Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Certified Solutions Architect - Associate > CloudFront > Flashcards

CloudFront Flashcards

1
Q

What does CloudFront provide?

A

CloudFront uses caching and an efficient global network to improve the delivery of content from its original location to the viewers of that content.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is an origin in CloudFront?

A

The origin is the source location of your content. It can be an S3 origin or a custom origin (a web server with a publicly routable IPv4 address).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is a distribution in CloudFront?

A

A distribution is the configuration unit of CloudFront.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is an Edge Location in CloudFront?

A

An Edge Location is a local cache of your data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a Regional Edge Cache in CloudFront?

A

A Regional Edge Cache is a larger version of an Edge Location that provides another layer of caching for content that is accessed less frequently, but still benefits from being cached closer to customers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What rules must a CloudFront distribution domain name adhere to?

A

It must be unique and it must end in “cloudfront.net”.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Does CloudFront support SSL certificates?

A

Yes, CloudFront integrates with AWS Certificate Manager (ACM).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Does CloudFront support upload caching?

A

No, uploads are sent directly to the Origin. CloudFront supports read-only caching.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are Behaviors in CloudFront?

A

Behaviors are part of a Distribution and define Origins, Origin Groups, TTL, Protocol Policies, and restricted access. Behaviors are configured with a path patterns (e.g., * or img/*). If a request matches a pattern (most specific wins), that Behavior is used.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

When an expired cached object is requested at an Edge Location, what HTTP codes may be returned by the Origin when the Edge Location requests an update?

A

304 Not Modified (if the version in the cache is the small as the one in the Origin)

200 OK (along with a new version of the object)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a benefit of more frequent cache hits on Edge Locations in CloudFront?

A

Lower load on the Origin.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the default TTL for an object in a CloudFront cache?

A

24 hours.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What headers are used by the Origin to set the TTL value for an object?

A

Cache-Control max-age [seconds]
Cache-Control s-maxage [seconds]
Expires [Date & Time]

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What can override the TTL value of an object in a CloudFront cache?

A

The minimum and maximum TTL values for the Behavior.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How do you manually invalidate specific objects in CloudFront?

A

You can use Cache Invalidation to invalidate specific paths (/images/cats.jpg or /images/* or /*) in a distribution. The invalidation is not instant (it takes time) and there is a cost.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is an alternative to Cache Invalidation?

A

Using versioned file names (cats_v1.jpg, cats_v2.jpg, etc.). The benefit is that you can update the application to point at the new name and it won’t matter that the old version is cached. Also, even if the old version is cached in the user’s browser, the new version will be used.

Logging is also more effective because you will know exactly which version of the object is being used.

17
Q

Does CloudFront support SSL by default?

A

Yes, via the default domain name (xyz.cloudfront.net) and the *.cloudfront.net certificate.

If you want to use your own domain name, you need to add a matching certificate in ACM in us-east-1.

18
Q

What type of certificates are needed for both SSL connections in a CloudFront deployment (View => CloudFront and CloudFront => Origin)?

A

Valid public certificates. Self-signed certs will not work.

19
Q

When using older browsers that don’t support Server Name Indication (SNI) what does each CloudFront Edge Location require?

A

A dedicated IP at each Edge Location.

20
Q

If your S3 bucket is configured to host a static website, what type of origin does CloudFront consider it to be?

A

A custom origin. Any non-static website S3 buckets are considered S3 origins.

21
Q

How do you restrict an S3 bucket so that it is only accessible via CloudFront.

A

By setting origin access control in the origin in CloudFront.

22
Q

How do you restrict a custom origin so that it is only accessible via CloudFront.

A

By accepting custom headers that are included in all requests that CloudFront sends to the origin. These headers are defined in the origin configuration in CloudFront.

Alternatively, you can set your firewall rules to only allow access from the CloudFront IP range, which is published by AWS.

23
Q

What is an Origin Access Identity?

A

An OAI can be associated with CloudFront Distributions. When requesting content from an S3 origin, CloudFront “becomes” the OAI. Since the OAI can be used in S3 Bucket Policies, you can DENY all but one or more OAIs to ensure that the S3 bucket is only accessed via CloudFront.

24
Q

What do you need to access Private Distribution in CloudFront?

A

A signed cookie or signed URL.

25
Q

What is a Trusted Signer in CloudFront?

A

A Trusted Signer holds a CloudFront Key (created by the Account Root User for the account that owns the CloudFront distribution). The Trusted Signer can create signed cookies and signed URLs for Private Distributions in CloudFront.

26
Q

What is the preferred method for generating signed cookies and signed URLs to access Private Distributions in CloudFront?

A

Trusted Key Groups.

27
Q

What do Signed URLs provide access to in CloudFront Private Distributions?

A

One object.

28
Q

What do Signed cookies provide access to in CloudFront Private Distributions?

A

Groups of objects.

29
Q

When should you use signed URLs and when should you use signed cookies for Private Distributions in CloudFront?

A

Signed URLs
- To access a single object
- If your client doesn’t support cookies

Signed cookies
- To access groups of objects
- To access all files of a type (e.g., all gifs)
- If you want to control the format of the URL

AWS Certified Solutions Architect - Associate (49 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions