AWS SAP-CO2 Study Guide Flashcards
What is an OU in AWS?
An Organizational Unit (OU) is a way to group AWS accounts within an AWS Organization to help manage and organize accounts more effectively.
What steps are involved in AWS Account Organizational Unit Migration?
Remove the member account from the former organization.
Send an invite to the member account from the prospective organization.
Accept the invite from the prospective organization upon the member account.
Ensure the OrganizationAccountAccessRole is added to the member account.
What is AWS Control Tower, and what does it automate?
AWS Control Tower is a service that simplifies the setup and governance of a secure and compliant multi-account AWS environment. It automates the setup of environments, as well as ongoing policy management using guard rails such as SCPs and AWS Config.
What are Service Control Policies (SCPs) used for?
SCPs are policies used for OUs to manage permissions within AWS Organizations. They help set limits and guardrails for accounts to ensure compliance and control.
Do SCPs grant permissions directly to AWS accounts?
No, SCPs do not grant permissions directly. Permissions are still managed through IAM (Identity and Access Management). SCPs define restrictions, and the effective permissions are the intersection of IAM, SCP, and IAM permissions boundaries.
What happens if an OU does not have all features enabled?
An OU must have all features enabled to utilize SCPs effectively. Disabling features may affect policy enforcement.
Who does SCPs affect within member accounts?
SCPs affect member accounts and attached users and roles within, including the root user(s), but not management accounts.
How do SCPs impact resource-based policies?
SCPs do not directly affect resource-based policies. They control permissions at the account level but do not change resource-based policies within services.
What are service-linked roles, and how do SCPs interact with them?
Service-linked roles enable other AWS services to integrate with AWS OUs. SCPs do not affect service-linked roles’ permissions; they continue to function as designed.
What happens if SCPs are disabled at the root account level?
If SCPs are disabled at the root account level, all SCPs are automatically detached from OUs under that root account. If re-enabled, accounts under that root revert to full AWS Access (default).
What is the similarity between SCPs and IAM permissions boundaries?
Both SCPs and IAM permissions boundaries require an explicit “allow.” If not explicitly allowed, access is denied.
What is the key principle of “Allow vs. Deny” in IAM policies?
If any “Deny” statement is present in a policy, it takes precedence over “Allow” statements. Default behavior is to deny all resources, and “Allow” statements are needed to grant permissions.
What does LDAP stand for, and what is its purpose?
LDAP stands for Lightweight Directory Access Protocol. It is a software protocol used for locating data about organizations, individuals, and resources in a network.
What is Identity Federation?
Identity Federation is a system of trust between two parties for authenticating users and conveying information needed to authorize their access to resources.
What types of entities can be included in AWS user groups?
AWS user groups can only contain users. They do not include other types of entities.
What is the difference between S3 Bucket Policies and Access permissions?
S3 Bucket Policies are used to add or deny permissions across some or all S3 objects in a bucket for central management. Access permissions grant users access to S3 resources. Bucket policies can restrict based on conditions like request time, SSL usage, and requester IP address.
What type of access control is provided by IAM Policies, ACLs, and Bucket Policies?
IAM Policies: User-level control.
ACLs (Access Control Lists): Account-level control.
Bucket Policies: Both account-level and user-level control.
What is the IAM Credentials Report used for?
The IAM Credentials Report is a security tool that lists all AWS accounts, IAM users, and the status of their various credentials. It is used for auditing permissions at the account level.
What is the purpose of IAM Access Advisor?
IAM Access Advisor shows the service permissions granted to a user and when those services were last used. It helps in revising policies at the user level.
What is the AWS Policy Simulator used for?
The AWS Policy Simulator is used to test and troubleshoot IAM policies that are attached to users, user groups, or resources.
What is IAM Access Analyzer used for?
IAM Access Analyzer is a service used to identify unintended access to resources in an organization and accounts, such as Amazon S3 buckets or IAM roles, shared with an external entity to avoid security risks.
What is Amazon Cognito, and what is its role?
Amazon Cognito is a web identity federation service and identity broker that handles interactions between applications/resources and web Identity Providers (IdPs). It helps with user authentication and authorization.
What is a User Pool in Amazon Cognito?
A User Pool is user-based and handles user registration, authentication, and account recovery in Amazon Cognito. It is compatible with various Identity Providers (IDPs).
What is an Identity Pool in Amazon Cognito?
An Identity Pool receives an authentication token to authorize access to resources directly or through the API Gateway. It maps to IAM roles and has default roles for authenticated/guest users.
What is AWS Resource Access Manager (RAM) used for?
AWS Resource Access Manager is used to share AWS resources that you own with other AWS accounts, either within the same Organizational Unit (OU) or any AWS account. It helps avoid resource duplication.
What can be shared using AWS RAM?
AWS RAM can be used to share resources like VPC subnets, AWS Transit Gateway, Route 53 Resolver Rules, and License Manager Configurations across accounts using Private IPs.
What is the purpose of AWS API Gateway?
AWS API Gateway serves as a front door to AWS resources, enabling users to access Lambda functions, EC2 instances, DynamoDB, and more. It offers caching for improved performance, throttling, low cost, scalability, CORS support, and handles security with authentication through Cognito User Pools and authorization with IAM.
What types of certificates are used for HTTPS security integration with AWS API Gateway?
For Edge-Optimized deployments, certificates are in the US-East-1 region. For Regional deployments, certificates are in the API Gateway region. Custom domain names for HTTPS integration can be set up using AWS ACM (AWS Certificate Manager).
What are the differences between Application Load Balancer (ALB) and Elastic Load Balancer (ELB/CLB)?
ALB is best suited for load balancing HTTP(s) traffic at the layer 7 (WebSockets) and has static DNS names. ELB/CLB are legacy load balancers that can handle HTTP(s) and strict Layer 4 load balancing for TCP protocols. They have static DNS names and support sticky sessions via cookies.
What is the purpose of Route 53 Health Checks?
Route 53 Health Checks are used to monitor the health of endpoints, such as applications, servers, or other AWS resources. They work with routing policies like weighted routing, latency-based routing, geolocation, and multivalue routing, helping to detect and respond to endpoint health issues.
What does AWS Global Accelerator offer?
AWS Global Accelerator provides Anycast/static IP addresses for global users, optimizing application availability and performance. It routes user traffic to the nearest endpoint based on performance, location, and policies. It’s suitable for non-HTTP use cases like gaming (UDP), IoT (MQTT), and VOIP.
What is the primary function of CloudFront in AWS?
CloudFront is a serverless service that scales, saves network bandwidth, and delivers entire websites, including dynamic, static, streaming, and interactive content using a global network of edge locations. It improves website performance by caching content and serving it from the nearest edge location to users.
What is the difference between Unicast IP and Anycast IP?
Unicast IP is where each server has a unique IP address, while Anycast IP is where multiple servers share the same IP address, and the client is routed to the nearest server using that IP.
What is the purpose of AWS PrivateLink?
AWS PrivateLink allows the exposure of a VPC service to other VPCs without using VPC peering. It provides a secure and private connection between VPCs, eliminating the need for public internet access.
What is the primary use case for AWS Direct Connect?
AWS Direct Connect is used to establish a dedicated network connection between on-premises data centers and AWS VPCs. It is ideal for high-throughput workloads and provides a reliable and secure connection to AWS resources.
How are IP addresses divided using CIDR notation?
CIDR (Classless Inter-Domain Routing) notation divides IP addresses into subnets by specifying the number of bits used for the network and host portions of the address. For example, /24 means the first 24 bits are for the network, and the remaining 8 bits are for hosts.
What is the main purpose of AWS Global Accelerator?
AWS Global Accelerator is a network service that improves the availability and performance of applications for global users. It provides Anycast/static IP addresses to create a fixed entry point, routes traffic to the optimal endpoint based on performance, and offers fast failover for disaster recovery.
What is the key difference between AWS Global Accelerator and Amazon CloudFront?
AWS Global Accelerator is designed to improve the performance of applications using TCP/UDP, making it suitable for non-HTTP use cases like gaming and IoT. Amazon CloudFront, on the other hand, is a content delivery service that caches and delivers website content, including dynamic and static content, at edge locations.
How does Route 53 handle DNS routing and domain registration?
Route 53 is an AWS service for DNS routing and domain registration. It manages DNS records, including A, AAAA, CNAME, MX, and PTR records, and allows you to route traffic based on routing policies such as simple, weighted, latency, geolocation, and more.
What is the primary purpose of Route 53 Health Checks (HC)?
Route 53 Health Checks are used for failover in services like Application Load Balancers (ALB) by monitoring the health of endpoints (e.g., applications, servers). If an endpoint fails the health check, traffic is redirected to healthy endpoints.
What is the difference between Unicast IP and Anycast IP?
Unicast IP assigns a unique IP address to each server, whereas Anycast IP assigns the same IP address to multiple servers, routing traffic to the nearest one. Anycast IP is used to create a fixed entry point, as in AWS Global Accelerator.
What does the Route 53 Resolver service do?
Route 53 Resolver allows connectivity between AWS infrastructure and external DNS resolvers. It can automatically answer DNS queries for local VPC domain names and be configured to integrate with on-premises DNS resolvers.
How can AWS Direct Connect benefit organizations?
AWS Direct Connect provides a dedicated network connection between on-premises data centers and AWS VPCs, reducing network costs, increasing bandwidth, and ensuring a more reliable and secure connection to AWS resources.
What are some common DNS types used in Route 53?
Common DNS types in Route 53 include SOA records, NS records, A records, MX records, and PTR records, each serving a specific purpose in DNS management.
What is the purpose of CIDR notation in networking?
CIDR (Classless Inter-Domain Routing) notation is used to specify IP address ranges and subnet masks. It allows for more flexible allocation of IP addresses and efficient use of address space.
How many VPCs are allowed per AWS region by default?
By default, AWS allows up to 5 Virtual Private Clouds (VPCs) per region.
How many subnets are allowed per VPC in AWS?
AWS allows up to 200 subnets per VPC. Subnets are used to segment a VPC into smaller network segments.
What does the notation “/32” represent in CIDR?
The notation “/32” in CIDR represents a subnet mask where no octet of the IP address changes. It effectively specifies a single IP address.
In CIDR notation, what does “/0” represent?
In CIDR notation, “/0” represents a subnet mask where all octets of the IP address can change, effectively representing all possible IP addresses.
How many IP addresses are available in a subnet with a CIDR notation of “/29”?
A subnet with a CIDR notation of “/29” provides 8 IP addresses. Two of them are reserved for network address and broadcast address, leaving 6 usable IP addresses.
Why does AWS reserve certain IP addresses within a VPC’s CIDR block for each subnet?
AWS reserves certain IP addresses, such as the first 4 and the last 1, in each subnet for specific purposes, including the VPC router, Amazon provided DNS mapping, and future use. These addresses are not available for user allocation.
What is the purpose of CIDR notation in AWS security group (SG) rules?
CIDR notation is used in AWS security group rules to define IP address ranges that are allowed or denied access to resources. SG rules specify which IP addresses or CIDR blocks can communicate with AWS resources.
What is an EC2 On-Demand Instance, and how is it billed?
An EC2 On-Demand Instance is a pay-as-you-go instance where you are billed by the second for instances launched after the first minute of usage.
What is an EC2 Savings Plan Instance, and what are the available commitment terms?
An EC2 Savings Plan Instance allows you to commit to a certain amount of usage for 1 or 3-year terms. Any usage beyond the commitment is billed at the On-Demand rate.
