Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Solutions Architect > Module 12 - Edge Services > Flashcards

Module 12 - Edge Services Flashcards

1
Q

What are the AWS edge services?

A
  • AWS Wavelength – 5G providers would use AWS Wavelength as their edge location.
  • AWS edge locations – CloudFront, AWS WAF, and AWS Shield are services used here.
  • Outposts – Outposts can be on premises or on a VPN. • AWS local zones – Local zones are an extension of a VPC
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is an edge location?

A

the nearest point to the user who is consuming the AWS service.
The server is not present in these locations. They cache copies of your content for faster delivery.

Works with AWS services like Route 53 and CloudFront.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What does CloudFront do?

A

It’s a CDN: Content delivery network. Provides a globally-distributed network of Point-of-Presence locations (edge locations & edge cache servers) that CACHE content, such as web videos or other bulky media, more locally to consumers, thus improving access SPEED for downloading the content.

For dynamic data, many CDNs can be configured to retrieve data from the origin servers.

DDoS protection, integrates with Shield, WAF

Good for: static content the needs to be available everytwhere

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What connection does CloudFront support other than HTTP/S?

A

CloudFront supports real-time, bidirectional communication over the WebSocket protocol. This persistent connection permits clients and servers to send real-time data to one another without the overhead of repeatedly opening connections. This is especially useful for communications applications such as chat, collaboration, gaming, and financial trading.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How do you configure CloudFront?

A

Specify an origin server for your files (S3 bucket, HTTP server a.k.a. custom origin) If S3 then the bucket is all lowercase no spaces.

Create a CloudFront streaming distribution. Tells CF which origin to use and your configs.

CF assigns a domain name to the new distribution.

CF sends your distribution’s configuration but not the content to all of its edge locations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How can you set up CloudFront to restrict access to paid users, for example?

A

Require that your users access your private content using special CloudFront signed URLs or signed cookies.
• signed URL: access to individual files (
• signed cookies: one cookie for many files

Require that your users access your content by using CloudFront URLs, not URLs that access content directly on the origin server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How do I set up CloudFront for high availability?

A

Set up origin failover. Create an origin GROUP with a primary and secondary origin. If one origin is offline, it will failover to the secondary.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the ways you can control when content expires in CloudFront?

A

TTL (Time To Live)
• Default
• Max TTL
(TTL can be fixed, custom set by you, or GET request to origin from CloudFront will use If-Modified-Since header)

change the object name (Header-v1.jpg becomes Header-v2.jpg)

invalidate the object. Invalidating the object is inefficient and very expensive.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How do you off-load static content in CloudFront?

A
  • Create absolute, instead of relative, URL references to your static assets.
  • Store static assets in Amazon S3.
  • Optimize for WORM. (Write once read many)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is geoblocking/geo-restriction?

A

Prevents users in specific countries from accessing content that you are distributing through a CloudFront web distribution. You can whitelist or blacklist countries.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What kinds of geoblocking/geo-restriction are there?

A
  • Use the CloudFront geo-restriction feature to restrict access to ALL the files on an edge location and to restrict access at the country level.
  • Use a third-party geolocation service to restrict access to a subset of the files that are associated with a distribution or to restrict access at a finer granularity than the country level.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

It can take many network hops to access your application over the public internet, and that introduces risk and possible performance problems. What can help avoid this?

A

Global Accelerator: a networking service that improves the availability and performance of the applications you offer to your global users. Uses the AWS network. Like an HOV lane.

Provides 2 static Anycast IP addresses that act as a fixed entry point to your AWS-hosted application so you don’t have to manage IP addresses across AZs or Regions.

Also performs health checks with auto-failover.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How does traffic go from the user to the endpoint in Global Accelerator?

A

traffic is routed to the optimal AWS endpoint based on:
• user’s location
• the health of the endpoint
• endpoint weights that you configure.

Traffic travels over the well-monitored, congestion-free, redundant AWS global network to the endpoint. By maximizing the time that traffic is on the AWS network, Global Accelerator ensures traffic is always routed over the optimum network path.

Supports TCP and UDP.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are 2 caveats for using Global Accelerator?

A
  • Direct Connect does not advertise IP address prefixes for Global Accelerator over a public virtual interface.
  • Global Accelerator does not support processing IP packet fragments or reassembly.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

CloudFront vs. Global Accelerator

A

CloudFront vs. Global Accelerator
• Layer 7 HTTP or HTTPS vs. Layer 4 TCP or UDP proxy
• HTTP or HTTPS vs. Any protocol running over TCP or UD
• Content caching vs no caching
• DNS-based routing vs. Anycast routing
• Dynamic IP addresses vs. Two global static IP addresses, with ability to BYOIP address ranges
• Native origin failover based on HTTP error codes or timeouts, or Route 53 DNS VS Built-in origin failover with no dependency on DNS TTLs
• Hosting: S3 buckets, HTTP servers, AWS Elemental MediaStore, or other servers vs. Network Load Balancers, Application Load Balancers, EC2 instances, and Elastic IPs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are some Infrastructure layer attacks (at layer 3 or 4)?

A

synchronized (SYN) floods
User Datagram Protocol (UDP) packet floods

both are types of DDoS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is an application layer attack?

A

Layer 7, attacks the application itself. E.g. HTTP flood, DNS query floods.

18
Q

What service protects against infrastructure layer attacks?

A

Shield Standard: always-on network flow monitoring. Detects malicious traffic.

19
Q

How does CloudWatch integrate with WAF?

A

CloudWatch collects and processes raw data from AWS WAF and AWS Shield Advanced into readable, near real-time metrics. These statistics are recorded for a period of two weeks.

You can activate logging to get detailed information about traffic that is analyzed by your web ACL. AWS WAF delivers logs to your storage destination through the HTTPS endpoint of Kinesis Data Firehose. (Do NOT choose Kinesis Data Streams as your source.)

20
Q

How does CloudWatch integrate with WAF?

A

CloudWatch collects and processes raw data from AWS WAF and AWS Shield Advanced into readable, near real-time metrics. These statistics are recorded for a period of two weeks.

You can activate logging to get detailed information about traffic that is analyzed by your web ACL. AWS WAF delivers logs to your storage destination through the HTTPS endpoint of Kinesis Data Firehose.

21
Q

What is an IP set in AWS WAF?

A

a collection of IP addresses and IP address ranges that you want to use together in a rule statement. IP sets are AWS resources.

22
Q

How do ACL rule statements work?

A

Rule statements are the part of a rule that tell WAF HOW to look at a request.

Pattern matching? (Regex, size, string)
Logical operation? (AND/OR/NOT)
Traffic filtering? (Geofencing, IP filter, rate-limiting)
Attack prevention? (SQLi or XXS detection)

23
Q

What kind of complexity can ACL rule statements handle?

A

They can reference rule groups. You won’t see them on the console, but you can manage them by editing the JSON.

Rules can be nested e.g. control the rate of requests from a specific country.

24
Q

What can I use to manage WAF, VPC security groups, and shield protections all at once?

A

AWS Firewall Manager. This service automatically applies the rules and protections across your accounts and resources, even as you add new resources.

25
Q

What do you need to use AWS Firewall Manager?

A

1) activate AWS Organizations with full feature
2) use AWS Config
3) have an assigned user as the Firewall Manager administrator

26
Q

When is AWS Firewall Manager a good idea?

A

1) You have a lot of resources and/or accounts to manage
2) You create a lot of new applications
3) You want a single place to monitor and respond to threats across the organization

27
Q

How can I handle latency issues when some applications have to be on-prem? (E.g. workloads on factory floors, patient diagnosis)

A

Use outposts, a way to extend the AWS Cloud to an on-premises data center. Basically your own rack.

28
Q

What can you run on outposts?

A 
EC2, S3, EBS
VPC
RDS
ECS/EKS
EMR (Elastic MapReduce aka big data)
29
Q

What are 2 benefits of implementing a CloudFront distribution?

A

Increased security

reduced latency

30
Q

What can CloudFront sit in front of?

A

S3:
• ❗️enhanced security with Origin Access Identity (OAI) which is an IAM role for the CloudFront origin
• CloudFront as ingress, i.e. upload to S3 from edge

HTTP endpoint
• e.g. ALB, EC2, S3 website, anything with endpoint

31
Q

How does security work with CloudFront in front of an ALB or EC2?

A

Endpoint must be public.

Edge location IPs must be in the security group of the ALB or EC2.

32
Q

How can I modify CloudFront to make it cheaper?

A

Costs vary depending on edge location.

You can reduce the # of locations to save money.
• Price Class All: all regions, best performance $$$
• Price Class 200: most regions except most expensive, $$
• Price Class 100: only the cheapest regions, $

33
Q

What other security can I add to user data using CloudFront besides HTTPS?

A

Field Level Encryption

Encrypted at edge location close to user. You can specify a field, e.g. credit card #. Encrypted with public key, decrypted at the app with the private key.

34
Q

What are Unicast and Anycast IPs?

A

Unicast: one server holds one IP

Anycast: all servers have the same IP; the client is routed to the closest one. This is how Global Accelerator works.

35
Q

Compare CloudFront and Global Accelerator.

A

Both use AWS network and edge locations
Both integrate with Shield, DDoS protection.

CF:
• improves performance for cacheable content
• content is served from the edge locations

GA:
• improves performance for lots of apps over TCP/UDP
• all requests are still going to the app
• good for HTTP when you need static IP
• good for when you need fast regional failover
• good for non-HTTP like VOIP, gaming (UDP), IOT(MQTT)

36
Q

You have paid content that is stored in an S3 bucket. You want to distribute that content globally, so you have set up a CloudFront Distribution and configured the S3 bucket to only exchange data with your CloudFront Distribution. Which CloudFront feature allows you to securely distribute this paid content?

A

CloudFront Signed URLs are commonly used to distribute paid content through dynamically generated signed URLs.

37
Q

A website is hosted on a set of EC2 instances fronted by an Application Load Balancer. You have created a CloudFront Distribution and set up its origin to point to your ALB. What should you use to provide access to hundreds of private files served by your CloudFront distribution?

A

Signed Cookies are useful when you want to access multiple files.

38
Q

You are creating an application that is going to expose an HTTP REST API. There is a need to provide request routing rules at the HTTP level. Due to security requirements, your application can only be exposed through the use of two static IP addresses. How can you create a solution that validates these requirements?

A

AWS Global Accelerator will provide us with the two static IP addresses and the ALB will provide us with the HTTP routing rules.

39
Q

What is edge computing? What can you use to accomplish this?

A

Process data while it is being collected at an edge location, i.e. without an internet connection.

Snowball edge (compute or storage optimized)
Snowcone. 2 CPUs, 4gb memory, wired or wifi

• All can run EC2, Lambda (using IoT GreenGrass)

You can preprocess the data, do machine learning on site, transcode media streams.

40
Q

What is OpsHub?

A

A GUI for your snow devices so you don’t have to use CLI. It’s software you install on your laptop.

AWS Solutions Architect (20 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions