able to be immediately retrieved for these 45 days, and afterwards, the user can wait up to 6 hours. How would you design this?

A

S3 source images can be on STANDARD, with a life-cycle configuration to transition them to GLACIER after 45 days.
S3 thumbnails can be on ONEZONE_IA with a life-cycle configuration to expire them (delete them) after 45 days.

74
Q

A rule in your company states that you should be able to recover your deleted S3 objects immediately for 15 days, although this may happen rarely. After this time, and for up to 365 days, deleted objects should be recoverable within 48 hours.

A

You need to enable S3 versioning in order to have object versions, so that “deleted objects” are in fact hidden by a “delete marker” and can be recovered;
You can transition these “non-current versions” of object to S3_IA;
You can transition afterwards these “non-current versions” to DEEP_ARCHIVE;

75
Q

Which encryption option can impact performance with S3 retrieval?

A

S3 KMS. When an upload happens, the GenerateDataKey KMS API is called, and when downloaded, the Decrypt KMS API is called. This may hit KMS limits.

76
Q

What is S3 Transfer Acceleration?

A

Increase transfer speed by transferring file to an AWS edge location which will forward the data to the S3 bucket in the target region. It is for upload only.

77
Q

What is S3 Byte-Range Fetching?

A

Parallelize GET’s by requesting specific byte ranges.

78
Q

What does S3 select allow us to do?

A

It allows us to grab a subset of data from an object by using simple SQL expressions.

79
Q

You want to ensure that an event notification is sent for every successful write. How would we do that?

A

Enable versioning for your bucket. With versioning, every new version created sends out an event notification

80
Q

What is AWS Athena?

A

It is a serverless service to perform analytics directly against S3 files

81
Q

Before you run an AWS Athena query, you must do what?

A

Add a query result location

82
Q

What is S3 object lock and Glacier Vault Lock?

A

S3 object lock is block an object version being changed for a specified amount of time.

83
Q

You have enabled versioning and want to be extra careful when it comes to deleting files on S3. What should you enable to prevent accidental permanent deletions?

A

Enable MFA Delete

84
Q

You suspect some of your employees to try to access files in S3 that they don’t have access to. How can you verify this is indeed the case without them noticing?

A

Enable S3 Access Logs and analyze them using Athena

85
Q

You are looking for your entire S3 bucket to be available fully in a different region so you can perform data analysis optimally at the lowest possible cost. Which feature should you use?

A

S3 Cross-Region Replication

86
Q

You would like to retrieve a subset of your dataset stored in S3 with the CSV format. You would like to retrieve a month of data and only 3 columns out of the 10. You need to minimize compute and network costs for this, what should you use?

A

S3 Select

87
Q

When uploading a file that is 1 GB to S3, which type of upload will give you the best throughput performance and resilience?

A

Do a multi-part upload. It is recommended to do this of files greater than 100 MB.

88
Q

Creating a bucket policy in S3 will override the S3 Block Public Access feature, true or false?

A

False. Even if the policy is set for public reads, BPA will overrules these policies.

AWS Developer (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions