Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Solutions Architect Associate > AWS UseCases > Flashcards

AWS UseCases Flashcards

1
Q

EC2 needs access to sensitive data in S3. Cannot travers the internet must use private IPs. S3 can only allow access from services in the VPC

A
  • Create a VPC Gateway endpoint for the S3 buck

- Enable a bucket policy to restrict S3 access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

A company needs to migrate 50TB of data into AWS within a month. They also want a secure and reliable private connection

A
  • Use a snowball device for the initial 50TBs

- Order a Direct Connect that could take over a month

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Website developers needs a solution for a static website over https without managing server infrastructure and should be scalable as the company grows.

A
  • Cloud Front with S3 as the origin
  • since its https vs http
  • can restrict with OAI - origin access identity
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

RDS postgres is configured in Multi-az. Need to scale read performance and the solution must be configured for high availablity.

A
  • Create a read replica as a Multi-az DB
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A shared services VPC is being created for use by several AWS accounts. An application needs to be security shared from the shared services vpc.

A
  • Use AWS private link to expose the application as an endpoint
  • Use a NLB to front the application.
  • IP in the VPC
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

A Web application that runs on EC2 instance behind an ELB and all data in transit must be encrypted. How is this accomplished for both ALB and NLB?

A
  • Using an ALB with HTTP Listener - Install Certs on ALB and EC2 Terminate on ALB and send to EC2
  • Using an NLB with TCP listener - terminate on EC2 - pass through
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Easiest way to block access to content from certain countries

A

Use Cloudfront to serve the application and block the content.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Restrict access to Dynamo DB to specific private source IPs from their VPC… what network resources?

A

Use a VPC Gateway endpoint.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

EC2 instances need to make api calls to Dynamo DB from your VPC where it does not go over the internet.

A
  • Create a VPC Gateway endpoint

- add a route to the endpoint

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Can an ALB be used to redirect clients to another region if a health check fails?

A

No. It only identifies the health of targets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What EBS storage should be used with a variable Disk I/O with peaks up to 3000 IOPS?

A

gp2… since it can burst to 3000 IOPS for an extended period of time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Aurora replica in Multi-AZ configuration. DB reads are high and causing performance issues. What can you do.

A

Update the app to read from the aurora replica.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How do you add encryption to a DirectConnect Connection?

A

Use a Virtual Private Gateway (VPG) A VPG is used to setup an AWS VPN which you can use in combination with DX to provide IPSEC-encrypted private comms.

You can’t just enable IPSec on the DX… that is not an option.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How can an ASG be used with an SQS queue to scale.

A

Use a custom cloud watch metric for the number of messages in the queue. Configure the ASG to scale based on the metric.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How can a security team limit access to specific services or actions in all of the teams AWS accounts that are part of a large org in AWS Organizatinos.

A

Use an SCP in the root org unit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Does CloudWatch Container Insights work with EKS?

A

Yes it does… with both ECS and EKS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Need to scale read ops within a region for an Aurura DB… what do you implement

A

Aurora Replicas - these offer standby and read scaling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

How to block malicious traffic from the same CIDR range… Security Group or NACL/

A

Use the NACL Inbound rule to block that CIDR range.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What protocol does CloudFront support?

A

HTTP/HTTPS only

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Can cloudfront expose static public IP addresses?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Mutiple consumer apps have total reads exceeding the per-shard limits of a Kinesis data stream…. how can this be resolved?

A

Increase the number of shards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

How are custom EC2 metrics enabled?

A

Use CloudWatch Agent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Which AWS service is used to Accelerate the migration of on-prem data to S3

A

AWS DataSync… StorageGateway is used for hybrid scenarios where servers need local access to data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Steps to create a SSO solution for users signed into the organizations active directory

A

Call the AWS STS AssumeRole or GetFederationToken API to obtain temp access
Call the AWS federation endpoint and supply the temp access to get the token

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Provide temporary AWS credentials for users who are guests (unathorized) and for Users who have been authenticated and received a token. Is a store of user identity data specific to your account

A

Cognito identity pools

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Allows users to sign into web or mobile apps through AWS Cognitio

A

User Pools

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What AWS S3 access control method should be used to grant API access.

A

IAM Policy

Grant Programmatic access

28
Q

A webservice that enables biz, research, data analysis, and developers to easily and cost effectively process vast amounts of data.

A

EMR

29
Q

Which service allows programmatically access to the IAM WebServer?
How is this authenticated

A

Query API

Access KeyID and secret access key

30
Q

How can I limit traffic to the DB from only the web tier

A

Add the webtier security group to the DB security group for the assigned DB port

31
Q

AWS services that Allows security access and authentication to manage on-prem and AWS resources via console…

A

AWS STS and SAML

32
Q

On prem app to connect to AWS API Gateway…all api calls use private address and avoid inet

A

Use private virtual interface and creat a vpc endpoint

33
Q

Make updates in cloud formation with preview option for complexity

A

Use change sets

34
Q

Can tags be used in IAM policies?

A

Yes. Use this to segment access based on tags

35
Q

Vpc info needed by lambda to connect to vpc resources?

A

Subnet ids

Security group ids

36
Q

ElasticCache that supports multi-thread

A

Memcached

37
Q

Can IAM groups be principals in policies?

A

No

38
Q

Can IAM groups assume a role?

A

No

39
Q

Which service uses multiple dynamically changing IPs. CloudFront or GlobalAccelerator?

A

CloudFront

40
Q

Which service uses a set of static IPs as fixed entry points?

A

Global Accelerator

41
Q

Global Accelerator uses what protocols?

A

Http and non http such as TCP and UDB

42
Q

What service uses edge to cache?

A

CloudFront

43
Q

What service uses edge to find the optimal pathway to the nearest region

A

Global Accelerator

44
Q

Use this to provide low latency live sports via an application using udp?

A

Global Accelerator

45
Q

Should I use step functions or SWF for lambda workflow?

A

Step functions first

46
Q

CloudFront price class

A

Where the content will be cached. Better performance

47
Q

What is the lambda timeout

A

15 minutes

48
Q

Can an ALB authenticate a user via facebook or google?

A

Yes… Use ALB authentication action listener rule that configures AWS Cognito USER pool with social IDPs

49
Q

These containers will use several AWS services. A container from one customer must not be able to access data from another customer.

A

Use IAM Roles for Tasks

50
Q

Can an ALB be a cloudfront origin

A

Yes

51
Q

What sse can use customer keys stored and managed in aws

A

SSE-KMS

52
Q

SSE that uses customer keys that are not stored in aws

A

SSE-c

53
Q

Transfer more than 10pbs

A

Snowmobile

54
Q

Can CloudFront route to specific regions based on price class?

A

No. Only on connect

55
Q

How many CloudFront price classes

A

3
Default- all regions
Most
Cheapest

56
Q

Stream data from S3 to kenisis

A

Use DMS as an option

57
Q

What is the RPO for PilotLight

A

A few minutes

58
Q

Only resource based policy that the IAM service supports

A

Trust policy

59
Q

Which snow family supports storage clustering

A

Snowball edge compute optimized

60
Q

Host multiple tls secured apps behind a single alb. Multiple HTTPS endpoints behind a single alb

A

SSL certificates with sni

61
Q

Grant additional permissions to an individual ECS application container on an ECS cluster that you have deployed without granting additional permissions to the other containers that are running on the cluster.

A

Create a separate Task Definition for the application container that uses a different Task Role

62
Q

implement more granular level security controls in ECS

A

achieved using IAM roles for tasks, and splitting the containers according to the permissions required to different task definition profiles

63
Q

Which sse is integrated with cloudtrail

A

Sse-kms

64
Q

Can you use cognito user pools with CloudFront

A

Nope. Plug it into the ALB instead

65
Q

DNS caching impacts route 53. Use global accelerator instead

A

True

66
Q

Which kinesics automatically scales to match the throughput?

A

Firehose… you have to add shards to Data streams

AWS Solutions Architect Associate (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions