AWS SAP-CO2 Study Guide 2 Flashcards
What are the two main types of policies in AWS Identity and Access Management (IAM) and their purposes?
Two main types of IAM policies are User-Based and Resource-Based policies. User-Based policies govern user access to AWS resources, while Resource-Based policies are attached to resources like S3 buckets to control access from other AWS accounts.
What is the purpose of S3 Bucket Policies, and what can they govern?
S3 Bucket Policies are JSON-based statements that govern access and permissions for S3 buckets. They can control things like blocking public access, enforcing encryption at upload, enabling cross-account access, and specifying access permissions.
What is the difference between Object Access Control Lists (ACLs) and Bucket Access Control Lists (ACLs) in S3?
ACLs in S3 allow finer control of individual objects, while Bucket ACLs control access at the bucket level. ACLs can be used to block public access to objects, but it’s recommended to use Bucket Policies for such control.
How does versioning impact S3 objects, and what is the purpose of MFA Delete?
Versioning in S3 allows objects to have multiple versions, providing protection against accidental deletions or modifications. MFA Delete is an additional layer of security, required for deleting objects within versioned buckets to prevent accidental permanent deletions.
What is Origin Access Control (OAC) in S3, and what is its role in preventing public availability?
Origin Access Control (OAC) restricts access to S3 objects, ensuring they are accessed through intended CloudFront distributions. It prevents public access and enforces access through CloudFront, eliminating direct access to S3.
What is Cross-Region Replication (CRR) and Same-Region Replication (SRR) in S3, and how do they differ?
CRR and SRR are replication options in S3. CRR replicates objects across different AWS regions, while SRR replicates objects within the same AWS region. CRR is suitable for compliance and replication between accounts, while SRR is used for live replication within the same region.
What are the considerations for replicating unencrypted objects and objects encrypted with SSE-KMS in S3?
By default, unencrypted objects and objects encrypted with SSE-S3 are replicated. Objects encrypted with SSE-KMS need an option enabled in the replication configuration. It’s important to specify the KMS Key in the target bucket and adapt the KMS Key Policy.
What is the purpose of S3 Batch Replication, and how does it differ from live replication?
S3 Batch Replication allows the replication of objects that existed before a replication configuration was in place and objects that have previously been replicated. It differs from live replication as it’s used for bulk operations and can replicate existing objects.
What is the S3 Sync Command, and how does it work?
The S3 Sync Command is used to copy objects between S3 buckets efficiently. It lists source and target buckets, identifies objects found in the source but not in the target, and copies them. It only copies the current version of objects in versioned buckets.
What are the different storage classes available in Amazon S3, and what are their key characteristics?
The main S3 storage classes are Standard, Intelligent Tiering, Standard-IA, One Zone-IA, Glacier Instant Retrieval, Glacier Flexible Retrieval, and Glacier Deep Archive. They differ in durability, availability, minimum storage duration charge, minimum billable object size, retrieval fees, storage costs, retrieval costs, and retrieval time.
When would you use S3 Standard storage class, and what is it suitable for?
S3 Standard is suitable for frequently accessed data that requires high throughput and low latency. It’s used for mobile applications, gaming, big data analytics, and as a pseudo content delivery network (CDN).
What is S3 Intelligent-Tiering, and how does it work?
S3 Intelligent-Tiering is a storage class that automatically moves objects between tiers based on their usage patterns. It includes Frequent and Infrequent access tiers, Archive Instant for objects not accessed for 90 days, and optional Archive and Deep Archive tiers.
When is S3 One Zone-IA storage class a suitable choice?
S3 One Zone-IA is suitable for data that can be recreated and doesn’t require high durability. It’s cost-effective for secondary backups or less critical data.
What is the purpose of S3 Glacier storage classes, and when should they be used?
S3 Glacier is designed for long-term archival and backup storage. Glacier Instant Retrieval is suitable for accessing data once a quarter, while Glacier Flexible Retrieval and Deep Archive are for infrequently accessed objects that don’t require immediate access.
S3 Glacier is designed for long-term archival and backup storage. Glacier Instant Retrieval is suitable for accessing data once a quarter, while Glacier Flexible Retrieval and Deep Archive are for infrequently accessed objects that don’t require immediate access.
S3 Lifecycle Rules are used to transition objects between S3 storage classes automatically or delete objects after a specified time. They are helpful for managing data retention, cost optimization, and compliance.
What is S3 Analytics, and how can it aid in managing S3 storage classes?
S3 Analytics provides insights into object usage patterns, helping in making informed decisions for transitioning objects between storage classes using Lifecycle Rules.
How can S3 performance be optimized for PUT/COPY/POST/DELETE and GET/HEAD operations?
PUT/COPY/POST/DELETE operations offer a rate of 3500 requests per second per prefix, and GET/HEAD operations offer a rate of 5500 requests per second per prefix. To increase efficiency, place objects in different prefixes and utilize S3 Byte-Range Fetches in parallel.
What are S3 Event Notifications, and what types of operations can trigger them?
S3 Event Notifications are triggered by all CRUD (Create, Read, Update, Delete) operations on objects and can be consumed by various services like SNS, SQS, Lambda functions, etc.
What is S3 Requester Payments, and when is it useful?
S3 Requester Payments allow the requester of objects to pay for transfer and request costs instead of the bucket owner. It is useful for sharing large files or datasets where the requester should bear the costs.
What is S3 Object Lock, and what are its modes?
S3 Object Lock is used for data immutability and comes in two modes: Retention Governance mode (users can’t alter lock settings without special permissions) and Retention Compliance mode (object version can’t be deleted or altered by anyone, including the root user).
What is S3 Transfer Acceleration, and how does it improve data transfer performance?
S3 Transfer Acceleration improves data transfer performance by routing traffic through CloudFront Edge and AWS backbone networks, resulting in faster uploads and downloads.
What are some key features of AWS RDS (Relational Database Service)?
AWS RDS offers features such as autoscaling when running out of storage, support for multiple database engines (MySQL, MariaDB, Postgres, Oracle, Aurora), at-rest encryption via KMS, SSL for data in transit, and the ability to use IAM authentication and Secrets Manager integration.
What is the purpose of Multi-AZ deployment in Amazon RDS?
Multi-AZ (Availability Zone) deployment in Amazon RDS provides high availability and fault tolerance by replicating the primary database instance synchronously to a standby instance in a different Availability Zone within the same region.
What is RDS autoscaling, and under what conditions does it autoscale?
RDS autoscaling automatically adjusts the capacity of your database instance based on workload requirements. It autoscales when free space falls below 10% allocated space, after 6 hours of inactivity, and if low-storage lasts at least 5 minutes.
What is Amazon RDS Proxy, and how does it benefit applications using RDS or Aurora databases?
Amazon RDS Proxy is a fully managed database proxy service that allows applications to efficiently pool and share database connections. It reduces stress on database resources, minimizes open connections, and improves database efficiency, reducing failover times.
What are some advantages of Amazon Aurora over traditional RDS databases?
Amazon Aurora offers better performance than traditional RDS databases, lower pricing, automatic replication with at least 2 copies in each Availability Zone, and support for up to 15 read replicas. It also provides cross-region replication and multi-region capabilities.
What is Amazon Redshift, and how is it used?
Amazon Redshift is a fully managed, scalable cloud data warehouse service that uses a columnar data storage approach. It is used for analyzing structured and semi-structured data across data warehouses, operational databases, and data lakes. It integrates with tools like QuickSight and Tableau for data visualization.
What is Amazon Redshift Spectrum, and how does it complement Amazon Redshift?
Amazon Redshift Spectrum is a service that allows you to efficiently query and retrieve structured and semi-structured data from files stored in Amazon S3, without loading the data into Redshift tables. It offloads compute-intensive tasks to reduce the load on your Redshift cluster.
What is Amazon Timestream, and what are its key features?
Amazon Timestream is a serverless time series database service designed for IoT and applications. It stores recent data in memory and less recent data in cost-optimized storage. It scales automatically and allows seamless queries between memory and storage.
What is Amazon Quantum LedgerDB (QLDB), and how is it different from Amazon Managed Blockchain?
Amazon Quantum LedgerDB (QLDB) is a fully managed, serverless, highly available service for recording financial transactions. It provides an immutable and cryptographically verifiable ledger. It differs from Amazon Managed Blockchain as it does not have a decentralized component and adheres to financial regulation rules.
What is Amazon Keyspaces, and what database system is it compatible with?
Amazon Keyspaces is a scalable, highly available, serverless, and managed NoSQL database service that is compatible with Apache Cassandra. It offers consistent single-digit millisecond server-side read/write performance, durability, and availability.
What is Amazon DocumentDB, and how does it relate to MongoDB?
Amazon DocumentDB is the AWS-managed version of MongoDB. It is used to store, query, and index JSON data. Similar to Aurora, it provides high availability with replication across 3 Availability Zones (AZs) and automatic storage scaling.
What are some key features of Amazon DynamoDB?
Amazon DynamoDB is a NoSQL key-value and document database that offers single-digit millisecond performance at any scale. It is fully managed, supports multi-region, multi-master, and offers features like in-memory caching, security with IAM, and backup and restore.
What is DynamoDB Global Tables, and what does it enable?
DynamoDB Global Tables allow a DynamoDB table to be accessible with low latency in multiple regions. It enables active-active replication, where applications can read and write to the table in any region. DynamoDB Streams must be enabled as a prerequisite.
What is DynamoDB Accelerator (DAX), and how does it improve performance?
DynamoDB Accelerator (DAX) is a fully managed, highly available, in-memory cache with microsecond latency. It can improve DynamoDB performance by up to 10x without requiring changes to application logic. It is ideal for reducing request times from milliseconds to microseconds.
What is Amazon Neptune, and what type of database does it support?
Amazon Neptune is a fully managed graph database service that supports highly connected data optimized for complex and hard queries. It is ideal for use cases such as knowledge graphs, fraud detection, recommendation engines, and social networking.
What is AWS Database Migration Service (DMS), and what are its supported sources and targets?
AWS Database Migration Service (DMS) is a service that allows you to transition supported sources to various database systems in AWS without the need for new code. It supports sources like on-premises databases, EC2 instances, Azure, Amazon RDS, and more. The targets include various databases, Amazon S3, Amazon Redshift, DynamoDB, and others.
What is the difference between homogenous and heterogeneous migration in AWS DMS?
In homogenous migration, the source and target databases are of the same type (e.g., Oracle to Oracle). In heterogeneous migration, the source and target databases are different types (e.g., Oracle to Amazon Aurora). Heterogeneous migration often involves using replication software and Change Data Capture (CDC) for data replication.
What is Amazon Kinesis, and what is its primary use case?
Amazon Kinesis is a platform for handling real-time, streaming data. Its primary use case is to collect, process, and analyze real-time data streams, enabling quick reactions to the information being received.
What are the different types of Amazon Kinesis services?
Amazon Kinesis provides several services, including:
Kinesis Data Streams
Kinesis Data Firehose
Kinesis Analytics
Kinesis Video Streams