Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

MyACG: AWS Solutions Architect-Associate > Merge 1 > Flashcards

Merge 1 Flashcards

1
Q

AWS Global Infrastructure consists of…

A
  1. Regions2. Availability Zones3. Edge Locations
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is a Region?

A

A Region is a geographical area.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is an Availability Zone?

A

An Availability Zone (AZ) is simply a data center.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is an Edge Location?

A

Edge locations are CDN endpoints for CloudFront.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Why are AZs isolated/independent from one another?

A

E.g. in case there is a flood in one, the other won’t be affected. Low latency between each AZ.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

VPC

A

Virtual data center

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Route53

A

DNS service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

CloudFront

A

CDN - edge locations to cache files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Direct Connect

A

connect physical datacenter to AWS directly using a dedicated phone line

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Use Direct Connect when…

A

…you need a very reliable internet connection for pushing lots of data to AWS or down from AWS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

EC2

A

virtual machines in cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Elastic Beanstalk

A

deploy code to AWS, AWS provisions infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Lambda

A

upload code, code will respond to events

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

S3

A

Virtual disk in the cloud where you can store objects (files). Don’t use to store DBs or OSs or apps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Glacier

A

Archive files from S3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

EFS (Elastic File Service)

A

Block-based storage that you can share (can install DBs, apps, etc)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Storage Gateway

A

Virtual machine that connects S3 to your on-premises datacenter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

RDS

A

relational database service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

DynamoDB

A

nonrelational database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

RedShift

A

data warehousing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Elasticache

A

cache data in cloud (takes load off of database)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Snowball

A

move terabytes of data into cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

DMS

A

migrate on-premise database to the cloud, migrate databases inside AWS to other regions or services. no down time, can convert databases

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

EMR

A

big data processing. know what it is and how to access it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Kinesis

A

streaming and analyzing real-time data at massive scale

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Cloud Search/Elastic Search

A

if you need to create search capabilities for website

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Data Pipeline

A

move data from one place to another

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

IAM

A

sign in, authenticate, manage users and permissions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Inspector

A

agent installed on VMs, inspects and reports on security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Certificate Manager

A

free SSL certificate for domains

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Directory Service

A

Using Active Directory, connects active directory to AWS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

WAF

A

give application-level protection to your website

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Artifacts

A

compliance documentation in AWS console

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

CloudWatch

A

monitor performance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

CloudFormation

A

document that turn infrastructure into code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

CloudTrail

A

audits AWS resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Opsworks

A

automates deployments using Chef

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Config

A

monitors/audits environment, can set alerts based on compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Trusted Advisor

A

automated way of scanning environment, giving security tips

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

SWF

A

coordinating automated and human tasks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

API Gateway

A

door for apps to access backend data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Elastic Transcoder

A

Changes video format to suitable devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

CodeCommit

A

GitHub

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

CodeBuild

A

compile code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

CodeDeploy

A

deploys code to EC2 instances

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

CodePipeline

A

keep track of all versions of code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Mobile Hub

A

design mobile apps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Cognito

A

sign in w/ Identity Federation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Device Farm

A

mobile testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Mobile Analytics

A

analyze mobile data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

WorkSpaces

A

have desktop in cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

SNS

A

task notification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

SQS

A

queue system to decouple apps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

SES

A

send/receive emails

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

AWS Global Infrastructure consists of…

A

Regions, Availability Zones, Edge Locations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What is a Region?

A

A Region is a geographical area. Each Region consists of 2 or more Availability Zones.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What is an Availability Zone?

A

An Availability Zone (AZ) is simply a data center.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What are Availability Zones, physically?

A

They are facilities that are close to each other but not dependent on one another. For example, one AZ in Manhattan, another in New Jersey.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Why are AZs isolated/independent from one another?

A

E.g. in case there is a flood in one (e.g. Manhattan), the other (NJ) won’t be affected.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

T/F: There is low latency between 2 AZs in the same region.

A

TRUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

What is an Edge Location?

A

Edge locations are CDN endpoints for CloudFront.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

What is an example of what CDN used for?

A

To cache large media files in the cloud. Example: if I am a user in NY and if I want to download a video hosted in Australia, the first time, the video has to travel to the edge location in NY prior to downloading. Next time, the video would be cached at the NY edge location.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Think of VPC as…

A

…a logical datacenter.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Where do you deploy a VPC?

A

Region

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

T/F: VPCs can span regions.

A

FALSE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

T/F: VPCs can span Availability Zones.

A

TRUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

According to the AWS definition, what does Amazon VPC allow you to provision?

A

Amazon VPC lets you provision a logically isolated section of the AWS cloud where you can launch AWS resources in a virtual network that you define.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

According to the AWS definition, how much control do you have over your networking environment?

A

You have complete control over your virtual networking environment, including selection of your own IP address range, creation of subnets, and configuration of route tables and network gateways.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

T/F: You can easily customize the network configuration for your Amazon VPC.

A

TRUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

What is an example of how you can customize the network configuration for VPC?

A

Create a public-facing subnet for your webservers that has access to the Internet, and place your backend systems (e.g. databases, application servers) in a private-facing subnet with no internet access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

You can leverage multiple layers of security, including…

A

…security groups and Network ACLs to help control access to EC2 instances in each subnet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

T/F: You can create a Hardware VPN connection between your corporate datacenter and your VPC and leverage the AWS cloud as an extension of your corporate datacenter.

A

TRUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

Private IP address ranges

A
  1. 10.0.0.0-10.255.255.255 (10/8 prefix)
  2. 172.16.0.0-172.31.255.255 (172.16/12 prefix)
  3. 192.168.0.0-192.168.255.255 (192.168/16 prefix)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

Maximum addressable size in AWS

A

/16

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

What are the two routes of entry into VPC?

A

Internet Gateway, Virtual Private Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

What is the purpose of the Internet Gateway?

A

Allows you to connect to the Internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

What is the purpose of the Virtual Private Gateway?

A

Allows you to terminate VPN connections

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

What is the purpose of the Router?

A

It routes traffic based on what is defined in the route tables

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

What is a Public subnet?

A

Internet-accessible subnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

What is a Private subnet?

A

Not Internet-accessible subnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

What do you normally put in public subnets?

A

Webservers, bastion host

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

What do you normally put in private subnets?

A

Database servers, application servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

Can security groups span subnets or availability zones?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

Can network ACLs span subnets or availability zones?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

How many subnets per availability zone?

A

One

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

Can route tables span subnets or availability zones?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

Can a subnet span multiple availability zones?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

What can you do with a VPC?

A
  1. Launch instances into a subnet of your choosing
  2. Assign custom IP address ranges in each subnet
  3. Configure route tables between subnets
  4. Create internet gateway and attach it to our VPC
  5. Much better security control over your AWS resources
  6. Instance security groups
  7. Subnet network access control lists (ACLs)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

What does a route table define?

A

Whether a subnet is public or private

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

How many internet gateways can you have per VPC?

A

One

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

Example question: if Internet connection is running slow, how can you boost Internet speed?

A

If one of the answers is “attach another IGW to the VPC,” DON’T PICK THAT ONE!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

T/F: Security groups are stateful.

A

TRUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

What does “stateful” mean?

A

If you create a rule allowing traffic in, it automatically allows traffic out.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

T/F: Network ACLs are stateless.

A

TRUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

What does “stateless” mean?

A

If you create a rule allowing traffic in, you need to create a rule allowing the traffic back out.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

Default VPC properties:

A
  1. User friendly, allowing you to immediately deploy instances
  2. All subnets in default VPC have a route out to the internet
  3. Each EC2 instance has both a public and private IP address
  4. If you delete the default VPC the only way to get it back is to contact AWS.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

What does VPC Peering allow you to do?

A

Allows you to connect one VPC with another via a direct network route using private IP addresses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

Example: VPC Peering Use Case

A

Connect: VPC for monitoring services, VPC for Active Directory, Administration VPC, Production VPC, Dev VPC, Test VPC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

T/F: When VPC Peering, instances behave as if they were on the same private network

A

TRUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

T/F: You can peer VPCs with other AWS accounts as well as with other VPCs in the same account.

A

TRUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

Example: peer VPCs with other accounts use case

A

Peer VPCs with Dev account, Test account, Production account

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

What is the configuration of VPC Peering?

A

Star configuration (1 central VPC peers with 4 other VPCs)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

T/F: Transitive peering is allowed.

A

FALSE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

What does a VPC consist of?

A
  1. IGWs (or Virtual Private Gateways)
  2. Route Tables
  3. Network Access Control Lists
  4. Subnets
  5. Security Groups
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

You have a business-to-business web application running in a VPC consisting of an Elastic Load Balancer (ELB), web servers, application servers and a database. Your web application should only accept traffic from predefined customer IP addresses. Which two options meet this security requirement? Choose 2 answers

A> Configure web server VPC security groups to allow traffic from your customers’ IPs
B> Configure your web servers to filter traffic based on the ELB’s “X-forwarded-for” header
C> Configure ELB security groups to allow traffic from your customers’ IPs and deny all outbound traffic
D> Configure a VPC NACL to allow web traffic from your customers’ IPs and deny all outbound traffic

A

A> Configure web server VPC security groups to allow traffic from your customers’ IPs

B> Configure your web servers to filter traffic based on the ELB’s “X-forwarded-for” header
A is obviously correct as security group can be configured to accept traffic from predefined customer IPs
You can leverage AWS WAF to configure your webserver and filter the traffic based of HTTP header passed by load balancer. Hence #B is correct
The security group can be configured to only allow the inbound or outbound traffic. When you allow certain inbound traffic in security group, the outbound traffic is automatically allowed because of the stateful nature. Hence #C is wrong
In case if you deny all outbound traffic in NACL it will accept the inbound traffic but outbound hence #D is wrong.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

In the VPC Lab it states that AWS won’t allow you to use more than /16 on a VPC. But then later on when you go to the ‘Create Subnet’ wizard, in the demo you entered 10.0.1.0/24. So why can you now exceed the /16?

A

This can be summed up quite simply. The /16 or /24 is the number of mask bits in the CIDR address. The 16 signifies that should mask the first two octets. Leaving two additional octets for addressing needs. Each octet contains 255 addresses. Therefore a mask of /16 is 255 X 255 addresses or 65535.A /24 address is only masking 8 bits or 255 addresses. So in essense a mask of /16 is a lot more than a mask of /24.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

Can a vpc of any size be created?

a) amazon vpc supports vpcs from /16 to /28 (in cidr)
b) there is no size limit
c) amazon vpc supports vpcs with any subnet smaller than /16
d) amazon vpc supports vpcs with any subnet greater than /28

A

a)amazon vpc supports vpcs from /16 to /28(in cidr)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

which of the following is true about route table in vpc (multiple)

a) main route table is created along with with vpc
b) the main route table can be replaced with a custom route table
c) route tables are automatically created and cannot be edited
d) a subnet can exist without association with route table .

A

a)main route table is created along with with vpcb)the main route table can be replaced with a custom route tableExplanations:
A is correct, as per AWS doc: “When you create a VPC, it automatically has a main route table.”
B is correct, as per AWS doc: “You cannot delete the main route table, but you can replace the main route table with a custom table that you’ve created”
C is totally wrong
D is wrong, as per AWS doc: “Each subnet must be associated with a route table, which controls the routing for the subnet. If you don’t explicitly associate a subnet with a particular route table, the subnet is implicitly associated with the main route table.”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

Through the training I was continuously told that Security Groups are stateful, and any rule created inbound is automatically created outbound. However, upon going through the Wordpress portion of the training, you create a Security Group and I see a Outbound Rules tab. So now I’m confused, did Security Groups change since they released the training or am I confusing it with something else?

A

The outbound tab is relevant where traffic originates from within the security group, whereas inbound rules are relevant from traffic originating from clients outside the security group.Taking your wordpress site example, assuming it is deployed on an instance secured by a security group for inbound traffic, say from a web browser you would want http 80 and https 443 open on inbound part of the security group whereas for Wordpress to pull updates to plugins you would want http 80 open on the outbound portion of the security group so it can poll remote plugin sites (either directly or via a nat). By default, there are no restrictions on outbound traffic, but if you wanted to limit the way in which your instance could reach out to the internet the this is one area in which you could do it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
110
Q

I’m in the middle of preparing for my Architect Associate exam and I have a question on VPC. I’ve created an exercise for myself where the following infrastructure should be created:
2 Frontend servers with an Apache HTTP server
2 Backend servers with Tomcat (and a simple web application that allows you to upload files to S3).
I’m a bit “stuck” on the VPC configuration, where I had the following in mind:
- Create 4 subnets, 1 for each server. Not per se to assign 1 subnet per server, but more to spread them throughout the availability zones.
- Add a Load Balancer between Frontend and Backend servers to divide the load between the
2.I know you can go a lot further than that, but the main idea is to tinker a bit with VPC stuff, not to provide a small enterprise with a full blown infrastructure. The reason why I would create 4 different subnets is to provide high availability, since you can put your EC2 instances in different availability zones. But is that reasoning correct? Or are there better ways of handling that problem.

A

Your approach to achieve HA for the use case you have described is ideal. if you wanted to take it a step further I’d also add an auto-scaling group so that if an instance dies in an AZ the auto-scaling group will recover it, but you’ll discover that anyway as you go through the course.Given you want to load-balance the backend instances, you have to think about which subnet(s) you’ll be launching them into, and here are 2 possible ways I have seen done:
1 - launch them into the frontend subnets; give the frontend instances access to hit the LBs via the LB security group, and give the LBs access to the backend instances via the backend’s SG.
2 - have another pair of subnets just for the LBs, and again do something similar with the SGs. You’ll need to adjust your route tables in order to put these new subnets in-between the other 2 sets. This of course presumes your VPC has enough spare IPs to allow for more subnets.
Similar to 1, it is possible to launch the LBs into the backend subnets. Usually it depends on which subnets you have room free for the LBs. Don’t forget to lock everything down security-wise with your SGs and network ACLs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
111
Q

amazon gurantees hardware isolation in vpc , is this true

a) yes but only dedicated placement option which is seperately billable
b) no guarantee that hardware will be shared by another account
c) yes it comes free with vpc
d) yes but only with virtual private gateway feature

A

a) yes but only dedicated placement option which is seperately billable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
112
Q

What is VPC Peering?

A

VPC peering is simply a connection between two VPCs that enables you to route traffic between them using private IP addresses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
113
Q

For VPC Peering, instances in either VPC can communicate with each other…

A

…as if they are within the same network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
114
Q

How can you create a VPC peering connection?

A

between your own VPCs, or with a VPC in another AWS account within a single region

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
115
Q

How does AWS create a VPC peering connection?

A

AWS uses the existing infrastructure of a VPC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
116
Q

T/F: VPC Peering connections are gateways.

A

FALSE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
117
Q

T/F: VPC Peering connections are VPN connections.

A

FALSE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
118
Q

Does VPC Peering rely on a single piece of hardware?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
119
Q

Is there a single point of failure for communication or a bandwidth bottleneck?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
120
Q

T/F: VPC peering can occur between VPCs in different regions.

A

False; VPC peering must occur between VPCs within a single region.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
121
Q

Example: If VPC A and VPC B were peered, and VPC A’s CIDR = 10.0.0.0/16 and VPC B’s CIDR = 10.0.0.0/24, what will happen to the connection?

A

It will not work since VPCs with matching or overlapping CIDRs cannot be peered.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
122
Q

Transitive Peering…

A

…is NOT supported!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
123
Q

How to create a VPC with public and private subnets:

A
  1. Create VPC, which creates a main route table, default security group, and default network ACL.
  2. Create 2 subnets.
  3. Create and attach an IGW to the VPC.
  4. Create another route table.
  5. Associate the IGW and one of the subnets to the custom route table.
  6. Launch instance in the public subnet with a security group allowing HTTP, HTTPS, SSH.
  7. Launch instance in the private subnet with a security group allowing SSH, ICMP, .
  8. Launch NAT instance or create NAT gateway or Bastion.
  9. Create Network ACL mirroring security groups
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
124
Q

What is the purpose of the CIDR block?

A

Specifies IP address ranges

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
125
Q

What size can the CIDR be for a VPC or subnet?

A

Between /16 and /28

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
126
Q

What is meant by “Tenancy?”

A

Determines whether VPC and its assets are deployed onto shared hardware or dedicated hardware. Default is shared hardware.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
127
Q

When would you want the Tenancy to be Dedicated?

A

Security concerns, e.g. regulatory requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
128
Q

When you create a VPC, what else is created?

A

Main route table, default security group, default network ACL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
129
Q

When you create a VPC, what is NOT created?

A

Subnets, Internet Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
130
Q

Can a subnet be the same size as your VPC?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
131
Q

1 subnet always equals

A

1 Availability Zone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
132
Q

To make a subnet public…

A

…create and attach an Internet Gateway, associate it with a route table, and associate the subnet with that route table. Additionally, enable auto-assign IP on that subnet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
133
Q

When you create a new subnet, is it associated with any route tables?

A

Yes, it will be associated with the main route table by default

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
134
Q

Why is it considered a best practice to keep the main route table private?

A

If there is a route out to the Internet from the main route table, all subnets in that route table will automatically be public, which is a security risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
135
Q

If you forget to enable auto-assign public IP for a subnet…

A

…when you launch an EC2 instance you can enable auto-assign there.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
136
Q

If you forget to assign a public IP address to a public EC2 instance…

A

…you can allocate an Elastic IP address to it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
137
Q

When you launch an instance in the private subnet…

A

…traffic will be sourced from the public subnet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
138
Q

To SSH into your private instance from your public instance…

A

…you need to copy/paste your keypair into the public instance and chmod 600

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
139
Q

To be able to PING the private instance…

A

…allow ICMP on the private instance and ping the private IP from the public instance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
140
Q

To perform security patches, install software, etc on a private instance…

A

…you need a way for that instance to access the Internet (NAT instance or NAT gateway)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
141
Q

To allow private instances to access the internet…

A

…use a NAT instance or a NAT gateway and allow a route out from the private route table > NAT > Internet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
142
Q

To launch a NAT instance…

A

…search “nat” in the Community AMIs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
143
Q

After NAT instance is launched…

A

…disable Source/Dest check

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
144
Q

In which subnet should the NAT instance or NAT gateway be deployed?

A

Public subnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
145
Q

Is a security group required for a NAT instance?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
146
Q

Is a security group required for a NAT gateway?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
147
Q

What happens when you create a NAT gateway?

A

You create an Elastic IP since it is required to create one or use an existing one. In addition, a message pops up that explains that you need to edit your main route table to include a route with a target = NAT gatway.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
148
Q

What is meant by Source/Dest check?

A

By default, EC2 instances are either the source or destination of any traffic, and traffic does not go through an EC2 instance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
149
Q

What happens if the NAT instance goes down, or its availability zone goes down?

A

The NAT instance is a single point of failure, so you will lose any internet access to everything in the private subnet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
150
Q

To prevent a NAT instance from going down…

A

…set it behind an Auto Scaling group, set min number = 1, or use multiple public subnets and deploy NAT instances in each

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
151
Q

With NAT gateways, do you need Auto Scaling?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
152
Q

When a NAT instance’s bandwidth is used up (bottlenecked), what do you do?

A

Increase the instance size, change instance family so you can support more traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
153
Q

T/F: When you deploy a NAT instance, you must assign a public IP address.

A

TRUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
154
Q

To create high availability with NAT instances…

A

…use Auto Scaling Groups, multiple subnets in different AZs, and a script to automate failover.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
155
Q

Can subnets/availability zones span multiple Network ACLs?

A

No, but the reverse is possible.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
156
Q

What traffic does the default Network ACL allow?

A

All traffic inbound and outbound.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
157
Q

What traffic does a new Network ACL allow?

A

No traffic inbound or outbound.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
158
Q

When you create a standard Network ACL for connecting to the Internet, why might it not connect right away?

A

You will need another rule that opens up ephemeral ports in order to cover the different types of clients that might initiate traffic to the public-facing instances in your VPC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
159
Q

T/F: Each subnet in your VPC must be associated with a network ACL.

A

TRUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
160
Q

If you don’t explicitly associate a subnet with a network ACL…

A

…the subnet is automatically associated with the default network ACL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
161
Q

When you associate a network ACL with a subnet…

A

…the previous association is removed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
162
Q

How are the rules in a Network ACL evaluated?

A

Numerical order starting with the lowest number

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
163
Q

When blocking specific IPs…

A

…use network ACLs not security groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
164
Q

If I have multiple VPCs created, may I use the same CIDR block, i.e. 10.0.0.0/16 for each VPC?

A

If there’s no peering needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
165
Q

Several questions indicate that in order to make an EC2 instance in a non-default/private subnet, 2-way internet accessible you need to add an elastic IP. Is that because the instance is already running and that’s the only way to add a public IP to a running instance? Specifying “Auto-assign Public IP” at launch time has the same effect, correct?

A

You can assign and unassign IPv4 and IPv6 IP addresses on each network interface. Leave the IP address field blank and an available address will be assigned or enter an IP address that you want to assign. To add or edit an IPv4 public IP Allocate an Elastic IP to this instance or network interface.Yes I think so ! Elastic IP’s can be allocate to an Private Instance through the Manage IP section even after the Instance is up and running

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
166
Q

In this lecture to access the DB server from the jump host you are copying the private key on to the bastion host. Which is not a safe practice as publicly accessible jump hosts are the first ones to be hacked.Is there a better way of doing this, like using a combination of IAM role and instance metadata, which gives temporary credentials to access other AWS services?

A

There is a better way indeed. If you connect to the first host with -A, it enables SSH Key forwarding, and your local ssh key will be used to connect to the second host

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
167
Q

To use an ELB in a custom VPC…

A

…you need two public subnets to make it highly available

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
168
Q

NAT vs Bastion

A

NAT: routes traffic from Internet to EC2 instances in private subnets and is Linux, so can SSH but cannot RDP

Bastion: used to securely administer EC2 instances using SSH/RDP in private subnets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
169
Q

Bastion use case

A

Administration only

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
170
Q

Scenario: how to make a bastion instance highly available?

A

Need multiple public subnets. can have a bastion in each public subnet. implement Autoscaling groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
171
Q

Bastion example

A

Think of the webserver created in the lab, where we ssh into public and then private instance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
172
Q

Can you delete a VPC while EC2 instances are active?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
173
Q

Can you delete a VPC while ELBs are active?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
174
Q

Why do you delete a NAT gateway before deleting a VPC?

A

NAT gateways take a while to delete and they are a dependency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
175
Q

Think of VPC as…

A

…a logical datacenter in AWS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
176
Q

1 Subnet =

A

1 AZ

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
177
Q

Security Groups are…

A

…stateful

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
178
Q

Network ACLs are…

A

…stateless

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
179
Q

Can you peer VPCs in same account?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
180
Q

Can you peer VPCs in different accounts?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
181
Q

Transitive peering?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
182
Q

When creating a NAT instance…

A

…disable Source/Destination Check on the instance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
183
Q

NAT instances must be in which subnet?

A

Public

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
184
Q

For NAT instance to work…

A

…must have elastic IP address, must be a route out of the private subnet to the NAT instance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
185
Q

How much traffic do NAT instances support?

A

Depends on the instance size. If bottlenecking, increase the instance size

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
186
Q

You can create high availability using…

A

…AutoScaling Groups, multiple subnets in different AZs, a script to automate failover

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
187
Q

T/F: NAT instances are behind a security group.

A

TRUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
188
Q

NAT gateways…

A

…scale automatically up to 10 Gbps, no need to patch, not associated with security groups, automatically assigned a public IP, do not need to disable source/dest check

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
189
Q

Default NACL…

A

…automatically created with a VPC and by default it allows all inbound and outbound traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
190
Q

Custom NACL…

A

…denies all inbound and outbound traffic until you add rules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
191
Q

T/F: Each subnet in your VPC must be associated with a network ACL

A

TRUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
192
Q

If you don’t explicitly associate a subnet with a network ACL…

A

…the subnet is automatically associated w/ default network ACL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
193
Q

Can you associate a network ACL with multiple subnets?

A

Yes, but a subnet can only be associated with one NACL at a time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
194
Q

When you associate a network ACL with a subnet…

A

…the previous association is removed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
195
Q

NACL rules…

A

…evaluated in order, starting with the lowest numbered rule

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
196
Q

NACL inbound and outbound rules are…

A

…separate. Each rule can either allow or deny traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
197
Q

NACLs are stateless, so…

A

…responses to allowed inbound traffic are subject to the rules of outbound traffic (and vice versa)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
198
Q

Block IP addresses using…

A

…NACLs not Security Groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
199
Q

A NAT is used to…

A

…provide internet traffic to EC2 instances in private subnets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
200
Q

A Bastion is used to…

A

…securely administer EC2 instances using SSH or RDP in private subnets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
201
Q

If you want resiliency…

A

…always have 2 public subnets and 2 private subnets. Make sure each subnet is in different AZs

202
Q

With ELBs, make sure…

A

…they are in 2 public subnets in 2 different AZs

203
Q

With Bastion hosts…

A

…put them behind an autoscaling group w/ a minimum size of 2. Use Route53 (round robin or health check) to automatically fail over

204
Q

To make NAT instances resilient…

A

…need one in each public subnet, each with their own public IP, and you need to write a script to fail between the two. Instead, where possible, use NAT gateways

205
Q

If you’ve used the Internet…

A

…you’ve used DNS

206
Q

DNS is used to convert…

A

…human friendly domain names into an IP address

207
Q

IP addresses are used by…

A

…computers to identify each other on the network

208
Q

IP address forms

A

IPv4, IPv6

209
Q

IPv6 was created because…

A

…we were running out of IPv4 addresses

210
Q

Top Level Domains - example

A

“.com” in google.com

211
Q

Second word in a domain name

A

second level domain name

212
Q

Top level domain names controlled by…

A

…Internet Assigned Numbers Authority (IANA) in a root zone database (DB of all available top level domains)

213
Q

Domain Registrars

A

ensure that domain names aren’t duplicated. Each domain name becomes registered in a central database known as the WhoIS database

214
Q

SOA Records

A

Start of Authority Records

215
Q

SOA Record stores information about…

A
  • the name of the server that supplied the data for the zone
  • the administrator of the zone (contact details, owner name)
  • current version of the data file-number of seconds a secondary name server should wait before checking for updates
  • the number of seconds a secondary name server should wait before retrying a failed zone transfer
  • the maximum number of seconds that a secondary name server can use data before it must either be refreshed or expire
  • the default number of seconds for the time-to-live file on resource records
216
Q

NS records

A

stands for Name Server records, used by Top Level Domain servers to direct traffic to the Content DNS server which contains the authoritative DNS records

217
Q

A records

A

Address Record. A record used by computer to translate the name of the domain to the IP address

218
Q

Do ELBs have an IPv4 or IPv6 address?

A

No, they have just a DNS name.

219
Q

Can you use an A record to resolve to an ELB?

A

No, use an Alias Record

220
Q

TTL record

A

The length that a DNS record is cached on either the Resolving Server or the user’s own local PC is equal to the value of the Time To Live in seconds.

221
Q

The lower the TTL…

A

…the faster changes to DNS records take to propagate throughout the internet

222
Q

If adding additional A records, servers to production website or migrate production website to AWS…

A

…DNS change required, will take time to propagate to all end users. Decrease TTL to 300 seconds

223
Q

CNAMES (Canonical Name)

A

resolve one domain name to another

224
Q

Alias Records

A

map record resource sets in your hosted zone to ELBs, CloudFront distributions, or S3 buckets that are configured as websites

225
Q

Key difference between CNAMEs and Alias Records

A

CNAME can’t be used for naked domain names (zone apex). A records or Alias Records can

226
Q

Alias resource record sets can save you time because…

A

…Route53 automatically recognizes changes in the record sets that the alias resource record set refers to

227
Q

Example of how Alias resource record sets can save you time

A

Alias resource record set for example.com points to an ELB at lb1-1234.us-east-1.elb.amazonaws.com. If IP of ELB changes, Route53 will reflect those changes in the DNS answers for example.com w/o any changes to the hosted zone that contains resource record sets for example.com

228
Q

Do ELBs have a pre-defined IPv4 address?

A

No, you resolve to them using a DNS name

229
Q

If you make a request to Route53, CNAMEs…

A

…will be associated w/ a charge. On the other hand, Alias Records won’t

230
Q

Register a Domain Name Steps

A
  1. Domains > Registered Domains > Register Domain
  2. Enter a domain name and click “Check” Note: Prices!
  3. Click “Add to Cart”
  4. Fill out contact details
  5. Review and Purchase
231
Q

After you register a domain name, what else is created?

A

A hosted zone, NS records, SOA records

232
Q

Route53 Routing Policies

A

Simple, Weighted, Latency, Failover, Geolocation

233
Q

Simple Routing Policy

A

This is the default routing policy when you create a new record set.

234
Q

When is a simple routing policy most commonly used?

A

When you have a single resource that performs a given function for your domain. For example, one web serves content for the http://acloud.guru website

235
Q

Pictoral example of Simple Routing Policy

A

User makes DNS request > Request hits Route53 > Route53 forwards request to EC2 instances in your region

236
Q

When you register a domain name, why are there multiple NS records?

A

For redundancy

237
Q

To link a domain name with an EC2 instance…

A

…create a record set in Route53, specify whether you want an alias record. If you specify an alias record, select an endpoint (either ELB, S3 bucket, or CloudFront distribution). Select routing policy

238
Q

Alias records are supported for…

A

A (IPv4), AAAA (IPv6)

239
Q

Weighted routing pictoral

A

User makes DNS request > request hits Route53 > send a percentage of traffic to one region, send another percentage of traffic to another

240
Q

Weighted routing use case

A

Business in California. 80% of orders come from California, so route 80% of traffic to US-WEST-1. However, some orders are mail order throughout the US, so maybe send 20% of traffic to US-EAST-1.Performing A and B testing for a website, ie flip production website to a new site. Continue to send most of users to new site, while send some to the new site for testing

241
Q

T/F: You can perform weighted routing in different regions or the same region.

A

TRUE

242
Q

Is Route53 region-dependent?

A

No, it is Global

243
Q

To create a weighted record set…

A

…you actually need to create 2 record sets, set separate endpoints, and assign weights to each.

244
Q

Latency based routing allows you to route your traffic based on…

A

…the lowest network latency for your end user (ie which region will give them the fastest response time)

245
Q

To use latency based routing…

A

…create a latency resource record set for the EC2 or ELB resource in each region that hosts your website

246
Q

When Route53 receives a query for your site…

A

…it selects the latency resource record set for the region that vies the user the lowest latency. Route53 then responds with the value associated with that record set.

247
Q

Latency based routing pictoral

A

User makes request to Route53 > Route53 determines that there is a latency of 50 ms to one region and 300 ms to another region. User then routed to region with lowest latency

248
Q

Failover routing policies are used when…

A

…you want to create an active/passive set up. For example, you may want your primary site to be in EU-WEST-2 and your secondary DR site in AP-SOUTHEAST-2

249
Q

What will Route53 do for your primary site?

A

Monitor the health using a health check, which monitors the health of your end points

250
Q

Failover pictoral

A

User makes request > primary site health check passes so request routed to primary site> if fails, switches to secondary site

251
Q

Failover policy creation steps

A
  1. configure health check for primary load balancer
  2. configure health check for entire website
  3. when you create a record set, specify failover
  4. primary or secondary
  5. evaluate target health = yes
  6. associate w/ existing health check = yes, select health check
  7. repeat for secondary but don’t associate it with health check
252
Q

Geolocation routing…

A

…lets you choose where your traffic will be sent based on the geographic location of your users (ie the location from which the DNS queries originate)

253
Q

Geolocation routing example

A

all queries from Europe to be routed to a fleet of EC2 instances that are specifically configured for your European customers. These servers may have the local language of your European customers and all prices are displayed in Euros

254
Q

Can you have an IP address for an ELB?

A

No, they do not have pre-defined IPv4 addresses, you resolve to them using a DNS name

255
Q

Alias Record vs CNAME

A

Alias: can resolve to individual AWS Resources, accept naked domain names
Given choice, choose Alias Record over CNAME

256
Q

What is Direct Connect?

A

Direct Connect makes it easy to establish a dedicated network connection from your premises to AWS

257
Q

Using Direct Connect…

A

…you can establish private connectivity between AWS and your datacenter, office, or colocation environment, which can reduce your network costs, increase bandwidth throughput, and provide a more consistent network experience than Internet-based connections

258
Q

Direct Connect benefits include:

A

reduced costs when using large volumes of traffic, increased reliability, increased bandwidth

259
Q

How is Direct Connect different from a VPN?

A

VPN connections can be configured in minutes and are a good solution if you have an immediate need, have low to modest bandwidth requirements, and can tolerate the inherent variability in Internet-based connectivity.
Direct Connect does not involve the Internet; instead it uses dedicated, private network connections between your intranet and Amazon VPC. Direct Connect takes longer to set up.

260
Q

A content delivery network (CDN) is…

A

…a system of distributed servers (network) that deliver web pages and other web content to a user based on the geographic locations of the user, the origin of the webpage and a content delivery server

261
Q

Edge location

A

location where content will be cached. separate to a region/AZ

262
Q

Origin

A

origin of all the files that the CDN will distribute. can either be an S3 bucket, an EC2 instance, an ELB or Route53

263
Q

Distribution

A

name given to the CDN which consists of a collection of edge locations

264
Q

With edge locations, when users make a request…

A

…request goes to edge location first. if desired object is not cached, the request goes to the origin and then pulled down/cached at the edge location

265
Q

CloudFront can be used to…

A

…deliver your entire website, including dynamic, static, streaming, and interactive content using a global network of edge locations.

266
Q

Requests for your content are…

A

…automatically routed to the nearest edge location, so content is delivered with the best possible performance

267
Q

T/F: CloudFront works with AWS as well as non-AWS servers

A

TRUE

268
Q

Web Distribution

A

used for websites

269
Q

RTMP

A

used for media streaming

270
Q

T/F: Edge locations are read only.

A

False; they are not just read only, you can write to them too

271
Q

How long are objects cached at the edge location?

A

life of the TTL

272
Q

Will there be a charge if you clear cached objects?

A

Yes

273
Q

Can you have multiple origins per distribution?

A

Yes

274
Q

Create a web distribution if you want to:

A
  1. Speed up distribution of static and dynamic content, for example, .html, .css, .php, and graphics files.
  2. Distribute media files using HTTP or HTTPS.
  3. Add, update, or delete objects, and submit data from web forms.
  4. Use live streaming to stream an event in real time.
275
Q

Create an RTMP distribution…

A

…to speed up distribution of your streaming media files using Adobe Flash Media Server’s RTMP protocol

276
Q

For web distributions, what can be the origin of your files?

A

either an Amazon S3 bucket or a web server

277
Q

After you create the web distribution, can you add more origins?

A

Yes

278
Q

With an RTMP distribution, can you play a media file before the file has finished downloading from a CloudFront edge location?

A

Yes

279
Q

For RTMP distributions, what can be the origin of your files?

A

an Amazon S3 bucket

280
Q

To use CloudFront live streaming…

A

…create a web distribution

281
Q

Origin Domain Name

A

name of the bucket or webserver

282
Q

Can you have on-premise origins?

A

Yes

283
Q

Origin Path

A

way of adding multiple subfolders in the origin (pictures, videos, etc)

284
Q

Origin ID

A

name of the origion

285
Q

Restrict Bucket Access

A

Yes or No, example: stop people from using s3 bucket url so that they use CloudFront instead

286
Q

If you decide to restrict bucket access…

A

…you need to create an Origin Access Identity (OAI)

287
Q

What is an Origin Access Identity?

A

a user. can add permissions to that user

288
Q

If you do not update the bucket policy to Grant Read Permissions…

A

…you will have to manually update the permissions yourself

289
Q

Path Pattern

A

allows us to set different origin servers

290
Q

Which HTTP methods are cached by default?

A

GET, HEAD

291
Q

If you have objects that constantly need to change (e.g. every 12 hours)…

A

…decrease the TTL

292
Q

What is meant by Restrict Viewer Access?

A

Viewers have to use signed URLs or signed cookies

293
Q

Restrict Viewer Access use case

A

If you have content you want to restrict to a certain audience, e.g. A Cloud Guru, it checks to make sure users have signed URLs or cookies (ie if users paid)

294
Q

Signed URLs/cookies are…

A

…private

295
Q

How are you going to secure CloudFront or secure objects in S3 to make sure only paying customers use it?

A

Always use signed URLs or signed cookies

296
Q

AWS WAF Web ACL

A

…Layer 7 protection, so WAF operates at the application layer. Protects against SQL injection, cross-site scripting

297
Q

Default CloudFront Certificate (*.cloudfront.net)

A

Choose this option if you want your users to use HTTPS or HTTP to access your content with the CloudFront domain name (such as https://d111111abcdef8.cloudfront.net/logo.jpg).

298
Q

Custom SSL Certificate (example.com)

A

Choose this option if you want your users to access your content by using an alternate domain name, such as https://www.example.com/logo.jpg.

299
Q

If you need to prevent users in selected countries from accessing your content…

A

…you can specify either a whitelist (countries where they can access your content) or a blacklist (countries where they cannot)

300
Q

Can you have both a whitelist and a blacklist simultaneously?

A

No

301
Q

Invalidating objects…

A

… removes them from CloudFront edge caches. there is a charge

302
Q

T/F: You can use CloudFront to download and upload files.

A

TRUE

303
Q

Amazon EC2 is…

A

…a web service that provides resizable compute capacity in the cloud

304
Q

EC2 reduces the time required to obtain and boot new server instances to…

A

…minutes, allowing you to quickly scale capacity, both up and down, as your computing requirements change

305
Q

EC2 changes the economies of computing by…

A

…allowing you to pay only for the capacity that you actually use

306
Q

EC2 provides developers the tools to…

A

…build failure resilient apps and isolate themselves from common failure scenarios

307
Q

EC2 pricing options

A

On Demand, Reserved, Spot, Dedicated Hosts

308
Q

On Demand

A

allow you to pay a fixed rate by the hour with no commitment.

309
Q

On Demand use case example

A

If you’re a startup, you can pay for instances by the hour with no long term commitment for experimentation, terminate instances when you are complete.

310
Q

Reserved

A

provide you with a capacity reservation, and offer a significant discount on the hourly charge for an instance. 1-year or 3-year terms

311
Q

Reserved use case example

A

If you need a minimum of 2 webservers to serve your customers

312
Q

Spot

A

enable you to bid whatever price you want for instance capacity, providing for even greater savings if your apps have flexible start and end times. engineering, pharma companies use these

313
Q

If bid price > spot price…

A

…instances can be provisioned

314
Q

If spot price > bid price…

A

…instances will be terminated

315
Q

Dedicated Hosts

A

physical EC2 server dedicated for your use (hourly rate). Dedicated hosts can help you reduce costs by allowing you to use your existing server-bound software licenses

316
Q

On Demand Use Cases

A

Users that want the low cost and flexibility of EC2 without any up-front payment or long-term commitmentApps with short term, spiky, or unpredictable workloads that cannot be interruptedApps being developed or tested on EC2 for the first time

317
Q

Reserved Use Cases

A

Apps with steady state or predictable usageApps that require reserved capacityusers able to make upfront payments to reduce their total computing costs even further

318
Q

Example of combining reserved + on demand instances

A

2 webservers = reserved. Need more for Black Friday = on demand

319
Q

Spot Use Cases

A

Apps that have flexible start and end timesApps that are only feasible at very low compute pricesUsers with urgent computing needs for large amounts of additional capacity

320
Q

Spot Use Case Examples

A

Large pharma company saves money by using compute capacity during very low demand timesLarge world events, e.g. Brexit, analysts need to find solutions really quickly

321
Q

Dedicated Hosts Use Cases

A

Useful for regulatory requirements that may not support multi-tenant virtualizationGreat for licensing which does not support multi-tenancy or cloud deployments (e.g. Microsoft, SQL, Oracle)Can be purchased on demand (hourly)can be purchased as a reservation for up to 70% off the on-demand price

322
Q

Termination of Spot Instances - EXAM TIP

A

If the spot instance is terminated by Amazon EC2, you will not be charged for a partial hour of usage. However, if you terminate the instance yourself, you will be charged for any hour in which the instance ran

323
Q

Instance Types

A 
D = Dense
R = Memory-optimized (RAM)
M = General Purpose (main choice)
C = Compute-optimized
G = Graphics-IntensiveI = High Speed Storage (I/O)
F = Field Programmable Gate Array
T = Lowest Cost, General Purpose (t2 micro)
P = Graphics/General Purpose CPU (pics)
X = Memory-optimized (extreme RAM)
324
Q

Dense Storage use case

A

Fileservers/Data Warehousing/Hadoop

325
Q

Memory Optimized use case

A

Memory Intensive apps/DBs

326
Q

General Purpose use case

A

Application Servers

327
Q

Compute Optimized use case

A

CPU Intensive apps/DBs

328
Q

Graphics Intensive use case

A

Video Encoding/3D application streaming

329
Q

Field Programmable Gate Array use case

A

Hardware acceleration for your code

330
Q

Lowest Cost, General Purpose use case

A

Web Servers/small DBs

331
Q

Graphics/General Purpose GPU use case

A

Machine Learning, Bit Coin Mining, etc

332
Q

Memory Optimized use case

A

SAP HANA, Apache Spark, etc

333
Q

What is EBS?

A

EBS allows you to create storage volumes and attach them to EC2 instances.

334
Q

Once a volume is attached…

A

…you can create a file system on top of these volumes, run a database, or use them in any other way you would use a block device

335
Q

EBS volumes are placed…

A

…in a specific AZ, where they are automatically replicated to protect you from the failure of a single component

336
Q

single component?

A

storage array

337
Q

EBS volume types

A

General Purpose SSD (GP2)
Provisioned IOPS SSD (IO1)
Throughput Optimized HDD (ST1)
Cold HDD (SC1)
Magnetic (Standard)

338
Q

General Purpose SSD (GP2)

A

General purpose, balances both price and performance
Ratio of 3 IOPS per GB with up to 10K IOPS and the ability to burst up to 3000 IOPS for extended periods of time for volumes under 1 Gib

339
Q

Provisioned IOPS SSD (IO1)

A

Designed for I/O intensive apps such as large relational or NoSQL databasesUse if you need more than 10K IOPSCan provision up to 20K IOPS per volumeHighest-performance SSD volume designed for mission-critical applications

340
Q

Throughput Optimized HDD (ST1)

A

Big data
Data warehousing
Log processing
Sequential data
Cannot be a boot volume

341
Q

Cold HDD (SC1)

A

Lowest cost storage for infrequently accessed workloadsFile ServerCannot be boot volumes

342
Q

Magnetic (Standard)

A

Lowest cost per GB of all EBS volumes types that is bootable.Ideal for workloads where data is accessed infrequently, and apps where the lowest storage cost is important

343
Q

Can you mount 1 EBS volume to multiple EC2 instances?

A

No, use EFS instead

344
Q

General Purpose SSD (GP2) Use Cases

A

-Recommended for most workloads-System boot volumes-Virtual desktops-Low-latency interactive apps-Development and test environments

345
Q

Provisioned IOPS SSD (IO1) Use Cases

A
  • Critical business applications that require sustained IOPS performance, or more than 10,000 IOPS or 160 MiB/s of throughput per volume
  • Large database workloads, such as:

MongoDB
Cassandra
Microsoft SQL Server
MySQL
PostgreSQL
Oracle

346
Q

Throughput Optimized HDD (ST1) Use Cases

A

-Streaming workloads requiring consistent, fast throughput at a low price-Big data-Data warehouses-Log processing-Cannot be a boot volume

347
Q

Cold HDD (SC1) Use Cases

A

-Throughput-oriented storage for large volumes of data that is infrequently accessed-Scenarios where the lowest storage cost is important-Cannot be a boot volume

348
Q

By default, if an EC2 instance is terminated, what happens to the EBS root volume attached to it?

A

The volume will be deleted since “Delete on Termination” is checked by default

349
Q

Bootstrap scripts are placed in…

A

…User Data under “Advanced Details”

350
Q

AWS tagging best practices

A

Tag everything!

351
Q

Where do you request spot instances?

A

Purchasing Option in Configure Instance Details

352
Q

Where do you request a dedicated host?

A

Tenancy in Configure Instance Details

353
Q

To launch reserved instances…

A

Reserved Instances > Purchased Reserved Instances, add instances to cart

354
Q

Encrypted boot volumes (default)

A

Root volumes cannot be encrypted by default. Other EBS volumes can be encrypted if you check Encrypted

355
Q

Termination protection…

A

…is turned off by default. You must turn it on yourself if you want it.

356
Q

On an EBS-backed instance, what is the default action if the instance is terminated?

A

The root EBS volume is deleted.

357
Q

EBS root volumes of your DEFAULT AMI’s

A

cannot be encrypted, but you can use a third party tool to encrypt the root volume, or this can be done when creating AMIs using the console or API

358
Q

A security group is…

A

…a virtual firewall

359
Q

1 instance can have how many security groups?

A

Multiple. Also, multiple instances can be one security group

360
Q

If you change security group rules…

A

…changes take effect immediately

361
Q

Security Groups: If you allow inbound rules (e.g. HTTP, HTTPS, SSH) but don’t allow outbound rules, will those outbound rules affect the request?

A

No; since security groups are stateful, the inbound requests will be allowed back out automatically

362
Q

Can you deny traffic with a security group?

A

No, only allow rules are allowed

363
Q

The default security group…

A

…allows all inbound and outbound traffic by default

364
Q

By default, all inbound traffic is…

A

…blocked

365
Q

By default, all outbound traffic is…

A

…allowed

366
Q

When creating a new volume…

A

…make sure it is in the same AZ as your instance, or you will not be able to attach it to your instance

367
Q

After SSH into instance and elevating privileges, type what to find volumes?

A

lsblk

368
Q

To attach a volume…

A

…you need to format and mount it

369
Q

To check if a volume has data…

A

file -s e.g. file -s /dev/xvdf”data” = no data

370
Q

To format a volume…

A

mkfs -t ext4 . ext4 is file format for Linux

371
Q

To mount a volume…

A

mount e.g. mount /dev/xvdf /myfileserver

372
Q

Which directory is created by default when you mount a volume?

A

lost+found

373
Q

To unmount a volume…

A

umount

374
Q

If you forget to unmount a volume when you try to detach it…

A

…use Force Detach

375
Q

Where are snapshots stored?

A

S3

376
Q

When another snapshot is taken…

A

…only changed data since your last snapshot is sent to S3, since snapshots are incremental

377
Q

Can you make a volume from a snapshot?

A

Yes

378
Q

Can you change the volume type, size when you make a volume from a snapshot?

A

Yes

379
Q

What is stored on your root volume?

A

OS

380
Q

Think of a snapshot as…

A

a photograph (point in time copies of volumes)

381
Q

If you create a snapshot for the first time…

A

…it may take some time to create

382
Q

What does RAID stand for?

A

Redundant Array of Independent Disks (putting together a bunch of disks as one disk)

383
Q

RAID types

A

RAID 0, RAID 1, RAID 5, RAID 10

384
Q

RAID 0

A

Striped, No Redundancy (if one disk fails, the entire volume fails), Good Performance (use: gaming)

385
Q

RAID 1

A

Mirrored (take one disk, mirror a copy to another disk), Redundancy

386
Q

RAID 5

A

at least 3 disks, good for reads, bad for writes, AWS does not recommend ever putting RAID 5’s on EBS

387
Q

RAID 10

A

Striped & Mirrored, good redundancy, good performance

388
Q

Where are RAID volumes used on AWS?

A

If you do not get disk I/O you require, add multiple volumes and create RAID array (usually RAID 0 or RAID 10 on AWS)

389
Q

Best practice when launching Windows instances

A

Create a new keypair for Windows instances, separate from Linux instances

390
Q

Username, password for Windows instances

A 
User = Administrator
Password = upload private key file into "Retrieve Password" window to obtain password
391
Q

To add a RAID

A

Right-click, Disk Management. Right-click on an unallocated volume and choose volume type you want to create, select drive you want the RAID volume assigned to

392
Q

How can I take a Snapshot of a RAID array - background?

A

Problem - Take a snapshot, the snapshot excludes data held in the cache by apps and the OS. This tends not to matter on a single volume; however, using multiple volumes in a RAID array, this can be a problem due to interdependencies of the array.
Solution - Take an application consistent snapshot

393
Q

How can I take a Snapshot of a RAID array - continued

A

Stop the application from writing to disk. Flush all caches to the disk.How can we do this? Freeze the file system, unmount the RAID array, shut down the associated EC2 instance (easiest)

394
Q

What is an AMI?

A

AMI provides the info required to launch a virtual server in the cloud.
Specify an AMI when you launch an instance, and you can launch as many instances from the AMI you need.
You can also launch instances from as many different AMIs as you need

395
Q

AMIs consist of…

A

a template for the root volume for the instance
launch permissions that control which AWS accounts can use the AMI to launch instances
a block device mapping that specifies the volumes to attach to the instance when it’s launched

396
Q

T/F: AMIs are regional.

A

Yes, you can only launch an AMI from the region in which it is stored. However, you can copy AMIs to other regions using the console, command line, or EC2 API

397
Q

select your AMI based on…

A

Region, OS, Architecture, Launch Permissions, Storage for the Root Device

398
Q

Instance Store is also known as

A

Ephemeral Storage

399
Q

EBS

A

Persistent Storage, fast provisioning times, more durability

400
Q

Can you attach EBS volumes after launching an instance?

A

Yes

401
Q

Can you attach instance store volumes after launching an instance?

A

No, but you can attach them before launching

402
Q

Can instances with instance stores be stopped?

A

No, only reboot or terminate

403
Q

Root device for EBS volume is created from

A

an EBS snapshot

404
Q

Root device for instance store volume created from

A

a template stored in S3

405
Q

Can you detach instance store volumes?

A

No

406
Q

Which takes longer to provision, EBS or instance store?

A

Instance store

407
Q

Can Instance store volumes be of any instance type?

A

No, there are limits on instance families

408
Q

On an instance store volume, what happens if the host fails?

A

instance data is gone

409
Q

What happens if you reboot both volume types?

A

You will not lose your data

410
Q

Can volumes be stopped?

A

EBS - Yes
Instance store - No

411
Q

Will root volumes be deleted on termination by default?

A

Yes. With EBS, you can tell AWS to keep the root volume

412
Q

Health check ping path

A

file to test health check i.e. an html file saying that instance is healthy

413
Q

Response timeout

A

how long it takes to do a healthcheck

414
Q

Interval

A

how long to wait between healthchecks

415
Q

Healthy threshold

A

how many consecutive health checks an instance must pass before becoming healthy

416
Q

Unhealthy threshold

A

how many consecutive health checks an instance must fail before becoming unhealthy

417
Q

Is IP address given for ELB?

A

No, a DNS name is given instead since the IP address may change

418
Q

By default, how many AZs is an ELB deployed into?

A

2

419
Q

Instances monitored by ELB are reported as either

A

In service or out of service

420
Q

How do health checks work?

A

they check the instance health by talking to it

421
Q

Metrics are monitored every N minutes (basic)

A

Metrics are monitored every 5 minutes

422
Q

Detailed monitoring = Monitoring every N minutes

A

Metrics are monitored every 1 minute

423
Q

What CloudWatch metrics are available by default for EC2 instances?

A

CPU, Disk, Network, Status Check

424
Q

Status checks at which level?

A

Instance, host

425
Q

To view RAM utilization…

A

you need to create a custom metric

426
Q

CloudWatch Events…

A

…help you respond to state changes in your AWS resources

427
Q

Logs…

A

…you can go into application layer and log different events (as opposed to host layer for dashboards). helps you to aggregate, monitor, and store logs

428
Q

CloudWatch is for…

A

performance monitoring

429
Q

CloudTrail is for…

A

auditing whatever happens with AWS account

430
Q

Role Types

A

AWS Service Roles, Role for Cross-Account Access, Role for Identity Provider Access

431
Q

When provisioning EC2 instance with IAM role, where do you select the role?

A

Configure Instance Details (IAM role)

432
Q

When you first use CLI…

A

You need to configure AWS credentials using access key ID and secret access key, Region

433
Q

Can you assign a role to an EC2 instance after launching it?

A

Not using console, but can using CLI. You can also modify a role

434
Q

The only way to modify a role attached to an EC2 instance is…

A

attach a policy

435
Q

If you delete a role attached to the EC2 instance

A

The role is gone. You cannot add a new role; you must terminate and launch a new instance with desired role

436
Q

Which is more secure, using roles or storing your access key and secret access key on EC2 instances?

A

Roles; they are also easier to manage

437
Q

T/F: Roles are universal, you can use them in any region.

A

TRUE

438
Q

How to obtain instance metadata:

A

curl http://169.254.169.254/latest/meta-data/

439
Q

Can we obtain user data from EC2?

A

No, it throws an error

440
Q

What is a Placement Group?

A

a logical grouping of instances within a single AZ.

441
Q

Using placement groups…

A

…enables apps to participate in a low-latency, 10 Gbps network

442
Q

Placement groups are recommended for…

A

…apps that benefit from low network latency, high network throughput, or both.

443
Q

Can a placement group span multiple AZs?

A

No, it’s a single point of failure

444
Q

The name you specify for a placement group…

A

…must be unique within your AWS account.

445
Q

Which instances can be launched in a placement group?

A

Compute Optimized, GPU, Memory Optimized, Storage Optimized

446
Q

T/F: AWS recommends homogeneous instances w/in placement groups.

A

TRUE

447
Q

Can you merge placement groups?

A

No

448
Q

Can you move an existing instance into a placement group?

A

No. Create an AMI from your existing instance, and launch a new instance from the AMI into a placement group

449
Q

RDS Types

A

SQL Server, Oracle, MySQL Server, PostgreSQL, Aurora, MariaDB

450
Q

What is Elasticache?

A

Web service that makes it easy to deploy, operate, and scale an in-memory cache in the cloud

451
Q

In-memory caching engines that Elasticache supports:

A

Memcached, Redis

452
Q

Use case for Elasticache

A

If web app constantly requests the top 10 products, cache that information in Elasticache

453
Q

DMS

A

allows you to migrate your production database to AWS

454
Q

Once migration starts…

A

AWS manages complexities of the migration processes like data type transformation, compression, and parallel transfer, while ensuring that data changes to the source database that occur during the migration process are automatically replicated to the target

455
Q

Purpose of the AWS schema conversion tool

A

automatically converts the source DB schema and a majority of the custom code, including views, stored procedures, and functions, to a format compatible with the target DB.

456
Q

RDS is used for

A

OLTP

457
Q

DynamoDB used for

A

NoSQL

458
Q

RedShift used for

A

OLAP

459
Q

Which RDS types can be encrypted at rest?

A

…

460
Q

Types of Backups

A

Automated Backups, Database Snapshots

461
Q

Automated Backups

A

allow you to recover your DB to any point in time within a retention period. they will take a full daily snapshot and will store transaction logs throughout the day

462
Q

Retention period range

A

1-35 days, 7 days by default

463
Q

Recover an automated backup

A

AWS will choose the most recent daily backup, and then apply transaction logs relevant to that day

464
Q

Which type of backup is enabled by default?

A

Automated

465
Q

Where is the backup data stored?

A

S3

466
Q

How much storage will you get?

A

Free storage space = size of your database

467
Q

When are backups taken?

A

within a defined window

468
Q

What will happen to storage I/O during the backup window?

A

may be suspended

469
Q

Are DB snapshots manual or automated?

A

Manual

470
Q

When the RDS instance is deleted, what happens to automated backups?

A

They are deleted.

471
Q

When the RDS instance is deleted, what happens to DB snapshots?

A

They are stored

472
Q

When the RDS instance is deleted, do you have a chance to make one final snapshot?

A

Yes.

473
Q

What happens when you restore either an automated backup or a DB snapshot?

A

the restored version of the DB will be a new RDS instance with a new end point.

474
Q

Encryption at rest is supported for which DBs?

A

MySQL, Oracle, SQL Server, PostgreSQL, MariaDB

475
Q

How do you perform encryption on DBs?

A

AWS KMS

476
Q

Will underlying storage, backups, read replicas, and snapshots be encrypted after the RDS instance is encrypted?

A

Yes

477
Q

Can you encrypt an existing DB instance?

A

No, you will need to create a new DB instance and migrate your data into it.

478
Q

to scale up RDS

A

take a snapshot, restore snapshot to larger instance size

479
Q

Multi-AZ is good for

A

failover/disaster recovery only.

480
Q

If you use Multi-AZ, will AWS handle the replication?

A

Yes

481
Q

Is Multi-AZ good for improving performance?

A

No. You need Read Replicas.

482
Q

Use case for Read Replicas

A

If DB has a lot of reads performed to it, you can change the connection of the EC2 instances to read from read replicas instead of the main DB

483
Q

Multi-AZ db options

A

All except Aurora, which has it by default.

484
Q

Read replica db options

A

MySQL Server, PostgreSQL, MariaDB

485
Q

Read replicas are used for

A

scaling, not DR

486
Q

In order to deploy a read replica

A

you must have automatic backups turned on

487
Q

How many read replicas can you have for one database?

A

5

488
Q

Can you have read replicas of read replicas?

A

Yes, but watch out for latency

489
Q

Is read replica asynchronous or synchronous?

A

asynchronous

490
Q

Is Multi AZ asynchronous or synchronous?

A

synchronous

491
Q

Will each read replica have a DNS endpoint?

A

Yes

492
Q

Can you have read replicas that have multi-AZ turned on?

A

No. You can create read replicas of Multi-AZ source dbs though.

493
Q

Can read replicas be promoted to their own databases?

A

Yes, but this breaks replication

494
Q

Can you change the instance size of a read replica?

A

Yes

495
Q

DynamoDB vs RDS

A

DynamoDB offers push button scaling, so you can scale your DB on the fly, w/o any down time.RDS is not so easy and you usually have to use a bigger instance size or add a read replica

496
Q

What is DynamoDB

A

fast and flexible NoSQL database service for all apps that need consistent, single-digit millisecond latency at any scale.

497
Q

Is DynamoDB fully managed?

A

Yes

498
Q

What models does DynamoDB support?

A

Document, key-value

499
Q

Uses for DynamoDB

A

mobile, web, gaming, ad-tech, IoT

500
Q

Where is data in DynamoDB stored?

A

SSD Storage

MyACG: AWS Solutions Architect-Associate (58 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions