Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

AWS SAA Dom > Networking > Flashcards

Networking Flashcards

1
Q

Where is data encrypted with encrypted AWS EBS?

A

Data at rest, snapshots and data moving between the volume and the instance is encrypted

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

How do you setup an IPsec (site-to-site VPN) between an on-premise and AWS VPC?

A

Create a Virtual Private Gateway on the AWS side and a customer gateway on the on-premise side

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is VPN CloudHub?

A

Provides secure coms between multiple site-to-site VPN connections for both on-premise and VPCs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a VPC Endpoint?

A

Connect your VPC to supported AWS services without traffic leaving AWS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a VPC Peering connection?

A

Connection between two VPCs in AWS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is AWS Shield Advanced?

A

Sophisticated protection against DDOS attacks, costs $3k / month / org. Cost is per org if consolidated billing enabled

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

When is user data script run?

A

When an instance is first started - can set it to be everytime instance restarts but not by default

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is RDS Custom?

A

Allows you to customize your database and operating system but still use RDS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is Amazon FSx Lustre?

A

Highpperformance file system, useful for HPC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is an EC2 Launch Configuration

A

Instance configuration template that an Auto Scaling group uses to launch EC2 instances

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Can you modify an EC2 Launch Configuration?

A

No, you must create a new launch configuration and then modify the auto scaling group

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is Amazon Aurora?

A

MySQL and PostgreSQL compatbile relational database for the cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Can a NAT instance be used as a bastion host?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Are security groups associated with a NAT instance?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Can port forwarding be enabled on a NAT instance?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Can port forwarding be enabled on a NAT gateway?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Are security groups associated with a NAT gateway?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is CloudTrail?

A

Log management API calls to your AWS account

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is AWS Global Accelerator?

A

Network layer service that directs traffic to optimal endpoints over the AWS global network.

Protected by AWS Shield

Can do weighted routing which is great for global blue/green deployments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is Amazon Redshift?

A

Uses SQL to analyze data across data warehouses and data lakes for BigData queries

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is Amazon Redshift Spectrum?

A

Directly query S3 without having to load data into Redshift tables. Offload processing to the Redshift Spectrum layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are IAM Permission Boundaries?

A

limits the maximum permissions for a given IAM principle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are placement groups?

A

Describes the spread of EC2 instances

Cluster - packs instances physically close together for low latency
Partition - spread instances across different AZs but in the same rack
Spread - Places small group of instances across AZs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the minimum storage period before you can transition objects to IA?

A

30 days

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What are the different S3 storage tiers?

A

S3 Standard, Standard IA, S3 Intelligent Tiering, S3 One Zone-IA, S3 Glacier

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are the different Aurora DB endpoints?

A

Primary DB instance - Supports read/write operations, only one DB instance

Aurora Replica - Supports only read operations, can have up to 15 replicas in this cluster

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is VPC sharing?

A

Allows multiple AWS accounts to share subnets, so that different accounts can deploy resources to subnets with other accounts. There is a primary account which controls the VPC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

How to stream S3 data files and changes to Amazon Kinesis Data Streams?

A

Use AWS DMS (Database Migration Service) as a bridge between S3 and Kinesis Data Streams

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

I need to stream data from RDS into Redshift for querying, how should I do this?

A

Use AWS Database Migration Service to replicate the data from the database into Amazon Redshift

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is AWS EMR?

A

Elastic Map Reduce (Hadoop Clusters)
Run BigData open source petabyte data scale with Apache Spark, Hive or Presto

A serverless option

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is AWS Glue?

A

Extract, Transform and load (ETL) service for preparing their data for analytics.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Describe S3 consistency

A

Strong read-after-write consistency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is AWS DataSync?

A

Online data transfer service that simplifies, automates and accelerates copying large data between on-premise and AWS Storage services as well as between AWS Storage services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

When would you use EC2 dedicated hosts?

A

Gives you the physical server dedicated for you use. Great for server-bound licences

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

When would you use EC2 dedicated instances?

A

Instances are physically isolated from instances from other AWS accounts, can’t be used for server-bound licences

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is AWS Direct connect?

A

On-premise connection to AWS without going over the internet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is Amazon GuardDuty?

A

Threat detection service that monitors for malicous activity by monitoring across AWS data sources including CloudTrail, VPC Flow Logs and DNS logs

Can integrate with EventBridge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Can you directly copy data from Snowball into S3 Glacier?

A

No, it goes directly into S3 Standard Tier. You can create an S3 lifecycle policy to move it into S3 Glacier

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is the maximum number of instances running in an AVailability Zone for a spread placement group?

A

Maximum in 7

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

How can you secure data in transit with RDS?

A

Configure RDS to use SSL for data in transit. RDS will create a certificate so the client can verify the connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What is the difference between a Launch Template and Launch Configuration?

A

Launch Configuration - used by ASGs
Launch Template - used to launch spot / on-demand instances

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

SQS FIFO

A

SQS FIFO
Max throughput 3000 messages per second
Queue name must end in ‘.fifo’
Must specify queue type at creation time, if you want to change the type you must recreate the queue
Exactly once delivery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is Amazon Macie?

A

Removes PII from data automatically with AI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What is Amazon GuardDuty?

A

Intelligent threat discovery with machine learning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What data sources are supported by GuardDuty?

A

CloudTrail, VPC Flow Logs, DNS Logs and K8 logs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What are the targets of a CloudWatch alarm?

A

EC2 action, auto scaling action or SNS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What is a Launch template?

A

Similar to launch configuration but allows you to provision capacity across multiple instance types and using Spot and On-Demand instances.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Your Amazon Kinesis Data Stream has many consumers reading from it, how do you speed it up?

A

Use enhanced fan-out feature so that each consumer can consume it’s own output pipe of 2MB/second pipe per shard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What is a VPC Gateway Endpoint?

A

Specify a target in your route table directly to an AWS service. Current supported are DynamoDB and S3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What is a VPC Interface Endpoint?

A

An Elastic Network Interface with a private IP address to route to an AWS service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

How can you copy data from one bucket to another?

A

Use aws S3 sync command that copies objects that aren’t in the target bucket but are in the source bucket. Can run multiple times.

Set up S3 batch replication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

How can you save money on EC2 instances based on your usage?

A

Use AWS Cost Explorer Resource Optimization to get a report of EC2 instances that are idle or have low utilization

Use the AWS Compute Optimizer to look at instance type recommendations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

How can you speed up client bucket uploads?

A

Use Amazon S3 Transfer Acceleration to enable faster file uploads

Use multipart uploads for faster file uploads

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What is the AWS Database Migration Service?

A

Helps you migrate databases to AWS quickly and securely

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What is AWS Schema Conversion Tool?

A

Converts the source schema and code to match that of the target database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What is a transit gateway?

A

A network transit hub that you can use to interconnect VPCs and on-premise networks

Can connect Transit Gateways with Inter-Region peering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What is AWS Global Accelerator?

A

Provides static IP addresses as a fixed entry point to your applications

Routes traffic to the optimal endpoint based on performance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What are the pillars of the AWS Well-Architected Framework?

A

Operational excellence
Security
Reliability
Performance efficiency
Cost Optimization
Sustainability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What is EBS?

A

Elastic Block Store: Network drive you can attach to a single instance

One EBS can be attached to only on EC2 instance
Bound to a specific AZ

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

How to query meta data on an EC2 instance?

A

169.254.169.254/latest/meta-data

Holds IAM credentials, private IP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

How to migrate an EBS volume across regions?

A

Create a snapshot, then restore that snapshot into another region

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

What is an EC2 instance store?

A

Ephemeral storage for EC2 instance that is physically connected to EC2 instance for high I/O. But data is lost when EC2 instance crashes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

How to encrypt a non encrypted EBS volume?

A

Create an encrypted snapshot form volume, create a volume from the encrypted snapshot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

What is EFS?

A

Elastic File System - NFS a single EFS can be mounted to many EC2 instances. Can be across multiple AZs within a single region

Access control is done with Security Groups

Supports 1000s of attached EC2 instances

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

What is a Gateway Load Balancer?

A

GLB - routes traffic via a target group and then to a destination. Operates at level 3 and is good for firewalls or packet inspection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

What is Cross-Zone Load Blancing

A

Allows the load balancer instance to distribute traffic across all registered instances in all AZs. Enabled by default for ALB.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

What are the Auto Scaling Groups Dynamic scaling policies?

A

Target Tracking Scaling, tracks a simple metric
Step scaling - When a CloudWatch alarm is triggered then step up/down
Scheduled scaling - Change the capacity at a time period
Predicative Scaling - forecast load and schedule scaling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

What is RDS Read Replicas?

A

For read scalability
Up to 5 read replicas
Can be cross region/AZ
Each replica has it’s own DNS name
Asynchronous replication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

What is RDS Multi-AZ?

A

Used for failover not scaling
Increases availability
Synchronous replication

Can only connect to it in the event of a failure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

What is RDS Custom?

A

You have access to the underlying OS and control it but still within RDS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

What is Amazon Aurora?

A

A performant manage relational database service
Compatible with Postgres & MySQL
More performant than RDS
Up to 15 replicas
Can backtrack to snapshots in the past

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

What are the Aurora scaling methods?

A

Serverless - auto scaling based on actual usage

Multi-Master - Instance failover if the master DB crashes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

What is Global Aurora?

A

High availability of aurora across the globe, great for disaster recovery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

What is Aurora Machine Learning?

A

Simple SQL interface for ML based predications on data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

Your RDS instance is dropping connections frequently, how to solve?

A

Use Amazon RDS Proxy, a fully managed proxy for RDS which intelligently reuses DB connections to reduce stress on DB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

What is Amazon ElastiCache?

A

Managed Redis / Memcached for read intensive workloads

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

When to use Redis?

A

Multi AZ, replicas, with data durability and supports complex queries

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

When to use Memcached?

A

Simple key-value data that does not need to be persisted

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

How is access managed on ElastiCache?

A

Security Groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

What are the caching strategies?

A

Lazy loading: data is added to cache as it is read with TTL

Write through: adds / updates cache when written to the DB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

What is Amazon Route 53?

A

Fully managed DNS service for registering certificates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

What are the DNS record types?

A

A - maps a hostname to IPv4
AAAA - maps a hostname to IPv6
CNAME - maps a hostname to another hostname
NS - Name Servers for the Hosted Zone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

What are Route 53 hosted Zones?

A

Public Hosted Zones - contains records that specify how to route traffic on the internet
Private Hosted Zones - contains records that specify how your traffic is routed within a VPC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

What is the difference between CNAME vs Alias?

A

CNAME: Points a hostname to any other hostname for non root domains

Alias (A or AAAA): Points a hostname to an AWS Resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

What are the Route 53 Routing Policies?

A

Simple: specify multiple values in same record

Weighted: control the % of requests that go to each resource

Failover: DNS lookup can point to a different ip based on a health check

Latency: redirect to resource that is closed to the user

Geolocation: direct to a server based on Geolocation

Geoproximity: Direct to a server based on distance, can set a bias to attract more traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

What is Elastic Beanstalk?

A

Platform-as-a-Service tool that manages an application for you including:

ECS instances, ALB, RDS, SQS and CloudWatch it uses CloudFormation under the hood at no extra cost!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

What are the different Elastic Beanstalk tiers and what are their uses?

A

Web Server tier: handling web requests

Work Environment Tier: handling longer running jobs, e.g periodic or background tasks. Can be triggered by SQS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

What is the max S3 object size?

A

5 TB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

What is the max S3 object single part upload size?

A

5 GB but consider doing it smaller than that as it will be faster

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

What are the main S3 access controls?

A

IAM: Role based policies

Bucket policies - bucket wide rules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

What are the S3 Storage classes?

A

Standard

Standard IA

S3 Glacier

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

What S3 Lifecycle Rules?

A

Automatically transition objects between storage classes or deleting them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

What are S3 Event Notifications?

A

Become notified of s# event with object pattern name filtering
Destination can be SQS queue, Lambda, EventBridge or SNS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

What are the S3 Server-Side encryption options?

A

SSE-S3: Encryption keys entirely handled by AWS, enabled by default

SSE-KMS: Encryption managed by a key AWS KMS

SSE-C: Server side encryption using keys managed by the customer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

S3 encryption in transit

A

Use SSL/TLS, S3 exposes a HTTP and HTTPS endpoint.

Can force encryption with a bucket policy to refuce API calls without encryption options

Must use HTTPS for SSE-C

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

What is S3 CORS?

A

Web Browser based mechanism to control request to other origins

If the resource server does not have the origin ‘Access-Control-Allow-Origin’ header then the request will fail.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

How is the CloudFront cache invalidated?

A

Data is refreshed after the TTL has expired
OR
You can force a cache refresh by performing a CloudFront Invalidation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

What is Athena?

A

Serverless query service to analyze data stored in S3. Integrated with QuickSight

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

What is Athena Federated Query

A

Use lambda to run queries across many data sources (S3, RDS, DDB, CloudWatch)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

What is Amazon ElasticSearch / Open Search Service?

A

Search any field, supports partial matches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

What is Amazon QuickSight?

A

Create interactive dashboards, integrates with RDS, Aurora, Athena Redshift, OpenSearch

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

What is AWS Glue?

A

ETL (Extract, Transform and Load) service. Convert data between formats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

What is AWS Lake Formation?

A

Central place for data to be stored for analytics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

What is Amazon Rekognition?

A

Find object, people in images/video using ML

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

What is Amazon Transcribe?

A

Convert speech to text
Able to automatically remove PII

106
Q

Amazon Polly

A

Convert text to speech

107
Q

Amazon Translate

A

Natural and accurate language translation

108
Q

Amazon Lex

A

Automatic speech recognition
Natural Language understanding
Helps to build chatbots and call center bots

109
Q

What is Amazon Connect

A

Virtual contact center solutions using Lex

110
Q

What is Comprehend

A

Natural Language Processing that is serverless. Finds relationships in text

111
Q

What is Amazon Comprehend Medical?

A

Detects & returns useful info in clinical text

112
Q

What is Amazon SageMaker?

A

Fully managed service for building ML models

113
Q

What is Amazon Forecast?

A

Fully managed amazon service to make predications from data in S3

114
Q

What is Amazon Kendra?

A

Fully managed document search analyzer across many document sources

115
Q

What is Amazon Personalzie?

A

Fully managed ML service to build apps and make personalized recommendations

116
Q

What is Amazon Textract?

A

Extracts text, handwritting and data from scanned documents

117
Q

What are the EC2 metrics?

A

Out of the box metrics: disk IO, CPU and network IO

Install unified agent to get more

118
Q

What is Amazon EventBridge?

A

Schedule events
Schedule to event patterns
Send event to destinations

119
Q

What is CloudTrail Insights?

A

Using a baseline for normal management events then detects anomalies of this and creates an event in EventBridge

120
Q

What is AWS Config?

A

See how a resource was modified over time
Auditing and record compliance
Periodically evaluate or when config changes

121
Q

What is AWS Organizations?

A

Manage multiple AWS accounts with consolidated billing

122
Q

What are Service Control Policies?

A

SCPs limit permissions within an account or OU

123
Q

What are IAM conditions?

A

Set conditions such as NotIpAddress or RequestRegion to trigger when IAM policy is in affect

124
Q

What is Cognito User Pools?

A

Allows users to sign-in/sign-up against a user pool or 3p federated idp
Integrates with API G/W or ALB

125
Q

What is Cognito Identity Pools?

A

Exchange a token from user pool for temporary AWS credentials so that the user can access AWS resources directly

126
Q

What is AWS IAM Identity Center?

A

Integrates with AWS to allow developers to integrate with multiple AWS accounts

One login (single sign-on SSO) for all your AWS accounts

127
Q

What is AWS Control Tower?

A

Detect policy violations and remediate them within an Organizational Unit

Offers guardrails for control of your AWS environment and prevents config changes.

Automates account creation.

128
Q

What is AWS Firewall Manager?

A

Manage rules in all accounts of an AWS Organization

Manage:
* WAF, AWS Shield, Security Groups, Network Firewall, Route 53 Resolver DNS firewall

129
Q

What is Amazon Inspector?

A

Automated Security Assessments for running EC2 instances, ECR and lambda functions

130
Q

How many VPCs can you have per region?

A

5 , but this is a soft limit

131
Q

How many IP addresses does AWS resource in a subnet?

A

5, so you need to be aware of that when determining the subnet size

132
Q

What are the characteristics of a subnet?

A

Within a single VPC,
Has a CIDR range
Within a single AZ

133
Q

What are the characteristics of a VPC?

A

Within a single AWS region
Has a CIDR range
Contains multiple subnets

134
Q

What is an Internet Gateway?

A

Allows resources in a VPC to connect to the internet in a VPC but be used with route table and router for internet access

135
Q

What is a route table?

A

Associated with a subnet(s) and contains traffic routing rules to other subnets or IGW

136
Q

What is a NAT Gateway?

A

AWS managed NAT, highly available and high bandwidth
Links a private subnet to the NATGW to the IGW

One NAT gateway per public subnet / AZ

137
Q

What is a NACL?

A

Network Access Control List
Operates at the subnet level
Inbound/outbound rules and is stateless
Default accepts everything inbound/outbound

Be wary of ephemeral ports on the NACL rules!

138
Q

What is S3 Object Lock?

A

Store objects using a write-once-read-many (WORM) model to prevent objects from being deleted.

139
Q

What is S3 Object Lock Governance mode?

A

Locks the object over a retention period but certain IAM users can delete the protect object versions

140
Q

What is S3 Object Lock Compliance mode?

A

Locks the object over a retention period but no users can delete the protected object

141
Q

What is the S3 Legal Hold?

A

Legal hold prevents an object from being deleted and remains in place until the legal hold is removed. Legal holds can be removed by users with correct permission

142
Q

Do Lambdas have resource based permissions?

A

Yes, to allow a role or AWS service to invoke the function on your behalf

143
Q

What is a Lambda execution role?

A

The role that lambda assumes when the function is launched

144
Q

What is AWS Trusted Advisor?

A

Analyzes your AWS accounts and provides recommendations for cost, performance, security, fault tolerance and service limits

145
Q

What is AWS Application Migration Service (MGN)?

A

An automated lift-and-shift (rehost) service to move a workload from on-premise to AWS.

146
Q

What is AWS Compute Optimizer?

A

Recommends optimal AWS resource for your AWS workloads to reduce costs/improve performance using machine learning.

Can be run on:
* EC2, ASGs, EBS and Lambda

147
Q

How to manage Prometheus and Grafana in AWS?

A

Use “AWS Manage Service for Prometheus” and set that workspace as the data source in “AWS Managed Grafana”

148
Q

How to protect against CloudTrail log modifications/deletion?

A

Enable CloudTrail log file integrity validation and have the logs delivered to an S3 bucket

149
Q

What is AWS Application Discovery Service?

A

Helps you plan your migration to AWS cloud by collecting usage and configuration data about your on-premises services.

It integrates wtih the AWS Migration Hub console to track the migration of each application.

150
Q

What is Amazon Quantum Ledger Database (QLDB)?

A

A fully managed ledger database that provides transparent, immutable and cryptographically verifiable transaction log.

151
Q

How to get more metrics from EC2 instances?

A

Install the CloudWatch agent to the EC2 instance

152
Q

How to get more detailed metrics of RDS?

A

Enable enhanced monitoring

153
Q

You have an on-premise provider IdP and you want to give users access to AWS resources, how to do this?

A

Setup an identity provider, app assumes role with SAML to get tokens to assume a role

154
Q

How to avoid “hot” partitions in DynamoDB?

A

Choose high-cardinality partition keys which vary greatly between items

155
Q

What is AWS Storage Gateway service?

A

File interface into S3 with mount points
Clients can use SMB or NFS to interact with it
Maintains a local cache for frequently accessed items

156
Q

What is Amazon FSx

A

Launch and manage high performance file systems in the cloud

157
Q

What is FSx for Windows?

A

Microsoft Active Directory (AD) integration
Accessible from Windows, Linux and Mac instances

158
Q

How to capture changes from an Aurora DB or RDS instance?

A

Create a lambda and trigger than lambda on update events. Lambda can then send message in SQS.

159
Q

What is AWS Artifact?

A

View compliance related information and security reports

160
Q

What is AWS Security Hub?

A

Comprehensive view of high-priority security alerts and security of your AWS account

161
Q

What is KMS custom key store?

A

Logical store to store keys but still use KMS for convenience. Customer is in full control of keys.

Can you CloudHSM or external key store for key material.

162
Q

How to enable RDS data IAM access?

A

Enable IAM DB Authentication, so that authentication is managed through IAM

163
Q

How do ASGs decide which instance to terminate?

A

Choose the AZ with the most number of instances
Select instances with the oldest launch config
Select the instance that is closest to the next billing hour

164
Q

How to query data from buckets in multiple accounts?

A

Use AWS Lake Formation to consolidate data from multiple accounts into a single account

165
Q

When to consider using the snow family over internet to transfer large amounts of data?

A

When it takes > 1 week to transfer the data

166
Q

What is AWS Tape Gateway?

A

Backs up data to AWS Storage Gateway to backup data directly to S3 Glacier Flexible Retrieval / Deep Archive

167
Q

What are cost allocation tags?

A

Tag AWS resources with a key value pair (department - eng).
Activate the tags in the Billing and Cost Management console, which generates a allocation report across the tags.

168
Q

Can you directly transfer data into S3 glacier deep archive / flexible retrieval from DataSync?

A

Yes, you don’t have to wait 30 days

169
Q

What is S3 Infrequent Access best for?

A

Long-lived, rapid but less frequently accessed data

170
Q

What is One Zone S3 best for?

A

Data is only stored in one AZ so has lower availability (99.5%) but is cheaper

171
Q

What are SNS filter policies?

A

A filter policy on an SNS subscription in which the subscriber would only receive messages that they are interested in

172
Q

What is AWS Proton?

A

Deploy serverless / container-based applications with infrastructure broken down into environment and service templates

173
Q

What is AWS Proton?

A

Deploy serverless / container-based applications with infrastructure broken down into environment and service templates

174
Q

What is Amazon Simple Workflow Service (SWF)?

A

Coordinate work across distributed applications which are task-oriented

175
Q

What is Amazon Database Migration Service (AWS DMS)?

A

Migrate data stores, good for one-time migrations and replicating ongoing changes between sources and targets.

Can also encrypt source/target endpoints with SSL but you need to add certificate tothe endpoint.

176
Q

What is the relationship between load balancers and subnets?

A

An ELB can be associated with multiple subnets.

An ELB can forward traffic as needed into other subnets.

177
Q

What is AWS Backup?

A

Configure backup policies for AWS / on-premise across accounts / regions

178
Q

What is the SQS message retention period?

A

Default 4 days
Minimum 1 minute
Max 14 days

179
Q

How to route traffic using Route 53 to a public website hosted in S3?

A

Configured bucket to host a static website and public access enabled
Name the bucket the same as your domain or subdomain
A registered domain name

180
Q

What is Amazon Data Lifecycle Manager (Amazon DLM)?

A

Used to automate the creation, retention and deletion of EBS volume snapshots

181
Q

What is the ASG cooldown period?

182
Q

What is AWS Resource Access Manager (RAM)?

A

Helps you share resource across AWS accounts or within OUs.

183
Q

What is EC2 hibernation?

A

Instance is put in hibernation, you pay only for the EBS volumes and Elastic IP address

184
Q

Can you enable EC2 hibernation on a running instance?

A

No, you have to enable hibernation when launching an instance. Also the EBS volume must be encrypted.

185
Q

Are you billed if your on-demand EC2 instance is stopping to hibernate?

186
Q

Are you billed if an EC2 instance is shutting-down to terminate?

187
Q

Are you billed if your spot EC2 instance is stopping?

188
Q

Are you billed if your Reserved instance is in a terminated state?

189
Q

Compare Transit Gateways to AWS VPN CloudHub?

A

Both interconnect VPCs and on-premise networks.

But
Transit Gateways use Direct connect a dedicated connection to connect to on-premise so traffic doesn’t traverse internet
AWS VPN CloudHub traverses the internetƒ

190
Q

What is AWS AppSync?

A

Keep app data updated in real-time from DynamoDB and ElastiCache with Lambda

Serverless and uses GraphQL with pub/sub

191
Q

What are the AWS Kinesis services?

A

Kinesis Data Streams, Kinesis Data Firehose, Kinesis Video Stream and Kinesis Data Analytics

192
Q

What is Kinesis Data streams used for?

A

Process and store data streams

193
Q

Kinesis Data Firehose?

A

Load data streams into AWS data stores
Transforms as well.

194
Q

Kinesis Data Analytics?

A

Analyze data streams with SQL / Apache Flink

195
Q

What should you do if you no longer need a reserved instance?

A

Sell the Reserved instances on the AWS Reserved Instance Marketplace OR
Terminate the Reserved instances to avoid being charged for the on-demand price once it expires

196
Q

How does Amazon S3 Transfer Acceleration work?

A

Leverages CloudFront’s globally distributed AWS Edge locations so users can upload around the world

197
Q

Is autoscaling enabled by default with DynamoDB?

A

No, you have to enable it manually

198
Q

What is the cloudformation CreationPolicy attribute?

A

For when you want to wait on resource configuration actions before stack creation proceeds. You need to signal success wtih the cfn-signal helper script.

199
Q

What is the Kinesis data stream retention period?

A

Time from when a record is added to when it is no longer available.
Default is 24 hours and can be increased to 365 days.

200
Q

Can you peer two VPCs with overlapping CIDR blocks?

201
Q

How to migrate an Aurora replica with no down time and performance being affected?

A

Use AWS DMS to migrate data

202
Q

How can you quickly access small amounts of data quickly from S3 Glacier?

A

Quickly access your data for urgent requests for a subnet of archives

Purchase provisioned retrieval capacity (1 - 5 mins retrieval)

203
Q

What is Route 53 active-active failover?

A

All your resources are routed to, when a resource becomes unavailable Route 53 can detect that and stop routing traffic to it

204
Q

What is Route 53 active-passive failover?

A

When you want a primary resource to be available and a standby resource to be routed to in case the primary fails

205
Q

Does an Elastic IP disassociate with an instance after it is stopped?

A

No, it remains attached

206
Q

An RDS instance is running out of disk storage, how best to fix?

A

Enable storage autoscaling

207
Q

What is the maximum backup retention period of Aurora?

A

35 days, if you need more use an AWS Backup plan

208
Q

What limits how many EC2 instances you can launch?

A

The vCPU limit per account per region

209
Q

How to grant users access to private content on CloudFront?

A

Using special CloudFront signed URLs / cookies

210
Q

How to import a certificate into AWS?

A

Use AWS Certificate Manager or IAM certificate store

211
Q

If your identity store is not compatible with SAML 2.0 how can you integrate it with AWS?

A

Develop a custom identity broker and use STS to issue AWS credentials

212
Q

How is CloudWatch agent used with SSM Parameter store?

A

SSM Param store stores the CloudWatch agent config.

213
Q

An EC2 instance launched doesn’t have a DNS name. Why?

A

DNS resolution and hostname of the VPC should be enabled

214
Q

How to get logs from an EC2 instance?

A

Install the CloudWatch unified agent

215
Q

Differences between DataSync and Storage Gateway?

A

DataSync supports a variety of AWS storage services whereas Storage G/W supports a few.

DataSync is more suitable in automating and accelerating data transfers or migrating data

Storage Gateway is more suitable for integrating on-premise with cloud.

216
Q

What is RAID 0 instance store configuration?

A

Improves the IOPS

217
Q

What is an Elastic Fabric Adapter? (EFA)

A

Network device you can attach to your EC2 instance to accelerate HPC

218
Q

What is S3 server access logging?

A

Enabled per bucket, logs all access requests to bucket. Like CloudTrail but also includes referer.

219
Q

What is the AWS Personal Health dashboard?

A

Shows AWS events which may affect resources in your account. Subscribe with EventBridge.

220
Q

What is the Origin Access identity used for with S3?

A

Can give cloudFront permission to read the bucket but not make the bucket public.

CloudFront needs a Origin Access Identity (OAI)

221
Q

What are the regular RDS metrics?

A

CPU Utilization, Database Connections, and Freeable Memory

222
Q

What is AWS License Manager?

A

A service to manage your software licences. Gives visibility with SNS topics and reduces risk of non-compliance.

223
Q

Do RDS Read replicas have their own DNS name?

A

Yes, you need to distribute requests amongst them yourself, route 53 can do this.

224
Q

What is S3 cross-region replication?

A

Makes your bucket available, even in the event of a regional failure.

225
Q

How can you use AWS Config to attempt remediation of non compliance

A

Use AWS Config to define the compliance rule, when Config detects a non-compliance event then trigger an EventBridge event which triggers Lambda to attempt remediation.

226
Q

What EBS volumes support the multi attach feature?

A

io1 / io2, doesn’t support multi-az resiliency

227
Q

What are EBS magnetic volumes?

A

Lowest cost per gigabyte, ideal for infrequently accessed data

228
Q

Does SSE-S3 provide an audit trail?

A

No, must use SSE-KMS for this.

228
Q

Does SSE-S3 provide an audit trail?

A

No, must use SSE-KMS for this.

229
Q

What are the storage gateways?

A

S3 File Gateway - NFS/SMB with S3 backing
FSx File Gateway - integrates with FSx
Volume Gateway - can cache data volumes, data is on-premise
Tape Gateway - backed with S3 and S3 glacier

230
Q

What are CloudTrail Management events?

A

Events for management operations (who, what action and if successful)

231
Q

What are CloudTrail Data events?

A

S3 object activity/lambda invokes. Not logged by default.

232
Q

What are the S3 lifecycle transition limits

A

Apply only to IA accessed. You must store the data for at least 30 days in the standard class.

Other transitions have no limits.

233
Q

Do ALBs support weighted target groups

A

Yes, other ELBs don’t though

234
Q

What is CloudWatch Application Insights?

A

Provides automated dashboards to show potential problem with monitored applications.

235
Q

What is SQS visibility timeout?

A

30s default
12 hrs max

236
Q

What is the Auto Scaling Group instance warm up time?

A

The time before the instance metrics are taken into account for the ASG action

237
Q

What is ALB slow start mode?

A

ALB gradually increases percentage of traffic that target receives

238
Q

What is Amazon Workspaces?

A

Virtual desktops to use in the cloud

239
Q

What is the S3 GET /PUT limits?

A

3500 PUT requests / s
5000 GET requests /s

240
Q

Does adding random prefixes to S3 objects help?

A

No, this is no longer needed

241
Q

Can tags be used in IAM conditions?

242
Q

How to programatically ensure you are not close to exceeding your service limits?

A

Lambda function that refreshes the AWS Trusted Advisor Service checks and then capture these events with Amazon EventBridge

243
Q

What is an Elastic Network Adapter? (ENA)

A

Like EFA but more compatible with windows

244
Q

What is AWS Network Firewall?

A

Define rules that provide fine-grained control on in/egress traffic

Inspect traffic

245
Q

What is AWS Systems Manager Run Command?

A

Manage the config of many EC2 instances (or on-premise) or run commands

246
Q

What is an IAM role trust policy?

A

Who can assume this role? Other accounts/services

247
Q

ASG Step scaling vs Target tracking

A

Use step scaling when you want to base the scaling based on a set of scaling adjustments

248
Q

How to increase the throughput of Site-to-Site VPN connections?

A

Associate the VPCs to an Equal Cost Multipath Routing enabled transit gateway

249
Q

What are On-Demand Capacity Reservations?

A

Enables you to reserve compute capacity for EC2 in a specific AZ for any duration

250
Q

How to get notified of certificate expiry in ACM?

A

Use Amazon EventBridge to run every day to determine expiry of certificates

Use EventBridge and listen to expiration events from ACM, starts 45 days prior to expiration.

Use an AWS Config managed rule “built-in-acm-certificate-expiration-check”

251
Q

Do IAM users need access keys to make API calls?

252
Q

What is the minimum storage in S3 Deep Archive?

253
Q

What is the RDS read replica asynchronous replication time

254
Q

What is the Aurora replica asynchronous replication time

A

milliseconds

255
Q

Do RDS instances have security groups?

A

Yes but can also use IAM auth when enabled

256
Q

Does athena have security groups

A

No, access is controlled by IAM

257
Q

Received a capacity error when launching an instance in a placement group that already has instances. What to do?

A

Stop and restart the instances in the placement group and launch the group again.

258
Q

Athena queries slow, what to do?

A

Convert the S3 data with Glue to Apache Parquet

259
Q

What is Aurora cloning?

A

Space and resource efficient clone of another aurora DB (records the diff)

AWS SAA Dom (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions