AWSexam_1 Flashcards
Invention requires two things
- The ability to try a lot of experiments, and
- Not having to live with the collateral damage of failed experiments
What is a region?
A physical location in the world which consists of 2 or more availability zones.
What is an availability zone?
An availability zone is one or more discrete data centers, each with redundant power, networking and connectivity, housed in separate facilities.
What are edge locations?
Edge locations are endpoints for AWS which are used for catching content. Typically this consists of CloudFront which is Amazon’s CDN.
What is IAM and what is it for?
Identity Access Management = Allows you to manage users and their level of access to the AWS console.
What are the 4 key terms for IAM?
- Users
- end-users such as employees
- Groups
- A collection of users (with certain permissions)
- Policies
- Permission documents
- Roles
- Some have more power than others
Is IAM regional or global?
Everything you do in IAM is GLOBAL
This goes for both managing users and managing policies.
What is the root account (IAM)?
simply the account created when first setting up your AWS account
Important to have two-factor authentication activated for the root account.
What permissions do users have when first created?
NONE. No permission whatsoever. Needs to be added.
but.. new users are assigned Access Key ID & Secret Access Keys when first created (note you only get to see these once)
What does power users access allow?
access to all AWS services EXCEPT the management of groups and users within IAM
In what language are IAM policy documents written?
JSON
Using SAML (Security Assertion Markup Language 2.0), you can give your federated users single sign-on (SSO) access to the AWS Management Console (TRUE or FALSE)?
TRUE
What is S3?
Simple Storage Service
S3 provides developer and IT teams a safe place to store files (across multiple devices)
object-based storage
How big files can you upload to S3?
0 bytes to 5 Terabytes
(unlimited storage but you pay by gigabytes)
What does “S3 is a universal namespace” mean?
that names must be unique GLOBALLY
How are files stored in S3?
in Buckets
What do you receive from S3 when your upload is successful?
a HTTP 200 code
How is the data consistency model in S3?
- Read AFTER write consistency for PUTS of new objects
- can read immediately after write
- Eventual consistency for overwrite PUTS and DELETES (can take some time to propagate)
- if updating or deleting updates, you might get different versions if reading it immediately after but eventually it will be consistent
What does S3 objects consist of?
- Keys
- the name of the object
- Value
- the data (made up of a sequence of bytes)
- Version ID
- important for versioning
- Metadata
- Data about data you are storing (tags etc.)
- Sub-resources
- Access control lists (permissions to access files)
How high availability do you have with S3?
- Built for 99.99 % availability (four 9s)
- Amazon guarantees 99.9 % availability (three 9s)
- and Amazon guarantees 99.999999999 % DURABILITY for S3 information (eleven 9s = your files will not disappear)
BUT depending on the storage tier used.
What are the S3 storage tiers?
- S3 Standard
- 99.99 % availability and 99.999999999 durability
- Stored redundantly across multiple devices in multiple facilities and is designed to sustain the loss of 2 facilities concurrently
- S3 - Infrequently Accessed
- (cheaper than S3)
- For data that is accessed less frequently but requires rapid access when needed
- S3 One Zone infrequently accessed
- low-cost option for infrequently accessed data (but relatively fast retrieval)
- do not require the multiple availability zone data resilience (only in 1 availability zone)
- Availability 99.50 %
- S3 - Intelligent Tiering
- designed for cost-efficiency by automatically moving data to the most cost-effective access tier, without performance impact or operational overhead
- S3 Glacier
- Retrieval times from minutes to hours
- S3 Glacier Deep Archive
- cheapest storage option but used for archival only
- retrieval time of 12 hours is acceptable
What characterises S3 standard?
- 99.99 % availability and 99.999999999 durability
- Stored redundantly across multiple devices in multiple facilities and is designed to sustain the loss of 2 facilities concurrently
What characterises S3 IA?
- S3 - Infrequently Accessed
- (cheaper than S3)
- For data that is accessed less frequently but requires rapid access when needed
What characterises S3 One Zone?
- S3 One Zone infrequently accessed
- low-cost option for infrequently accessed data (but relatively fast retrieval)
- do not require the multiple availability zone data resilience (only in 1 availability zone)
- Availability 99.50 %
What characterises S3 Intelligent Tiering?
- designed for cost-efficiency by automatically moving data to the most cost-effective access tier, without performance impact or operational overhead
What characterises S3 Glacier?
- Retrieval times from minutes to hours
What characterises S3 Glacier Deep Archive?
- cheapest storage option but used for archival only
- retrieval time of 12 hours is acceptable
What determines charges in S3?
- Storage
- Requests
- Storage Management Pricing (meta-data)
- Data Transfer Pricing
- Transfer Acceleration
What is transfer acceleration?
Amazon S3 Transfer acceleration enables fast, easy, and secure transfer of files over long distances between your end users and an S3 bucket.
=> CloudFront CDN
What types of encryption can you make in S3?
- Client Side Encryption
- Server Side Encryption
- with Amazon S3 Managed Keys => SSE-S3
- with KMS => SSE-KMS
- with Customer Provided Keys => SSE-C
What are the default settings for Buckets in S3?
Buckets are by default PRIVATE and All objects inside are PRIVATE by default
What region does he recommend?
US East (N. Virginia) - where all new services come out first - however, goes out more often
What are Regions?
Distinct geographical areas - and each region always consists of two or more availability zones
A Region is a physical location in the world which consists of two or more Availability Zones (AZ)
What is an Availability Zone (AZ)?
An Availability Zone (AZ) is one or more discrete data centers, each with redundant power, networking and connectivity, housed in separate facilities.
What is an Edge Location?
Edge Locations are endpoints for AWS which are used for caching content. Typically this consists of CloudFront, Amazon’s Content Delivery Network (CDN)
Example: someone from Sydney downloads something from New York - the content can be cached in Sydney so someone else from Sydney can download it directly from Sydney instead of NY.
What are the differences between the four different AWS plans?
Can be typical exam questions!
Q1: An AWS VPC is a component of which group of AWS services?
Networking Services
A Virtual Private Cloud (VPC) is a virtual network dedicated to a single AWS account. It is logically isolated from other virtual networks in the AWS cloud, providing compute resources with security and robust networking functionality.
Q2: Which of the below are storage services in AWS? (Choose 2)
S3 and EFS both provide the ability to store files in the cloud. EC2 provides compute, and is often augmented with other storage services. VPC is a networking service. Further information:
https://aws.amazon.com/efs/https://aws.amazon.com/s3/https://aws.amazon.com/ec2/https://aws.amazon.com/vpc/
Q3: Which of the following is correct?
of Edge Locations > # of Availability Zones > # of Regions
The number of Edge Locations is greater than the number of Availability Zones, which is greater than the number of Regions. Further information: https://aws.amazon.com/about-aws/global-infrastructure/
Q4: Which of the below are compute service from AWS? (Choose 2)
Both Lambda and EC2 offer computing in the cloud. S3 is a storage offering while VPC is a network service. Further information: https://aws.amazon.com/ec2/https://aws.amazon.com/lambda/https://aws.amazon.com/s3/https://aws.amazon.com/vpc/
Q5: Which of the below are database services from AWS? (Choose 2)
RDS is a service for relational databases provided by AWS. DynamoDB is AWS’ fast, flexible, no-sql database service. S3 provides the ability to store files in the cloud and is not suitable for databases, while EC2 is part of the compute family of services. Further information: https://aws.amazon.com/dynamodb/https://aws.amazon.com/rds/https://aws.amazon.com/ec2/https://aws.amazon.com/s3/
Q6: Which of the following are a part of AWS’ Network and Content Delivery services? (Choose 2)
Cloudfront + VPC
VPC allows you to provision a logically isolated section of the AWS where you can launch AWS resources in a virtual network. Cloudfront is a fast, highly secure and programmable content delivery network (CDN). EC2 provides compute resources while RDS is Amazon’s Relational Database System. Further information: https://aws.amazon.com/vpc/https://aws.amazon.com/cloudfront/https://aws.amazon.com/ec2/https://aws.amazon.com/rds/
Q7: In which of the following is CloudFront content cached?
CloudFront content is cached in Edge Locations.
Q8: Which of the below are factors that have helped make public cloud so powerful? (Choose 2)
Not having to deal with the collateral damage of failed experiments
The ability to try out new ideas and experiment without an upfront commitment
Public cloud allows organisations to try out new ideas, new approaches and experiment with little upfront commitment. If it doesn’t work out, organisations have the ability to terminate the resources and stop paying for them. Further information: https://docs.aws.amazon.com/whitepapers/latest/aws-overview/six-advantages-of-cloud-computing.html
Q9: What is an Amazon VPC?
VPC stands for Virtual Private Cloud. Further information: https://aws.amazon.com/vpc/
Q10: Which statement best describes Availability Zones?
Distinct locations from within an AWS region that are engineered to be isolated from failures.
An Availability Zone (AZ) is a distinct location within an AWS Region. Each Region comprises at least two AZs. Further information: https://aws.amazon.com/about-aws/global-infrastructure/
Q11: What does an AWS Region consist of?
A distinct location within a geographic area designed to provide high availability to a specific geography.
Each region is a separate geographic area. Each region has multiple, isolated locations known as Availability Zones. Further information: https://aws.amazon.com/about-aws/global-infrastructure/
Q12: What is an AWS region?
A region is a geographical area divided into Availability Zones. Each region contains at least two Availability Zones.
What is IAM and what is it for?
Identity Access Management = Allows you to manage users and their level of access to the AWS console.
What features does IAM offer?
- Centralised control of your AWS account
- Shared access to your AWS account
- Granular permissions
- Identity Federation (including Active Directory, Facebook, LinkedIn, etc.)
- Multi Factor Authentication
- Temporary access for users/deviced and services
- Set up own password rotation policy
- Integrates with many AWS services
- Support PCI DSS Compliance (e.g. when taking credit card details)
What are the 4 key terms for IAM?
- Users
- end-users such as employees
- Groups
- A collection of users (with certain permissions)
- Each user of inherit the permissions of the group
- Policies
- Permission documents
- Roles
- Some have more power than others
What group does IAM belong to in AWS?
Security, Identity, and Compliance
What is the root account in IAM?
The account you can do EVERYTHING with and has unlimited resources.
What are the three multi factor authentication (MFA) for IAM?
Virtual MFA device, U2F security key, Other hardware MFA device
What region does IAM apply to?
Global - i.e. ALL regions
What access do users have when first created?
No access at all
What are users assigned when first created in IAM?
An Access Key ID and Secret Access Key (these are not those you use to login to the AWS console, but can be used with APIs and command line access). They can only be viewed once.
What should you always do with your root account?
Use multi factor authentication
What group does CloudWatch belong to in AWS?
Management & Governance
What does S3 stand for?
Simple Storage Service
What is an object in S3?
Simply a file that consist of:
Key (name of file), Value (data of the file), Version ID, Metadata (data about data)
What is a bucket in S3?
Simply a folder - their name must be unique as this is what appears on the web-address
How does data consistency work for S3?
Read after Write for PUTS of new Objects
Eventual Consistency for overwrite PUTS and DELETES
What are the AWS guarantee of S3?
Built for 99.99% availability
Guaranteed 99.9% availability
Guaranteed 11x9s durability
What are the different storage classes?
S3 Standard (designed to sustain loss of 2 facilities concurrently)
S3 - IA (Infrequently Accessed) but needs rapid access when needed (charged retrieval fee)
S3 One Zone - IA (RRS) (Infrequently Accessed) same as above but just for one zone
S3 Intelligent Tiering (uses AI to intelligently move your files to correct tier)
S3 Glacier (used for archiving but retrieval takes from minutes to hours)
S3 Glacier Deep Archive (cheapest option where retrieval takes 12 hours)
How are you charged in S3?
Storage, Requests, Storage Management Pricing, Data Transfer Pricing, Transfer Acceleration, Cross Region Replication Pricing
How can you protect your S3 objects from being deleted?
Turn on multi factor authentication delete
What is good to read about the S3 before the exam?
The FAQ: https://aws.amazon.com/s3/faqs/
What are the types of encryption?
- Encryption in transit = HTTPS
- Achieved through SSL/TLS
- Encryption at rest (server side)
- Achieved by
- S3 Managed Keys (SSE-S3) (Amazon manages for you)
- AWS Key Management Service (SSE-KMS) - you manage with Amazon
- Server Side Encryption with Customer provided keys (SSE-C) - you provide keys to amazon
- Achieved by
- Client Side encryption
- You just upload an encrypted object
What does versioning do?
- Stores all versions of an object (including all writes and even if you delete an object)
- => GREAT backup tool
Can you disable versioning?
No… Once enabled, versioning cannot be disabled, only suspended.
What is MFA Delete?
A feature in S3 versioning, which requires the use of multi-factor authentication to provide an additional layer of security for when you try to delete things.
Will the access change when you reupload a file?
Yes…
you will return to not being accessible / all blocked and you have to allow access again.
If you had versioning enabled, what happens if you delete the file in a bucket?
it will still keep the earlier versions in the versioning backup - it just puts a delete marker as the most recent version.
What are lifecycle rules for?
Automates moving your objects (files) between different storage tiers
E.g. if you want it in S3 standard and later want it in S3 infrequently accessed (IA) depending on time
What happens to objects within a bucket when you make cross region replication it?
The files will NOT be in the new bucket.
The new bucket will have the same permissions as in the other region but the objects/files will not be present.
What is important about cross region replication?
Versioning must be enabled on both the source and destination buckets
What happens to new files added to cross-region replication buckets?
NEW files will be automatically replicated across the two region buckets but existing files at creation will not appear.
Will deletes be replicated in cross region replication?
No - neither individual deletes nor delete markers
What is S3 transfer acceleration?
S3 transfer acceleration utilises the CloudFront Edge Network to accelerate your upload to S3 (CDN)
….so from edge location to S3 bucket in availability zone
How does S3 transfer acceleration work?
You simply upload to an edge location that then uploads to the main bucket instead of you uploading directly to the main bucket, which can be slower.
What is CloudFront, Edge Location, Origin and Distribution?
- CloudFront
- Amazon’s Content Delivery Network (CDN)
- Edge Location
- Location where content will be cached
- Origin
- Origin of all the files that the CDN will distribute. This can be an S3 Bucket, an EC2 instance, an Elastic Load Balancer or Route52
- Distribution
- Name given to the CDN which consists of a collection of edge locations (Web Distributions and RTMP distributions)
What is Web Distribution used for?
websites (part of cloudfront)
What is RTMP used for?
Media Streaming (part of cloudfront)
Are edge locations read or write?
Both - you can certainly read from them but you can also write = put an object in them (which should be more or less the same as transfer acceleration)
What is TTL?
Time To Live = the time objects are cached for in the cdn distribution. up to the user to set TTL
What happens if you delete cached objects from edge locations?
they will be deleted BUT you will be charged.
What does restricting viewer access in CloudFront do?
E.g. if only paying customers can access the content they need to have a signed URL to access the content (e.g. Netflix)
What is a CloudFront Invalidation?
A way to quickly remove/invalidate content from the CloudFront, e.g. if you uploaded the wrong media or there is an error (but you’ll be charged).
What is Snowball?
Petabyte-scale data transport solution that uses secure appliances to transfer large amounts of data in and out of S3 AWS = a big desk.
50TB or 80TB
What is Snowball Edge?
up to 100TB data WITH on-board storage and compute capabilities
useful to support local workloads in remote or offline locations (such as on an airplane)
= a portable version of AWS essentially
What is Snowmobile?
An EXABYTE-scale data transfer service. Up to 100 PB per snowmobile, which is a 45-foot long shipping container.
What is Storage Gateway?
Service that connects on-premises software appliance with cloud-based storage to provide seamless and secure integration between an organization’s on-premises IT environment and AWS’s storage infrastructure.
What are the 3 types of Storage Gateway?
- File Gateway (NFS & SMB)
- files are stored in your S3 bucket
- Volume Gateway (iSCSI)
- Stored Volumes
- store your ENTIRE primary data locally and backed up in AWS
- Cached Volumes
- only has the most frequently used data locally (NOT entire data)
- Stored Volumes
- Tape Gateway (VTL)
- way to archive your data in the AWS cloud = good to move your backup to the cloud
Q1: Power User Access allows ________.
Access to all AWS services except the management of groups and users within IAM.
Q2: You have been asked by your company to create an S3 bucket with the name “acloudguru1234” in the EU West region. What would the URL for this bucket be?
https://s3-eu-west-1.amazonaws.com/acloudguru1234
Q3: You work for a health insurance company that amasses a large number of patients’ health records. Each record will be used once when assessing a customer, and will then need to be securely stored for a period of 7 years. In some rare cases, you may need to retrieve this data within 24 hours of a claim being lodged. Given these requirements, which type of AWS storage would deliver the least expensive solution?
Glacier: The recovery rate is a key decider. The record shortage must be; safe, durable, low cost, and the recovery can be slow.
Q4: What is the default level of access a newly created IAM User is granted?
No access to any AWS services.
Q5: Which of the following is not a component of IAM?
Organizational Units
Q6: What is the availability of S3-OneZone-IA?
99.50% OneZone-IA is only stored in one Zone. While it has the same Durability, it may be less Available than normal S3 or S3-IA.
Q7: What is the availability of objects stored in S3?
99.99%
Q8: A new employee has just started work, and it is your job to give her administrator access to the AWS console. You have given her a user name, an access key ID, a secret access key, and you have generated a password for her. She is now able to log in to the AWS console, but she is unable to interact with any AWS services. What should you do next?
Grant her Administrator access by adding her to the Administrators’ group.
Q9: Which statement best describes IAM?
IAM allows you to manage users, groups, roles, and their corresponding level of access to the AWS Platform.
Q10: Which of the following options allows users to have secure access to private files located in S3? (Choose 3)
CloudFront Signed Cookies
CloudFront Signed URLs
CloudFront Origin Access Identity
Q11: What is Amazon Glacier?
An AWS service designed for long term data archival.
Q12: In what language are policy documents written?
JSON
Q13: When you create a new user, that user ________.
Will be able to interact with AWS using their access key ID and secret access key using the API, CLI, or the AWS SDKs.
Q14: You run a popular photo-sharing website that depends on S3 to store content. Paid advertising is your primary source of revenue. However, you have discovered that other websites are linking directly to the images in your buckets, not to the HTML pages that serve the content. This means that people are not seeing the paid advertising, and you are paying AWS unnecessarily to serve content directly from S3. How might you resolve this issue?
Remove the ability for images to be served publicly to the site and then use signed URLs with expiry dates.
Q15: The difference between S3 and EBS is that EBS is object-based where as S3 is block-based.
False
Q16: A __________ is a document that provides a formal statement of one or more permissions.
Policy
Q17: What level of access does the “root” account have?
Administrator Access
Q18: One of your users is trying to upload a 7.5GB file to S3. However, they keep getting the following error message: “Your proposed upload exceeds the maximum allowed object size.”. What solution to this problem does AWS recommend?
Design your application to use the Multipart Upload API for all objects.
Q19: You are a solutions architect working for a large engineering company that are moving from a legacy infrastructure to AWS. You have configured the company’s first AWS account and you have set up IAM. Your company is based in Andorra, but there will be a small subsidiary operating out of South Korea, so that office will need its own AWS environment. Which of the following statements is true?
You will need to configure Users and Policy Documents only once, as these are applied globally.
Q20: How many S3 buckets can I have per account by default?
100
Q21: You work for a major news network in Europe. They have just released a new mobile app that allows users to post their photos of newsworthy events in real-time, which are then reviewed by your editors before being copied to your website and made public. Your organization expects this app to grow very quickly, essentially doubling its user base each month. The app uses S3 to store the images, and you are expecting sudden and sizable increases in traffic to S3 when a major news event takes place (as users will be uploading large amounts of content.) You need to keep your storage costs to a minimum, and it does not matter if some objects are lost. With these factors in mind, which storage media should you use to keep costs as low as possible?
S3 - One Zone-Infrequent Access
Q22: You have uploaded a file to S3. Which HTTP code would indicate that the upload was successful?
HTTP 200
Q23: What is the minimum file size that I can store on S3?
0 bytes
Q24: You are a developer at a fast-growing startup. Until now, you have used the root account to log in to the AWS console. However, as you have taken on more staff, you will need to stop sharing the root account to prevent accidental damage to your AWS infrastructure. What should you do so that everyone can access the AWS resources they need to do their jobs? (Choose 2)
Create individual user accounts with minimum necessary rights and tell the staff to log in to the console using the credentials provided.
Create a customized sign-in link such as “yourcompany.signin.aws.amazon.com/console” for your new users to use to sign in with.
Q25: What does S3 stand for?
Simple Storage Service
Q26: S3 has eventual consistency for which HTTP Methods?
overwrite PUTS and DELETES
Q27: S3 has what consistency model for PUTS of new objects
Read After Write Consistency
Q28: You are a security administrator working for a hotel chain. You have a new member of staff who has started as a systems administrator, and she will need full access to the AWS console. You have created the user account and generated the access key id and the secret access key. You have moved this user into the group where the other administrators are, and you have provided the new user with their secret access key and their access key id. However, when she tries to log in to the AWS console, she cannot. Why might that be?
You cannot log in to the AWS console using the Access Key ID / Secret Access Key pair. Instead, you must generate a password for the user, and supply the user with this password and your organization’s unique AWS console login URL.
Q29: What is an additional way to secure the AWS accounts of both the root account and new users alike?
Implement Multi-Factor Authentication for all accounts.
Q30: You are a solutions architect who works with a large digital media company. The company has decided that they want to operate within the Japanese region and they need a bucket called “testbucket” set up immediately to test their web application on. You log in to the AWS console and try to create this bucket in the Japanese region however you are told that the bucket name is already taken. What should you do to resolve this?
Bucket names are global, not regional. This is a popular bucket name and is already taken. You should choose another bucket name.
Q31: What is AWS Storage Gateway?
It is a physical or virtual appliance that can be used to cache S3 locally at a customer’s site.
Q32: Every user you create in the IAM systems starts with ________.
No Permissions
Q33: Which of the following is not a feature of IAM?
IAM allows you to set up biometric authentication, so that no passwords are required.
Q34: You have a client who is considering a move to AWS. In establishing a new account, what is the first thing the company should do?
Set up an account using their company email address.
Q35: You run a meme creation website where users can create memes and then download them for use on their own sites. The original images are stored in S3 and each meme’s metadata in DynamoDB. You need to decide upon a low-cost storage option for the memes, themselves. If a meme object is unavailable or lost, a Lambda function will automatically recreate it using the original file from S3 and the metadata from DynamoDB. Which storage solution should you use to store the non-critical, easily reproducible memes in the most cost-effective way?
S3 - OneZone-IA is the recommended storage for when you want cheaper storage for infrequently accessed objects.
Q36: You work for a busy digital marketing company who currently store their data on-premise. They are looking to migrate to AWS S3 and to store their data in buckets. Each bucket will be named after their individual customers, followed by a random series of letters and numbers. Once written to S3 the data is rarely changed, as it has already been sent to the end customer for them to use as they see fit. However, on some occasions, customers may need certain files updated quickly, and this may be for work that has been done months or even years ago. You would need to be able to access this data immediately to make changes in that case, but you must also keep your storage costs extremely low. The data is not easily reproducible if lost. Which S3 storage class should you choose to minimize costs and to maximize retrieval times?
S3 - IA Glacier has a long recovery time at a low cost or a shorter recovery time at a high cost, and 1Zone-IA has a lower Availability level which means that it may not be available when needed.
Q37: You have created a new AWS account for your company, and you have also configured multi-factor authentication on the root account. You are about to create your new users. What strategy should you consider in order to ensure that there is good security on this account.
Enact a strong password policy: user passwords must be changed every 45 days, with each password containing a combination of capital letters, lower case letters, numbers, and special symbols.
Q38: Using SAML (Security Assertion Markup Language 2.0), you can give your federated users single sign-on (SSO) access to the AWS Management Console.
True
Q39: You have been asked to advise on a scaling concern. The client has an elegant solution that works well. As the information base grows they use CloudFormation to spin up another stack made up of an S3 bucket and supporting compute instances. The trigger for creating a new stack is when the PUT rate approaches 100 PUTs per second. The problem is that as the business grows that number of buckets is growing into the hundreds and will soon be in the thousands. You have been asked what can be done to reduce the number of buckets without changing the basic architecture.
Change the trigger level to around 3000 as S3 can now accommodate much higher PUT and GET levels.
What is EC2?
a web service that provides resizable compute capacity in the cloud
- reduces the time required to obtain and boot new server instances to minutes, allowing you to quickly scale capacity, both up and down, as your computing requirements change.
How do you pay for EC2?
As you go, for what you use, less as you use more, and even less when you reserve capacity
4 overall options:
- On Demand = fixed rate by the hour (or by the second) with no commitment
- Reserved = capacity reservation (contracts of 1-3 years but significant discounts)
- Spot = when Amazon has excess capacity, you can bid whatever price you want for instance capacity. Great if you have flexible start and end times for your needs
- Dedicated Hosts = physical EC2 servers dedicated for your use
When is On-Demand pricing useful?
- Low cost and flexible with no up-front payment or long-term commitment
- applications with short term, spiku, or unpredictable workloads that cannot be interrupted
- New tests on EC2
When Reserved pricing useful?
- Steady state or predictable usage
- Applications that require reserved capacity
- when you can afford making up-front payments
- Standard reserved instances (up to 75 % off)
- Convertible Reserved instances (up to 54 % off)
- Scheduled Reserved Instances (specific time windows)
When is Spot pricing useful?
Applications that have flexible start and end times as Amazon can buy them back
Applications that are only feasible at very low compute prices
Users with urgent computing needs for large amounts of additional capacity
When is Dedicated host pricing useful?
- For regulatory requirements
- Great for licensing which does not support multi-tenant or cloud deployments (like licenses with Oracle)
- Can be purchased on-demand (hourly)
- Can be purchased as a reservation for up to 70 % off standard price
How are you charged for EC2 Spot Instances?
If the Spot instance is terminated by Amazon EC2, you’ll not be charged for a partial hour of usage. However, if you terminate the instance yourself, you’ll be charged for any hour in which the instance ran.
What are T3s?
low cost, general purpose instances (used for web servers and small databases)
What happens if a Spot instance is terminated?
If terminated by Amazon, you will not be charged for a partial hour of usage.
However, if you terminate the instance yourself, you will be charged for any hour in which the instance ran.
What is IOPS?
Instance Output Per second = how fast your harddisk drive is
Can you encrypt your root device volumes?
yes… Even from the beginning when you create it
can also be encrypted using third party tools such as bit locker
Is termination protection on or off by default?
It is turned OFF by default so you must turn it on
What happens to an EBS backed instance when terminated?
On an EBS-backed instance, the default action is for the root EBS volume to be deleted when the instance is terminated
How quickly does changes in security group settings take effect?
IMMEDIATELY
What also happens when you create an inbound security group rule?
it also creates an outbound rule at the same time
What is the default setting for inbound traffic?
the security is set to block ALL inbound traffic by default
(all outbound traffic is allowed)
How many EC2 instances can you have within a security group?
any number
Can you only have one security group attached to an EC2 instance?
No… you can have multiple security groups attached to one EC2 instance
What does it mean that security groups are STATEFUL?
if you create an inbound rule allowing traffic in, that traffic is automatically allowed back out again
How can you block specific IP addresses?
Using Network Access Control Lists
(NOT using security groups)
Can you set up deny rules in security groups?
NO!
only allow rules (no deny rules)
(deny rules can be made in Network Access Control Lists but that is different)
What is EBS?
Elastic Block Store
= virtual hard disk in the cloud that provides persistent block storage volumes for use with Amazon EC2 instances.
What are the 5 types of EBS Storage and what are they useful for?
- General Purpose SSD
- Most workloads
- Provisioned IOPS SSD
- Databases
- Throughput Optimised HDD
- Big data and data warehouses
- Cold HDD (also magnetic)
- File servers
- EBS Magnetic
- workloads where data is infrequently accessed
Where will the EBS volume be located?
EBS volumes will always be in the same availability zone as your EC2 instance
Are volumes terminated as you terminate the EC2 instance?
By default, the ROOT volume is terminated together with the EC2 instance.
However, additional volumes are not deleted unless specified.
What are snapshots?
photographs of the hard disk
(point in time copies of volumes)
What does it mean that snapshots are incremental?
only the blocks that have changed since your last snapshot are moved/replicated to S3
What is best practice when creating a snapshot for Amazon EBS volumes that serve as root devices?
you should stop the instance before taking the snapshot when trying to create a snapshot for Amazon EBS volumes that serve as root devices
but… you can also take a snapshot while the instance is running.
Can you create AMIs from volumes or snapshots?
both…
When can you change EBS volume sizes?
on the fly
both size and storage types can be changed any time.
How do you move an EC2 volume from one availability zone to another?
take a snapshot of it, create an AMI from the snapshot and then use the AMI to launch the EC2 instance in a new availability zone.
How do you move an EC2 volume from one REGION to another?
take a snapshot of it, create an AMI from the snapshot and then COPY the AMI from one region to the other
Next, use the copied AMI to launch the new EC2 instance in the new region
What are the two different types of AMIs?
- EBS Volumes
- root device for an instance launched from the AMI is an Amazon EBS Volume created from an Amazon EBS snapshot
- Instance Store Volumes (Ephemeral Storage)
- root device for an instance launched from the AMI is an instance store volume created from a template stored in Amazon S3.
What can you select AMI based on?
- Region
- Operating system
- Architecture (32bit or 64bit)
- Launch permissions
- Storage for the root device
- Instance Store Volumes
- EBS Backed Volumes
What is important to note about instance store volumes?
- CANNOT be stopped.
- If the underlying host fails, you will lose your data
- can reboot
What is important to note about EBS backed instances?
- CAN be stopped
- will not lose your data if it is stopped
- can reboot
- can tell AWS to keep the root volume when terminating the EBS volume if you want
What are Encrypted root device volumes?
The hard disk that has the operating system on it.
back in the days you could not encrypt this when you created it, but now you can encrypt it immediately at creation
if you have not done it from the beginning
- Create a snapshot of the unencrypted root device volume
- Create a copy of the snapshot and select the encrypt option
- Create an AMI from the encrypted snapshot
- Use that AMI to launch new encrypted instances
How do you encrypt your root device volume?
back in the days you could not encrypt this when you created it, but now you can encrypt it immediately at creation
if you have not done it from the beginning
- Create a snapshot of the unencrypted root device volume
- Create a copy of the snapshot and select the encrypt option
- Create an AMI from the encrypted snapshot
- Use that AMI to launch new encrypted instances
What is CloudWatch?
Amazon CloudWatch is a monitoring service to monitor your AWS resources as well as the applications you run within AWS
= PERFORMANCE MONITORING
Monitor
- Computed
- EC2 instances, autoscaling groups, elastic load balances, route53 health checks
- Storage and content delivery
- EBS Volumes
- Storage Gateways
- CloudFront
What are the host level metrics of CloudWatch?
- CPU
- Network
- Disk
- Status Check
What is AWS CloudTrail?
think of CloudTrail as a CCTV (camera) that increases visibility into your user and resource activity by recording AWS Management Console actions and API calls.
Using CloudTrail, you can identify which users and accounts that called AWS, the source IP Address from which the calls were made and when the calls occurred.
(DO NOT confuse with CloudWatch which is for performance monitoring)
How frequent will CloudWatch monitor?
every 5 minutes by default but can be turned even longer down to 1 minute (detailed monitoring) intervals for example
What are the 4 main features of CloudWatch?
- Dashboards
- awesome dashboards to see what is happening with your AWS environment
- Alarms
- alarms to notify when you reach specified thresholds
- Events
- helps you respond to state changes in your AWS resources
- Logs
- helps you aggregate, monitor and store logs
What is the AWS Command Line (CLI)?
Can be used through terminal after connecting with key pair and setting up the access through IAM.
then AWS can be accessed from anywhere in the world
What is smart about Roles?
- Roles are more secure than storing your access key and secret access key on individual EC2 instances
- Roles are also easier to manage
- Roles can be assigned to an EC2 instance after it is created using the console & command line
- Roles are universal - you can use them in any region
What are boot strap scripts?
A way of automating your AWS EC2 deployment.
running it at the command line => can run individual command line commands as scripts (updates, installations, httpd starts, opening of web page, make buckets, create files etc.)
(set up when configuring instances from the AMI creation panel)
What is Instance Metadata for?
used to get information about an instance (fx public IP)
get by something like.…
curl http://169.254.169.254/latest/meta-data/
curl http://169.254.169.254/latest/user-data/
What is EFS?
Elastic File System = a file storage service for Amazon Elastic Compute Cloud (EC2) instances.
=> With amazon EFS, storage capacity is ELASTIC, growing and shrinking automatically as you add and remove files, so your applications have the storage they need, when they need it
What are the 3 types of Placement Groups?
- Cluster Placement Group
- Spread Placement Group
- Partitioned Placement Group
What are Cluster Placement Groups?
A grouping of instances within a single availability zone.
Recommended for applications that need
low network latency,
high network throughput,
or both.
putting instances as close as possible
What are Spread Placement Groups?
- group of instances each placed on DISTINCT underlying hardware
- Spread placement groups are recommended for applications that have a small number of critical EC2 instances that should be kept separate from each other
- can only have 7 running instances per availability zone
think of individual instances
(opposite of clustered placement group)
What are Partitioned Placement Groups?
- Similar to spread placement groups BUT you can have multiple EC2 instances within a partition.
- each partition is on each own set of racks where each rack has its own network and power source
- this allows you to isolate the impact of hardware failure within your application
- for multiple EC2 instances: HDFS, HBase, Cassandra
- each partition is on each own set of racks where each rack has its own network and power source
think of multiple instances
How can the 3 different Placement Groups span across availability zones and regions?
- Clustered
- only within one availability zone
- Spread and Partitioned
- within MULTIPLE availability zones BUT still the same region
How should the naming of placement groups be?
unique within your own AWS account
What does AWS recommend for clustered placement groups?
homogenous instances = same type of hardware and so on in the horizontal scaling
Can you merge placement groups?
no…
Can you move existing instances into a placement group?
no…
but…. you can create an AMI from your existing instance, then launch a new instance from the AMI into a placement group.
Which AWS CLI command should I use to create a snapshot of an EBS volume?
aws ec2 create-snapshot
Individual instances are provisioned in ….
availability zones
What is the underlying Hypervisor for EC2? (choose 2)
Nitro and Xen
Can you attach an EBS volume to more than one EC2 instance at the same time?
no..
What type of storage are EBS volumes?
block based storage
In order to enable encryption at rest using EC2 and Elastic Block Store, you must ________
configure encryption when creating the EBS volume
Which of the following provide the lowest cost EBS options? (choose 2)
- Throughput optimized (st1)
- Cold (sc1)
- Provisioned IOPS (io1)
- General purpose (gp2)
cold (sc1)
throughput optimised (st1)
Is it possible to perform actions on an existing Amazon EBS Snapshot?
Yes, though the AWS APIs, CLI, and AWS Console
EBS Snapshots are backed up to S3 in what manner?
incrementally
Q1: EBS Snapshots are backed up to S3 in what manner?
Incrementally
Q2: You have developed a new web application in the US-West-2 Region that requires six Amazon Elastic Compute Cloud (EC2) instances to be running at all times. US-West-2 comprises three Availability Zones (us-west-2a, us-west-2b, and us-west-2c). You need 100 percent fault tolerance: should any single Availability Zone in us-west-2 become unavailable, the application must continue to run. How would you make sure 6 servers are ALWAYS available? NOTE: each answer has 2 possible deployment configurations. Select the answer that gives TWO satisfactory solutions to this scenario.
Solution 1: us-west-2a with six EC2 instances, us-west-2b with six EC2 instances, and us-west-2c with no EC2 instances. Solution 2: us-west-2a with three EC2 instances, us-west-2b with three EC2 instances, and us-west-2c with three EC2 instances.
You need to work through each case to find which will provide you with the required number of running instances even if one AZ is lost. Hint: always assume that the AZ you lose is the one with the most instances. Remember that the client has stipulated that they MUST have 100% fault tolerance.
Q3: In order to enable encryption at rest using EC2 and Elastic Block Store, you must ________.
Configure encryption when creating the EBS volume
The use of encryption at rest is default requirement for many industry compliance certifications. Using AWS managed keys to provide EBS encryption at rest is a relatively painless and reliable way to protect assets and demonstrate your professionalism in any commercial situation.
Q4: When creating a new security group, all inbound traffic is allowed by default.
False
There are slight differences between a normal ‘new’ Security Group and a ‘default’ security group in the default VPC. For an ‘new’ security group nothing is allowed in by default.
False
There are slight differences between a normal ‘new’ Security Group and a ‘default’ security group in the default VPC. For an ‘new’ security group nothing is allowed in by default.
Q5: You are consulting to a mid-sized company with a predominantly Mac & Linux desktop environment. In passing they comment that they have over 30TB of unstructured Word and spreadsheet documents of which 85% of these documents don’t get accessed again after about 35 days. They wish that they could find a quick and easy solution to have tiered storage to store these documents in a more cost-effective manner without impacting staff access. What options can you offer them? (Choose 2)
Migrate documents to File Gateway presented as NFS and make use of life-cycle using Infrequent Access storage.
Migrate documents to EFS storage and make use of life-cycle using Infrequent Access storage.
Trying to use S3 without File Gateway in front would be a major impact to the user environment. Using File Gateway is the recommended way to use S3 with shared document pools. Life-cycle management and Infrequent Access storage is available for both S3 and EFS. A restriction however is that ‘Using Amazon EFS with Microsoft Windows is not supported’. File Gateway does not support iSCSI in the client side.
Q6: You need to know both the private IP address and public IP address of your EC2 instance. You should ________.
Retrieve the instance Metadata from http://169.254.169.254/latest/meta-data/.
Instance Metadata and User Data can be retrieved from within the instance via a special URL. Similar information can be extracted by using the API via the CLI or an SDK.
Q7: Spread Placement Groups can be deployed across multiple Availability Zones
True
Spread Placement Groups can be deployed across availability zones since they spread the instances further apart. Cluster Placement Groups can only exist in one Availabiity Zone since they are focused on keeping instances together, which you cannot do across Availability Zones
Q8: Can you attach an EBS volume to more than one EC2 instance at the same time?
No
Q9: Which of the following features only relate to Spread Placement Groups?
The placement group can only have 7 running instances per Availability Zone
Spread placement groups have a specific limitation that you can only have a maximum of 7 running instances per Availability Zone and therefore this is the only correct option. Deploying instances in a single Availability Zone is unique to Cluster Placement Groups only and therefore is not correct. The last two remaining options are common to all placement group types and so are not specific to Spread Placement Groups.
Q10: The use of a cluster placement group is ideal _______
Your fleet of EC2 instances requires high network throughput and low latency within a single availability zone.
Cluster Placement Groups are primarily about keeping you compute resources within one network hop of each other on high speed rack switches. This is only helpful when you have compute loads with network loads that are either very high or very sensitive to latency.
Q11: Can I delete a snapshot of an EBS Volume that is used as the root device of a registered AMI?
No
Q12: Standard Reserved Instances can be moved between regions
False
Standard Reserved Instances cannot be moved between regions. You can choose if a Reserved Instance applies to either a specific Availability Zone, or an Entire Region, but you cannot change the region.
Q13: Can Spread Placement Groups be deployed across multiple Availability Zones?
Spread Placement Groups can be deployed across availability zones since they spread the instances further apart. Cluster Placement Groups can only exist in one Availability Zone since they are focused on keeping instances together, which you cannot do across Availability Zones.
Q14: To retrieve instance metadata or user data you will need to use the following IP Address:
http://169.254.169.254
Q15: In addition to choosing the correct EBS volume type for your specific task, what else can be done to increase the performance of your volume? (Choose 3)
Schedule snapshots of HDD based volumes for periods of low use
Stripe volumes together in a RAID 0 configuration.
Ensure that your EC2 instances are types that can be optimized for use with EBS
There are a number of ways you can optimise performance above that of choosing the correct EBS type. One of the easiest options is to drive more I/O throughput than you can provision for a single EBS volume, by striping using RAID 0. You can join multiple gp2, io1, st1, or sc1 volumes together in a RAID 0 configuration to use the available bandwidth for these instances. You can also choose an EC2 instance type that supports EBS optimisation. This ensures that network traffic cannot contend with traffic between your instance and your EBS volumes. The final option is to manage your snapshot times, and this only applies to HDD based EBS volumes. When you create a snapshot of a Throughput Optimized HDD (st1) or Cold HDD (sc1) volume, performance may drop as far as the volume’s baseline value while the snapshot is in progress. This behaviour is specific to these volume types. Therefore you should ensure that scheduled snapshots are carried at times of low usage. The one option on the list which is entirely incorrect is the option that states “Never use HDD volumes, always ensure that SSDs are used” as the question first states “In addition to choosing the correct EBS volume type for your specific task”. HDDs may well be suitable to certain tasks and therefore they shouldn’t be discounted because they may not have the highest specification on paper.
Q16: Amazon’s EBS volumes are ________.
Block based storage
EBS, EFS, and FSx are all storage services base on Block storage.
Q17: What is the underlying Hypervisor for EC2 ? (Choose 2)
ESX
Xen
Until very recently AWS exclusively used Xen Hypervisors, Recently they started making use of Nitro Hypervisors.
Q18: If an Amazon EBS volume is an additional partition (not the root volume), can I detach it without stopping the instance?
Yes, although it may take some time.
Q19: Is it possible to perform actions on an existing Amazon EBS Snapshot?
Yes, through the AWS APIs, CLI, and AWS Console.
Q20: I can use the AWS Console to add a role to an EC2 instance after that instance has been created and powered-up.
True
Q21: To help you manage your Amazon EC2 instances, you can assign your own metadata in the form of ________.
Tags
Tagging is a key part of managing an environment. Even in a lab, it is easy to lose track of the purpose of a resources, and tricky determine why it was created and if it is still needed. This can rapidly translate into lost time and lost money.
Q22: I can change the permissions to a role, even if that role is already assigned to an existing EC2 instance, and these changes will take effect immediately.
True
Q23: Will an Amazon EBS root volume persist independently from the life of the terminated EC2 instance to which it was previously attached? In other words, if I terminated an EC2 instance, would that EBS root volume persist?
Only if I specify (using either the AWS Console or the CLI) that it should do so.
You can control whether an EBS root volume is deleted when its associated instance is terminated. The default delete-on-termination behaviour depends on whether the volume is a root volume, or an additional volume. By default, the DeleteOnTermination attribute for root volumes is set to ‘true.’ However, this attribute may be changed at launch by using either the AWS Console or the command line. For an instance that is already running, the DeleteOnTermination attribute must be changed using the CLI.
Q24: Which of the following provide the lowest cost EBS options? (Choose 2)
Cold (sc1)
Throughput Optimized (st1)
Of all the EBS types, both current and of the previous generation, HDD based volumes will always be less expensive than SSD types. Therefore, of the options available in the question, the Cold (sc1) and Throughout Optimized (st1) types are HDD based and will be the lowest cost options.
Q25: You can add multiple volumes to an EC2 instance and then create your own
True
5/RAID 10/RAID 0 configurations using those volumes.
True
Q26: Which AWS CLI command should I use to create a snapshot of an EBS volume?
aws ec2 create-snapshot
Q27: Individual instances are provisioned ________.
In Availability Zones
What are the two most important features of relational databases in regards to AWS?
- Multi-Availability Zones = for disaster recovery
- Read replicas = for performance
- can send some of the traffic to the read replicas to your site does not crash
What is data warehousing used for?
used to pull in very large and complex data sets… usually used by management to do queries on data
What is OLTP and OLAP?
Online Transaction Processing (OLTP) = for relational databases
and…
Online Analytical Processing (OLAP) (a lot of queries, more complicated) = for non-relational databases
these two differ widely
What is Redshift?
Redshift is for OLAP (online analytical processing) by Amazon. Data warehouse solution by Amazon.
Redshift is used for business intelligence.
What is RDS for?
OLTP: Online Transaction Processing (OLTP) = for relational databases
- SQL
- MySQL
- PostgreSQL
- Oracle
- Aurora
- MariaDB
What does RDS run on?
virtual machines and you have no access to those virtual assistance (you cannot log in to these operating systems)
Patching of the RDS operating system and DB is Amazon’s responsibility
Is RDS serverless?
no…
(with the exception of Aurora Serverless)
What are the types of backups for RDS?
- Automatic backups
- recover your database to any point in time within a “retention period”.
- Automated backups take full daily snapshots
- Automated backups are enabled by default
- Backups are stored in S3
- You Get free storage space equal to the size of your database (10gb RDS Instance = 10gb worth of storage)
- Database Snapshots
- Are user-initiated / done manually
- Stored even after you delete the original RDS instance (unlike automated backups
what happens when you restore a RDS backup?
When you restore a backup, the restored version will be a new RDS instance with a new DNS endpoint.
How does encryption work with RDS backups?
As soon as your RDS instance is encrypted, the data stored at rest in the underlying storage is encrypted, as are its automated backups, read replicas and snapshots.
What is smart about Multi-AZ?
in the event of planned database maintenance, DB instance failure or an Availability Zone failure, Amazon RDS will automatically failover to the standby so that database operations can resume quickly without administrative intervention
the backup/copy of your production database is automated when it has been enabled
What databases is Multi-AZ available for?
- SQL Server
- Oracle
- MySQL Server
- PostgreSQL
- MariaDB
(NOT Aurora as it has its own different architecture)
What are read replicas for?
Read replicas allow you to have a read-only copy of your production database.
You use read-replicas primarily for very read-heavy database workloads
Used for scaling / to increase performance
What databases are read replicas available for?
- Oracle
- MySQL Server
- PostgreSQL
- MariaDB
- Aurora
(NOT for SQL Server)
What databases is encryption at rest supported for?
all 6 database systems. Set up using KMS (Key Management Service)
- SQL Server
- Oracle
- MySQL Server
- PostgreSQL
- MariaDB
- Aurora
How many read replicas can you have of a single database?
5
and you can have read replicas of read replicas (which may give latency)
How does read replicas work multi-AZ?
You can have read replicas that have multi-AZ
and… you can create read replicas of multi-AZ source databases
(you have even have a read replica in a second region)
what must be remembered for replicas in regards to end points?
each read replica will have its own DNS endpoint
What happens if you promote a read replica to master?
it will break the other read replicas
What is DynamoDB?
Amazon’s noSQL database solutions (opposite of RDS)
when need consistent, single-digit millisecond latency at any scale
DynamoDB = SERVERLESS
What should be remembered about DynamoDB?
- Stored on SSD Storage
- Spread across 3 geographically distinct data centres
- Eventual consistent read (default) (1 second)
- Strongly consistent read (optional = less than 1 second)
What is the difference between eventual and strongly consistent read?
- Eventual consistent read
- Consistency across all copies of data is usually reached within a second
- Strongly consistent read
- a strongly consistent read returns a result that reflects all writes that received a successful response prior to the read = this is basically immediate (in less than 1 second)
How is Redshift configured?
- Single-node (160gb)
- or… Multi Node
- Leader node (client connections and receives queries)
- Compute node (store data and perform queries and computations) can have up to 128 compute nodes behind the leqder node
How is Redshift able to compress?
as non-relational database system you can compress the data much more and thus uses much less space
What is MPP?
Massively Parallel Processing
a part of Amazon Redshift that automatically distributes data and query load across all nodes.
for fast query performance as data warehouse grows
How is backups with Redshift?
- Enabled by default with a 1 day retention period
- Maximum retention period is 35 days
- Always attempts to maintain at least 3 copies of your data (original, replica and backup in S3)
- can also replicate snapshots to S3 in another region for disaster recovery
How is redshift priced?
- Compute node Hours = total number of hours you run across all your compute nodes for the billing period
- not charged for leader node hours
- backups
- Data transfer
How is the availability of Redshift?
Only available in 1 availability zone at a time
What is Amazon Aurora?
a MySQL compatible, relational database engine that combines the speed and availability of high-end commercial databases.
what should you know about Aurora?
Starts at 10gb (scales in 10gb increments to 64 TB)
computer resources can scale up to 32vCPUs and 244GB memory
2 copies of your data in contained in each availability zone, with minimum of 3 availability zones (6 copies of your data)
What are the two types of read replicas with Aurora?
- Aurora replicas (up to 15 available)
- automated failover only available with Aurora replicas
- MySQL Read replicas (up to 5 available)
How is backups with Aurora?
- Automated backups are enabled on Amazon Aurora DB instances
- Snapshots are also possible
- and these can be shared with other AWS accounts
What is ElastiCache for?
used to improve the performance of web applications by allowing you to retrieve information from fast, managed, in-memory caches, instead of relying entirely on slower disk-based databases.
used to speed up performance of existing databases (frequent identical queries)
Which open-source in-memory caching engines does ElastiCache support?
- Memcached
- for very simple things
- Redis
- multi-AZ and backup and restores possible
Q1: When you add a rule to an RDS DB security group, you must specify a port number or protocol.
False
Technically a destination port number is needed, however with a DB security group the RDS instance port number is automatically applied to the RDS DB Security Group.
Q2: If I wanted to run a database on an EC2 instance, which of the following storage options would Amazon recommend?
EBS
Q3: What data transfer charge is incurred when replicating data from your primary RDS instance to your secondary RDS instance?
There is no charge associated with this action.
Q4: How many copies of my data does RDS - Aurora store by default?
6
Q5: RDS Reserved instances are available for multi-AZ deployments.
True
Q6: Which of the following AWS services is a non-relational database?
DynamoDB
Q7: MySQL installations default to port number ________.
3306
Q8: Which of the following is most suitable for OLAP?
Redshift would be the most suitable for online analytics processing.
Q9: Which of the following data formats does Amazon Athena support? (Choose 3)
Apache Parquet
JSON
Apache ORC
Amazon Athena is an interactive query service that makes it easy to analyse data in Amazon S3, using standard SQL commands. It will work with a number of data formats including “JSON”, “Apache Parquet”, “Apache ORC” amongst others, but “XML” is not a format that is supported.
Q10: In RDS, what is the maximum value I can set for my backup retention period?
35 Days
Q11: What happens to the I/O operations of a single-AZ RDS instance during a database snapshot or backup?
I/O may be briefly suspended while the backup process initializes (typically under a few seconds), and you may experience a brief period of elevated latency.
Q12: Which set of RDS database engines is currently available?
Oracle, SQL Server, MySQL, PostgreSQL
Q13: If you want your application to check RDS for an error, have it look for an ______ node in the response from the Amazon RDS API.
Error
Q14: Which AWS DB platform is most suitable for OLTP?
RDS
Q15: When creating an RDS instance, you can select the Availability Zone into which you deploy it.
True
Q16: You can RDP or SSH into an RDS instance to see what is going on with the operating system.
False
Q17: AWS’s NoSQL product offering is known as ________.
DynamoDB
Q18: Under what circumstances would I choose provisioned IOPS over standard storage when creating an RDS instance?
If you use online transaction processing in your production environment.
Provisioned IOPS becomes important when you are running production environments requiring rapid responses, such as those which run e-commerce websites. Without high performant responses from an RDS instance page loads of the website could suffer resulting in loss of business. If your workloads are not latency sensitive or you are running a test environment the additional cost of provisioned IOPS will not be cost beneficial to your project.
Q19: You are hosting a MySQL database on the root volume of an EC2 instance. The database is using a large number of IOPS, and you need to increase the number of IOPS available to it. What should you do?
Add 4 additional EBS SSD volumes and create a RAID 10 using these volumes.
Q20: Which of the following DynamoDB features are chargeable, when using a single region? (Choose 2)
Storage of Data
Read and Write Capacity
There will always be a charge for provisioning read and write capacity and the storage of data within DynamoDB, therefore these two answers are correct. There is no charge for the transfer of data into DynamoDB, providing you stay within a single region (if you cross regions, you will be charged at both ends of the transfer.) There is no charge for the actual number of tables you can create in DynamoDB, providing the RCU and WCU are set to 0, however in practice you cannot set this to anything less than 1 so there always be a nominal fee associated with each table.
Q21: If you are using Amazon RDS Provisioned IOPS storage with a Microsoft SQL Server database engine, what is the maximum size RDS volume you can have by default?
16TB
Q22: With new RDS DB instances, automated backups are enabled by default?
True
Q23: In RDS, changes to the backup window take effect ________.
Immediately
Q24: Amazon’s ElastiCache uses which two engines?
Redis & Memcached
Q25: Which of the following is not a feature of DynamoDB?
Single availability zone by default
DynamoDB is the AWS managed NoSQL database service. It has many features that are being added to constantly, making it a great service to use for many different requirements. The feature which was incorrect is DynamoDB only being single availability zone by default making this the correct answer. DynamoDB is distributed across three geographically distinct datacentres by default, all of the other options listed are valid features of DynamoDB.
Q26: Which AWS service is ideal for Business Intelligence Tools/Data Warehousing?
Redshift
Why is it called route53?
because DNS is on port53
What is DNS?
just think of a phone book.
DNS is used to convert human friendly domain names into an IPv4 or IPv6.
So from acloud.guru to 82.124.53.1
What is the difference between IPv4 and IPv6?
- IPv4 is a 32-bit field with +4 billion different addresses
- IPv6 has 128-bits which gives 340 undecillion addresses
- = invented because the 4.3 billion addresses of IPv4 were not enough
Currently both IPv4 and IPv6 are used
What are top level domains?
.com
.edu
.gov(top-level)
.co(second-level).uk(top-level)
.com(second-level).au(top-level)
What is the IANA?
Internet Assigned Numbers Authority
those that make the top-level domains
What is a Domain Registrar?
entities which serve the purpose of organising the distribution of domain names such that they are not duplicated.
all registered domain names end up in WhoIS.
(examples….GoDaddy.com, 123-reg.co.uk, Amazon, DanDomain.dk etc.)
What are NS records?
Name Server Records
used by Top Level Domain servers to direct traffic to the Content DNS server which contains the authoritative DNS records
What is an A record?
An “A” record is the fundamental type of DNS record.
A stands for Address.
The A record is used by a computer to translate the name of the domain to an IP address so from www.acloud.guru to 123.10.10.80
What is TTL?
Time to Live
the length that a DNS record is cached on either the Resolving Server or the users own local PC is equal to the value of the the “time to live” TTL in seconds.
so for example a user could cache your homepage for 48 hours.
What’s a CName?
A Canonical Name … can be used resolve one domain name to another.
essentially just that you have both..
https: //m.acloud.guru and
https: //mobile.acloud.guru
What is alias records for?
used to map resource record sets in your hosted zone to Elastic Load Balancers, CloudFront distributions, or S3 buckets that are configured as websites.
Alias Records work like CNAME records BUT….. CNAME can’t be used for naked domain names (= without www in front of it)
Do Elastic Load Balances have pre-defined IPv4 addresses?
No…
You must resolve to them using a DNS name.
What should you choose if you can choose between Alias Record and CNAME?
Always Alias Record
What are some common DNS types?
- SOA Records (state of authority)
- NS Records (Name Server)
- A Records (Address)
- CNAMES (Canonical Name)
- MX Records
- PTR Records
What routing policies are available with Route53?
- Simple Routing
- Weighted routing
- Latency-based Routing
- Failover Routing
- Geolocation Routing
- GeoProximity Routing
- Multivalue Answer Routing
How does the simple routing policy work?
you can only have one record with multiple IP addresses.
if you specify multiple values (IP addresses) in a record, Route53 returns all values to the user in a random order
(it will pick a new place randomly when the TTL expires)
How does the weighted routing policy work?
allows you to split your traffic based on different weight assigned
fx 10 % to US-EAST-1 and 90% to EU-WEST-1
(remember TTL still determines when you can update and get different results)
How does the latency routing policy work?
Allows you to route your traffic based on the lowest network latency for your end user (which gives them the fastest response time)
to do this you have to create a latency resource record set for the Amazon EC2 (or ELM) resource in each region that hosts your website.
How does the failover routing policy work?
used when you want to create an active/passive set up.
= you may want your primary site to be in EU-WEST-2 and your secondary DR site in AP-SOUTHEAST-2
Route 53 will monitor the health of your primary site using a health check => If a failure is detected in the Active region, users will be directed to the passive.
How does the Geolocation routing policy work?
lets you choose where your traffic will be sent based on the geographic location of your users
= all queries from europe to routed to a fleet of EC2 instances that are specifically configured for European customers (language, prices etc.)
Can be done by country or by continent
(different from latency-based routing)
How does the GeoProximity routing policy work? (out of scope for our exam)
route traffic to your resources based on the geographic location of your users and your resources.
+you can also insert a bias to route more or less traffic to a resource
(only in Route53 traffic flow mode)
How does the Multivalue Answer routing policy work?
lets you configure route53 to return multiple values, such as IP addresses for your web servers, in response to DNS queries.
The same as simple routing HOWEVER multivalue answers allows you to put health checks on each record set.
What is the limit of number of domain names you can manage using Route53?
50 is set by default BUT you can increase this limit by contacting AWS support.
You have created a new subdomain for your popular website, and you need this subdomain to point to an Elastic Load Balancer using Route53. Which DNS record set should you create?
CNAME
Q1: You have created a new subdomain for your popular website, and you need this subdomain to point to an Elastic Load Balancer using Route53. Which DNS record set should you create?
CNAME
Q2: Which of the following Route 53 policies allow you to a) route data to a second resource if the first is unhealthy, and b) route data to resources that have better performance?
Failover Routing and Latency-based Routing
Failover Routing and Latency-based Routing are the only two correct options, as they consider routing data based on whether the resource is healthy or whether one set of resources is more performant than another. Any answer containing location based routing (Geoproximity and Geolocation) cannot be correct in this case, as these types only consider where the client or resources are located before routing the data. They do not take into account whether a resource is online or slow. Simple Routing can also be discounted as it does not take into account the state of the resources.
Q3: True or False: There is a limit to the number of domain names that you can manage using Route 53.
True and False. With Route 53, there is a default limit of 50 domain names. However, this limit can be increased by contacting AWS support.
Q4: Your company hosts 10 web servers all serving the same web content in AWS. They want Route 53 to serve traffic to random web servers. Which routing policy will meet this requirement, and provide the best resiliency?
Multivalue answer routing lets you configure Amazon Route 53 to return multiple values, such as IP addresses for your web servers, in response to DNS queries. Route 53 responds to DNS queries with up to eight healthy records and gives different answers to different DNS resolvers. The choice of which to use is left to the requesting service effectively creating a form or randomisation.
Q5: In AWS Route 53, which of the following are true? (Choose 2)
Route 53 allows you to create an Alias record at the top node of a DNS namespace (zone apex)
Alias Records provide a Route 53–specific extension to DNS functionality
Alias Records have special functions that are not present in other DNS servers. Their main function is to provide special functionality and integration into AWS services. Unlike CNAME records, they can also be used at the Zone Apex, where CNAME records cannot. Alias Records can also point to AWS Resources that are hosted in other accounts by manually entering the ARN.
Q6: Route 53 is Amazon’s DNS Service.
True
Q7: You have an enterprise solution that operates Active-Active with facilities in Regions US-West and India. Due to growth in the Asian market you have been directed by the CTO to ensure that only traffic in Asia (between Turkey and Japan) is directed to the India Region. Which of these will deliver that result? (Choose 2)
Route 53 - Geoproximity routing policy
Route 53 - Geolocation routing policy
The instruction from the CTO is clear that that the division is based on geography. Latency based routing will approximate geographic balance only when all routes and traffic evenly supported which is rarely the case due to infrastructure and day night variations. You cannot combine blacklisting and whitelisting in CloudFront. Weighted routing is randomized and will not respect Geo boundaries. Geolocation is based on national boundaries and will meet the needs well. Geoproximity is based on Latitude & Longitude and will also provide a good approximation with potentially less configuration.
Q8: You are hosting a website and would like visitors from United Kingdom to see a different site than those in Australia. Which Routing Policy would help you to accomplish this?
Geolocation routing policy
Geolocation routing lets you choose the resources that serve your traffic based on the geographic location of your users, meaning the location that DNS queries originate from. For example, you might want all queries from Europe to be routed to an ELB load balancer in the Frankfurt region.
What is a VPC?
A virtual data center in the cloud (logical datacenter in AWS)
…so you create your own data center within AWS and then have a ton of opportunities for customisation and management.
What does a VPC consist of?
- Internet gateways or Virtual Private gateways
- Route Tables
- Network access control lists
- Subnets
- Security groups
What are the two ways into a VPC?
- Internet Gateway
- Virtual Private Gateway
What is VPC peering for?
connect one VPC with another via a direct network route using private IP addresses.
you can also peer VPCs with other AWS accounts
Peering is in a star configuration = 1 central VPC peers with 4 others.
- BUT.. there is no transitive peering (cannot go through A to get to C = has to be direct peering between two)
When you build a VPC from scratch in AWS, what will it create when you launch a new VPC?
- The VPC
- A route table
- A Network ACL
- A default Security group
(no subnets, no internet gateway)
What is NAT instances and NAT gateways?
Network Address Translation instances and gateways
to ensure that the subnets are not public BUT that we can still download software from our private subnet. So NAT are to connect to the internet gateways
(NAT instances are on their way out while NAT gateways are what is used today)
What is a Bastion Host?
special purpose computer on a network specifically designed and configured to withstand attacks.
A Bastion is used to securely administer EC2 instances (Using SSH or RDP).
The computer usually hosts a single application, for example a proxy server, and all other services are removed or limited to reduce the threat to the computer.
(cannot use a NAT Gateway as a Bastion host)
What is Direct Connect?
A cloud service solution that makes it easy to establish a dedicated network connection from your premises to AWS. = a direct connection from your data center to AWS
Useful for high throughput workloads (lots of network traffic) so if you want a stable and reliable and secure connection, use direct connect between your database and AWS
What is a VPC Endpoint?
A VPC endpoint enables you to privately connect your VPC to supported AWS services and VPC endpoint services powered by PrivateLink WITHOUT requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect Connection.
(no need to go outside the AWS network)
What is a load balancer?
physical or virtual device that is designed to help you balance the network load across multiple web servers
What is the X-forwarded for header about?
helps ensure that we actually also get the users public IP after going through the elastic load balancer. without getting the public IPs, we do not know where our users are coming from
What is Cross Zone Load Balancing for?
with no cross zone load balancing, our traffic is split evenly across availability zones…
but we may not have the same amount of instances in the different availability zones.
WITH cross zone load balancing, this is taken care of such that all instances get the same load.
= > Cross zone = the instances can send traffic across availability zones
What are Path Patterns?
path-based routing = you can create a listener with rules to forward requests based on the URL path
example… enabling path patterns here such that we can send traffic regarding www.myurl.com/images to the second availability zone, US-EAST-1B
How would a high-availability / fault-tolerant wordpress site architecture look?
What is API Gateway?
a fully managed service that makes it easy for developers to publish, maintain, monitor and secure APIs at any scale = you can make a “front door” for applications to access stuff from your back-end services
API Gateway scales automatically
What is Kinesis Streams?
a place to store streaming data
within a Kinesis stream, you have SHARDS
What is Kinesis Firehose?
with Kinesis Firehose, the streaming data is not stored, it must instead be analyzed as it comes in and then sent out again
What are Cognito USER pools?
used to manage sign-in and sign-up for mobile and web applications
focused on users and thus handles things like user registration, authentication, and account recovery
What are Cognito IDENTITY pools?
provide temporary AWS credentials to access AWS services like S3 or DynamoDB
identity pools authorise access to your AWS resources
what is the difference between traditional architecture and serverless?
Traditional = user - root53 to ELB - web server - RDS/Database
Serverless = user - API Gateway - Lambda - DynamoDB/AuroraServerless
With serverless you do not have to worry about auto-scaling
What are the 3 types of storage gateway?
- File Gateway (NFS & SMB)
- files stored in your S3 bucket
- Volume Gateway (iSCSI) - to store Hard disk drive in AWS
- Stored Volumes
- store ENTIRE primary data locally and backed up in AWS
- Cached Volumes
- stores the most frequently used data locally (NOT entire data) and the rest of the data in S3
- Stored Volumes
- Tape Gateway (VLT)
- way to archive your data in the AWS cloud = good to move your backup to the cloud
What is partition key about?
The partition key portion of a table’s primary key determines the logical partitions in which a table’s data is stored. (part of DynamoDB)
More partition keys = more data divisions = more division of provisioned I/O capacity = better distribution of workload evenly and less risk of throttling
(DynamoDB stores data as groups of attributes, known as items. Items are similar to rows or records in other database systems. DynamoDB stores and retrieves each item based on the primary key value, which must be unique. Items are distributed across 10-GB storage units, called partitions (physical storage internal to DynamoDB)
Your client is an insurance company that utilizes SAP HANA for their day-to-day ERP operations. Since you can’t migrate this database due to customer preferences, you need to integrate it with your current AWS workload in your VPC in which you are required to establish a site-to-site VPN connection.
What needs to be configured outside of the VPC for you to have a successful site-to-site VPN connection?
An Internet-routable IP address (statis) of the customer gateway’s external interface for the on-premises network.
Although the term VPN connection is a general term, in the Amazon VPC documentation, a VPN connection refers to the connection between your VPC and your own network. AWS supports Internet Protocol security (IPsec) VPN connections.
A customer gateway is a physical device or software application on your side of the VPN connection.
To create a VPN connection, you must create a customer gateway resource in AWS, which provides information to AWS about your customer gateway device. Next, you have to set up an Internet-routable IP address (static) of the customer gateway’s external interface.
An accounting application uses an RDS database configured with Multi-AZ deployments to improve availability. What would happen to RDS if the primary database instance fails?
The canonical name record (CNAME) is switched form the primary to standby instance
In Amazon RDS, failover is automatically handled so that you can resume database operations as quickly as possible without administrative intervention in the event that your primary database instance went down. When failing over, Amazon RDS simply flips the canonical name record (CNAME) for your DB instance to point at the standby, which is in turn promoted to become the new primary.
What are the possible Event Notification destinations available for S3 buckets?
- Lambda Function
- SQS
- SNS
Your company is running a multi-tier web application farm in a virtual private cloud (VPC) that is not connected to their corporate network. They are connecting to the VPC over the Internet to manage the fleet of Amazon EC2 instances running in both the public and private subnets. You have added a bastion host with Microsoft Remote Desktop Protocol (RDP) access to the application instance security groups, but the company wants to further limit administrative access to all of the instances in the VPC.
Which of the following bastion host deployment options will meet this requirement?
Deploy a Windows Bastion host with an elastic IP address in the public subnet and allow RDP access to bastion only from the corporate IP address
The correct answer is to deploy a Windows Bastion host with an Elastic IP address in the public subnet and allow RDP access to bastion only from the corporate IP addresses.
A bastion host is a special purpose computer on a network specifically designed and configured to withstand attacks. If you have a bastion host in AWS, it is basically just an EC2 instance. It should be in a public subnet with either a public or Elastic IP address with sufficient RDP or SSH access defined in the security group. Users log on to the bastion host via SSH or RDP and then use that session to manage other hosts in the private subnets.
What is the shared responsibility model in AWS and who is responsible for what?
Security and Compliance is a shared responsibility between AWS and the customer.
A media company has two VPCs: VPC-1 and VPC-2 with peering connection between each other. VPC-1 only contains private subnets while VPC-2 only contains public subnets. The company uses a single AWS Direct Connect connection and a virtual interface to connect their on-premises network with VPC-1. Which of the following options increase the fault tolerance of the connection to VPC-1?
Establish another AWS Direct Connect connection and private virtual interface in the same AWS region as VPC-1
Establish a hardware VPN over the internet between VPC-1 and the common on-premises network
For data privacy, a healthcare company has been asked to comply with the Health Insurance Portability and Accountability Act (HIPAA). They have been told that all of the data being backed up or stored on Amazon S3 must be encrypted. What is the best option to do this? (Choose 2)
- Before sending the data to amazon S3 over HTTPS, encrypt the data locally first using your own encryption keys
- Enable server-side encryption on an S3 bucket to make use of AES-256 encryption
Server-side encryption is about data encryption at rest—that is, Amazon S3 encrypts your data at the object level as it writes it to disks in its data centers and decrypts it for you when you access it. As long as you authenticate your request and you have access permissions, there is no difference in the way you access encrypted or unencrypted objects. For example, if you share your objects using a pre-signed URL, that URL works the same way for both encrypted and unencrypted objects.
You are working for a University as their AWS Consultant. They want to have a disaster recovery strategy in AWS for mission-critical applications after suffering a disastrous outage wherein they lost student and employee records. They don’t want this to happen again but at the same time want to minimize the monthly costs. You are instructed to set up a minimal version of the application that is always available in case of any outages. The DR site should only run the most critical core elements of your system in AWS to save cost which can be rapidly upgraded to a full-scale production environment in the event of system outages.
Which of the following disaster recovery architectures is the most cost-effective type to use in this scenario?
The correct answer is Pilot Light.
The term pilot light is often used to describe a DR scenario in which a minimal version of an environment is always running in the cloud. The idea of the pilot light is an analogy that comes from the gas heater. In a gas heater, a small flame that’s always on can quickly ignite the entire furnace to heat up a house. This scenario is similar to a backup-and-restore scenario.
For example, with AWS you can maintain a pilot light by configuring and running the most critical core elements of your system in AWS. When the time comes for recovery, you can rapidly provision a full-scale production environment around the critical core.
You have a new, dynamic web app written in MEAN stack that is going to be launched in the next month. There is a probability that the traffic will be quite high in the first couple of weeks. In the event of a load failure, how can you set up DNS failover to a static website?
For this scenario, using Route 53 with the failover option to a static S3 website bucket or CloudFront distribution is correct. You can create a new Route 53 with the failover option to a static S3 website bucket or CloudFront distribution as an alternative.
A start-up company has an EC2 instance that is hosting a web application. The volume of users is expected to grow in the coming months and hence, you need to add more elasticity and scalability in your AWS architecture to cope with the demand.
Which of the following options can satisfy the above requirement for the given scenario? (Choose 2)
Using an Elastic Load Balancer is an ideal solution for adding elasticity to your application. Alternatively, you can also create a policy in Route 53, such as a Weighted routing policy, to evenly distribute the traffic to 2 or more EC2 instances. Hence, setting up two EC2 instances and then put them behind an Elastic Load balancer (ELB) and setting up two EC2 instances and using Route 53 to route traffic based on a Weighted Routing Policy are the correct answers.
As a Network Architect developing a food ordering application, you need to retrieve the instance ID, public keys, and public IP address of the EC2 server you made for tagging and grouping the attributes into your internal application running on-premises. Which EC2 feature will help you achieve your requirements?
Instance Metadata
Instance metadata is the data about your instance that you can use to configure or manage the running instance. You can get the instance ID, public keys, public IP address and many other information from the instance metadata by firing a URL command in your instance to this URL:
http://169.254.169.254/latest/meta-data/
You are working as a Solutions Architect for a start-up company that has a not-for-profit crowdfunding platform hosted in AWS. Their platform allows people around the globe to raise money for social enterprise projects including challenging circumstances like accidents and illnesses. Since the system handles financial transactions, you have to ensure that your cloud architecture is secure.
Which of the following AWS services encrypts data at rest by default?
- Amazon S3 Glacier
- AWS Storage Gateway
All data transferred between any type of gateway appliance and AWS storage is encrypted using SSL. By default, all data stored by AWS Storage Gateway in S3 is encrypted server-side with Amazon S3-Managed Encryption Keys (SSE-S3). Also, when using the file gateway, you can optionally configure each file share to have your objects encrypted with AWS KMS-Managed Keys using SSE-KMS. This is the reason why AWS Storage Gateway is correct.
Data stored in Amazon Glacier is protected by default; only vault owners have access to the Amazon Glacier resources they create. Amazon Glacier encrypts your data at rest by default and supports secure data transit with SSL. This is the reason why Amazon S3 Glacier is correct.
A corporate and investment bank has recently decided to adopt a hybrid cloud architecture for their Trade Finance web application which uses an Oracle database with Oracle Real Application Clusters (RAC) configuration. Since Oracle RAC is not supported in RDS, they decided to launch their database in a large On-Demand EC2 instance instead, with multiple EBS Volumes attached. As a Solutions Architect, you are responsible to ensure the security, availability, scalability, and disaster recovery of the whole architecture. In this scenario, which of the following will enable you to take backups of your EBS volumes that are being used by the Oracle database?
Create snapshots of the EBS volumes
Creating snapshots of the EBS Volumes is correct. You can back up the data on your Amazon EBS volumes to Amazon S3 by taking point-in-time snapshots. Snapshots are incremental backups, which means that only the blocks on the device that have changed after your most recent snapshot are saved.
This minimizes the time required to create the snapshot and saves on storage costs by not duplicating data. When you delete a snapshot, only the data unique to that snapshot is removed. Each snapshot contains all of the information needed to restore your data (from the moment the snapshot was taken) to a new EBS volume.
As an AWS Cloud Consultant working for a record company, you are building an application that will store both key-value store and document models like band ID, album ID, song ID and composer ID.
Which AWS service will suit your needs for your application?
DynamoDB
Amazon DynamoDB is a fast and flexible NoSQL database service for all applications that need consistent, single-digit millisecond latency at any scale. It is a fully managed cloud database and supports both document and key-value store models. Its flexible data model, reliable performance, and automatic scaling of throughput capacity makes it a great fit for mobile, web, gaming, ad tech, IoT, and many other applications.
The following diagram shows an example of data stored as key-value pairs in DynamoDB:
Your customer is building an internal application that serves as a repository for images uploaded by a couple of users. Whenever a user uploads an image, it would be sent to Kinesis for processing before it is stored in an S3 bucket. Afterwards, if the upload was successful, the application will return a prompt telling the user that the upload is successful. The entire processing typically takes about 5 minutes to finish.
Which of the following options will allow you to asynchronously process the request to the application in the most cost-effective manner?
Create a Lambda function that will asynchronously process the requests.
AWS Lambda supports synchronous and asynchronous invocation of a Lambda function. You can control the invocation type only when you invoke a Lambda function. When you use an AWS service as a trigger, the invocation type is predetermined for each service. You have no control over the invocation type that these event sources use when they invoke your Lambda function. Since the processing only takes 5 minutes, Lambda is also a cost-effective choice.
You are instructed by your manager to set up a bastion host in your Amazon VPC and it should only be accessed from the corporate data center via SSH. What is the best way for you to achieve this?
The best way to implement a bastion host is to create a small EC2 instance which should only have a security group from a particular IP address for maximum security. This will block any SSH Brute Force attacks on your bastion host. It is also recommended to use a small instance rather than a large one because this host will only act as a jump server to connect to other instances in your VPC and nothing else.
You have a static corporate website hosted in a standard S3 bucket and a new web domain name which was registered using Route 53. You are instructed by your manager to integrate these two services in order to successfully launch their corporate website.
What are the prerequisites when routing traffic using Amazon Route 53 to a website that is hosted in an Amazon S3 Bucket?
Here are the prerequisites for routing traffic to a website that is hosted in an Amazon S3 Bucket:
- An S3 bucket that is configured to host a static website. The bucket must have the same name as your domain or subdomain. For example, if you want to use the subdomain portal.tutorialsdojo.com, the name of the bucket must be portal.tutorialsdojo.com.
- A registered domain name. You can use Route 53 as your domain registrar, or you can use a different registrar.
- Route 53 as the DNS service for the domain. If you register your domain name by using Route 53, we automatically configure Route 53 as the DNS service for the domain.
A company has an OLTP (Online Transactional Processing) application that is hosted in an Amazon ECS cluster using the Fargate launch type. It has an Amazon RDS database that stores data of its production website. The Data Analytics team needs to run queries against the database to track and audit all user transactions. These query operations against the production database must not impact application performance in any way.
Which of the following is the MOST suitable and cost-effective solution that you should implement?
Set up a new Amazon RDS Read Replica of the production database. Direct the Data Analytics team to query the production data from the replica.
Amazon RDS Read Replicas provide enhanced performance and durability for database (DB) instances. This feature makes it easy to elastically scale out beyond the capacity constraints of a single DB instance for read-heavy database workloads.
You can create one or more replicas of a given source DB Instance and serve high-volume application read traffic from multiple copies of your data, thereby increasing aggregate read throughput. Read replicas can also be promoted when needed to become standalone DB instances. Read replicas are available in Amazon RDS for MySQL, MariaDB, Oracle and PostgreSQL, as well as Amazon Aurora.
You can reduce the load on your source DB instance by routing read queries from your applications to the read replica. These replicas allow you to elastically scale out beyond the capacity constraints of a single DB instance for read-heavy database workloads.
Because read replicas can be promoted to master status, they are useful as part of a sharding implementation. To shard your database, add a read replica and promote it to master status, then, from each of the resulting DB Instances, delete the data that belongs to the other shard.
When should you use Instance Stores, EFS, S3 and EBS?
You are working for a tech company which currently has an on-premises infrastructure. They are currently running low on storage and want to have the ability to extend their storage using AWS cloud.
Which AWS service can help you achieve this requirement?
Amazon Storage Gateway
AWS Storage Gateway connects an on-premises software appliance with cloud-based storage to provide seamless integration with data security features between your on-premises IT environment and the AWS storage infrastructure. You can use the service to store data in the AWS Cloud for scalable and cost-effective storage that helps maintain data security.
You are managing an online platform which allows people to easily buy, sell, spend, and manage their cryptocurrency. To meet the strict IT audit requirements, each of the API calls on all of your AWS resources should be properly captured and recorded. You used CloudTrail in your VPC to help you in the compliance, operational auditing, and risk auditing of your AWS account.
In this scenario, where does CloudTrail store all of the logs that it creates?
S3…
CloudTrail is enabled on your AWS account when you create it. When activity occurs in your AWS account, that activity is recorded in a CloudTrail event. A trail is a configuration that enables delivery of events to an Amazon S3 bucket that you specify.
You are managing a global news website which is deployed to AWS and is using MySQL RDS. The website has millions of viewers from all over the world which means that the website has read-heavy database workloads. All database transactions must be ACID compliant to ensure data integrity.
In this scenario, which of the following is the best option to use to increase the read throughput on the MySQL database?
Enable Amazon RDS Read Replicas
Amazon RDS Read Replicas provide enhanced performance and durability for database (DB) instances. This feature makes it easy to elastically scale out beyond the capacity constraints of a single DB instance for read-heavy database workloads. You can create one or more replicas of a given source DB Instance and serve high-volume application read traffic from multiple copies of your data, thereby increasing aggregate read throughput. Read replicas can also be promoted when needed to become standalone DB instances. Read replicas are available in Amazon RDS for MySQL, MariaDB, Oracle and PostgreSQL as well as Amazon Aurora.
An online trading platform with thousands of clients across the globe is hosted in AWS. To reduce latency, you have to direct user traffic to the nearest application endpoint to the client. The traffic should be routed to the closest edge location via an Anycast static IP address. AWS Shield should also be integrated into the solution for DDoS protection.
Which of the following is the MOST suitable service that the Solutions Architect should use to satisfy the above requirements?
AWS Global Accelerator
AWS Global Accelerator and Amazon CloudFront are separate services that use the AWS global network and its edge locations around the world. CloudFront improves performance for both cacheable content (such as images and videos) and dynamic content (such as API acceleration and dynamic site delivery). Global Accelerator improves performance for a wide range of applications over TCP or UDP by proxying packets at the edge to applications running in one or more AWS Regions. Global Accelerator is a good fit for non-HTTP use cases, such as gaming (UDP), IoT (MQTT), or Voice over IP, as well as for HTTP use cases that specifically require static IP addresses or deterministic, fast regional failover. Both services integrate with AWS Shield for DDoS protection.
What is AWS Global Accelerator?
AWS Global Accelerator is a service that improves the availability and performance of your applications with local or global users. … AWS Global Accelerator continually monitors the health of your application endpoints and will detect an unhealthy endpoint and redirect traffic to healthy endpoints in less than 1 minute.
You have a web-based order processing system which is currently using a queue in Amazon SQS. The support team noticed that there are a lot of cases where an order was processed twice. This issue has caused a lot of trouble in your processing and made your customers very unhappy. Your IT Manager has asked you to ensure that this issue does not happen again.
What can you do to prevent this from happening again in the future?
Amazon SWF provides useful guarantees around task assignment. It ensures that a task is never duplicated and is assigned only once. Thus, even though you may have multiple workers for a particular activity type (or a number of instances of a decider), Amazon SWF will give a specific task to only one worker (or one decider instance). Additionally, Amazon SWF keeps at most one decision task outstanding at a time for a workflow execution. Thus, you can run multiple decider instances without worrying about two instances operating on the same execution simultaneously. These facilities enable you to coordinate your workflow without worrying about duplicate, lost, or conflicting tasks.
You have an Auto Scaling group which is configured to launch new t2.micro EC2 instances when there is a significant load increase in the application. To cope with the demand, you now need to replace those instances with a larger t2.2xlarge instance type. How would you implement this change?
create a new launch configuration with the new instance type and update the Auto Scaling Group.
You can only specify one launch configuration for an Auto Scaling group at a time, and you can’t modify a launch configuration after you’ve created it. Therefore, if you want to change the launch configuration for an Auto Scaling group, you must create a launch configuration and then update your Auto Scaling group with the new launch configuration.
A leading IT consulting company has an application which processes a large stream of financial data by an Amazon ECS Cluster then stores the result to a DynamoDB table. You have to design a solution to detect new entries in the DynamoDB table then automatically trigger a Lambda function to run some tests to verify the processed data. What solution can be easily implemented to alert the Lambda function of new entries while requiring minimal configuration change to your architecture?
Enable DynamoDB Streams to capture table activity and automatically trigger the Lambda function..
Amazon DynamoDB is integrated with AWS Lambda so that you can create triggers—pieces of code that automatically respond to events in DynamoDB Streams. With triggers, you can build applications that react to data modifications in DynamoDB tables.
If you enable DynamoDB Streams on a table, you can associate the stream ARN with a Lambda function that you write. Immediately after an item in the table is modified, a new record appears in the table’s stream. AWS Lambda polls the stream and invokes your Lambda function synchronously when it detects new stream records.
A Solutions Architect is designing the cloud architecture for the enterprise application suite of the company. Both the web and application tiers need to access the Internet to fetch data from public APIs. However, these servers should be inaccessible from the Internet.
Which of the following steps should the Architect implement to meet the above requirements?
Deploy a NAT gateway in the public subnet and add a route to it from the private subnet where the web and application tiers are hosted.
A web application is hosted in an Auto Scaling group of EC2 instances deployed across multiple Availability Zones in front of an Application Load Balancer. You need to implement an SSL solution for your system to improve its security which is why you requested an SSL/TLS certificate from a third-party certificate authority (CA).
Where can you safely import the SSL/TLS certificate of your application? (Choose 2)
- AWS Certificate Manager
- IAM Certificate Store
If you got your certificate from a third-party CA, import the certificate into ACM or upload it to the IAM certificate store. Hence, AWS Certificate Manager and IAM certificate store are the correct answers.
You are working as a Solutions Architect for a global game development company. They have a web application currently running on twenty EC2 instances as part of an Auto Scaling group. All twenty instances have been running at a maximum of 100% CPU Utilization for the past 40 minutes however, the Auto Scaling group has not added any additional EC2 instances to the group.
What could be the root cause of this issue? (Choose 2)
You are limited to running up to a total of 20 On-Demand instances across the instance family, purchasing 20 Reserved Instances, and requesting Spot Instances per your dynamic Spot limit per region.
If the maximum size of your Auto Scaling group has already been reached, then it would not create any new EC2 instance.
Hence, the correct answers are:
- You already have 20 on-demand instances running in your entire VPC.
- The maximum size of your Auto Scaling group is set to twenty.
A large insurance company has an AWS account that contains three VPCs (DEV, UAT and PROD) in the same region. UAT is peered to both PROD and DEV using a VPC peering connection. All VPCs have non-overlapping CIDR blocks. The company wants to push minor code releases from Dev to Prod to speed up time to market. Which of the following options helps the company accomplish this?
Create a new VPC peering connection between PROD and DEV with the appropriate routes.
A VPC peering connection is a networking connection between two VPCs that enables you to route traffic between them privately. AWS uses the existing infrastructure of a VPC to create a VPC peering connection; it is neither a gateway nor a VPN connection and does not rely on a separate piece of physical hardware. There is no single point of failure for communication or a bandwidth bottleneck.
In Amazon EC2, you can manage your instances from the moment you launch them up to their termination. You can flexibly control your computing costs by changing the EC2 instance state. Which of the following statements is true regarding EC2 billing? (choose 2)
- you will be billed when your Reserved Instance is in terminated state
- you will be billed when you On-Demand instance is in pending state
- you will be billed when your on demand instance is preparing to hibernate with a stopping state
- you will be billed when your Spot instance is preparing to stop with a stopping state
- you will not be billed for any instance usage while an instance is not in the running state
- you will be billed when your Reserved Instance is in terminated state
- you will be billed when your on demand instance is preparing to hibernate with a stopping state
You are a Solutions Architect for a major TV network. They have a web application running on eight Amazon EC2 instances, consuming about 55% of resources on each instance. You are using Auto Scaling to make sure that eight instances are running at all times. The number of requests that this application processes are consistent and do not experience spikes. Your manager instructed you to ensure high availability of this web application at all times to avoid any loss of revenue. You want the load to be distributed evenly between all instances. You also want to use the same Amazon Machine Image (AMI) for all EC2 instances. How will you be able to achieve this?
The best option to take is to deploy four EC2 instances in one Availability Zone and four in another availability zone in the same region behind an Amazon Elastic Load Balancer. In this way, if one availability zone goes down, there is still another available zone that can accommodate traffic.
Take note that Auto Scaling will launch additional EC2 instances to the remaining Availability Zone/s in the event of an Availability Zone outage in the region.
You are working for an investment bank as their IT Consultant. You are working with their IT team to handle the launch of their digital wallet system. The applications will run on multiple EBS-backed EC2 instances which will store the logs, transactions, and billing statements of the user in an S3 bucket. Due to tight security and compliance requirements, you are exploring options on how to safely store sensitive data on the EBS volumes and S3. Which of the below options should be carried out when storing sensitive data on AWS? (Choose 2)
- Use AWS Shiled and WAF
- Create an EBS snapshot
- Migrate the EC2 instances from the public to private subnet
- enable Amazon S3 Server-Side or use Client-Side Encryption
- enable EBS encryption
- enable Amazon S3 Server-side or use Client-side encryption
- enable EBS encryption
Enabling EBS Encryption and enabling Amazon S3 Server-Side or use Client-Side Encryption are correct. Amazon EBS encryption offers a simple encryption solution for your EBS volumes without the need to build, maintain, and secure your own key management infrastructure.
You are a new Solutions Architect in your company. Upon checking the existing Inbound Rules of your Network ACL, you saw this configuration:
You are the Solutions Architect for your company’s AWS account of approximately 300 IAM users. They have a new company policy that will change the access of 100 of the IAM users to have a particular sort of access to Amazon S3 buckets. What will you do to avoid the time-consuming task of applying the policy at the individual user?
Create a new IAM group and then add the users that require access to the S3 bucket. Afterwards, apply the policy to IAM group.
= . This will enable you to easily add, remove, and manage the users instead of manually adding a policy to each and every 100 IAM users.
You are unable to connect to your new EC2 instance via SSH from your home computer, which you have recently deployed. However, you were able to successfully access other existing instances in your VPC without any issues. Which of the following should you check and possibly correct to restore connectivity?
Configure the Security Group of the EC2 instance to permit ingress traffic over port 22 from your IP..
=> When connecting to your EC2 instance via SSH, you need to ensure that port 22 is allowed on the security group of your EC2 instance.
A security group acts as a virtual firewall that controls the traffic for one or more instances. When you launch an instance, you associate one or more security groups with the instance. You add rules to each security group that allow traffic to or from its associated instances. You can modify the rules for a security group at any time; the new rules are automatically applied to all instances that are associated with the security group.
A global online sports betting company has its popular web application hosted in AWS. They are planning to develop a new online portal for their new business venture and they hired you to implement the cloud architecture for a new online portal that will accept bets globally for world sports. You started to design the system with a relational database that runs on a single EC2 instance, which requires a single EBS volume that can support up to 30,000 IOPS. In this scenario, which Amazon EBS volume type can you use that will meet the performance requirements of this new online portal?
EBS Provisioned IOPS SSD (io1)
The scenario requires a storage type for a relational database with a high IOPS performance. For these scenarios, SSD volumes are more suitable to use instead of HDD volumes. Remember that the dominant performance attribute of SSD is IOPS while HDD is Throughput.
You are working for a data analytics company as a Software Engineer, which has a client that is setting up an innovative checkout-free grocery store. You developed a monitoring application that uses smart sensors to collect the items that your customers are getting from the grocery’s refrigerators and shelves then automatically maps it to their accounts. To know more about the buying behavior of your customers, you want to analyze the items that are constantly being bought and store the results in S3 for durable storage. What service can you use to easily capture, transform, and load streaming data into Amazon S3, Amazon Elasticsearch Service, and Splunk?
Amazon Kinesis Data Firehose
Amazon Kinesis Data Firehose is the easiest way to load streaming data into data stores and analytics tools. It can capture, transform, and load streaming data into Amazon S3, Amazon Redshift, Amazon Elasticsearch Service, and Splunk, enabling near real-time analytics with existing business intelligence tools and dashboards you are already using today.
what llows you to connect your AWS cloud resources to your on-premises data center using secure and private sessions with IP security (IPSec) or Transport Layer Security TLS tunnels?
VPN!
