Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

AWS Certified SysOps Administrator 2 > Deck 3 > Flashcards

Deck 3 Flashcards

1
Q

How many policies per role?

A

2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What to do to avoid storing credentials in EC2 instances?

A

Assign role/s to instance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

STS user’s procedence

A

• Federation (AD):
- Uses Security Assertion Markup Language (SAML)
- Grants temporary access based on the users AD credentials (does not need to
be an user in AWS)
• Federation with mobile apps
- Use Facebook / Amazon / Google or other OpenID providers to login
• Cross Account Access:
- Let users from one AWS account access resources in another.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Define federation

A

Combining or joining lists of users from one domain to another (Ex: IAM and AD or IAM and Google)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Define Identity broker

A

Service that allows you to take an identity from point A and federate it to point B.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Define identity store

A

Services that create identities, like AD, Google, Facebook, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Define identitie

A

User of a service like Facebook, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Responsibilities in shared security model

A
  • AWS is responsible for securing the underlying infrastructure that supports the cloud (hardware, software, networking and facilities that runs AWS services)
  • You’re responsible for anything you put on the cloud or connect to the cloud.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

User responsability in managed services

A

Account management and user access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What does CloudTrail logs?

A

API calls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What AWS does when a storage device has reached the end of its useful life?

A

AWS procedures include a decommissioning process that is designed to prevent data to being exposed (degauss and physically destroyed).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What can customers who require additional layers of network security do?

A
  • VPC private subnet within the AWS cloud

- Use an IPSec VPN device to provide an encrypted tunnel between AWS VPN and your data centre.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

AWS protects networks from?

A
  • DDOS
  • MITM
  • Packet sniffing
  • Port scanning
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Is it possible to perform a vulnerability scan in your AWS resources?

A

Yes, but you have to ask AWS for permision

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

AWS credential types

A

• Passwords: AWS root account and IAM user account to the AWS management console.
• MFA: AWS root account and IAM user account to the AWS management console.
• Access keys: Digitally signed requests to AWS APIs.
• Key Pairs: SSH login to EC2 instances. Cloudfront signed URLs.
• X.509 certificates: Digitally signed SOAP requests to AWS APIs. SSL server
certificates for HTTPS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What can you do to make sure S3 is secure?

A

Create a temporary URL and sent it to the user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

To which service is related trusted advisor?

A

IAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is Direct connect?

A

Dedicated network connection from your premises to AWS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

From where is served route 53?

A

Edge locations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What you should do in order to increase network performance?

A

Increase instance size

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Can EBS throughput vary depending on the size of the instance?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Main difference between NACLs and SGs?

A
  • SGs are stateful

* NACLs are stateless

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

How to restore default VPC?

A

Contact AWS to get it back

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

VPC subnet size restrictions

A
  • not bigger than /16
  • not lower than /28
    (then, recommended /16)
25
What is VPC peering?
Connect over VPC to another via a direct network route using private IP addresses
26
With which VPCs you can connect via VPC peering?
- VPCs in another AWS account or in the same | - Only VPCs in the same region
27
Is VPC peering transitive?
No, it uses a star configuration
28
VPC main components
- IGW (or Virtual Private Gateway) - Route tables - NACL - Subnets - SGs
29
How many IGW per VPC?
1
30
Does a subnet have a route table when it is created?
When you create a subnet, it is automatically associated with the default route table.
31
Steps to build custom VPC
1. Create a VPC. By default, it will create: a. Route table b. NACL c. SG 2. Create subnets 3. Create IGW. Attach it to VPC 4. Create custom route table 5. Create instances
32
Parameter to disble in NAT instances
Disable parameter “Enable source destination check”
33
In which kind of subnet should you put a NAT instance?
Public
34
What do you need to use NAT to a private subnet?
There must be a route out of the private subnet to the NAT instance
35
Which kind of IP should have a NAT instance?
EIP
36
NAT gateways
* Very new * Preferred by the enterprise * Scale automatically up to 10 Gbps * No need to patch * Not associated with SGs * Automatically assigned a public IP address * Remember to update your route tables * No need to disable source/destination check
37
In which level operate NACLs and ASGs?
- NACLs: Subnet level (2nd layer) | - SGs: Instance level (1st layer)
38
How are rules evaluated in NACLs and ASGs?
- NACLs: by number order | - SGs: All rules evaluated before allowing traffic
39
How many NACLs per subnet?
1
40
Traffic allowed by default on default and custom NACL
- default: all inbound / outbound | - custom: none
41
How many subnets per NACL?
Multiple
42
What shoul you you use for blocking a IP address?
NACL
43
What do you need to provide HA to your ELB?
More than 1 AZ
44
What do you need to provide NAT instance in HA?
Tricky to make resilient. You need 1 in each subnet, each with public IP, and you need to write a script to fail between them, Instead, if possible, use NAT Gateways.
45
Does traffic between AZs have cost?
Yes
46
Who executes user data?
* Cloud-init on Linux | * EC2Config service on Windows
47
How many times user data is executed?
Once per instance-id by default
48
What does user data do on failure?
Exits
49
IP address for instance metadata?
169.254.169.254
50
Which family of instances works with credits?
T2
51
What control egress rules?
Traffic going outside instance
52
What is Trusted advisor?
Service that makes recommendations for us
53
What should you use to copy images between regions?
EC2 copy-image (traffic cost apply)
54
What is Cost explorer?
Service to manage costs
55
What is AWS config?
Registers the overal status of your services
56
Which service do roles use to work?
STS
57
What is better, double instance size or instance count?
*Hurry up and go idle* A larger instance size can save time and money
58
Is it a good idea to monitor EC2 t2 instances by CPU?
No, monitoring instances without credits will show an usage of 20% (or baseline peformance) aprox

AWS Certified SysOps Administrator 2 (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions