AWS Solutions Architect Certification Flashcards
1
Q
What is data durability and what is S3’s rating
A
Chance of data loss, and 9 11s (99.9s %)
2
Q
What is block storage
A
Range of bytes/bits on disk where storage files are divided into blocks.
Each block receives a unique identifier and written to disk efficiently
Can be spread across multiple disks or environments
3
Q
Object storage vs file storage
A
Object storage is flat structure where the data (object) is located in a single repository (bucket)
Prefixes and delimiters allow you to group similar items to visually organize and retrieve your data giving the appearance of files.
File storage is how an OS stores data in a hierarchical fs. Need to know the exact path and location of the files.
4
Q
What are the components of object data
A
The data, metadata (size, dates, file types), attributes (permissions), unique id
5
Q
How many buckets are allowed per AWS account
A
100
6
Q
What are some of the limitations of block storage (buckets)
A
Cannot be transferred to other accounts
Need objects to make globally unique names
Cannot change the name of after creation
Only can remove buckets when they’re empty
Can create as many objects in the bucket as you want
7
Q
Bucket naming convention
A
my-s3-bucket.s3.amazonaws.com
bucket-name.s3.amazonaws.com
8
Q
What are bucket/object tags used for
A
Help to track storage costs, can help with finer grained access control, can use CloudWatch to setup metrics for specific tags
9
Q
Use of S3 for public, static websites
A
Can host static web content, enable static hosting, set public read permissions, provide index.html file
10
Q
S3 Path style Urls
A
Virtual hosted: bucket-name.s3.Region.amazonaws.com/key-name
Path Style:
s3.Region.amazonaws.com/bucket-name/key-name
11
Q
S3 Virtual hosted style
A
http:/bucket-name.s3.region.amazonaws.com/key-name
Can make the bucket name the same as your registered domain name and make that nam a DNS alias for AWS S3
12
Q
S3 Consistency
A
After uploading/overwriting new object, read requests return new object immediately
13
Q
S3 Object Versioning
A
Keeping multiple versions of an object in the same bucket.
When enabled, even if an object is overwritten, older versions will remain.
If object is deleted, can still retain prior versions
14
Q
S3 Transfer Accelerator
A
Online
Fast file transfer over long distances leveraging CloudFront globally distributed edge locations over an optimized network path
15
Q
Kinesis data firehouse (Data transfer)
A
Online
Captures and automatically loads streaming data into S3, Redshift and can get real time analytics
16
Q
Kinesis data stream (Data transfer)
A
Online
Can emit to various AWS services. EMR, Redshift, Lambda, S3, etc.
17
Q
Snowcone (Data transfer)
A
Offline
Smallest edge storage transfer device. 8TB. Can transfer offline or online with Datasync
18
Q
DataSync (Data transfer)
A
Can transfer hundreds of TB at speeds 10x open source tools from On prep to cloud
19
Q
Snowball (Data transfer)
A
Offline
block and object storage with 40vCPUs. Used for data collection, ML, storage in remote or bad network connectivity
20
Q
Snowmobile (Data transfer)
A
Offline
Extremely large amounts of data to AWS. 100 PB per snowmobile.
21
Q
Direct Connect (Data transfer)
A
Hybrid Offline/Online
Dedicated network connection that bypasses the internet from onprem data centers to S3
22
Q
Storage Gateway (Data transfer)
A
Hybrid Online/Offline
Store on prep data on an S3 bucket
23
Q
Bucket policies (Securing data)
A
Permissions for all or a subject of objects using tags and prefixes
24
Q
Presigned Urls (Securing data)
A
Grant limited access to others with temporary urls
25
Block public access (Securing data)
Default configuration for S3 buckets
26
Resource-based Policies (Securing data)
Use if granting cross-account access permissions to other AWS accounts.
Also if user IAM polices reach their size limits or you prefer to keep access policies in S3
Will require a principal
27
User policy (Securing data)
Use if you prefer to keep access control policies in IAM
Or if you have numerous S3 buckets with different permission requirements
28
Encrypt data at rest (S3) server side encryption
S3 encrypts objects before saving to disk and decrypts the data when downloaded
Can allow S3 to create/encrypt keys, can provide CMK and store in KMS, or can manage the key yourself
29
Client side encryption (S3)
Encrypt data before storing in S3 and manage master encryption keys yourself
30
Data Lakes in S3
Centralized repository to store structured and unstructured data, and S3 is a good selection for its near limitless storage capacity
Used to decouple compute from storage as well as ML and analytics workloads
Can use Athena, Redshift, Rekognition, and Glue
31
Data cataloguing S3
Query-able interface all assets stored in S3 and provides single source of contents
Can input data into S3, extract metadata with Lambda and store in DynamoDB and query with elastic search
32
AWS Glue
Fully managed ETL pipelines
33
Athena (Querying S3 data)
Analyze data directly in S3 using SQL.
Serverless so only pay for volume of data you run queries on.
Best used for light data discovery
34
Redshift Spectrum
Run queries against S3. Should be used for complex queries with many concurrent users.
35
Intelligent Tiering (S3)
Monitors data access patterns and transfers data into more appropriate storage class to save on costs.
Works best when data has an unknown access pattern
36
Life cycle config (S3)
Set of rules defining actions to apply to a group of objects. Can tell S3 to transition objects to less expensive storage classes. Can automate the move to archival tiers, but will need to manually move them back
37
S3 General purpose tier
Default storage option that provides high performance for frequently accessed data.
High throughput and low latency. SSL encryption at rest, and no minimums or storage duration
Price is the highest, but the more you store the cheaper per GB the fees become
38
S3 Standard-Infrequent Access
Less frequent access, but rapid access when you need it. Idea for long-term storage, backups, datastore, DR files, etc.
Less expensive than general purpose for storage, but more expensive for access
39
S3 One-Zone IA
Less available, less resilient, only available in one AZ
Less frequently accessed data and less resilient
Good for backups of onprem data where it can be recovered if necessary.
Cheaper
40
Glacier Instant vs Flexible retrieval
Instant (rarely accessed but need it instantly, ex. medical images)
Flexible 1-5min, 3-5 hrs, 12 hours for bulk, rarely accessed and only need 1-2 times per year. Good for Offset storage needs.
Data minimum duration of 90 days
41
Glacier Deep Archive
Lowest storage cost option.
Minimum of 180 days
12-48 hr retrieval times
42
Factors of S3 pricing
Storage: Amount/size of objects, intelligent tiering, moving from tier class to the other
Requests/data retrieval: Pay per requests made against objects in bucket
Data transfer: Except to EC2, from the internet, or CF
Storage management features: S3 inventory, analytics, object tagging
43
S3 Server Access Logs
Free
Provides details about requests made to a bucket, requester, bucket name, status, environment
Can help to learn about customer base with certain access patterns, and understanding of bill
Can use Athena to analyze logs
Not guaranteed log delivery
44
S3 Cloudtrail logging
Fee
Captures subset of API calls for S3 events
Determine which requests were made to S3 from which IP address, time and additional details
Can use Athena to analyze logs
Can use CloudWatch to monitor Cloudtrail events and invoke AWS lambdas and SNS notifications
Guaranteed log delivery and more structured
45
S3 Events
New object created, object removed, restore object, reduced redundancy storage, replication
Can publish events to SNS, SQS, Lambda
46
S3 Batch operations
Can perform a single API action on a list of objects:
Put object tagging
Restore requests to Glacier
Copies of objects
Invoke lambdas
Can use with S3 inventory, manage with labels and tags, monitor/troubleshoot the jobs with Cloudtrail
47
Cloudwatch
Monitoring service that collects logs, events and metrics
Can create custom dashboards and set alarms for certain thresholds
Metrics can have multiple dimensions (bucket name, filtered, storage type, etc). Dimensions are used to drill down on certain metrics
48
AWS Config (S3 auditing)
Check that you have recommended settings enabled in S3 account.
Can receive notifications via SNS or remediate issues with Lambdas
Can check if Logging is enabled for buckets, checks for publics access, checks if buckets require SSL
49
AWS IAM Access Analyzer (S3 auditing)
Receive alerts for questionable access to S3 buckets and can remediate issues by removing access
Identify resources in your account/org that is shared with external identities
Alerts you if buckets configured to allow access to internet
Need to create an analyzer in each bucket region
50
AWS Trusted Advisor (S3 auditing)
Ensure account follows best practices for security, performance, fault tolerance, service limits, and cost optimizations
Can asses bucket permissions, bucket logging, bucket versioning
51
Four pillars of S3 cost optimization
App requirements: Understand data access patterns or archival needs.
Data organization: Use prefixes or tags to organize all data to help manage it
Understand, analyze, optimize: Setup monitors to help manage costs proactively and defensively
Continuous right sizing: Know the correct storage classes
52
Predictable workload tooling
Storage class analysis, observes data access patterns over time
53
AWS resources to manage/monitor costs
QS dashboards that can use ML insights
CloudWatch that can provide actionable insights to monitor application performance changes
AWS budgets to track costs and usage
Cost and usage reports
54
S3 Lifecycle policy
Rule that moves objects between storage classes based on create dates
Only supports transitions from one more frequently accessed tier to one less frequently accessed
Works for versioned and unversioned buckets
CT doesn't support lifecycle actions
55
S3 Mutlipart uploads
For object greater than 100 MB, or transfer over a spotty network
Can remove incomplete uploads
56
File, Volume and Tape Gateways (S3)
Connect to cloud to store app data files in S3, cloud backed storage volumes of onprem apps, and physical tape on prep to virtual tapes in AWS
57
S3 Storage Lens
Provides org wide visibility into object storage and activity trends
Can drill down into account, region, storage class, bucket, and prefixes. Can create custom dashboards
58
AWS budgets
Tracks and takes action on AWS costs and usage
Can set custom budget alerts
Set budgets on a recurring bases to continue to be notified
59
S3 Performance metrics
network throughput, CPU, DRAM, DNS lookup time, latency, data transfer speeds with HTTP analysis tools
60
S3 performance tools
Prefixes: Scale for high request rates
Parallelization: Maximize bandwidth by scaling connections horizontally
S3 select: Optimize data retrieval operations by querying subset of objects. Works with JSON, CSV, and Parquet
Timeout/retries: Recover from continuous failures
Use Cloudfront for frequently accessed content
Transfer accelerator: transferring data across vast geographic locations
Cloudwatch: monitor performance
61
Bucket partitioning with prefixes
Naming scheme:
bucket-name/prefix/object
The bucket prefix allows objects to be stored on separate partitions, so can increase the transactions per second
62
Parallelization (S3)
Horizontally scale parallel requests to S3 service endpoints for better performance
Can break up object data into multiple parts
Requires an upload id and part #
Can pause between uploads and don't need to finish uploading the entire object
63
S3 Connection delays and failures
Use AWS SDK for connection timeouts, retries, backoffs (exponential or random increase in request wait times)
64
CloudFront
CDN to ensure low latency and higher transfer speeds
Caches copies of content, for everything not cached it will maintain open connection with origin server
DNS routes client requests to closest CDN
Can restrict access to buckets to only be accessible by CF
Can use HTTPS
Implement georestrictions
WAF to prevent certain traffic based on IPs
65
AWS Organizations
Account management service where you can programatically create accounts and consolidate accounts within the org
Root --> OU --> Account
Policies can impact all child nodes and leaves when assigned
66
Service Control Policies
Will apply to all AWS users, groups, and roles within the account including the root identity
67
CloudFront Use cases
Increase points of presence
```
Static asset caching
Live, on demand video streaming
Security and DDos protection
Dynamic and customized content
API acceleration
Software distribution
Can help with app availability since content can be cached and origin servers can go down
```
68
S3 ACLs (Access Control Lists)
Can be applied to every object and object stored in S3 and grand additional permissions beyond those specified in IAM or bucket policies. Can be used to grant access to another AWS user or predefined groups like the public.
If you have read permissions on the bucket, but not the actual objects, then you can only list contents of the bucket
69
S3 bucket permissions vs object permission
Can be set separately, If you want smoke to be able to view list of files in a bucket and be able To view/download them, you must gran them permission on the bucket itself as well as each object
70
S3 IAM user policy
Great way to apply very limited permissions to an IAM role. Good if you want the user to have a policy that applies to multiple buckets
For example, a role used for DB backups should only be able to create objects and not view/delete them
71
S3 data consistency
Creation and updates to individual objects in S3 are atomic, you'll never upload a new object or change an existing object and see only half of the change
New objects are seen instantly (read-after-write consistency)
Updates to objects only guarantee eventual consistency. Thus it's best to treat objects as immutable.
72
S3 gotchas
S3 sits outside the VPC and can be access from anywhere if bucket polices are not set to deny it.
Incomplete multipart upload costs accrue storage costs event if it fails to fully upload. Create lifecycle policies to clean up these incomplete uploads
73
EBS
High performance block storage designed for use with EC2
Can handle relational/nonrelational DBs, containerized apps, fs, media workflows, and big data analytic workloads
All volumes are replicated within an AZ and can easily scale to PB of data
Can use snapshots with automated lifecycle policies to back up to S3
74
What is block storage
Raw storage where hardware is presented as disk or volume, and can be attached to compute system for use
Storage is formatted in predefined continuous segments called blocks and are the basic fixed storage unites to store data
Can be on HDD, SSDs, or NVMe
Application shares data management with OS
75
What is file storage
Built on top of block storage, that serves as a file share or file server
Created using an OS that formats and manages the reading and writing of data to the block storage. Data is stored in a directory tree hierarchy
SMB and NFS are the most common storage protocols
OS manages the storage protocol and the operation of the file system and differentiates based on types of data
76
What is object storage
Built on top of block and created using an OS that formats and manages the reading and writing of data to the block storage device,
Object storage does not differentiate between types of data, and type becomes part of object metadata.
One object storage system could use binary objects of size 128MB, so smaller files or data are stored at a binary level within the object, and data larger than that are stored by spreading the data across multiple objects
77
How does file storage work in the cloud
Instead of storing files locally and managing access on. a NFs server, you store files in cloud resources by a managed file service like EFS
Customer manages access control for who has access to FS via network controls (SGs/NACLs), access points, and IAM policies
Comm between clients are storage is handled by special NFS protocol
The cloud service provides a common DNS namespace for clients to connect to the shared file system and those with appropriate permissions access the FS by connecting to their attached mount points and file systems appear as local volumes to the client.
78
What are the file storage services
EFS, FSx for Lustre, FSx for Windows FS, Fsx on NETApp ONTAP, FSx for OpenZFS
79
EFS
Scalable, elastic, fully managed and supports NFS. Capacity is dynamic without any intervention
Can be shared with up to 10k+ concurrent clients.
Only pay for the storage that you use
80
FSx for Lustre
Parallel FS for high performing workloads. Need to select the specific performance and capacity parameters suited for you app needs
81
File storage performance
Latency: Amount of time between making requests to storage system and receiving a response.
EFS standard offers 1 to 2.4 ms
IOPS: General purpose FS offers 35k read and 7k write. Max I/O offers over 500k
Throughput: Measuring the performance of reading and writing large sequential data files measured in MBs/second. EFS offers rates up to 10GB/sec
Has higher latency but better durability and availability than EBS
82
How many AZs are all files and directories redundantly stores with EFS
3. A write isn't acknowledged until data is written to all 3.
83
EFS security
POSIX permissions: user and group level permissions to control client access permissions to your fs
SGs: Restrict access over network with VPC SFs. Determines which IPs have network visibility to EFS endpoint.
IAM: Control both the creation and administration of the EFS FS
KMS: Encrypt data at rest and turn on TLS when you mount the fs
84
EFS Cost optimization
Standard and Standard IA and OneZone IA
Lifecycle management will move files based on access frequency
Much more expensive than EBS
85
Can an EFS be mounted on prep?
Yes, using Direct connect
86
Lambda and EFS
Can set an EFS fs as the local mount path directly within the Lambda service console.
87
EFS use cases
Big data and analytics: Shared files access to data scientists using genomics software running on EKS cluster
Web serving content management: Serve files to web apps quickly and scalable way to meet demand
App testing and development: Shared storage repository to share code and other files in a secure and organized way
DB backups: NFS files system is the preferred backup repository for many common database backup apps, like Oracle, SAP
Container storage: Providing persistent shared access across common file repository
88
Placement groups
The amount of data center capacity to provide all the computational resources to an AZ. Can be multiple data centers
For high performance needs, with extremely low latencies, AWS offers the availability to provision compute not just within same availability zone, but same placement grouping, so basically the same data center (hardware).
89
FSx for Windows File Server
Simplifies the setup, provisioning and maintenance of Windows workloads
SSD and HDD storage. Provides up to 64TB per file system. Throughput up to 3GB
Provides backups and replication across multiple AZs
Migration of files from Windows servers to AWS, accelerating the adoption of migration through the use of a hybrid files system with low latency
Identity-based auth through Microsoft Active Directory
90
Factors that affect pricing for FSx for WFS
Deployment type (Multi or single AZ)
Storage type (HDD or SSD)
Storage capacity (Priced per GB-month)
Throughput capacity (priced per MBps-month)
91
What are the components of the FSx for WFS
Windows file server (with DNS address) and storage volumes
92
What is an elastic network interface
A resource that allows client compute instances, where in AWS or on prep, to connect to FS
93
What is AWS Direct Connect and Client VPN
Direct Connect: Service that enables you to access FS over a dedicated network connection from on-prem environment
Client VPN: Access FS from on-prem using secure and private tunnel
94
AWS Managed AD with FSx for WFS
Setup and run Active Directories in the cloud
Deploy each directory across multiple AZ and AWS handles the integration of the two services
Can also keep self-managed AD on prem and integrated with FSx in the cloud
95
Network interface level access control with FSx and WFS
Can control which resources in VPC can access FSx with SGs with inbound and outbound rules.
Will need to allow outbound traffic to connect to AD
96
AWS RDS
Web services that sets up, operates and scales relational dbs
Handles updates and backups
Supported drivers include Postgres, mysql, mariadb, oracle, and sql server
97
AWS Aurora
Managed db service only compatible with mysql and Postgres drivers
98
AWS DynamoDb
Managed key-value, non-relational db service that provides fast and predictable performance
You can create db tables that store and retrieve data and serve any level of request traffic
Can scale up or scale down your tables' throughput capacity without downtime or degradation
Uses a partition key to allocate data to different nodes. Can have an optional sort key to store related attributes in a sorted order to be queried as a collection
Also has a PK and can use global and local indexes to speed up performance
99
AWS DocumentDB
MongoDB workloads at scale with separate storage and compute that can be scaled independently
```
Table -> Collection
Row -> Document
Column -> Field
PK -> Object ID
Nested table -> Embedded document
```
100
AWS Elasticache
Improves performance by retrieving data from high throughput and low latency in-memory data stores
Provides access to data across replicated nodes
Popular choice for gaming, FS, healthcare and IOT
Memcached and Redis cache engines differ based on backup and replication, automatic failover
Redis supports complex data types, data replication and data availability.
101
AWS Neptune
Fast, reliable managed graph db for apps with highly connected datasets.
Good for applications that work with highly connected data sets used to discover potential fraudulent behavior before it happens.
Used for recommendation engines, fraud detection, drug discovery, and network security
102
AWS Redshift
Enterprise-level, petabyte scale, fully managed warehousing service. Can achieve efficient storage and optimum query performance through a combination of massively parallel process, columnar data storage, and efficient data compression encoding schemes
Offers 10x faster performance than other solutions.
Serve different purposes than RDBMS. Warehouses are meant to store aggregate values (analytical data)
103
Structured Data
Organized to support transactional and analytical operations.
Most commonly stored in relational databases but can also be in non-relational.
Can run powerful data queries and analysis
104
Semistructured Data
More flexible than structured and without the requirement to change the schema for every single record in the table.
Allows user to capture any data in any structure as data evolves and changes over time.
Examples include XML, email, and JSON
105
Unstructured data
Not organized in any distinguishable or predefined manner
Full of irrelevant info which means data needs to first be processed to perform any kind of meaningful analysis
Examples include text messages, word processing docs, videos, photos, and other images. Files are not organized
106
Relational DBs
Built to store structured data in tables using defined schema
107
Key-Value DBs
non-relational that store unstructured data in the form of key-value pairs
+ Store data in a single table as blob objects without predefined schema
+ Flexible and handles a wide variety of data types
+ No need for complex joins
- Difficult to perform analytical queries due to lack of ions
- Access patterns need to be known in advance for optimum performance
108
Non-relational Document Dbs
Type of non-relational db that store semistructured and unstructured data in the form of files
+ Flexible
+ No need to play for a specific type of data
+ Easy to scale
- Sacrifice ACID compliance
- Databases cannot query across files natively
109
In-Memory
Both structured and unstructured data sources and for apps that require real-time access to data.
+ Support demanding apps requiring ms response times
+ Great for caching
+ Ultrafast and inexpensive access to copies of data
- Not great for rapidly changing data
110
Graph Dbs
Store any type of data, structured, semi, unstructured
+ Allow simple, fast retrieval of complex hierarchical structures
+ Great for RT big data mining, such as fraud detection
+ Great for making relevant recommendations and allowing for rapid querying of this relationships
- Cannot adequately store transactional data
- Not efficient for analytics
111
OLTP Databases
Focus on recording update, insertion and deletion transactions. Queries are simple and short which require less time and space to process.
112
OLAP
Store historical data that has been input by OLTP. Can extract information from a large database and analyze if for decision-making. A good example is business intelligence Tool
113
Describe real-time data analytics architecture with RDS
Stored procedure in RDS is executed for every new row, triggering a lambda function that passes the event to Kinesis and is stored in S3. Then can use Athena queries in QS to visualize data
114
Aurora vs RDS
Aurora is more durable than RDS and more resilient, it is very fast recovery from failures.
Aurora has better auto scaling capabilities and can provision up to 15 replicas
115
AWS DMS
Migrate data from external database to AWS.
Requires source and target DB connection strings, a deployed EC2 instance to run replication task
Transfer data from S3 into relational db in Aurora
116
Data Design Relational vs Non-relational
Relational: Normalized or dimensional data warehouse
Non: Denormalized document, wide column, or key-value
117
Advantages of Non-relational
Much east to scale horizontally, but has the issue of eventual consistency, which can be an issue for apps that require ACID compliance (Data may not be updated at the same time for all distributed systems)
118
Homogenous vs heterogeneous database migrations
Homogenous: Migrate between same DB engines, and require use of native database tools
Heterogenous: Migrate between different database engines. Requires the use of AWS Schema conversion Tool to translate db schema to new platform.
119
What instance classes does Aurora support
Burstable performance (short-lived bursts of high activity)
and
memory-optimized (suitable for most DBs)
120
What are the database engines RDS can run
Oracle, postgres, aurora, mysql, mariadb, oracle, and sql server
121
Which instance types are available for RDS
On-demand and reserved
122
What security features does Aurora provide
Require both authentication and permissions to access tables
IAM polices and be used to assign permissions
Security groups are used to control access to the DB instance
123
What are the pricing models for Aurora
Serverless, on-demand, reserved
124
What security options are available for DynamoDb
IAM, fully managed encryption at rest
125
What are the components of DynamoDB
Attribute, items, table
126
What are valid capacity modes for DynamoDB
Provisioned and On-demand
127
Server vs serverless DB architectures benefits/tradeoffs
Server-based: Traditional architecture, server hosts, delivers, and manages the resources the application users need. Need to pay for maintenance and you're responsible for maintaining them. Requires you to pay for additional server as scale grows
+ Better for predictable workloads, in-depth analysis, or long running computations
+ Full visibility since you own all the infra
+ Good for legacy apps that can't be decoupled
Serverless: Apps are hosted by 3rd party service so no need to manage server. Provide automatic scaling and higher availability
+ Good for rapid scaling and applications with short running tasks that have a single purpose
+ Liability is reduced
+ Smaller deployable units result in faster delivery
128
AWS RDS benefits
Automates config, management, and maintenance
Configures read replicas or setup synchronous replication
Automatic backups and encryption at rest and in transit
Can easily scale compute resources
129
Databases with EC2 benefits
Full control over database deployment
Supervise number of instances per database
Encrypt EBS volumes to protect your data at rest and in transit as data travels between the volume and the instance
130
Does RDS automatically scale workloads
No
131
Serverless Databases Benefits (DynamoDB and Aurora serverless)
High available, fault tolerant, and scales as damn grows
DynamoDB supports ACID
No hardware provisioning, patching, or upgrading
Encrypts data by default
Aurora serverless provides relational dbs, with on demand and automatically scaling. Shuts down when not in use
132
What are some use cases for aurora serverless
Variable workloads (Peaks throughout the day)
Unpredictable workloads (Peaks of unpredictable traffic)
New apps with unknown instance size
Multitenant apps where each customer has their own db
133
What are ideal applications for Redis
Session caching, full page caching, message queue applications, leaderboards
134
What are applications for memcached
Small and static data, static HTML page or JS pages
135
What are the node types for elasticache
On-demand (pay by the hour) and
reserved (1 or 3 year term) but high savings
136
What is the high level architecture of Redshift
Clients work with database via SQL endpoint at the leader node (leader and compute nodes are grouped into a cluster). This node spins up jobs and distributes to compute nodes that contain the actual data. Leader node aggregates data from compute nodes
Compute nodes have their own CPU, memory and disk storage. Jobs are partitioned into slices and allocated compute node resources
137
What are the pricing options for Redshift
On-demand: Pay an hourly rate based on type and number of nodes
Concurrency scaling: Per second on demand rate that exceeds free daily credits
Reserved Instance: Lots of savings by committing to 1 or 3 yr term
Spectrum pricing: Applied when you use this feature. Bytes scanned on S3
138
How many copies of your data and across how many availability zones does Aurora provide
6 copies across 3 zones
139
What are the 3 parts to Aurora billing
Instance hosting the database:
- On-demand, reserved, serverless (based on capacity)
Storage:
- per GB per month
- I/O
Data transferred out to the internet and other AWS regions. Never between services in the same region.
140
What is Amazon Aurora Global Database
Only a feature for MySQL but allows for single db to span multiple regions for shorter latencies throughout each region
141
Types of EC2 billing
On demand: Pay for compute capacity by the second with no long-term commitments
Spot Instances: Unused EC2 capacity. Can save a lot, but not always available
Reserved: Discounted but need to pay for 1 or 3yr contract
142
EC2 Families
General Purpose: M4, M5, T2/T3 Burstable
Compute Optimized: C4, C5, C5d
Memory Optimized: R4, R5
143
EC2 Placement Groups
Clusters: Logical grouping of instances within single AZ. Good for low network latency, high network throughput
Spread: Placed on distinct racks within data center. Good for small number of critical instances that should be kept separate from each other
Partition: Reduce the likelihood of correlated hardware failures of your application. Can be used to deploy large distributed and replicated workloads like HDFS and Cassandra across distinct racks +
144
What are the five types of EBS Volumes
General purpose SSD gp2
Provisioned IOPS SSD io1
Throughput HDD st1
Cold HDD sc1
EBS Magnetic standard
145
What is the volume size range of a gp (General purpose) EBS volume and the IOPS it can accommodate
1GB to 16TB
| 16k IOPS
146
What is the IOPS range for the provisioned SSD EBS Volumes
64k -256k IOPS
| This would be for big database workloads
147
What is the volume size and max throughput volume of a Throughput optimized HDD EBS volume
125GB to 16TB
Throughput is 500 MiB/s
Used for data lakes and data warehouses
148
What are cold HDD EBS volumes for
Lowest cost block store for infrequently accessed data workloads. Some use cases include file servers and throughput oriented storage for data that is infrequently accessed
149
Volume size of EBS magnetic
1GB to 1TB. Workloads for infrequently used data
150
What are some characteristics of Redis
Advanced data structures
Multi AZ capable
Replication
Backup and restore
151
What are some characteristics of memcached
Simple data structures
No replication
No backups
Multiple nodes
Multi-threaded
No backups
152
What is the throughput performance for Aurora in regards to MySQL and Postgres
5x for MySQL; 3x for Postgres; Can scale out to 15 replicas
153
What is DynamoDB Accelerator DAX
High available cache for DynamoDB. Microsecond latency. Millions of requests per second. API compatible
154
What is the range of the C4 class of EC2 instances
This is compute optimized instances
Anywhere from 3 to 36 vCPUS
155
What is the maximum number of vCPUs available for EC2 in the C family
64
156
What is the main difference going from C4 to C7 EC2 instances
Basically better/new get processors that may be more cost-effective/higher performing
157
Can RDS instances encrypt backups
Yes, if you enable encryption at the time of launching an RDS instance
158
Can RDS instances encrypt logs
Yes, in you enable encryption at the time of launching an RDS instance
159
Does RDS automatically encrypt data, logs, and backups
Yes once you enable encryption it is done automatically
160
When deploying a DB cluster with limited use (ie debugging prod issues) what is the most cost-effective option
Aurora Serverless. Not a long running instance.
161
Do DynamoDB instances exist outside the VPC boundary? What about Aurora
DynamoDb is a regional service and can exist outside the VPC, whereas Aurora must reside within it.
162
What major performance benefit do you get from using Dynamo vs Aurora
Dynamo sales much better, and is faster at both reading and writing.
163
What are general purpose EC2 instances
Provide a balance of compute, memory, and network resources
Range from M classes: Can provide large amounts of memory, network bandwidth, and many vCPUs.
T classes: Burstable performance instances
164
What is burstable EC2 performance
Sudden, temporary spikes in usage.
Instances accumulate CPU credit when workload is operating below baseline threshold. They can trust at any time for as long as needed.
165
What are good applications of memory optimized EC2 instances
Enterprise-class databases and in-memory applications
X and R series, which have varying high performing CPUs
166
What is the maximum memory capacity of memory optimized EC2
24TB
167
What are storage optimized EC2 instances used for
Workloads requiring high sequential read/write access to very large data sets on local storage. High IOPS, low latency
168
What is the NIST CSF
Framework consisting of standards, guidelines, and best practices to manage cybersecurity risks
Country agnostic
169
What are some security features of CloudFront
Permit approved country IP addresses. Prevent banned countries
170
What are some of the security threats blocked by WAF
Deny traffic based on IP
Sql injection prevention
Cross-site scripting prevention
User-agent block
Bad bot block
Content scraper block
171
Where can AWS WAF be deployed
Cloudfront, ALBs, EC2 instances, API Gateways
Only pay based on how many rules you deploy and how many web requests your application receives
172
What are the purposes of subnets from a security standpoint
Isolate tiers of your application within a single VPC. Network segmentation limits the spread and damage of potential attacks.
It also reduces the scope when auditing for specific requirements
173
What is an alternative to opening SSH or RDP within instances of the production environment
Deploy a bastion server or use SSM
174
What are route tables
Specify a destination IP and a target which is the connection by which to send the destination traffic
175
What is Amazon GuardDuty
Uses VPC flow logs, DNS logs, and AWS CT events to use threat intelligence/ML for anomaly detection. Categorizes risk levels and notifies operations team
176
What is DNSSEC
A way to protect DNS traffic and is a way to protect your domain registered with Router53.
DNS spoofing can direct users to malicious websites.
177
What are stateless network filtering methods
NACLS
Generally uses info from headers (IP source or destination) for filtering
Fast and no issue with heavy traffic
Explicit Deny implicit allow
178
What are stateful network filtering methods
SGs and Firewalls
Can identify TCP connection stages, packet statue, and other key statuses
179
What level of network segregation are NACLs applied to
Subnets
180
What is the default behavior of a newly added custom NACL
Denies all inbound and outbound traffic unless you add rules
181
What is the behavior of the default NACL
Allows all inbound and outbound traffic
If no NACL are specifically added to subnet, default is provided
182
How many NACLs can a subnet have
1
183
How are NACLs evaluated
In order based on their rule number 10, 20, 30, etc.
Will ignore any higher level rule that contradicts lower level rule
184
What is the behavior of a default security group
Permits all inbound and outbound traffic
185
What is the behavior of a custom security group
Permits no inbound traffic, but allows all outbound traffic
186
What are some best practices around SGs
Ensure they don't have a large range of ports open
Limit modifications to only certain IAM roles
Use ELBs with SGs to restrict access to internet
Don't ignore outbound rules
187
What does AWS Shield provide
Protection from DDoS attacks
Can also pay for additional protection and features, including layer 7 DDoS and AWS Firewall Manager
188
What does AWS Firewall manager provide
Centrally configure and manage firewall rules across accounts and app.
Can make sure new applications and resources follow common set of security rules.
189
Can SGs be applied to a VPC
Yes
190
Are SGs cumulative
Yes, and they combine of form a single, combined policy
191
Can you specify deny rules for SGs
No, you can only specify allow
192
What all can you do with Session Manager
Limit connection to instances
Manage instances at scale using Run command
Patch and update with defined maintenance windows
Secure, monitor, and rotate secrets
193
Benefits of secrets manager
Provide full key rotation integration with RDS
Randomly generates passwords in CloudFormation and stores the password in Secrets Manager
Share secrets across different AWS accounts
194
What are some of the functionalities of AWS Systems Manager
Session manager, run command, state manager, patch manager, and parameter store
195
What does Amazon Inspector do
Continuously scans resources to help prioritize patch remediation, meet compliance requirements, identify vulnerabilities sooner.
Can indicate overly permissive paths over TCP or UDP at VPC edges
196
What are AWS Config benefits
Discover resources
Record current state of resources and track historical changes
Evaluate config changes against compliance polices
Automate remediation
197
What are VPC flow logs
Capture packet metadata like source/destination IP address, ports, protocol, packet size, etc.
Cannot monitor payloads
Not real-time
Should be enabled for packet rejects
198
What is considered best practice for S3 log storage
Use dedicated bucket for CT logs
Implement least-privilege access to buckets where you store log files
Enable MFA to delete log storage bucket
199
What are some of the important CloudWatch alarms to setup
Console sign-in requests without MFA
IAM policy changes
Unauthorized API calls w/in AWS account
KMS key configuration changes
ACLs, SGs, Route table changes
200
When to consider hybrid cloud
Existing app that must run on prem but want to use cloud resources and scalability
Fast, local access to data
Many physical locations to manage with data and want reliable connectivity and simplified maintenance
201
What is storage gateway (hybrid cloud)
Facilitates private cloud storage
Can bring data into AWS for processing in the cloud. Can also backup, archive and tier your storage
Deploys in-cloud and on-prem
Will integrate with S3, KMS, EBS etc.
202
How does storage gateway provide low-latency access to data
Gateway first writes application data to on-prem disk used for cache storage. Then it uploads the data to AWS
Cache acts as durable store for data
203
What are the storage gateway types
S3 FIle gateway, FSx FG, Tape gateway and volume gateway
204
How much data can a virtual tape store
100GB to 5Tb
205
How are you charged with Storage Gateway
Amount of data transferred out of the gateway
The type and amount of storage (ex S3)
Requests made to the gateway
206
What are the two methods a storage gateway appliance can be deployed
On prem via VM appliance
On AWS via EC2
207
How much data can the tape storage gateway appliance cache store
150Gb
208
How does storage gateway appliance connect to service
Public endpoint over internet
VPC endpoint via AWS VPN or direct connect
FIPS
209
When is application data encrypted with storage gateway
Initially data is stored on-disk in a cache storage where it is later encrypted and compressed as it moves to upload buffer where it will then traverse the wire to the S3 tape library
210
Can virtual tapes stored in an S3 buckets be accessed directly?
No, must go through Storage Gateway for I/O ops. Storage gateway uses an S3 service bucket rather than customer bucket, so content is not accessible
211
What are some methods to reduce cost of Tape Gateway storage
Archive tapes into Glacier Flexible Retrieval or Deep Archive
212
What is the relevant information when creating a new tape
Number of tapes, capacity, and barcode prefix
213
How can AWS storage gateway access S3 bucket
Assume role with an associated IAM policy that grants access
214
How does EBS server side encryption work
EBS volume requests CMK (KMS stores master key)
EC2 mounts EBS volume and volume passes encrypted volume key to instance. The instance decrypts the data key with KMS (with master key). Instance now has access to decrypted data key and can encrypt data to EBS
215
What are some of the uses cases for S3 File Gateway
Backing up data to the cloud
Archiving long-term, retention based data
Building data lakes
216
What is the S3 File Gateway file share
Each file that is uploaded to S3 on-prem appliance is paired with a single S3 bucket and uses the appliance's local cache
217
Do S3 File Gateway files act as native S3 objects?
Yes, unlike tape storage gateway, you can access data directly in S3
218
What are some common capabilities across Storage Gateway types
Local caching and optimized data transfers to storage in AWS
219
What are the three elements of billing for Storage Gateway
Storage, requests, and data transfer
220
What is the primary difference between the on-prem S3 file gateway and Tape gateway
S3 does not utilize an upload buffer. Both will allocate a certain amount of space for a cache to prevent frequent lookups in S3/AWS
221
Does renaming a file in S3 create a new object
Yes. Objects are immutable in S3
222
Does each file share in S3 File Gateway need to be connected to an S3 bucket
Yes, they would be connected to separate buckets. However, you can adjust the prefix from each share if it needs to write to the same bucket
223
Should you configure your S3 buckets so only one file share can write to it
Yes
224
What is a way to limit file permissions if you configure guess access to S3 FIle Gateway without being able to use IAM
POSIX permissions
225
What are the two different modes Volume Gateway can be deployed
Cached: low latency to most recent data
Stored: Entire dataset is on prem with scheduled backups to S3
Only available with on-prem host platform. Asynchronous point-in-time snapshots to S3.
Data is stored durably in S3 service buckets as EBS snapshots. Backups capture only changed blocks.
Both use the iSCSI protocol
226
What is AWS Backup
Centralized backup services that backs up your application data across AWS services
227
What are some use cases for cached volume storage in Volume Gateway
Custom file shares and migrating app data into S3 to transition to using EC2
You want all your data stored locally and require AWS for backup snapshots
228
What are some use cases for stored volume storage in Volume Gateway
Block storage backups, cloud-based DR
229
Explain the process for cached volume reads for Volume Gateway
Read requests are served locally form the cache and there is no latency.
If there's a cache miss, it must retrieve data from the backend data store then returned to the calling application
230
Can you expand the size of a volume used for Volume Gateways
No, you'll need a snapshot of the prior volume and use it to create a new one of a larger size. You can also used a cached volume
231
What are some ways to cutdown on costs when using Volume gateway
Remove old snapshots
232
What is a volume recovery point
A point in time when volume is consistent from which you can create a snapshot or clone a volume
233
Once a cache volume is added, what action can you perform in AWS Storage Gateway
Add/edit the snapshot schedule.
Configure CHAP authentication
234
How do you access EC2 instance metadata with IPv4 and IPv6
IPv4: http://instance-ip/latest/meta-data
IPv6: http://[fd00:ec2::hostid-in-ip-address]/latest/meta-data
*USES HTTP
235
Do SGs only have inbound rules
Yes
236
Do NACLs have inbound and outbound rules
Yes
237
For more control, it is best practice to use AWS managed CMKs
No, it is better to use customer generated
238
What all is encrypted when EBS encryption is selected
Data at rest inside the volume
All data moving between the volume and instance
All snapshots created from the volume
All volumes created from these snapshots
239
What is AWS EventBridge
Serverless event bus service that you can connect applications with data to
Will receive events and applies rules to route the event to a target
240
What does WAF give you control over
How traffic reaches your application and can control bot traffic and block common attack patterns such as SQL injection and CSS
This protects against layer 7 attacks (HTTP)
Can only deploy on ALBs, API Gateway, CloudFront
241
What service best protects against DDos
Amazon shield -- free for every AWS customer
Can use Shield advanced as a paid service to protect against more sophisticated attacks
242
What is Macie for
Will detect PII stored within S3 across multiple accounts
243
What service can monitor suspicious activity across CloudTrail, VPC Flow logs, and AWS DNS Logs
GuardDuty
Can set up CloudWatch events rules and be notified of any findings
244
What workload is Amazon Inspector for
Predominantly scanning EC2 for software vulnerabilities , but also for containers pushed to ECR
This needs to be applied after a starting up an EC2 instance
245
What is KMS
Secure and resilient service that uses hardware security modules that have been validated under FIPS 140-2 to protect keys
246
What are symmetric CMKs (AES-256)
Single encryption key that is used to encrypt and decrypt data
247
What are asymmetric keys (RSA)
Public key to encrypt private key to decrypt. Basics of SSL. Also used to sign/verify operations
248
What are the three types of CMKS
AWS managed, user keys created in KMS, user keys created outside of KMS
249
Can you access the CMK used to encrypt data in KMS
NO
250
Can KMS keys be used across regions
No. If you wanted to copy an EBS encrypted volume to a new region then you'd have to create a new encrypted snapshot and create new volume in new region with new encrypted key
251
How frequent are keys rotated when enabling KMS automatic key rotation for customer-managed CMKs
1 year. Previous backing key will be kept active to encrypt old data. CMK ID will remain the same, but backing key will change
252
What is the rotation period for manual key rotations
You can select a custom date, like 90 days or 180. However, manual key rotation will generate a new CMK ID, so you should make use of key aliases to know which version of the key you want to use
253
What is the purpose of SSM parameter store
Storing secrets like db-urls and passwords and configuration management. Integrates with KMS for encrypted parameters or can store as plain text
Can enforce parameter polices like a custom TTL where a forced update will happen for sensitive data
254
What's the difference between Secrets Manger and Parameter Store
Secrets manager can enforce rotation every X days and can automatically generate secrets on rotation
It is mostly made for RDS
255
What does the file storage gateway do
Expand NFS file storage system
256
When a question talks about on-prem data to the cloud which service should you think about
Storage gateway
257
Which storage gateway should you consider if you need to expand network file system NFS to the cloud
File storage gateway. Users can authenticate with Active Directory
258
What is Route53
Global, highly-available DNS service where a user's ISP will route url requests to Route53, which will provide the IP
You can register domain with Route53 and even purchase the domain name. Can do public or private
Uses multiple routing algorithms
259
Identify all the dns components in aws.amazon.com.
"." is the root
".com" is the top level domain
".amazon" is the second level domain
"aws." is the subdomain
260
Identify the tree components of the DNS hierarchy
Root is the label (domain name of node)
Zone (holds resources records for node's domain (com.)
Resource records: Composed of separate resource records (amazon.com.)
Authoritative name server: At least one ANS (aws.amazon.com.)
261
What is a DNS recursive name server (Resolver)
Extract info from name servers in response to client requests
Traverse DNS hierarchy to provide full resolution
Cache results based on record's TTL
262
What are some of the features of VPC
Builds upon high availability of Regions and AZs
Subnets divide VPC
Route tables to control traffic going out of subnets
Internet Gateway allows access from internet to VPC because otherwise not internet traffic should be allowed
NAT gateway allows private subnet resources access to the internet
NACLs control access to subnets; stateless
263
What is CIDR
Classless inter-domain routing, which is a method for allocating IP addresses defining a range of addresses
Example:
192.168.0.0/26 = 192.168.0.0 - 192.168.0.63
Composed of a base IP and subnet mask (which is how many bits can change in the IP)
192.168.0.0, /0 or /24 or /32
264
What is the subnet mask
Basically allows part of the underlying IP to get additional next values from the base IP
/32 allows for 1 IP 2^0
/31 allows for 2 IP 2^1
/30 allows for 4 IP 2^2
/24 allows for 256 IP 2^8 Allows for 1 of the octets in the IP address to change so 256 * 256 amount of options
265
What are the allowable IP values for private IPs
10. 0.0.0/8 in big networks
172. 16.0.0/12 AWS default VPC in that range
192. 168.0.0/16 for home networks
266
What is the maximum amount of allowable IPv4 IPs for a VPC
around 65,000 per CIDR. CIDR blocks will contain a subnet mask of 16
Can add multiple CIDRs within a VPC though. Can have up to 5
267
Do all resources within a VPC exist within a subnet?
Yes, and each subnet has its own CIDR block
268
What is the purpose of a public route table
Provides a network route for packets to leave VPC to IGW and to the internet. Will require an additional entry within the route table to specify that
Then need to associate public route tables with public subnets
269
What's the purpose of a bastion
To allow an admin to have access to a public facing instance to log into other resources within private subnets that they have permissions to
It will have its own SGs and NACLs
Make sure it only has port 22 traffic from the IP address you need
270
What is the purpose of a NAT server/gateway
Allow outbound traffic from resources within a private subnet.
Will allow outbound traffic (0.0.0.0/0) to be added to private route table with the NAT gateway as the target
NAT gateways will have access to public route tables
271
Why are SGs considered stateful
Traffic that exists an instance is still able to return to that instance as inbound traffic even if no rule exists.
It's able to remember a request.
272
Why are NACL considered stateless
Contains an outbound and inbound rule, and both must be considered for a round trip process
Doesn't mattered if traffic was allowed in, it will be checked again
273
Why shouldn't you just use NACLs since they're more strict as stateless firewalls
There are no subnet boundaries between instances, so still need SGs
274
What is AWS Direct Connect
Uses dedicated private connections between on-prem infrastructure and cloud account with consistent network performance and lower bandwidth costs
This is accomplished with private VLANS
275
What are the two available bandwidth options for Direct connect
10Gbps and 1 Gbps
276
What are some use cases of Direct Connect
Big data, latency, DR, and hybrid cloud
277
What is Global Accelerator
Fully managed global network traffic manager
Route53 can send a more permanent and resilient IP address for ALBs in the case that the client caches the IP but it changes for some reason
Can provide great network/application reliability
278
How many IP addresses are reversed in each subnet
5. So keep this in mind when choosing the correct subnet size
279
How do you make NAT gateways more resilient
Will need to create multiple NAT gateways in multiple AZs
280
What are some characteristics of the default NACL
Accepts everything inbound/outbound with the subnets its associated with
281
Why are ephemeral ports important when designing NACLs
Client that make requests to servers will open up an ephemeral port to accept response, so outbound NACL policies need to specify a port range provided by host OS. And the client will need to allow inbound TCP connections on the same port range.
282
What is the difference between how rules are evaluated between SGs and NACLs
SGs will evaluate all rules before deciding to allow traffic
NACLs will evaluate rules from lowest to highest and first match wins
283
What is the VPC analyzer used for
Can test connection between two endpoints within VPC to see if NACLs and SGs are configured as expected
284
Can VPC peering be setup in different AWS accounts/regions
Yes
285
What all needs to be setup to enable VPC peering
Initially need to create a VPC Peering connection
Then will need to modify route tables. One for the subnet route table for the resources that need to be peered and for the VPC route table with the peering connection as the target
286
What are VPC Endpoints
Allows resources within VPC to access AWS resources without traversing the public internet with a private connection
More efficient than relying on NAT and Internet gateways
287
What are the two types of Endpoints with VPC Endpoints
Interface: Provision an ENI (private IP address) as an entry point with SG
Gateway endpoints: Provision gateway that must be used as a target in the route table
Only works for S3 and DynamoDB
288
Does a VPC only exist within one region
Yes
289
Can a subnet exist within multiple AZs
No
290
Do all AWS resources have to be deployed within a VPC
No
291
How do you preserve an EBS volume if an EC2 instance is terminated
Disable the DeleteOnTermination attribute for the EBS volumes
292
Can SGs explicitly block traffic
No, they can only allow certain traffic. So will need the help of NACLs
293
What are some of the characteristics of ALBs
Works at layer 7 so can take action based on things in that protocol such as paths, headers, and hosts
294
What are some of the characteristics of NLBs
Doesn't worry about upper layer protocol so it's much faster
Easier to integrate with security and firewall products
295
What are some of the characteristics of GLBs
Load balances third-party virtual appliances (like firewalls and intrusion detection systems)
296
Can you resize a CIDR block after it's been created
No
297
Can CIDR blocks specified in route tables overlap
Yes, and when they do the more specific one takes precedence
298
Can ELB route traffic between regions
No, just subnets and AZs
299
Should you reserve the largest CIDR block to the private subnet for applications
Yes
300
Are subnets bounds by AZs
Yes. Generally you'll want to replicate each of your subnets in each AZ within the region
301
Are VPCs bound by a region
Yes. It cannot go across regions
302
Do EC2 instances have IPv4 and IPv6 addresses
Yes
303
Can you have multiple CIDR ranges per VPC
Yes
304
What is the maximum amount of SGs that can be attached to an EC2 instance and how many rules can exist per SG
5, 50
305
Why would you need to allow all ports on a NACL for an outbound rule
Clients have ephemeral ports, so unable to determine which ones would be allowed
306
By default do SGs allow inbound traffic
No, they have no inbound rules by default
307
How many Internet gateways does one VPC have and how many NAT gateways
1 IG per VPC, but multiple NATs since they cannot span AZs, so would need one for each AZ
308
What would be a benefit of using placement groups for EC2 instances and what are some drawbacks
Much better network performance, decreasing latency and maximizing bandwidth
However, not most resilient since it'll be in the same AZ and event the same rack
Restricts the availability to deploy EC2 instances since need to find space for multiple instances
309
What is the best thing to do if you've run out of IP addresses in your VPC
Add an additional CIDR block.
310
How can you accomplish Blue/Green deploys with Route53
Use a weighted policy to distribute traffic between two ELBs
311
What's the best way to enforce a blacklist of IP addresses
WAF in front of an ALB
312
Which ELB retains the IP address of the original client
NLB. CLB and ALB will only show the IP address of those LBs to target EC2 instance
313
What are some additional benefits of CloudFront other than low latency
Geographical restrictions - white/black list at country level
Caching custom error pages
314
To prevent a list of IPs from accessing CloudFront distributions what should you do
Create a Web Access Control List (WAF)
315
How do ALBS with multiple target groups configure health check settings
Health check settings are defined on a per target group basis
316
What tools can be used to establish a private connection between VPC and On-prem data center
Customer gateway deployed to on prem data center and site-to-site VPN connection with Virtual private gateway enabled on VPC
Can connect to Customer Gateway over public IP or a private IP using a NAT device (NAT device would have a public IP)
Need to enable route propagation for VPG in the route table associated with subnets
317
What is Direct Connect
It is a dedicated private connection from a remote network to your VPC
You'll need to setup a Virtual Private Gateway on your VPC
Can access private sources (EC2) and need VPG and public (S3) don't need a VPG
318
What are the benefits of direct connect
Increased bandwidth throughput when working with large data sets
More consistent network experience
Supports hybrid environemtns
319
What is needed in order to setup Direct Connect for more than one VPC across regions
Direct Connect Gateway
320
What are the two connection types available for Direct Connect
Dedicated Connections - 1GB - 10GB. Physical port dedicated to a customer
Hosted Connections: 50Mbps, 500Mbps, 10 Gbps and capacity can be added or removed on demand
* Both take over a month to establish
321
What is the setup for a high resiliency Direct connect connection
Can setup multiple Direct Connect locations in the case that one fails. Both will point to the same VPG in a region
322
What is the setup for maximum resiliency in direct connect connections
Deploy multiple direct connect locations each with multiple connections
323
What are some of the ways for VPCs to communicate with one another
Over the public Internet
VPC Peering - although this opens the entire network and you may only want to expose one service
AWS PrivateLink (VPC Endpoint Services)
324
What are the components required for Private Link
Will have to connect service application (within separate VPC) to a NLB and then create an ENI and attach to consuming service. Then can establish a private link
325
What is the AWS offering that attempts to reduce some of the complexity in networking topology
Transitgateway
326
How do you place limitations on transit gateway so not all VPCs can access one another
Route tables: Specify which VPC and talk to another
327
What is one way you can increase your throughput from multiple VPCs and remote network
Use VPN to transit gateway with ECMP which increases the amount of tunnels as opposed to the traditional VPN connection through Virtual private gateway. Can then add more site-to-site VPN connections to get more throughput
328
Can you leverage transit gateway to establish multiple direct connections to onprem
Yes, can allow transit gateway to connect with direct connect gateway and connect to direct connect location to a customer router.
329
What is VPC Traffic Mirroring
Allows you to capture and inspect network traffic in your VPC by routing inbound and outbound traffic to its original destination as well as a NLB with EC2 instances running security appliances
330
Can EC2 instances have private IPv4 and IPv6 IPs
Yes, and both can communicate to the internet through an internet gateway
331
If you're unable to initialize a new EC2 instance in a subnet due to a lack for available IPs what should you do
Create a new CIDR within your subnet
332
What are the steps to add IPv6 addresses to an instance
Add IPv6 CIDR address to subnet and enable auto-assign
Go to instance and assign an IPv6 address
Will need to modify SG to allow for IPv6 traffic
Typically IPv6 CIDR group within subnet will be added to route table and then can communicate with one another over IPv6
333
What are egress-only internet gateways used for
Keeping inbound IPv6 connections to VPC, but allowing outbound IPv6 connections
Will need to update route tables to reflect connecting outbound traffic with a target of the egress-only IG
334
Whats the way in indicate all traffic in IPv4 and IPv6
IPv4: 0.0.0.0/0
IPv6: ::/0
335
Does AWS site-to-site VPN traverse the public internet
Yes. Requires a customer gateway on datacenter and a Virtual private gateway on VPC and site-to-stie VPN over public internet
336
What networking tool should you use to establish a direct private connection to an AWS direct connect location
Direct Connect. Setup a VPG on the VPC and establish a direct private connection to a Direct Connect location
337
Does an EC2 instance need a public IP address in order to be accessible by the internet
Yes
338
Do you need to update both VPC route tables when enabling VPC peering
Yes
339
If you are launching new EC2 instances inside a subnet but they're not getting public hostnames and DNS resolution isn't working, what should you do
Enable DNS resolution and DNS hostnames in VPC
340
What is a networking tool to use when you have an app you want to share with customers hosted in a private VPC but don't want public internet access
VPC Endpoint Services ( AWS PrivateLink)
341
What does AWS Cloudhub allow you to do and does it require a VPC
Allows for secure communication across multiple network sites and does not require a VPC
342
What is the difference between PrivateLink and Direct Connect
Private Link is used for secure communication from services within a VPC to AWS services outside VPC (VPC Endpoint) not on the public internet
Direct Connect is secure communication between VPC and on-prem networks that don't traverse the public internet
343
What does hibernating an EC2 instance do
Shuts down the instance but stores the current RAM contents to a volume and when rebooted loads back that volume
344
What are Elastic IPs
Static IPv4 addresses associated with AWS account
Can associate them with any other instance or ENI and can remap them to another instance in your account in the case of an instance failure
Not used when Load Balancers are being used
345
What protocols do NAT Gateways support
UDP, TCP, ICMP
346
What is the maximum bandwidth of a NAT Gateway
10 Gbps
347
What can a VPC owner do
Create and edit components within VPC
348
What can VPC participants do
Launch resources within their assigned subnets
349
What are the differences between AWS Direct Connect Private and Public VIFS
Private VIFS allows access to VPC IP address
Public VIFS allow access to AWS Public IP address space
350
For large scale connections between corporate data centers and VPC what components should be used
Customer gateways deployed on-prem and AWS DX devices which will connect to a DX Gateway and can then connect to a transit gateway to spread traffic over multiple VPCs
351
What does global accelerator do
Route clients to closest health endpoint
Client ingress traffic is routed through closest available edge location
352
Do you get to choose your IPv6 address for a new instance
No, they're chose for you
353
What are some examples of Route53 routing policies
Geolocation routing policy, geoproximity routing policy, latency routing policy, weighted routing, IP-based policy
354
What is geolocation routing
Route users based on their location to closest resources
355
What is geoproximity routing
Route traffic based on the location of your resources
356
What is latency routing
When you have resources in multiple regions and you want to route based on which provides the best latency
357
What is weighted routing
Route traffic to multiple resources in proportions that you specify
358
What are ALB listeners
A process that checks for connection requests using the protocol and port you configure; Rules that you define for a listener is how the load balancer routes the requests
359
What is an ALB target
Destination for traffic based on the established listener rules
360
What is an ALB target group
Each target groups routes requests to one ore more registered targets. A target can be registered with multiple groups
361
What is path and host based ALB routing
Path: Rules that forward requests to different target groups based on URL
Host: Forward requests to different target groups based on host name
362
What AWS services are available for autoscaling
EC2, ECS, DynamoDB, Aurora
363
What are the 3 built-in ASG scaling strategies
Optimize for availability, availability and cost, optimize for cost
364
What are target tracking scaling policies
Set a metrics like CPU utilization and target value
365
What are CloudFormation templates
Text based descriptions of CloudFormation stacks that you can use to define all your resources and is stored as a text file in JSON or YAML
366
What are CloudFormation stacks
Collection of resources that you can manage as a single unit
367
What are CloudFormation macros
They can enforce specific standards your organization sets for your resources
Can also help to ensure consistency
They help custom resources manage the lifecycle of resources outside of what is defined in the Cloudformation template
368
Can you use CloudFront for TLS handshake termination
Yes
369
Can Cloudfront forward requests along the AWS backend networks
Yes
370
What is AWS Simple Workflow Service
Orchestrator for distributed applications, sequential processing of tasks. Consists of workflow with multiple tasks and deciders and maintains a history of all the activities.
Have multiple, separate workflows within a domain
Essentially an Airflow competitor as a fully managed state tracker
371
What are some use cases for SWS
Video encoding: Video upload triggers a workflow execution
E-Commerce App:
372
What is SNS
Fully managed pub/sub messaging and mobile communications service
373
Does SQS have a maximum amount of time a message can exist
Yes, 14 days
374
What is the purpose of long consumer polling in SQS
Reduce the number of API requests to SQS
375
What is the managed AWS service option to implement the Request Response messaging pattern
SQS Temporary Queue client
376
How can SNS and SQS be used together
Can use both to create the fan out pattern where some app/service will submit a message to SNS and there will be multiple SQS queues subscribing to that topic and will fan out to other downstream services subscribed to the SQS topic
377
What's a way to disperse one message to an SNS topic to multiple SQS queues
Message filtering
378
What are the different streams that Kinesis provides
Data Streams
Video Streams
Analytics Streams
Firehose
379
What is the retention maximum for kinesis data streams
1 year
380
What are the destinations Kinesis Batch / can write to
S3, Redshift, and ElasticSearch
Can also write to a number of 3rd party services
381
Is there ordering in Kinesis
Yes, at the shard level
382
What are the best use cases for Kinesis
ETL, Data and Analytics/Big data
383
What messaging platform should you use if you're migrating an application that uses message queues with a common messaging protocol and don't want to rearchitect
AWS MQ
384
What are the 3 invocation models of lambda
Synchronous: Invoker expects response (API Gateway)
Async: Events are queued and requestor doesn't wait
Polling: Lambda will poll services like Kineses, SQS, and DynamoDB streams
Async and Polling have built in retry mechanisms, but synch does not have retries
385
What does an IAM execution rule for Lambda do
Controls what the function can do
386
What are the three settings you have to configure for Lambda functions
Memory, Timeout, Concurrency
387
How are you charged for Lambdas
Based on the amount of invocations and the duration. The price will also depend on the memory allocated to the function
388
What is the maximum execution time, concurrent functions, and RAM available to Lambdas
15 minutes, 1000, and 10 GB of RAM
389
What is the difference between the provisioned and on-demand modes
Provisioned is used for planning read/write capacity ahead of time
On-demand should scale dynamically based on workload, thus is more expensive
390
What are dynamodb global tables
Table replication across regions with two-way replication, which helps reduce latency across regions. So any write in an region will be replicated on the other
391
What are global and local secondary indexes
Allows you to optimize queries on attributes other than the primary key (partition key + sort key)
392
What are the different API Gateway Endpoint types
Private: Only exposed on your using an VPC Endpoint
Regional: For clients within same region
Edge optimized: Requests are routed through edge locations
393
What are SigV4 permission
IAM permissions for API Gateway
394
What are some methods of authentication with API Gateway
Lambda authorizer (IAM based) and Cognito
395
What are federated identity pools from Cognito
Uses a federated identity provider to submit token to federated identity server, then gets credentials from STS and provides temporary AWS creds to client
396
What are containers grouped into in ECS
Tasks
397
Are containers/ECS good for batch jobs
Yes
398
What are ECS services
Provides a mechanism/API to interact with ECS cluster tasks and can define ALBs/NLBs and ASGs for tasks. Groups tasks together
399
What is ECS Fargate
Serverless platform where you don't have to manage the EC2 instances in an ECS cluster. Just need to create task definitions
400
How do you give permissions to ECS tasks
Assign each task a role with a policy to connect to whichever AWS service is needed
401
Can you mount an EFS volume to an ECS task
Yes. Cannot use S3 as a task file system
402
How can you set ASGs for ECS clusters
Can define memory and CPU utilization at the service level, adding additional tasks
ECS capacity providers and scale EC2 instances if more tasks need to be added greater than the original capacity
403
Does ECS support rolling updates
Yes
