Deck Flashcards
Does IAM apply to regional assets?
No, IAM is universal across the platform
What is the root IAM account?
The account created when the AWS instance is first setup
Should you use IAM roles or hard coded secrets/keys in programmatic access?
IAM roles
Do new users have permissions when they are created?
No
Can you view a new user’s access key id & secret access key after creation?
No
Can you use the access keys to login to the AWS console?
No
Should the root account have MFA setup?
Yes, always
True or False: AWS recommends that EC2 instances have credentials stored on them so that the instances can access other resources (such as S3 buckets).
False
What is the best way to enable your EC2 instance to read files in an S3 bucket?
Create an IAM role with read access to S3 and assign the role to the EC2 instance
What is an IAM Policy?
A JSON document which defines one or more permissions
What IAM entity can you use to delegate access to your AWS resources to users, groups or services?
IAM Role
What are the EC2 Options
On Demand, Reserved, Spot, Dedicated Hosts
What is the Reserved EC2 Option
provides you with a capacity reservation, and offer a significant discount on the hourly charge for an instance. 1 or 3 year term reservation
FIGHTDRMCPX
FPGA, IOPS, Graphics, High Disk Throughput, Cheap General Purpose(T2 Micro), Density, Ram, Main choice for general purpose apps(M), Compute, Graphics(Pics), Extreme Memory
What is Amazon EBS?
Elastic Block Storage (disk)
What EBS type would I use for more than 10000 IOPS?
IO1 aka, not GP2
What EBS type would I use for less than 10000 IOPS?
GP2
What is the On Demand EC2 Option
Allows you to pay a fixed rate by the hour or second with no commitment
What is the Spot EC2 option
enables you to bid whatever price you want for the instance - instances are brought online when the price drops at or below your bid and then terminated when the price goes back up
What is the dedicated hosts EC2 option
Physical EC2 server dedicated for your use.
True or False: When a sport EC2 instance is terminated by Amazon, you will not be charged for the partial hour of use
True
What types of SSD storage does Amazon offer for EC2?
General Purpose SSD and Provisioned IOPS SSD
What types of Magnetic storage does Amazon offer for EC2?
Throughput Optimized HDD, Cold HDD, and Magnetic
What is an EC2 Security Group
Virtual Firewall
What types of Load balancers exist on Amazon
Application, Network, and Classic Load Balancer
What are application load balancers
Best suited for load balancing HTTP/S traffic and operate at layer 7
What are network load balancers
Best suited for TCP traffic where extreme performance is needed, operates at layer 4
What are classic load balancers
Legacy elastic load balancers, does both layer 4 and layer 7
With a classic load balancer, what happens when your application stops responding
Load balancer responds with a 504 error
What is the X-Forwarded-For header
Header that contains the actual client IP Address for a request that came through a classic load balancer
What is Amazon Route53
Amazon DNS service
What services can you map domain names to with Route53
EC2 instances, Load Balancers, S3 Buckets
What do all AWS CLI commands start with
AWS
How much access should I grant to CLI users
The least amount needed to do their job
Should users be assigned to groups
Yes, this is preferred way of granting permissions
How can you access Amazon services from EC2 instances without an access key
Use IAM Roles assigned to the instance
What is the preferred way of granting access to Amazon services for EC2 instances
IAM Roles
What controls what an IAM Role can do
JSON Policy
When do changes to policies on a role take affect
Immediately
Can you attach or detach a role from a running EC2 instance
Yes
If you create an EBS volume from an encrypted snapshot, is the newly created volume encrypted?
Yes
If you create an EBS volume from an unencrypted snapshot, is the newly created volume unencrypted?
Yes
If you create an EBS volume from an encrypted snapshot, is the newly created volume unencrypted?
No
If you create an EBS volume from an unencrypted snapshot, is the newly created volume encrypted?
No
Do your EC2 instances need to be in the same availability zone as the EBS volumes they use?
Yes
When creating a volume from a snapshot, can you change whether the drive is encrypted or not?
No, the un/encryption is all based on the snapshot itself and cannot be changed
What are the two ways for encrypting a root EBS drive?
Using the OS, like Bitlocker, or by taking a snapshot in AWS Console
What is the preferred way of encrypting a root EBS drive?
Using the AWS Console and a snapshot
Can you encrypt an unencrypted EBS snapshot?
Yes
How do you encrypt an unencrypted EBS snapshot?
Create a copy of the snapshot
What is Amazon RDS
Relational Database Service
What is Amazon Elasticache
Web service that makes it easy to deploy, operate, and scale an in-memory cache
What two open-source in-memory caching engines are supported by Elasticache
Memcached and Redis
Is Amazon RDS service for OLTP or OLAP
OLTP
What is Amazon’s NoSQL Db?
DynamoDB
What is Amazon’s OLAP service?
Redshift
By default, can resource security groups talk to one antoher?
No
How can you make it so one security group can talk to another?
Define an inbound rule for the target security group from the source security group. i.e. Db group and web server group
What are the two types of RDS backups in AWS?
Automated backups and Database snapshots
How can you restore a RDS db from an Automated Backup
You can restore to any point within a retention period
How long is the retention period for an Automated Backup
one to 35 days
True or False: Automated RDS backups take a full snapshot daily
true
Do Automated backups store transaction logs throughout the day?
Yes
How accurate is a recovery from an Automated Backup for RDS
Down to a second
Where does Amazon store the Automated backups
In a S3 bucket
Ture or False: When you restore a RDS from a backup,, a new database is created
True
True or False: When you restore a RDS from a Automated Backup, a new database is created
True
True or False: When you restore a RDS from a snapshot, a new database is created
True
Does a RDS instance restored from a backup get a new DNS pointer?
Yes
Can you encrypt an existing RDS instance in place?
No, you must create a snapshot
In RDS, what is Multi-AZ
When you select to have a database live in multiple availability zones for disaster recovery
In RDS, is Multi-AZ designed and used for high availability?
No, for disaster recovery
Do you ever use a public IP when working with a RDS database instance?
No, never use public IP - always use the DNS name
When should you use the DNS name to connect to a RDS instance?
Always
True or False: RDS Multi-AZ is used for disaster recovery only
True
True or False: RDS Multi-AZ is used for increasing performance
False
How would I increase performance of my RDS instance?
Using a read replica
What is a RDS read replica
Automatically updated RDS instances used to increase read throughput for your database instance
Can you have read replicas of a read replica?
Yes
True or False: RDS Read replica is used for disaster recovery only
False
True or False: RDS Read Replica is used for increasing performance
True
True or False: Each read replica of a RDS instance will have its own DNS endpoint
True
Can you have Multi-AZ for read replicas?
Yes
Can you have both Read Replica and Multi-AZ RDS instances?
Yes
True or False: A read replica can be promoted to become its own RDS instance?
True
What does promoting a read replica to its own database do?
Creates a RDS instance from the read replica and breaks replication
True or False: You can’t have read replicas in a second region?
False, you can
Which Elsticache provider do you use to have Multi-AZ
Redis
Does the Memcached Elasticache provider allow for Multi-AZ
No
Which Elasticache provider should I use if object caching is my primary goal?
Memcached
Which Elasticache provider should I use if I want the simplest possible approach
Memcached
Which Elasticache provider should I use if I am planning on running large cache nodes, and require multithreaded performance with utilization of multiple cores?
Memcached
Which Elasticache provider should I use if I need to scale my cache horizontally as i grow?
Memcached
Which Elasticache provider should I use if I have more advanced datatypes
Redis
Which Elasticache provider should I use if sorting and ranking datasets in memory will help me
Redis
Which Elasticache provider should I use if persistance of my keystore is important
Redis
Which Elasticache provider should I use if I want to run Multi-AZ
Redis
If my database is under a lot of stress/load and is read heavy executing many OLTP, what Amazon service should i use to alleviate this?
Elasticache
If my database is under a lot of stress/load and is executing OLAP, what Amazon service should I use to alleviate this?
Redshift
Which Elasticache provider should I use if I need pub/sub capabilities?
Redis
Which Elasticache provider should I use if I am implementing leaderboards?
Redis
What is S3?
Simple Storage Service
What does S3 provide to customers?
secure, durable, highly-scalabale object storage
What is the main purpose of S3?
To store objects, not operating systems or databases
Can I use S3 to store/run a database?
No
Can I use S3 to store/run an operating system?
No
Can I use S3 to store a webpages, files, or images?
Yes
Is S3 a safe place to store your files?
Yes
Does S3 store your objects across multiple devices and facilities?
Yes
Does S3 have high availability built in?
Yes
True or False: S3 has an element of disaster recovery built in?
True
How big can one file be in S3?
5TB
True or False: S3 provides unlimited storage
True
True or False: S3 limits your total amount of storage
False
If I have a 4.5TB file, can I store this in S3?
Yes
If I have a 5.1TB file, can I store this in S3?
No
What are folders called in S3?
Buckets
What is a bucket in S3?
Location files are stored (folder)
True or False: S3 bucket names must be unique globally
True
What HTTP code is returned when you successfully upload a file to S3?
200 OK
What data consistency does S3 provide for PUTs of new objects?
Read after write
How long do I have to wait to access my file in S3 after I have finished uploading it?
You don’t have to wait at all
What data consistency does S3 provide for overwriting an existing file with a PUT or DELETEs on a file?
Eventual Consistency
True or False: S3 is a key-value store
True
An S3 object consists of _______
Key, Value, Version ID, Metadata, Subresources
Does S3 support versioning of specific files?
Yes
Is S3 designed to sustain the loss of 2 facilities at the same time?
Yes
What is S3 - IA?
S3 for infrequently accessed data
When using S3 - IA, do I pay per data retrieval?
Yes
What is S3 - One Zone IA?
S3 for infrequently accessed data that is only in one availability zone
What is S3 reduced redundancy storage?
S3 for data that is easy to recreate, like thumbnails
What is S3 Glacier?
Very cheap S3 bucket for archiving data.
How long do you have to wait before accessing your data in Glacier?
3-5 hours
Which S3 storage class has the highest availability and durability?
Standard
What is S3 Intelligent tiering?
automatically moves your S3 buckets to the most cost effective tier based on how you access each object
What is S3 intelligent tiering used for?
Unknown or unpredictable access patterns
What are the two tiers for S3 intelligent tiering?
Frequent and infrequent
How long does data have to go unaccessed before it is moved to the infrequent tire in S3 intelligent tiering?
30 consecutive days
How much does S3 Intelligent tiering cost?
$0.0025 per 1000 objects/month
What do you get charged for in S3
Storage per GB, Requests, Storage management pricing, data management pricing(for moving data out of S3), Transfer Acceleration (using cloudfront)
True or False: Newly created buckets in S3 are publicly available?
False
True or False: Newly created buckets in S3 are private?
True
What are the mechanisms for controlling access to your S3 buckets?
Bucket policies and access control lists
What is an S3 Bucket Policy
Access control policy at the bucket level
What is a S3 Access Control List
Access control policy at the object level
Can I configure my S3 bucket to log accesses?
Yes
Can I configure my S3 bucket to log accesses and store those logs in another bucket?
Yes
Does S3 support encryption on objects?
Yes
Will S3 encrypt your objects for you?
Yes
True or False: I must encrypt files myself before uploading them to S3 if I want them to be encrypted
False
True or False: I cannot log API actions at the bucket level in S3
False
What tool can I use to log actions at the bucket level in S3
CloudTrail, for additional cost
Can I monitor the performance of requests into my S3 buckets?
Yes, using CloudWatch
Can you upload a publicly available file to a private bucket?
No, the bucket must be publicly available
If a bucket is publicly available, are all the objects automatically publicly available?
No
What types of encryption does S3 support?
In transit and at rest
What types of in transit security are supported by S3?
SSL/TLS
What types of at rest encryption does S3 support?
SSE-S3, SSE-KMS, SSE-C
Can I encrypt existing objects in my S3 bucket?
Yes
Can I provide my own keys for S3 encryption?
Yes
How would I enforce S3 object encryption on my bucket for all newly uploaded files?
Using a bucket policy
What encryption parameter should you include to encrypt your files at upload time?
x-amz-server-side-encryption: AES256 or ams:kms
Does S3 support CORS access?
Yes
What is CloudFront?
Amazon’s CDN
What is an Edge Location in CloudFront?
Geographically dispersed data centers that you can select to host your CDN in
What is an Origin in CloudFront?
This is the origin of all the files that the CDN will distribute
What are valid Origins for a CloudFront CDN?
S3 Bucket, EC2 instance, Elastic Load Balancer, or Route53
What is a CloudFront Distribution
Name given to a CDN which consists of a collection of edge locations
What is a CloudFront Web Distribution?
A distribution typically used for WebSites
What is RTMP in CloudFront?
A distribution used for media streaming on the CDN
What does RTMP stand for in CloudFront
Real Time Messaging Protocol
If I want to optimize performance for global users of my S3 backed website, what tool should I use?
CloudFront
Can I use CloudFront with any non-AWS Origin server?
Yes
Is a CloudFront edge location the same thing as an AWS Region or Availability Zone?
No
True or False: CloudFront edge locations are read-only
False
How long are objects cached in an edge location?
For the TTL (Time to LIve)
True or False: I cannot manually clear an edge location cache
False, you can
True or False: Manually clearing an edge location cache is free
False, it costs
I have content on my website that I want to restrict to paid users only and I’m using CloudFront for CDN. How do I achieve this?
By using the Signed URLs/Signed Cookies option
True or False: The first time a user access a file using cloudfront, the file will load fast
False
When does a file get cached in an edge location by cloudfront?
The first time a user access the file
How would I optimize performance for my GET-Intensive S3 workloads?
CloudFront CDN
How would I optimize performance for my Mixed Request Type workloads
Using a random key name instead of a sequential one