Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Advanced Network Specialty > CloudFront > Flashcards

CloudFront Flashcards

1
Q

In CloudFront, what is the Origin?

A

The source of the original version of your content to be cached.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

In CloudFront, what is a Distribution?

A

A Distribution is the configuration entity within CloudFront that defines how your content is delivered to end users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

In CloudFront, what are Edge Locations?

A

They are local caches of your data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

In CloudFront, where are Distributions pushed out to?

A

Edge Locations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

In CloudFront, what are Regional Edge Caches?

A

Larger caches that are fewer in number but larger in size.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

In CloudFront what is it called, and what happens, if a user requests some content and the Edge Location doesn’t have it?

A

It’s called a Cache Miss.
The Edge Location will check the Regional Edge Cache.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

With CloudFront, what happens if the Regional Edge Cache doesn’t have the content that an Edge Location has requested?

A

It performs an Origin Fetch.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Does CloudFront work with SSL/TLS certificates for HTTPS?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Does CloudFront integrate with ACM?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How does write-caching work with CloudFront?

A

Write-caching isn’t supported with CloudFront.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

With CloudFront, where do uploads go?

A

Directly to the Origin. Write-caching isn’t supported.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

With CloudFront, what are Behaviours?

A

They are sub-configurations within Distributions, are associated with a path pattern. They allow multiple configurations of Origins and cache behaviour.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How many Behaviours can there be in a CloudFront Distribution?

A

Minimum of one, but there can be more.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the default TTL for a Behaviour?

A

24 hours.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What other TTL values can be set at the Behaviour level?

A

Minimum TTL and Maximum TTL.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What effect do the Behaviour-level minimum and maximum TTL values have?

A

They limit the range of TTL values that objects can use.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What happens if an object’s TTL value is outside the Behaviour-level minimum or maximum TTL values?

A

The object’s TTL will be re-set to the limit that it exceeded.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the three Origin headers that can define TTL at a per-object level (including their unit) ?

A
  1. Cache-Control max-age (seconds)
  2. Cache-Control s-maxage (seconds)
  3. Expires (date & time)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What first step occurs when a request is made to an Edge Location for an object whose TTL has expired?

A

The Edge Location will forward the request to the Origin.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

When an Edge Location forwards a request to the Origin for a TTL-expired object, what does the Origin do if the object is unchanged?

A

It will respond with HTTP 304 (Not Modified).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

When the Edge Location receives an HTTP Not Modified from the Origin, what will it do next?

A

The Edge Location will deliver the object to the user from its cache.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

When an Edge Location forwards a request to the Origin for a TTL-expired object, what does the Origin do if the object has changed?

A

The Origin sends an HTTP 200 response that includes the new version of the object.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

How are object-level TTLs set when using S3?

A

They are set via object metadata.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

How are object-level TTLs set when using a Custom Origin?

A

They are set by the web/application server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Is filename versioning related to S3 object versioning?

A

No! They are completely separate things.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

At what level are cache invalidations performed?

A

They are performed on the whole Distribution.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Are all Edge Locations affected by a cache invalidation?

A

Yes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What does a cache invalidation do?

A

It immediately expires any objects that match a specified pattern, such as /images/*

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is the main downside of using invalidations?

A

There is an AWS charge.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is the recommended alternative to using invalidations?

A

Versioned filenames.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What are the four benefits of using versioned filenames?

A
  1. Avoids invalidations
  2. Avoids stale versions cached by web browsers
  3. Logs will be more useful because object names will indicate the version.
  4. Allows Edge Locations to retain previous versions.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is the most cost-effective way to handle frequently updated objects, instead of using cache invalidation?

A

Versioned filenames.
This will avoid the AWS charge for invalidations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What format does the CloudFront distribution default CNAME have?

A

[random-characters].cloudfront.net

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

You have created a new CloudFront distribution but have not created a certificate or assigned an alternate domain name. Does this distribution support SSL?

A

Yes, using a default CNAME.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

How does CloudFront support SSL by default without requiring the user to issue their own certificate?

A

It uses a wildcard certificate for *.cloudfront.net

36
Q

What does the Alternate Domain Name feature allow you to do?

A

Use your own domain name to front your CloudFront distribution, eg. www.catagram.io.

37
Q

When configuring an alternate domain name for your CloudFront distribution, why is it better to use a certificate to prove domain ownership, if that domain is hosted on Route 53?

A

Because you’ll need a certificate for SSL anyway (ie. one that matches your custom domain).

38
Q

What must the SAN of the certificate match? (two possibilities)

A

The SAN must be the same as alternate domain name, OR a wildcard that matches it.

39
Q

Can SAN wildcards match greater than one level of subdomain? E.g. if the SAN says *.catagram.io, can the cert be used for a domain name web.corp.catagram.io?

A

No.

40
Q

In a given client-server session via CloudFront, how many SSL sessions exist?

A

Two.

41
Q

In a given client-server session via CloudFront, what are the two SSL connections called?

A
  1. The Viewer connection or request
  2. The Origin connection or request
42
Q

When generating certificates with CloudFront, what ACM region must you use? Why?

A

us-east-1, because CF distributions are always tied to the us-east-1 region.

43
Q

Do the Viewer and Origin SSL sessions require their own valid certificates?

A

Yes.

44
Q

When was the SNI extension to TLS introduced?

A

2003.

45
Q

Prior to the introduction of SNI, why wasn’t it possible for a TLS-terminating web server to serve multiple websites from the same IP?

A

Because the only way to know which site a user is requesting is via the HTTP header “Host”; but HTTP (layer 7) cannot be established until TLS (layer 4) is established, and TLS can’t match the FQDN to the certificate if it doesn’t know which certificate to serve to the user.

46
Q

In technical terms, what does the SNI extension allow TLS to include in its handshake, and what does this allow the server to do?

A

To include Host (ie. the requested FQDN) information in the TLS handshake, allowing the server to respond with the associated certificate for that FQDN.

47
Q

You have clients with older web browsers - what is the issue with SNI here?

A

Older browsers won’t support it.

48
Q

What is the CloudFront mitigation for older browsers that don’t support SNI?

A

Dedicated IPs.

49
Q

Why would you choose to use the CloudFront dedicated IP option?

A

Because your clients don’t support SNI (usually because of older web browsers)

50
Q

What is the downside of the CloudFront dedicated IP option?

A

Cost. Around $600pcm per distribution.

51
Q

Broadly speaking, what do Origin Access Identity (OAI) and Origin Access Control (OAC) do?

A

They restrict access to CloudFront origins, usually to prevent clients accessing the origin directly.

52
Q

What is Origin Access Identity (OAI) designed to protect?

A

S3 buckets ONLY.

53
Q

How does Origin Access Identity (OAI) protect S3 buckets?

A

By creating a special user, which CloudFront uses to access your S3 bucket, ensuring that only CloudFront can serve the content from the S3 bucket.

54
Q

What types of origins can OAC protect? (Two types)

A

Both S3 origins and custom origins.

55
Q

When OAC is enabled, what effect does it have on Origin requests?

A

OAC signs the Edge Location’s request to the origin.

56
Q

What two methods can be used to secure CloudFront custom origins?

A
  1. Use OAC to add a custom header, which the origin is configured to authenticate & authorise.
  2. Firewalling the origin with a whitelist based on the published list of Edge Location IPs.
57
Q

Can OAI protect custom origins?

A

No. It can only protect S3.

58
Q

Can OAC use IAM for granular control?

A

Yes.

59
Q

Can OAI use IAM for granular control?

A

No.

60
Q

Does CloudFront Geo Restriction allow whitelisting/blacklisting by city?

A

No, it can only provide country-level granularity.

61
Q

What is the main advantage of using CloudFront Geo Restriction?

A

Simplicity - everything is self-contained within AWS.

62
Q

What is the main disadvantage of CloudFront Geo Restriction?

A

It can restrict based only on the country of the client’s IP.

63
Q

Is CloudFront Geo Restriction applied at the Behaviour level, Distribution level, or Origin level?

A

Distribution.

64
Q

What is the main advantage of Third Party Geolocation?

A

It can make allow/deny decisions based on anything that the app server has access to. E.g. IP geolocation, user, browser, app state, etc.

65
Q

What additional AWS resource(s) is required when using Third Party Geolocation?

A

One or more compute instances (to make decisions)

66
Q

If you want to make content restriction decisions based on license, which option do you need to use?

A

Third Party Geolocation.

67
Q

If you want to make content restriction decisions based on user data fields, which option do you need to use?

A

Third Party Geolocation.

68
Q

If you want to make content restriction decisions based on headers, which option do you need to use?

A

Third Party Geolocation.

69
Q

If you want to make content restriction decisions based on the user’s latitude & longitude, which option do you need to use?

A

Third Party Geolocation.

70
Q

If you want to make content restriction decisions based on the user’s city, which option do you need to use: CloudFront Geo Restriction or Third Party Geolocation?

A

Third Party Geolocation.

71
Q

If you want to make content restriction decisions based on anything other than the user IP’s country, which option do you need to use?

A

Third Party Geolocation.

72
Q

If you only need to restrict content by country, which option can you use?

A

CloudFront Geo Restriction.

73
Q

Which CloudFront security mode is the default, public or private?

A

Public.

74
Q

In CloudFront private mode, how does security work?

A

Requests must have a signed cookie or signed URL, or they will be denied.

75
Q

Is the CloudFront security mode set per distribution or per behaviour?

A

Per behaviour.

76
Q

In a real-world scenario what is the likely setting of CF behaviours: all public, all private, or a mixture?

A

A mixture.

77
Q

In CF terminology, what is the entity called which can create signed cookies or signed URLs?

A

A signer.

78
Q

What happens as soon as you add a Signer to a behaviour?

A

The behaviour becomes Private.

79
Q

Are Trusted Key Groups the old way or the new way to control access to a distribution?

A

The new way.

80
Q

Are CloudFront Keys the old way or the new way to control access to a distribution?

A

The old way.

81
Q

Why are Trusted Key Groups better than CloudFront Keys? (3 reasons)

A
  1. You don’t have to use the Account’s Root user.
  2. They can be managed via the API.
  3. Key rotation is easier, because you can add and remove keys to a key group without having to reconfigure your CF distribution.
82
Q

What is the key architectural difference between CloudFront Keys and Trusted Key Groups?

A

A CloudFront Key is associated directly with a distribution, whereas Trusted Key Groups are a layer of abstraction that allows you to add and remove keys from the group without reconfiguring the distribution.

83
Q

What are two key advantages of signed cookies over signed URLs?

A
  1. Signed cookies can grant access to multiple objects, whereas signed URLs only work for a single object.
  2. Signed cookies allow you to preserve the original application URL.
84
Q

Why would you choose signed cookies over signed URLs? (two reasons)

A

A. You need to grant access to multiple objects.
B. You need to preserve original application URLs.

85
Q

When would you choose signed URLs over signed cookies?

A

If your application doesn’t support cookies.

AWS Advanced Network Specialty (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions