Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Computer Science > AWS Solutions Architect Certification > Flashcards

AWS Solutions Architect Certification Flashcards

You may prefer our related Brainscape-certified flashcards:
Biology 101 flashcards
1
Q

What is data durability and what is S3’s rating

A

Chance of data loss, and 9 11s (99.9s %)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is block storage

A

Range of bytes/bits on disk where storage files are divided into blocks.

Each block receives a unique identifier and written to disk efficiently

Can be spread across multiple disks or environments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Object storage vs file storage

A

Object storage is flat structure where the data (object) is located in a single repository (bucket)

Prefixes and delimiters allow you to group similar items to visually organize and retrieve your data giving the appearance of files.

File storage is how an OS stores data in a hierarchical fs. Need to know the exact path and location of the files.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the components of object data

A

The data, metadata (size, dates, file types), attributes (permissions), unique id

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How many buckets are allowed per AWS account

A

100

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are some of the limitations of block storage (buckets)

A

Cannot be transferred to other accounts

Need objects to make globally unique names

Cannot change the name of after creation

Only can remove buckets when they’re empty

Can create as many objects in the bucket as you want

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Bucket naming convention

A

my-s3-bucket.s3.amazonaws.com

bucket-name.s3.amazonaws.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are bucket/object tags used for

A

Help to track storage costs, can help with finer grained access control, can use CloudWatch to setup metrics for specific tags

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Use of S3 for public, static websites

A

Can host static web content, enable static hosting, set public read permissions, provide index.html file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

S3 Path style Urls

A

Virtual hosted: bucket-name.s3.Region.amazonaws.com/key-name

Path Style:

s3.Region.amazonaws.com/bucket-name/key-name

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

S3 Virtual hosted style

A

http:/bucket-name.s3.region.amazonaws.com/key-name

Can make the bucket name the same as your registered domain name and make that nam a DNS alias for AWS S3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

S3 Consistency

A

After uploading/overwriting new object, read requests return new object immediately

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

S3 Object Versioning

A

Keeping multiple versions of an object in the same bucket.

When enabled, even if an object is overwritten, older versions will remain.

If object is deleted, can still retain prior versions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

S3 Transfer Accelerator

A

Online
Fast file transfer over long distances leveraging CloudFront globally distributed edge locations over an optimized network path

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Kinesis data firehouse (Data transfer)

A

Online

Captures and automatically loads streaming data into S3, Redshift and can get real time analytics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Kinesis data stream (Data transfer)

A

Online

Can emit to various AWS services. EMR, Redshift, Lambda, S3, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Snowcone (Data transfer)

A

Offline

Smallest edge storage transfer device. 8TB. Can transfer offline or online with Datasync

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

DataSync (Data transfer)

A

Can transfer hundreds of TB at speeds 10x open source tools from On prep to cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Snowball (Data transfer)

A

Offline

block and object storage with 40vCPUs. Used for data collection, ML, storage in remote or bad network connectivity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Snowmobile (Data transfer)

A

Offline

Extremely large amounts of data to AWS. 100 PB per snowmobile.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Direct Connect (Data transfer)

A

Hybrid Offline/Online

Dedicated network connection that bypasses the internet from onprem data centers to S3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Storage Gateway (Data transfer)

A

Hybrid Online/Offline

Store on prep data on an S3 bucket

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Bucket policies (Securing data)

A

Permissions for all or a subject of objects using tags and prefixes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Presigned Urls (Securing data)

A

Grant limited access to others with temporary urls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Block public access (Securing data)

A

Default configuration for S3 buckets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Resource-based Policies (Securing data)

A

Use if granting cross-account access permissions to other AWS accounts.

Also if user IAM polices reach their size limits or you prefer to keep access policies in S3

Will require a principal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

User policy (Securing data)

A

Use if you prefer to keep access control policies in IAM

Or if you have numerous S3 buckets with different permission requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Encrypt data at rest (S3) server side encryption

A

S3 encrypts objects before saving to disk and decrypts the data when downloaded

Can allow S3 to create/encrypt keys, can provide CMK and store in KMS, or can manage the key yourself

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Client side encryption (S3)

A

Encrypt data before storing in S3 and manage master encryption keys yourself

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Data Lakes in S3

A

Centralized repository to store structured and unstructured data, and S3 is a good selection for its near limitless storage capacity

Used to decouple compute from storage as well as ML and analytics workloads

Can use Athena, Redshift, Rekognition, and Glue

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Data cataloguing S3

A

Query-able interface all assets stored in S3 and provides single source of contents

Can input data into S3, extract metadata with Lambda and store in DynamoDB and query with elastic search

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

AWS Glue

A

Fully managed ETL pipelines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Athena (Querying S3 data)

A

Analyze data directly in S3 using SQL.

Serverless so only pay for volume of data you run queries on.

Best used for light data discovery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Redshift Spectrum

A

Run queries against S3. Should be used for complex queries with many concurrent users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Intelligent Tiering (S3)

A

Monitors data access patterns and transfers data into more appropriate storage class to save on costs.

Works best when data has an unknown access pattern

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Life cycle config (S3)

A

Set of rules defining actions to apply to a group of objects. Can tell S3 to transition objects to less expensive storage classes. Can automate the move to archival tiers, but will need to manually move them back

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

S3 General purpose tier

A

Default storage option that provides high performance for frequently accessed data.

High throughput and low latency. SSL encryption at rest, and no minimums or storage duration

Price is the highest, but the more you store the cheaper per GB the fees become

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

S3 Standard-Infrequent Access

A

Less frequent access, but rapid access when you need it. Idea for long-term storage, backups, datastore, DR files, etc.

Less expensive than general purpose for storage, but more expensive for access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

S3 One-Zone IA

A

Less available, less resilient, only available in one AZ

Less frequently accessed data and less resilient

Good for backups of onprem data where it can be recovered if necessary.

Cheaper

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Glacier Instant vs Flexible retrieval

A

Instant (rarely accessed but need it instantly, ex. medical images)

Flexible 1-5min, 3-5 hrs, 12 hours for bulk, rarely accessed and only need 1-2 times per year. Good for Offset storage needs.

Data minimum duration of 90 days

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Glacier Deep Archive

A

Lowest storage cost option.

Minimum of 180 days

12-48 hr retrieval times

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Factors of S3 pricing

A

Storage: Amount/size of objects, intelligent tiering, moving from tier class to the other

Requests/data retrieval: Pay per requests made against objects in bucket

Data transfer: Except to EC2, from the internet, or CF

Storage management features: S3 inventory, analytics, object tagging

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

S3 Server Access Logs

A

Free

Provides details about requests made to a bucket, requester, bucket name, status, environment

Can help to learn about customer base with certain access patterns, and understanding of bill

Can use Athena to analyze logs

Not guaranteed log delivery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

S3 Cloudtrail logging

A

Fee

Captures subset of API calls for S3 events

Determine which requests were made to S3 from which IP address, time and additional details

Can use Athena to analyze logs

Can use CloudWatch to monitor Cloudtrail events and invoke AWS lambdas and SNS notifications

Guaranteed log delivery and more structured

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

S3 Events

A

New object created, object removed, restore object, reduced redundancy storage, replication

Can publish events to SNS, SQS, Lambda

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

S3 Batch operations

A

Can perform a single API action on a list of objects:

Put object tagging
Restore requests to Glacier
Copies of objects
Invoke lambdas

Can use with S3 inventory, manage with labels and tags, monitor/troubleshoot the jobs with Cloudtrail

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Cloudwatch

A

Monitoring service that collects logs, events and metrics

Can create custom dashboards and set alarms for certain thresholds

Metrics can have multiple dimensions (bucket name, filtered, storage type, etc). Dimensions are used to drill down on certain metrics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

AWS Config (S3 auditing)

A

Check that you have recommended settings enabled in S3 account.

Can receive notifications via SNS or remediate issues with Lambdas

Can check if Logging is enabled for buckets, checks for publics access, checks if buckets require SSL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

AWS IAM Access Analyzer (S3 auditing)

A

Receive alerts for questionable access to S3 buckets and can remediate issues by removing access

Identify resources in your account/org that is shared with external identities

Alerts you if buckets configured to allow access to internet

Need to create an analyzer in each bucket region

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

AWS Trusted Advisor (S3 auditing)

A

Ensure account follows best practices for security, performance, fault tolerance, service limits, and cost optimizations

Can asses bucket permissions, bucket logging, bucket versioning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Four pillars of S3 cost optimization

A

App requirements: Understand data access patterns or archival needs.

Data organization: Use prefixes or tags to organize all data to help manage it

Understand, analyze, optimize: Setup monitors to help manage costs proactively and defensively

Continuous right sizing: Know the correct storage classes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Predictable workload tooling

A

Storage class analysis, observes data access patterns over time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

AWS resources to manage/monitor costs

A

QS dashboards that can use ML insights

CloudWatch that can provide actionable insights to monitor application performance changes

AWS budgets to track costs and usage

Cost and usage reports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

S3 Lifecycle policy

A

Rule that moves objects between storage classes based on create dates

Only supports transitions from one more frequently accessed tier to one less frequently accessed

Works for versioned and unversioned buckets

CT doesn’t support lifecycle actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

S3 Mutlipart uploads

A

For object greater than 100 MB, or transfer over a spotty network

Can remove incomplete uploads

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

File, Volume and Tape Gateways (S3)

A

Connect to cloud to store app data files in S3, cloud backed storage volumes of onprem apps, and physical tape on prep to virtual tapes in AWS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

S3 Storage Lens

A

Provides org wide visibility into object storage and activity trends

Can drill down into account, region, storage class, bucket, and prefixes. Can create custom dashboards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

AWS budgets

A

Tracks and takes action on AWS costs and usage

Can set custom budget alerts

Set budgets on a recurring bases to continue to be notified

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

S3 Performance metrics

A

network throughput, CPU, DRAM, DNS lookup time, latency, data transfer speeds with HTTP analysis tools

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

S3 performance tools

A

Prefixes: Scale for high request rates

Parallelization: Maximize bandwidth by scaling connections horizontally

S3 select: Optimize data retrieval operations by querying subset of objects. Works with JSON, CSV, and Parquet

Timeout/retries: Recover from continuous failures

Use Cloudfront for frequently accessed content

Transfer accelerator: transferring data across vast geographic locations

Cloudwatch: monitor performance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Bucket partitioning with prefixes

A

Naming scheme:
bucket-name/prefix/object

The bucket prefix allows objects to be stored on separate partitions, so can increase the transactions per second

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Parallelization (S3)

A

Horizontally scale parallel requests to S3 service endpoints for better performance

Can break up object data into multiple parts

Requires an upload id and part #

Can pause between uploads and don’t need to finish uploading the entire object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

S3 Connection delays and failures

A

Use AWS SDK for connection timeouts, retries, backoffs (exponential or random increase in request wait times)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

CloudFront

A

CDN to ensure low latency and higher transfer speeds
Caches copies of content, for everything not cached it will maintain open connection with origin server

DNS routes client requests to closest CDN

Can restrict access to buckets to only be accessible by CF
Can use HTTPS
Implement georestrictions
WAF to prevent certain traffic based on IPs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

AWS Organizations

A

Account management service where you can programatically create accounts and consolidate accounts within the org

Root –> OU –> Account

Policies can impact all child nodes and leaves when assigned

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

Service Control Policies

A

Will apply to all AWS users, groups, and roles within the account including the root identity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

CloudFront Use cases

A

Increase points of presence

Static asset caching
Live, on demand video streaming
Security and DDos protection
Dynamic and customized content
API acceleration
Software distribution
Can help with app availability since content can be cached and origin servers can go down
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

S3 ACLs (Access Control Lists)

A

Can be applied to every object and object stored in S3 and grand additional permissions beyond those specified in IAM or bucket policies. Can be used to grant access to another AWS user or predefined groups like the public.

If you have read permissions on the bucket, but not the actual objects, then you can only list contents of the bucket

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

S3 bucket permissions vs object permission

A

Can be set separately, If you want smoke to be able to view list of files in a bucket and be able To view/download them, you must gran them permission on the bucket itself as well as each object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

S3 IAM user policy

A

Great way to apply very limited permissions to an IAM role. Good if you want the user to have a policy that applies to multiple buckets

For example, a role used for DB backups should only be able to create objects and not view/delete them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

S3 data consistency

A

Creation and updates to individual objects in S3 are atomic, you’ll never upload a new object or change an existing object and see only half of the change

New objects are seen instantly (read-after-write consistency)

Updates to objects only guarantee eventual consistency. Thus it’s best to treat objects as immutable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

S3 gotchas

A

S3 sits outside the VPC and can be access from anywhere if bucket polices are not set to deny it.

Incomplete multipart upload costs accrue storage costs event if it fails to fully upload. Create lifecycle policies to clean up these incomplete uploads

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

EBS

A

High performance block storage designed for use with EC2

Can handle relational/nonrelational DBs, containerized apps, fs, media workflows, and big data analytic workloads

All volumes are replicated within an AZ and can easily scale to PB of data

Can use snapshots with automated lifecycle policies to back up to S3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

What is block storage

A

Raw storage where hardware is presented as disk or volume, and can be attached to compute system for use

Storage is formatted in predefined continuous segments called blocks and are the basic fixed storage unites to store data

Can be on HDD, SSDs, or NVMe

Application shares data management with OS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

What is file storage

A

Built on top of block storage, that serves as a file share or file server

Created using an OS that formats and manages the reading and writing of data to the block storage. Data is stored in a directory tree hierarchy

SMB and NFS are the most common storage protocols

OS manages the storage protocol and the operation of the file system and differentiates based on types of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

What is object storage

A

Built on top of block and created using an OS that formats and manages the reading and writing of data to the block storage device,

Object storage does not differentiate between types of data, and type becomes part of object metadata.

One object storage system could use binary objects of size 128MB, so smaller files or data are stored at a binary level within the object, and data larger than that are stored by spreading the data across multiple objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

How does file storage work in the cloud

A

Instead of storing files locally and managing access on. a NFs server, you store files in cloud resources by a managed file service like EFS

Customer manages access control for who has access to FS via network controls (SGs/NACLs), access points, and IAM policies

Comm between clients are storage is handled by special NFS protocol

The cloud service provides a common DNS namespace for clients to connect to the shared file system and those with appropriate permissions access the FS by connecting to their attached mount points and file systems appear as local volumes to the client.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

What are the file storage services

A

EFS, FSx for Lustre, FSx for Windows FS, Fsx on NETApp ONTAP, FSx for OpenZFS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

EFS

A

Scalable, elastic, fully managed and supports NFS. Capacity is dynamic without any intervention

Can be shared with up to 10k+ concurrent clients.

Only pay for the storage that you use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

FSx for Lustre

A

Parallel FS for high performing workloads. Need to select the specific performance and capacity parameters suited for you app needs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

File storage performance

A

Latency: Amount of time between making requests to storage system and receiving a response.
EFS standard offers 1 to 2.4 ms

IOPS: General purpose FS offers 35k read and 7k write. Max I/O offers over 500k

Throughput: Measuring the performance of reading and writing large sequential data files measured in MBs/second. EFS offers rates up to 10GB/sec

Has higher latency but better durability and availability than EBS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

How many AZs are all files and directories redundantly stores with EFS

A
  1. A write isn’t acknowledged until data is written to all 3.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

EFS security

A

POSIX permissions: user and group level permissions to control client access permissions to your fs

SGs: Restrict access over network with VPC SFs. Determines which IPs have network visibility to EFS endpoint.

IAM: Control both the creation and administration of the EFS FS

KMS: Encrypt data at rest and turn on TLS when you mount the fs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

EFS Cost optimization

A

Standard and Standard IA and OneZone IA

Lifecycle management will move files based on access frequency

Much more expensive than EBS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

Can an EFS be mounted on prep?

A

Yes, using Direct connect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

Lambda and EFS

A

Can set an EFS fs as the local mount path directly within the Lambda service console.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

EFS use cases

A

Big data and analytics: Shared files access to data scientists using genomics software running on EKS cluster

Web serving content management: Serve files to web apps quickly and scalable way to meet demand

App testing and development: Shared storage repository to share code and other files in a secure and organized way

DB backups: NFS files system is the preferred backup repository for many common database backup apps, like Oracle, SAP

Container storage: Providing persistent shared access across common file repository

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

Placement groups

A

The amount of data center capacity to provide all the computational resources to an AZ. Can be multiple data centers

For high performance needs, with extremely low latencies, AWS offers the availability to provision compute not just within same availability zone, but same placement grouping, so basically the same data center (hardware).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

FSx for Windows File Server

A

Simplifies the setup, provisioning and maintenance of Windows workloads

SSD and HDD storage. Provides up to 64TB per file system. Throughput up to 3GB

Provides backups and replication across multiple AZs

Migration of files from Windows servers to AWS, accelerating the adoption of migration through the use of a hybrid files system with low latency

Identity-based auth through Microsoft Active Directory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

Factors that affect pricing for FSx for WFS

A

Deployment type (Multi or single AZ)

Storage type (HDD or SSD)

Storage capacity (Priced per GB-month)

Throughput capacity (priced per MBps-month)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

What are the components of the FSx for WFS

A

Windows file server (with DNS address) and storage volumes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

What is an elastic network interface

A

A resource that allows client compute instances, where in AWS or on prep, to connect to FS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

What is AWS Direct Connect and Client VPN

A

Direct Connect: Service that enables you to access FS over a dedicated network connection from on-prem environment

Client VPN: Access FS from on-prem using secure and private tunnel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

AWS Managed AD with FSx for WFS

A

Setup and run Active Directories in the cloud

Deploy each directory across multiple AZ and AWS handles the integration of the two services

Can also keep self-managed AD on prem and integrated with FSx in the cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

Network interface level access control with FSx and WFS

A

Can control which resources in VPC can access FSx with SGs with inbound and outbound rules.

Will need to allow outbound traffic to connect to AD

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

AWS RDS

A

Web services that sets up, operates and scales relational dbs

Handles updates and backups

Supported drivers include Postgres, mysql, mariadb, oracle, and sql server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

AWS Aurora

A

Managed db service only compatible with mysql and Postgres drivers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

AWS DynamoDb

A

Managed key-value, non-relational db service that provides fast and predictable performance

You can create db tables that store and retrieve data and serve any level of request traffic

Can scale up or scale down your tables’ throughput capacity without downtime or degradation

Uses a partition key to allocate data to different nodes. Can have an optional sort key to store related attributes in a sorted order to be queried as a collection

Also has a PK and can use global and local indexes to speed up performance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

AWS DocumentDB

A

MongoDB workloads at scale with separate storage and compute that can be scaled independently

Table -> Collection 
Row -> Document
Column -> Field
PK -> Object ID
Nested table -> Embedded document
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

AWS Elasticache

A

Improves performance by retrieving data from high throughput and low latency in-memory data stores

Provides access to data across replicated nodes

Popular choice for gaming, FS, healthcare and IOT

Memcached and Redis cache engines differ based on backup and replication, automatic failover

Redis supports complex data types, data replication and data availability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

AWS Neptune

A

Fast, reliable managed graph db for apps with highly connected datasets.

Good for applications that work with highly connected data sets used to discover potential fraudulent behavior before it happens.

Used for recommendation engines, fraud detection, drug discovery, and network security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

AWS Redshift

A

Enterprise-level, petabyte scale, fully managed warehousing service. Can achieve efficient storage and optimum query performance through a combination of massively parallel process, columnar data storage, and efficient data compression encoding schemes

Offers 10x faster performance than other solutions.

Serve different purposes than RDBMS. Warehouses are meant to store aggregate values (analytical data)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

Structured Data

A

Organized to support transactional and analytical operations.

Most commonly stored in relational databases but can also be in non-relational.

Can run powerful data queries and analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

Semistructured Data

A

More flexible than structured and without the requirement to change the schema for every single record in the table.

Allows user to capture any data in any structure as data evolves and changes over time.

Examples include XML, email, and JSON

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

Unstructured data

A

Not organized in any distinguishable or predefined manner

Full of irrelevant info which means data needs to first be processed to perform any kind of meaningful analysis

Examples include text messages, word processing docs, videos, photos, and other images. Files are not organized

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

Relational DBs

A

Built to store structured data in tables using defined schema

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

Key-Value DBs

A

non-relational that store unstructured data in the form of key-value pairs

+ Store data in a single table as blob objects without predefined schema

+ Flexible and handles a wide variety of data types

+ No need for complex joins

  • Difficult to perform analytical queries due to lack of ions
  • Access patterns need to be known in advance for optimum performance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

Non-relational Document Dbs

A

Type of non-relational db that store semistructured and unstructured data in the form of files

+ Flexible

+ No need to play for a specific type of data

+ Easy to scale

  • Sacrifice ACID compliance
  • Databases cannot query across files natively
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

In-Memory

A

Both structured and unstructured data sources and for apps that require real-time access to data.

+ Support demanding apps requiring ms response times

+ Great for caching

+ Ultrafast and inexpensive access to copies of data

  • Not great for rapidly changing data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
110
Q

Graph Dbs

A

Store any type of data, structured, semi, unstructured

+ Allow simple, fast retrieval of complex hierarchical structures

+ Great for RT big data mining, such as fraud detection

+ Great for making relevant recommendations and allowing for rapid querying of this relationships

  • Cannot adequately store transactional data
  • Not efficient for analytics
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
111
Q

OLTP Databases

A

Focus on recording update, insertion and deletion transactions. Queries are simple and short which require less time and space to process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
112
Q

OLAP

A

Store historical data that has been input by OLTP. Can extract information from a large database and analyze if for decision-making. A good example is business intelligence Tool

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
113
Q

Describe real-time data analytics architecture with RDS

A

Stored procedure in RDS is executed for every new row, triggering a lambda function that passes the event to Kinesis and is stored in S3. Then can use Athena queries in QS to visualize data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
114
Q

Aurora vs RDS

A

Aurora is more durable than RDS and more resilient, it is very fast recovery from failures.

Aurora has better auto scaling capabilities and can provision up to 15 replicas

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
115
Q

AWS DMS

A

Migrate data from external database to AWS.

Requires source and target DB connection strings, a deployed EC2 instance to run replication task

Transfer data from S3 into relational db in Aurora

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
116
Q

Data Design Relational vs Non-relational

A

Relational: Normalized or dimensional data warehouse

Non: Denormalized document, wide column, or key-value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
117
Q

Advantages of Non-relational

A

Much east to scale horizontally, but has the issue of eventual consistency, which can be an issue for apps that require ACID compliance (Data may not be updated at the same time for all distributed systems)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
118
Q

Homogenous vs heterogeneous database migrations

A

Homogenous: Migrate between same DB engines, and require use of native database tools

Heterogenous: Migrate between different database engines. Requires the use of AWS Schema conversion Tool to translate db schema to new platform.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
119
Q

What instance classes does Aurora support

A

Burstable performance (short-lived bursts of high activity)
and
memory-optimized (suitable for most DBs)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
120
Q

What are the database engines RDS can run

A

Oracle, postgres, aurora, mysql, mariadb, oracle, and sql server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
121
Q

Which instance types are available for RDS

A

On-demand and reserved

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
122
Q

What security features does Aurora provide

A

Require both authentication and permissions to access tables

IAM polices and be used to assign permissions

Security groups are used to control access to the DB instance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
123
Q

What are the pricing models for Aurora

A

Serverless, on-demand, reserved

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
124
Q

What security options are available for DynamoDb

A

IAM, fully managed encryption at rest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
125
Q

What are the components of DynamoDB

A

Attribute, items, table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
126
Q

What are valid capacity modes for DynamoDB

A

Provisioned and On-demand

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
127
Q

Server vs serverless DB architectures benefits/tradeoffs

A

Server-based: Traditional architecture, server hosts, delivers, and manages the resources the application users need. Need to pay for maintenance and you’re responsible for maintaining them. Requires you to pay for additional server as scale grows

+ Better for predictable workloads, in-depth analysis, or long running computations

+ Full visibility since you own all the infra

+ Good for legacy apps that can’t be decoupled

Serverless: Apps are hosted by 3rd party service so no need to manage server. Provide automatic scaling and higher availability

+ Good for rapid scaling and applications with short running tasks that have a single purpose

+ Liability is reduced

+ Smaller deployable units result in faster delivery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
128
Q

AWS RDS benefits

A

Automates config, management, and maintenance

Configures read replicas or setup synchronous replication

Automatic backups and encryption at rest and in transit

Can easily scale compute resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
129
Q

Databases with EC2 benefits

A

Full control over database deployment

Supervise number of instances per database

Encrypt EBS volumes to protect your data at rest and in transit as data travels between the volume and the instance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
130
Q

Does RDS automatically scale workloads

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
131
Q

Serverless Databases Benefits (DynamoDB and Aurora serverless)

A

High available, fault tolerant, and scales as damn grows

DynamoDB supports ACID

No hardware provisioning, patching, or upgrading

Encrypts data by default

Aurora serverless provides relational dbs, with on demand and automatically scaling. Shuts down when not in use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
132
Q

What are some use cases for aurora serverless

A

Variable workloads (Peaks throughout the day)

Unpredictable workloads (Peaks of unpredictable traffic)

New apps with unknown instance size

Multitenant apps where each customer has their own db

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
133
Q

What are ideal applications for Redis

A

Session caching, full page caching, message queue applications, leaderboards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
134
Q

What are applications for memcached

A

Small and static data, static HTML page or JS pages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
135
Q

What are the node types for elasticache

A

On-demand (pay by the hour) and

reserved (1 or 3 year term) but high savings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
136
Q

What is the high level architecture of Redshift

A

Clients work with database via SQL endpoint at the leader node (leader and compute nodes are grouped into a cluster). This node spins up jobs and distributes to compute nodes that contain the actual data. Leader node aggregates data from compute nodes

Compute nodes have their own CPU, memory and disk storage. Jobs are partitioned into slices and allocated compute node resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
137
Q

What are the pricing options for Redshift

A

On-demand: Pay an hourly rate based on type and number of nodes

Concurrency scaling: Per second on demand rate that exceeds free daily credits

Reserved Instance: Lots of savings by committing to 1 or 3 yr term

Spectrum pricing: Applied when you use this feature. Bytes scanned on S3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
138
Q

How many copies of your data and across how many availability zones does Aurora provide

A

6 copies across 3 zones

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
139
Q

What are the 3 parts to Aurora billing

A

Instance hosting the database:
- On-demand, reserved, serverless (based on capacity)

Storage:

  • per GB per month
  • I/O

Data transferred out to the internet and other AWS regions. Never between services in the same region.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
140
Q

What is Amazon Aurora Global Database

A

Only a feature for MySQL but allows for single db to span multiple regions for shorter latencies throughout each region

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
141
Q

Types of EC2 billing

A

On demand: Pay for compute capacity by the second with no long-term commitments

Spot Instances: Unused EC2 capacity. Can save a lot, but not always available

Reserved: Discounted but need to pay for 1 or 3yr contract

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
142
Q

EC2 Families

A

General Purpose: M4, M5, T2/T3 Burstable

Compute Optimized: C4, C5, C5d

Memory Optimized: R4, R5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
143
Q

EC2 Placement Groups

A

Clusters: Logical grouping of instances within single AZ. Good for low network latency, high network throughput

Spread: Placed on distinct racks within data center. Good for small number of critical instances that should be kept separate from each other

Partition: Reduce the likelihood of correlated hardware failures of your application. Can be used to deploy large distributed and replicated workloads like HDFS and Cassandra across distinct racks +

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
144
Q

What are the five types of EBS Volumes

A

General purpose SSD gp2

Provisioned IOPS SSD io1

Throughput HDD st1

Cold HDD sc1

EBS Magnetic standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
145
Q

What is the volume size range of a gp (General purpose) EBS volume and the IOPS it can accommodate

A

1GB to 16TB

16k IOPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
146
Q

What is the IOPS range for the provisioned SSD EBS Volumes

A

64k -256k IOPS

This would be for big database workloads

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
147
Q

What is the volume size and max throughput volume of a Throughput optimized HDD EBS volume

A

125GB to 16TB
Throughput is 500 MiB/s
Used for data lakes and data warehouses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
148
Q

What are cold HDD EBS volumes for

A

Lowest cost block store for infrequently accessed data workloads. Some use cases include file servers and throughput oriented storage for data that is infrequently accessed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
149
Q

Volume size of EBS magnetic

A

1GB to 1TB. Workloads for infrequently used data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
150
Q

What are some characteristics of Redis

A

Advanced data structures

Multi AZ capable

Replication

Backup and restore

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
151
Q

What are some characteristics of memcached

A

Simple data structures

No replication

No backups

Multiple nodes

Multi-threaded

No backups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
152
Q

What is the throughput performance for Aurora in regards to MySQL and Postgres

A

5x for MySQL; 3x for Postgres; Can scale out to 15 replicas

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
153
Q

What is DynamoDB Accelerator DAX

A

High available cache for DynamoDB. Microsecond latency. Millions of requests per second. API compatible

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
154
Q

What is the range of the C4 class of EC2 instances

A

This is compute optimized instances

Anywhere from 3 to 36 vCPUS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
155
Q

What is the maximum number of vCPUs available for EC2 in the C family

A

64

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
156
Q

What is the main difference going from C4 to C7 EC2 instances

A

Basically better/new get processors that may be more cost-effective/higher performing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
157
Q

Can RDS instances encrypt backups

A

Yes, if you enable encryption at the time of launching an RDS instance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
158
Q

Can RDS instances encrypt logs

A

Yes, in you enable encryption at the time of launching an RDS instance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
159
Q

Does RDS automatically encrypt data, logs, and backups

A

Yes once you enable encryption it is done automatically

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
160
Q

When deploying a DB cluster with limited use (ie debugging prod issues) what is the most cost-effective option

A

Aurora Serverless. Not a long running instance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
161
Q

Do DynamoDB instances exist outside the VPC boundary? What about Aurora

A

DynamoDb is a regional service and can exist outside the VPC, whereas Aurora must reside within it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
162
Q

What major performance benefit do you get from using Dynamo vs Aurora

A

Dynamo sales much better, and is faster at both reading and writing.

163
Q

What are general purpose EC2 instances

A

Provide a balance of compute, memory, and network resources

Range from M classes: Can provide large amounts of memory, network bandwidth, and many vCPUs.

T classes: Burstable performance instances

164
Q

What is burstable EC2 performance

A

Sudden, temporary spikes in usage.

Instances accumulate CPU credit when workload is operating below baseline threshold. They can trust at any time for as long as needed.

165
Q

What are good applications of memory optimized EC2 instances

A

Enterprise-class databases and in-memory applications

X and R series, which have varying high performing CPUs

166
Q

What is the maximum memory capacity of memory optimized EC2

A

24TB

167
Q

What are storage optimized EC2 instances used for

A

Workloads requiring high sequential read/write access to very large data sets on local storage. High IOPS, low latency

168
Q

What is the NIST CSF

A

Framework consisting of standards, guidelines, and best practices to manage cybersecurity risks

Country agnostic

169
Q

What are some security features of CloudFront

A

Permit approved country IP addresses. Prevent banned countries

170
Q

What are some of the security threats blocked by WAF

A

Deny traffic based on IP

Sql injection prevention

Cross-site scripting prevention

User-agent block

Bad bot block

Content scraper block

171
Q

Where can AWS WAF be deployed

A

Cloudfront, ALBs, EC2 instances, API Gateways

Only pay based on how many rules you deploy and how many web requests your application receives

172
Q

What are the purposes of subnets from a security standpoint

A

Isolate tiers of your application within a single VPC. Network segmentation limits the spread and damage of potential attacks.

It also reduces the scope when auditing for specific requirements

173
Q

What is an alternative to opening SSH or RDP within instances of the production environment

A

Deploy a bastion server or use SSM

174
Q

What are route tables

A

Specify a destination IP and a target which is the connection by which to send the destination traffic

175
Q

What is Amazon GuardDuty

A

Uses VPC flow logs, DNS logs, and AWS CT events to use threat intelligence/ML for anomaly detection. Categorizes risk levels and notifies operations team

176
Q

What is DNSSEC

A

A way to protect DNS traffic and is a way to protect your domain registered with Router53.

DNS spoofing can direct users to malicious websites.

177
Q

What are stateless network filtering methods

A

NACLS

Generally uses info from headers (IP source or destination) for filtering

Fast and no issue with heavy traffic

Explicit Deny implicit allow

178
Q

What are stateful network filtering methods

A

SGs and Firewalls

Can identify TCP connection stages, packet statue, and other key statuses

179
Q

What level of network segregation are NACLs applied to

A

Subnets

180
Q

What is the default behavior of a newly added custom NACL

A

Denies all inbound and outbound traffic unless you add rules

181
Q

What is the behavior of the default NACL

A

Allows all inbound and outbound traffic

If no NACL are specifically added to subnet, default is provided

182
Q

How many NACLs can a subnet have

A

1

183
Q

How are NACLs evaluated

A

In order based on their rule number 10, 20, 30, etc.

Will ignore any higher level rule that contradicts lower level rule

184
Q

What is the behavior of a default security group

A

Permits all inbound and outbound traffic

185
Q

What is the behavior of a custom security group

A

Permits no inbound traffic, but allows all outbound traffic

186
Q

What are some best practices around SGs

A

Ensure they don’t have a large range of ports open

Limit modifications to only certain IAM roles

Use ELBs with SGs to restrict access to internet

Don’t ignore outbound rules

187
Q

What does AWS Shield provide

A

Protection from DDoS attacks

Can also pay for additional protection and features, including layer 7 DDoS and AWS Firewall Manager

188
Q

What does AWS Firewall manager provide

A

Centrally configure and manage firewall rules across accounts and app.

Can make sure new applications and resources follow common set of security rules.

189
Q

Can SGs be applied to a VPC

A

Yes

190
Q

Are SGs cumulative

A

Yes, and they combine of form a single, combined policy

191
Q

Can you specify deny rules for SGs

A

No, you can only specify allow

192
Q

What all can you do with Session Manager

A

Limit connection to instances

Manage instances at scale using Run command

Patch and update with defined maintenance windows

Secure, monitor, and rotate secrets

193
Q

Benefits of secrets manager

A

Provide full key rotation integration with RDS

Randomly generates passwords in CloudFormation and stores the password in Secrets Manager

Share secrets across different AWS accounts

194
Q

What are some of the functionalities of AWS Systems Manager

A

Session manager, run command, state manager, patch manager, and parameter store

195
Q

What does Amazon Inspector do

A

Continuously scans resources to help prioritize patch remediation, meet compliance requirements, identify vulnerabilities sooner.

Can indicate overly permissive paths over TCP or UDP at VPC edges

196
Q

What are AWS Config benefits

A

Discover resources

Record current state of resources and track historical changes

Evaluate config changes against compliance polices

Automate remediation

197
Q

What are VPC flow logs

A

Capture packet metadata like source/destination IP address, ports, protocol, packet size, etc.

Cannot monitor payloads

Not real-time

Should be enabled for packet rejects

198
Q

What is considered best practice for S3 log storage

A

Use dedicated bucket for CT logs

Implement least-privilege access to buckets where you store log files

Enable MFA to delete log storage bucket

199
Q

What are some of the important CloudWatch alarms to setup

A

Console sign-in requests without MFA

IAM policy changes

Unauthorized API calls w/in AWS account

KMS key configuration changes

ACLs, SGs, Route table changes

200
Q

When to consider hybrid cloud

A

Existing app that must run on prem but want to use cloud resources and scalability

Fast, local access to data

Many physical locations to manage with data and want reliable connectivity and simplified maintenance

201
Q

What is storage gateway (hybrid cloud)

A

Facilitates private cloud storage

Can bring data into AWS for processing in the cloud. Can also backup, archive and tier your storage

Deploys in-cloud and on-prem

Will integrate with S3, KMS, EBS etc.

202
Q

How does storage gateway provide low-latency access to data

A

Gateway first writes application data to on-prem disk used for cache storage. Then it uploads the data to AWS

Cache acts as durable store for data

203
Q

What are the storage gateway types

A

S3 FIle gateway, FSx FG, Tape gateway and volume gateway

204
Q

How much data can a virtual tape store

A

100GB to 5Tb

205
Q

How are you charged with Storage Gateway

A

Amount of data transferred out of the gateway

The type and amount of storage (ex S3)

Requests made to the gateway

206
Q

What are the two methods a storage gateway appliance can be deployed

A

On prem via VM appliance

On AWS via EC2

207
Q

How much data can the tape storage gateway appliance cache store

A

150Gb

208
Q

How does storage gateway appliance connect to service

A

Public endpoint over internet

VPC endpoint via AWS VPN or direct connect

FIPS

209
Q

When is application data encrypted with storage gateway

A

Initially data is stored on-disk in a cache storage where it is later encrypted and compressed as it moves to upload buffer where it will then traverse the wire to the S3 tape library

210
Q

Can virtual tapes stored in an S3 buckets be accessed directly?

A

No, must go through Storage Gateway for I/O ops. Storage gateway uses an S3 service bucket rather than customer bucket, so content is not accessible

211
Q

What are some methods to reduce cost of Tape Gateway storage

A

Archive tapes into Glacier Flexible Retrieval or Deep Archive

212
Q

What is the relevant information when creating a new tape

A

Number of tapes, capacity, and barcode prefix

213
Q

How can AWS storage gateway access S3 bucket

A

Assume role with an associated IAM policy that grants access

214
Q

How does EBS server side encryption work

A

EBS volume requests CMK (KMS stores master key)

EC2 mounts EBS volume and volume passes encrypted volume key to instance. The instance decrypts the data key with KMS (with master key). Instance now has access to decrypted data key and can encrypt data to EBS

215
Q

What are some of the uses cases for S3 File Gateway

A

Backing up data to the cloud

Archiving long-term, retention based data

Building data lakes

216
Q

What is the S3 File Gateway file share

A

Each file that is uploaded to S3 on-prem appliance is paired with a single S3 bucket and uses the appliance’s local cache

217
Q

Do S3 File Gateway files act as native S3 objects?

A

Yes, unlike tape storage gateway, you can access data directly in S3

218
Q

What are some common capabilities across Storage Gateway types

A

Local caching and optimized data transfers to storage in AWS

219
Q

What are the three elements of billing for Storage Gateway

A

Storage, requests, and data transfer

220
Q

What is the primary difference between the on-prem S3 file gateway and Tape gateway

A

S3 does not utilize an upload buffer. Both will allocate a certain amount of space for a cache to prevent frequent lookups in S3/AWS

221
Q

Does renaming a file in S3 create a new object

A

Yes. Objects are immutable in S3

222
Q

Does each file share in S3 File Gateway need to be connected to an S3 bucket

A

Yes, they would be connected to separate buckets. However, you can adjust the prefix from each share if it needs to write to the same bucket

223
Q

Should you configure your S3 buckets so only one file share can write to it

A

Yes

224
Q

What is a way to limit file permissions if you configure guess access to S3 FIle Gateway without being able to use IAM

A

POSIX permissions

225
Q

What are the two different modes Volume Gateway can be deployed

A

Cached: low latency to most recent data

Stored: Entire dataset is on prem with scheduled backups to S3

Only available with on-prem host platform. Asynchronous point-in-time snapshots to S3.

Data is stored durably in S3 service buckets as EBS snapshots. Backups capture only changed blocks.

Both use the iSCSI protocol

226
Q

What is AWS Backup

A

Centralized backup services that backs up your application data across AWS services

227
Q

What are some use cases for cached volume storage in Volume Gateway

A

Custom file shares and migrating app data into S3 to transition to using EC2

You want all your data stored locally and require AWS for backup snapshots

228
Q

What are some use cases for stored volume storage in Volume Gateway

A

Block storage backups, cloud-based DR

229
Q

Explain the process for cached volume reads for Volume Gateway

A

Read requests are served locally form the cache and there is no latency.

If there’s a cache miss, it must retrieve data from the backend data store then returned to the calling application

230
Q

Can you expand the size of a volume used for Volume Gateways

A

No, you’ll need a snapshot of the prior volume and use it to create a new one of a larger size. You can also used a cached volume

231
Q

What are some ways to cutdown on costs when using Volume gateway

A

Remove old snapshots

232
Q

What is a volume recovery point

A

A point in time when volume is consistent from which you can create a snapshot or clone a volume

233
Q

Once a cache volume is added, what action can you perform in AWS Storage Gateway

A

Add/edit the snapshot schedule.

Configure CHAP authentication

234
Q

How do you access EC2 instance metadata with IPv4 and IPv6

A

IPv4: http://instance-ip/latest/meta-data

IPv6: http://[fd00:ec2::hostid-in-ip-address]/latest/meta-data

*USES HTTP

235
Q

Do SGs only have inbound rules

A

Yes

236
Q

Do NACLs have inbound and outbound rules

A

Yes

237
Q

For more control, it is best practice to use AWS managed CMKs

A

No, it is better to use customer generated

238
Q

What all is encrypted when EBS encryption is selected

A

Data at rest inside the volume

All data moving between the volume and instance

All snapshots created from the volume

All volumes created from these snapshots

239
Q

What is AWS EventBridge

A

Serverless event bus service that you can connect applications with data to

Will receive events and applies rules to route the event to a target

240
Q

What does WAF give you control over

A

How traffic reaches your application and can control bot traffic and block common attack patterns such as SQL injection and CSS

This protects against layer 7 attacks (HTTP)

Can only deploy on ALBs, API Gateway, CloudFront

241
Q

What service best protects against DDos

A

Amazon shield – free for every AWS customer

Can use Shield advanced as a paid service to protect against more sophisticated attacks

242
Q

What is Macie for

A

Will detect PII stored within S3 across multiple accounts

243
Q

What service can monitor suspicious activity across CloudTrail, VPC Flow logs, and AWS DNS Logs

A

GuardDuty

Can set up CloudWatch events rules and be notified of any findings

244
Q

What workload is Amazon Inspector for

A

Predominantly scanning EC2 for software vulnerabilities , but also for containers pushed to ECR

This needs to be applied after a starting up an EC2 instance

245
Q

What is KMS

A

Secure and resilient service that uses hardware security modules that have been validated under FIPS 140-2 to protect keys

246
Q

What are symmetric CMKs (AES-256)

A

Single encryption key that is used to encrypt and decrypt data

247
Q

What are asymmetric keys (RSA)

A

Public key to encrypt private key to decrypt. Basics of SSL. Also used to sign/verify operations

248
Q

What are the three types of CMKS

A

AWS managed, user keys created in KMS, user keys created outside of KMS

249
Q

Can you access the CMK used to encrypt data in KMS

A

NO

250
Q

Can KMS keys be used across regions

A

No. If you wanted to copy an EBS encrypted volume to a new region then you’d have to create a new encrypted snapshot and create new volume in new region with new encrypted key

251
Q

How frequent are keys rotated when enabling KMS automatic key rotation for customer-managed CMKs

A

1 year. Previous backing key will be kept active to encrypt old data. CMK ID will remain the same, but backing key will change

252
Q

What is the rotation period for manual key rotations

A

You can select a custom date, like 90 days or 180. However, manual key rotation will generate a new CMK ID, so you should make use of key aliases to know which version of the key you want to use

253
Q

What is the purpose of SSM parameter store

A

Storing secrets like db-urls and passwords and configuration management. Integrates with KMS for encrypted parameters or can store as plain text

Can enforce parameter polices like a custom TTL where a forced update will happen for sensitive data

254
Q

What’s the difference between Secrets Manger and Parameter Store

A

Secrets manager can enforce rotation every X days and can automatically generate secrets on rotation

It is mostly made for RDS

255
Q

What does the file storage gateway do

A

Expand NFS file storage system

256
Q

When a question talks about on-prem data to the cloud which service should you think about

A

Storage gateway

257
Q

Which storage gateway should you consider if you need to expand network file system NFS to the cloud

A

File storage gateway. Users can authenticate with Active Directory

258
Q

What is Route53

A

Global, highly-available DNS service where a user’s ISP will route url requests to Route53, which will provide the IP

You can register domain with Route53 and even purchase the domain name. Can do public or private

Uses multiple routing algorithms

259
Q

Identify all the dns components in aws.amazon.com.

A

”.” is the root

“.com” is the top level domain

“.amazon” is the second level domain

“aws.” is the subdomain

260
Q

Identify the tree components of the DNS hierarchy

A

Root is the label (domain name of node)

Zone (holds resources records for node’s domain (com.)

Resource records: Composed of separate resource records (amazon.com.)

Authoritative name server: At least one ANS (aws.amazon.com.)

261
Q

What is a DNS recursive name server (Resolver)

A

Extract info from name servers in response to client requests

Traverse DNS hierarchy to provide full resolution

Cache results based on record’s TTL

262
Q

What are some of the features of VPC

A

Builds upon high availability of Regions and AZs

Subnets divide VPC

Route tables to control traffic going out of subnets

Internet Gateway allows access from internet to VPC because otherwise not internet traffic should be allowed

NAT gateway allows private subnet resources access to the internet

NACLs control access to subnets; stateless

263
Q

What is CIDR

A

Classless inter-domain routing, which is a method for allocating IP addresses defining a range of addresses

Example:
192.168.0.0/26 = 192.168.0.0 - 192.168.0.63

Composed of a base IP and subnet mask (which is how many bits can change in the IP)
192.168.0.0, /0 or /24 or /32

264
Q

What is the subnet mask

A

Basically allows part of the underlying IP to get additional next values from the base IP

/32 allows for 1 IP 2^0
/31 allows for 2 IP 2^1
/30 allows for 4 IP 2^2
/24 allows for 256 IP 2^8 Allows for 1 of the octets in the IP address to change so 256 * 256 amount of options

265
Q

What are the allowable IP values for private IPs

A
  1. 0.0.0/8 in big networks
  2. 16.0.0/12 AWS default VPC in that range
  3. 168.0.0/16 for home networks
266
Q

What is the maximum amount of allowable IPv4 IPs for a VPC

A

around 65,000 per CIDR. CIDR blocks will contain a subnet mask of 16

Can add multiple CIDRs within a VPC though. Can have up to 5

267
Q

Do all resources within a VPC exist within a subnet?

A

Yes, and each subnet has its own CIDR block

268
Q

What is the purpose of a public route table

A

Provides a network route for packets to leave VPC to IGW and to the internet. Will require an additional entry within the route table to specify that

Then need to associate public route tables with public subnets

269
Q

What’s the purpose of a bastion

A

To allow an admin to have access to a public facing instance to log into other resources within private subnets that they have permissions to

It will have its own SGs and NACLs

Make sure it only has port 22 traffic from the IP address you need

270
Q

What is the purpose of a NAT server/gateway

A

Allow outbound traffic from resources within a private subnet.

Will allow outbound traffic (0.0.0.0/0) to be added to private route table with the NAT gateway as the target

NAT gateways will have access to public route tables

271
Q

Why are SGs considered stateful

A

Traffic that exists an instance is still able to return to that instance as inbound traffic even if no rule exists.

It’s able to remember a request.

272
Q

Why are NACL considered stateless

A

Contains an outbound and inbound rule, and both must be considered for a round trip process

Doesn’t mattered if traffic was allowed in, it will be checked again

273
Q

Why shouldn’t you just use NACLs since they’re more strict as stateless firewalls

A

There are no subnet boundaries between instances, so still need SGs

274
Q

What is AWS Direct Connect

A

Uses dedicated private connections between on-prem infrastructure and cloud account with consistent network performance and lower bandwidth costs

This is accomplished with private VLANS

275
Q

What are the two available bandwidth options for Direct connect

A

10Gbps and 1 Gbps

276
Q

What are some use cases of Direct Connect

A

Big data, latency, DR, and hybrid cloud

277
Q

What is Global Accelerator

A

Fully managed global network traffic manager

Route53 can send a more permanent and resilient IP address for ALBs in the case that the client caches the IP but it changes for some reason

Can provide great network/application reliability

278
Q

How many IP addresses are reversed in each subnet

A
  1. So keep this in mind when choosing the correct subnet size
279
Q

How do you make NAT gateways more resilient

A

Will need to create multiple NAT gateways in multiple AZs

280
Q

What are some characteristics of the default NACL

A

Accepts everything inbound/outbound with the subnets its associated with

281
Q

Why are ephemeral ports important when designing NACLs

A

Client that make requests to servers will open up an ephemeral port to accept response, so outbound NACL policies need to specify a port range provided by host OS. And the client will need to allow inbound TCP connections on the same port range.

282
Q

What is the difference between how rules are evaluated between SGs and NACLs

A

SGs will evaluate all rules before deciding to allow traffic

NACLs will evaluate rules from lowest to highest and first match wins

283
Q

What is the VPC analyzer used for

A

Can test connection between two endpoints within VPC to see if NACLs and SGs are configured as expected

284
Q

Can VPC peering be setup in different AWS accounts/regions

A

Yes

285
Q

What all needs to be setup to enable VPC peering

A

Initially need to create a VPC Peering connection

Then will need to modify route tables. One for the subnet route table for the resources that need to be peered and for the VPC route table with the peering connection as the target

286
Q

What are VPC Endpoints

A

Allows resources within VPC to access AWS resources without traversing the public internet with a private connection

More efficient than relying on NAT and Internet gateways

287
Q

What are the two types of Endpoints with VPC Endpoints

A

Interface: Provision an ENI (private IP address) as an entry point with SG

Gateway endpoints: Provision gateway that must be used as a target in the route table
Only works for S3 and DynamoDB

288
Q

Does a VPC only exist within one region

A

Yes

289
Q

Can a subnet exist within multiple AZs

A

No

290
Q

Do all AWS resources have to be deployed within a VPC

A

No

291
Q

How do you preserve an EBS volume if an EC2 instance is terminated

A

Disable the DeleteOnTermination attribute for the EBS volumes

292
Q

Can SGs explicitly block traffic

A

No, they can only allow certain traffic. So will need the help of NACLs

293
Q

What are some of the characteristics of ALBs

A

Works at layer 7 so can take action based on things in that protocol such as paths, headers, and hosts

294
Q

What are some of the characteristics of NLBs

A

Doesn’t worry about upper layer protocol so it’s much faster

Easier to integrate with security and firewall products

295
Q

What are some of the characteristics of GLBs

A

Load balances third-party virtual appliances (like firewalls and intrusion detection systems)

296
Q

Can you resize a CIDR block after it’s been created

A

No

297
Q

Can CIDR blocks specified in route tables overlap

A

Yes, and when they do the more specific one takes precedence

298
Q

Can ELB route traffic between regions

A

No, just subnets and AZs

299
Q

Should you reserve the largest CIDR block to the private subnet for applications

A

Yes

300
Q

Are subnets bounds by AZs

A

Yes. Generally you’ll want to replicate each of your subnets in each AZ within the region

301
Q

Are VPCs bound by a region

A

Yes. It cannot go across regions

302
Q

Do EC2 instances have IPv4 and IPv6 addresses

A

Yes

303
Q

Can you have multiple CIDR ranges per VPC

A

Yes

304
Q

What is the maximum amount of SGs that can be attached to an EC2 instance and how many rules can exist per SG

A

5, 50

305
Q

Why would you need to allow all ports on a NACL for an outbound rule

A

Clients have ephemeral ports, so unable to determine which ones would be allowed

306
Q

By default do SGs allow inbound traffic

A

No, they have no inbound rules by default

307
Q

How many Internet gateways does one VPC have and how many NAT gateways

A

1 IG per VPC, but multiple NATs since they cannot span AZs, so would need one for each AZ

308
Q

What would be a benefit of using placement groups for EC2 instances and what are some drawbacks

A

Much better network performance, decreasing latency and maximizing bandwidth

However, not most resilient since it’ll be in the same AZ and event the same rack

Restricts the availability to deploy EC2 instances since need to find space for multiple instances

309
Q

What is the best thing to do if you’ve run out of IP addresses in your VPC

A

Add an additional CIDR block.

310
Q

How can you accomplish Blue/Green deploys with Route53

A

Use a weighted policy to distribute traffic between two ELBs

311
Q

What’s the best way to enforce a blacklist of IP addresses

A

WAF in front of an ALB

312
Q

Which ELB retains the IP address of the original client

A

NLB. CLB and ALB will only show the IP address of those LBs to target EC2 instance

313
Q

What are some additional benefits of CloudFront other than low latency

A

Geographical restrictions - white/black list at country level

Caching custom error pages

314
Q

To prevent a list of IPs from accessing CloudFront distributions what should you do

A

Create a Web Access Control List (WAF)

315
Q

How do ALBS with multiple target groups configure health check settings

A

Health check settings are defined on a per target group basis

316
Q

What tools can be used to establish a private connection between VPC and On-prem data center

A

Customer gateway deployed to on prem data center and site-to-site VPN connection with Virtual private gateway enabled on VPC

Can connect to Customer Gateway over public IP or a private IP using a NAT device (NAT device would have a public IP)

Need to enable route propagation for VPG in the route table associated with subnets

317
Q

What is Direct Connect

A

It is a dedicated private connection from a remote network to your VPC

You’ll need to setup a Virtual Private Gateway on your VPC

Can access private sources (EC2) and need VPG and public (S3) don’t need a VPG

318
Q

What are the benefits of direct connect

A

Increased bandwidth throughput when working with large data sets

More consistent network experience

Supports hybrid environemtns

319
Q

What is needed in order to setup Direct Connect for more than one VPC across regions

A

Direct Connect Gateway

320
Q

What are the two connection types available for Direct Connect

A

Dedicated Connections - 1GB - 10GB. Physical port dedicated to a customer

Hosted Connections: 50Mbps, 500Mbps, 10 Gbps and capacity can be added or removed on demand

  • Both take over a month to establish
321
Q

What is the setup for a high resiliency Direct connect connection

A

Can setup multiple Direct Connect locations in the case that one fails. Both will point to the same VPG in a region

322
Q

What is the setup for maximum resiliency in direct connect connections

A

Deploy multiple direct connect locations each with multiple connections

323
Q

What are some of the ways for VPCs to communicate with one another

A

Over the public Internet

VPC Peering - although this opens the entire network and you may only want to expose one service

AWS PrivateLink (VPC Endpoint Services)

324
Q

What are the components required for Private Link

A

Will have to connect service application (within separate VPC) to a NLB and then create an ENI and attach to consuming service. Then can establish a private link

325
Q

What is the AWS offering that attempts to reduce some of the complexity in networking topology

A

Transitgateway

326
Q

How do you place limitations on transit gateway so not all VPCs can access one another

A

Route tables: Specify which VPC and talk to another

327
Q

What is one way you can increase your throughput from multiple VPCs and remote network

A

Use VPN to transit gateway with ECMP which increases the amount of tunnels as opposed to the traditional VPN connection through Virtual private gateway. Can then add more site-to-site VPN connections to get more throughput

328
Q

Can you leverage transit gateway to establish multiple direct connections to onprem

A

Yes, can allow transit gateway to connect with direct connect gateway and connect to direct connect location to a customer router.

329
Q

What is VPC Traffic Mirroring

A

Allows you to capture and inspect network traffic in your VPC by routing inbound and outbound traffic to its original destination as well as a NLB with EC2 instances running security appliances

330
Q

Can EC2 instances have private IPv4 and IPv6 IPs

A

Yes, and both can communicate to the internet through an internet gateway

331
Q

If you’re unable to initialize a new EC2 instance in a subnet due to a lack for available IPs what should you do

A

Create a new CIDR within your subnet

332
Q

What are the steps to add IPv6 addresses to an instance

A

Add IPv6 CIDR address to subnet and enable auto-assign

Go to instance and assign an IPv6 address

Will need to modify SG to allow for IPv6 traffic

Typically IPv6 CIDR group within subnet will be added to route table and then can communicate with one another over IPv6

333
Q

What are egress-only internet gateways used for

A

Keeping inbound IPv6 connections to VPC, but allowing outbound IPv6 connections

Will need to update route tables to reflect connecting outbound traffic with a target of the egress-only IG

334
Q

Whats the way in indicate all traffic in IPv4 and IPv6

A

IPv4: 0.0.0.0/0

IPv6: ::/0

335
Q

Does AWS site-to-site VPN traverse the public internet

A

Yes. Requires a customer gateway on datacenter and a Virtual private gateway on VPC and site-to-stie VPN over public internet

336
Q

What networking tool should you use to establish a direct private connection to an AWS direct connect location

A

Direct Connect. Setup a VPG on the VPC and establish a direct private connection to a Direct Connect location

337
Q

Does an EC2 instance need a public IP address in order to be accessible by the internet

A

Yes

338
Q

Do you need to update both VPC route tables when enabling VPC peering

A

Yes

339
Q

If you are launching new EC2 instances inside a subnet but they’re not getting public hostnames and DNS resolution isn’t working, what should you do

A

Enable DNS resolution and DNS hostnames in VPC

340
Q

What is a networking tool to use when you have an app you want to share with customers hosted in a private VPC but don’t want public internet access

A

VPC Endpoint Services ( AWS PrivateLink)

341
Q

What does AWS Cloudhub allow you to do and does it require a VPC

A

Allows for secure communication across multiple network sites and does not require a VPC

342
Q

What is the difference between PrivateLink and Direct Connect

A

Private Link is used for secure communication from services within a VPC to AWS services outside VPC (VPC Endpoint) not on the public internet

Direct Connect is secure communication between VPC and on-prem networks that don’t traverse the public internet

343
Q

What does hibernating an EC2 instance do

A

Shuts down the instance but stores the current RAM contents to a volume and when rebooted loads back that volume

344
Q

What are Elastic IPs

A

Static IPv4 addresses associated with AWS account

Can associate them with any other instance or ENI and can remap them to another instance in your account in the case of an instance failure

Not used when Load Balancers are being used

345
Q

What protocols do NAT Gateways support

A

UDP, TCP, ICMP

346
Q

What is the maximum bandwidth of a NAT Gateway

A

10 Gbps

347
Q

What can a VPC owner do

A

Create and edit components within VPC

348
Q

What can VPC participants do

A

Launch resources within their assigned subnets

349
Q

What are the differences between AWS Direct Connect Private and Public VIFS

A

Private VIFS allows access to VPC IP address

Public VIFS allow access to AWS Public IP address space

350
Q

For large scale connections between corporate data centers and VPC what components should be used

A

Customer gateways deployed on-prem and AWS DX devices which will connect to a DX Gateway and can then connect to a transit gateway to spread traffic over multiple VPCs

351
Q

What does global accelerator do

A

Route clients to closest health endpoint

Client ingress traffic is routed through closest available edge location

352
Q

Do you get to choose your IPv6 address for a new instance

A

No, they’re chose for you

353
Q

What are some examples of Route53 routing policies

A

Geolocation routing policy, geoproximity routing policy, latency routing policy, weighted routing, IP-based policy

354
Q

What is geolocation routing

A

Route users based on their location to closest resources

355
Q

What is geoproximity routing

A

Route traffic based on the location of your resources

356
Q

What is latency routing

A

When you have resources in multiple regions and you want to route based on which provides the best latency

357
Q

What is weighted routing

A

Route traffic to multiple resources in proportions that you specify

358
Q

What are ALB listeners

A

A process that checks for connection requests using the protocol and port you configure; Rules that you define for a listener is how the load balancer routes the requests

359
Q

What is an ALB target

A

Destination for traffic based on the established listener rules

360
Q

What is an ALB target group

A

Each target groups routes requests to one ore more registered targets. A target can be registered with multiple groups

361
Q

What is path and host based ALB routing

A

Path: Rules that forward requests to different target groups based on URL

Host: Forward requests to different target groups based on host name

362
Q

What AWS services are available for autoscaling

A

EC2, ECS, DynamoDB, Aurora

363
Q

What are the 3 built-in ASG scaling strategies

A

Optimize for availability, availability and cost, optimize for cost

364
Q

What are target tracking scaling policies

A

Set a metrics like CPU utilization and target value

365
Q

What are CloudFormation templates

A

Text based descriptions of CloudFormation stacks that you can use to define all your resources and is stored as a text file in JSON or YAML

366
Q

What are CloudFormation stacks

A

Collection of resources that you can manage as a single unit

367
Q

What are CloudFormation macros

A

They can enforce specific standards your organization sets for your resources

Can also help to ensure consistency

They help custom resources manage the lifecycle of resources outside of what is defined in the Cloudformation template

368
Q

Can you use CloudFront for TLS handshake termination

A

Yes

369
Q

Can Cloudfront forward requests along the AWS backend networks

A

Yes

370
Q

What is AWS Simple Workflow Service

A

Orchestrator for distributed applications, sequential processing of tasks. Consists of workflow with multiple tasks and deciders and maintains a history of all the activities.

Have multiple, separate workflows within a domain

Essentially an Airflow competitor as a fully managed state tracker

371
Q

What are some use cases for SWS

A

Video encoding: Video upload triggers a workflow execution

E-Commerce App:

372
Q

What is SNS

A

Fully managed pub/sub messaging and mobile communications service

373
Q

Does SQS have a maximum amount of time a message can exist

A

Yes, 14 days

374
Q

What is the purpose of long consumer polling in SQS

A

Reduce the number of API requests to SQS

375
Q

What is the managed AWS service option to implement the Request Response messaging pattern

A

SQS Temporary Queue client

376
Q

How can SNS and SQS be used together

A

Can use both to create the fan out pattern where some app/service will submit a message to SNS and there will be multiple SQS queues subscribing to that topic and will fan out to other downstream services subscribed to the SQS topic

377
Q

What’s a way to disperse one message to an SNS topic to multiple SQS queues

A

Message filtering

378
Q

What are the different streams that Kinesis provides

A

Data Streams
Video Streams
Analytics Streams
Firehose

379
Q

What is the retention maximum for kinesis data streams

A

1 year

380
Q

What are the destinations Kinesis Batch / can write to

A

S3, Redshift, and ElasticSearch

Can also write to a number of 3rd party services

381
Q

Is there ordering in Kinesis

A

Yes, at the shard level

382
Q

What are the best use cases for Kinesis

A

ETL, Data and Analytics/Big data

383
Q

What messaging platform should you use if you’re migrating an application that uses message queues with a common messaging protocol and don’t want to rearchitect

A

AWS MQ

384
Q

What are the 3 invocation models of lambda

A

Synchronous: Invoker expects response (API Gateway)
Async: Events are queued and requestor doesn’t wait
Polling: Lambda will poll services like Kineses, SQS, and DynamoDB streams

Async and Polling have built in retry mechanisms, but synch does not have retries

385
Q

What does an IAM execution rule for Lambda do

A

Controls what the function can do

386
Q

What are the three settings you have to configure for Lambda functions

A

Memory, Timeout, Concurrency

387
Q

How are you charged for Lambdas

A

Based on the amount of invocations and the duration. The price will also depend on the memory allocated to the function

388
Q

What is the maximum execution time, concurrent functions, and RAM available to Lambdas

A

15 minutes, 1000, and 10 GB of RAM

389
Q

What is the difference between the provisioned and on-demand modes

A

Provisioned is used for planning read/write capacity ahead of time

On-demand should scale dynamically based on workload, thus is more expensive

390
Q

What are dynamodb global tables

A

Table replication across regions with two-way replication, which helps reduce latency across regions. So any write in an region will be replicated on the other

391
Q

What are global and local secondary indexes

A

Allows you to optimize queries on attributes other than the primary key (partition key + sort key)

392
Q

What are the different API Gateway Endpoint types

A

Private: Only exposed on your using an VPC Endpoint

Regional: For clients within same region

Edge optimized: Requests are routed through edge locations

393
Q

What are SigV4 permission

A

IAM permissions for API Gateway

394
Q

What are some methods of authentication with API Gateway

A

Lambda authorizer (IAM based) and Cognito

395
Q

What are federated identity pools from Cognito

A

Uses a federated identity provider to submit token to federated identity server, then gets credentials from STS and provides temporary AWS creds to client

396
Q

What are containers grouped into in ECS

A

Tasks

397
Q

Are containers/ECS good for batch jobs

A

Yes

398
Q

What are ECS services

A

Provides a mechanism/API to interact with ECS cluster tasks and can define ALBs/NLBs and ASGs for tasks. Groups tasks together

399
Q

What is ECS Fargate

A

Serverless platform where you don’t have to manage the EC2 instances in an ECS cluster. Just need to create task definitions

400
Q

How do you give permissions to ECS tasks

A

Assign each task a role with a policy to connect to whichever AWS service is needed

401
Q

Can you mount an EFS volume to an ECS task

A

Yes. Cannot use S3 as a task file system

402
Q

How can you set ASGs for ECS clusters

A

Can define memory and CPU utilization at the service level, adding additional tasks

ECS capacity providers and scale EC2 instances if more tasks need to be added greater than the original capacity

403
Q

Does ECS support rolling updates

A

Yes

Computer Science (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions