Networking & Content Delivery Flashcards

1
Q

What it the main purpose of Route 53

A

Routing Internet Traffic to your Website or Web Application

Route 53 Health Checks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Whats steps are required for route53 to route Internet Traffic to your Website or Web Application

A
  • Use the Route 53 console to register a domain name and configure Route 53 to route internet traffic to your website or web application.
    • After you register your domain name, Route 53 automatically creates a public hosted zone that has the same name as the domain.
    • To route traffic to your resources, you create records, also known as resource record sets, in your hosted zone.
    • You can create special Route 53 records, called alias records, that route traffic to S3 buckets, CloudFront distributions, and other AWS resources.
    • Each record includes information about how you want to route traffic for your domain, such as:
    ◦ Name – name of the record corresponds with the domain name or subdomain name that you want Route 53 to route traffic for.
    ◦ Type – determines the type of resource that you want traffic to be routed to.
    ◦ Value
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How do you route internet traffic to AWS resources?

A

• To route traffic to your resources, you create records, also known as resource record sets, in your hosted zone.
• You can create special Route 53 records, called alias records, that route traffic to S3 buckets, CloudFront distributions, and other AWS resources.
• Each record includes information about how you want to route traffic for your domain, such as:
◦ Name – name of the record corresponds with the domain name or subdomain name that you want Route 53 to route traffic for.
◦ Type – determines the type of resource that you want traffic to be routed to.
◦ Value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What values can you use to specify how a health check work in route 53?

A

◦ Create a health check and specify values that define how you want the health check to work, such as:
▪ The IP address or domain name of the endpoint that you want Route 53 to monitor.
▪ The protocol that you want Route 53 to use to perform the check: HTTP, HTTPS, or TCP.
▪ The request interval you want Route 53 to send a request to the endpoint.
▪ How many consecutive times the endpoint must fail to respond to requests before Route 53 considers it unhealthy. This is the failure threshold.

◦ You can configure a health check to check the health of one or more other health checks.
◦ You can configure a health check to check the status of a CloudWatch alarm so that you can be notified on the basis of a broad range of criteria.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which policy in route 53 allows routing of internet traffic to a single resource that performs a given function for your domain?

A

• Simple routing policy – route internet traffic to a single resource that performs a given function for your domain. You can’t create multiple records that have the same name and type, but you can specify multiple values in the same record, such as multiple IP addresses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

To configure active-passive failover in route 53 which routing policy would you use?

A

Failover routing policy – use when you want to configure active-passive failover.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

To route internet traffic to your resources based on the location of your users which routing policy would you use?

A

Geolocation routing policy – use when you want to route internet traffic to your resources based on the location of your users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

To route internet traffic based on the location of your resources and optionally, shift traffic from resources in one location to resources in another you’d use which routing policy?

A

• Geoproximity routing policy – use when you want to route traffic based on the location of your resources and, optionally, shift traffic from resources in one location to resources in another.
◦ You can also optionally choose to route more traffic or less to a given resource by specifying a value, known as a bias. A bias expands or shrinks the size of the geographic region from which traffic is routed to a resource.
◦ The effect of changing the bias for your resources depends on a number of factors, including the following:
▪ The number of resources that you have.
▪ How close the resources are to one another.
▪ The number of users that you have near the border area between geographic regions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

You want to route traffic to the resource that provides the best latency, which policy would you use?

A

Latency routing policy – use when you have resources in multiple locations and you want to route traffic to the resource that provides the best latency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Why use a weighted routing policy?

A
  • Weighted routing policy – use to route traffic to multiple resources in proportions that you specify.
    • When you register a domain or transfer domain registration to Route 53, it configures the domain to renew automatically. The automatic renewal period is typically one year, although the registries for some top-level domains (TLDs) have longer renewal periods.
    • When you register a domain with Route 53, it creates a hosted zone that has the same name as the domain, assigns four name servers to the hosted zone, and updates the domain to use those name servers.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the purpose of DNS records?

A

• Create records in a hosted zone. Records define where you want to route traffic for each domain name or subdomain name. The name of each record in a hosted zone must end with the name of the hosted zone.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What a are the differences between CNAME and Alias records?

A

CNAME Records

  • You can’t create a CNAME record at the zone apex.
    Route 53 charges for CNAME queries.
  • A CNAME record redirects queries for a domain name regardless of record type.
  • A CNAME record can point to any DNS record that is hosted anywhere.
  • A CNAME record appears as a CNAME record in response to dig or Name Server (NS) lookup queries.
  • An alias record appears as the record type that you specified when you created the record, such as A or AAAA.

Alias Records

  • You can create an alias record at the zone apex. Alias records must have the same type as the record you’re routing traffic to.
  • Route 53 doesn’t charge for alias queries to AWS resources.
  • Route 53 responds to a DNS query only when the name and type of the alias record matches the name and type in the query.
  • An alias record can only point to selected AWS resources or to another record in the hosted zone that you’re creating the alias record in.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Route 53 supported record types?

A
  • A Record Type – the value for an A record is an IPv4 address in dotted decimal notation.
  • AAAA Record Type – the value for a AAAA record is an IPv6 address in colon-separated hexadecimal format.
  • CAA Record Type – lets you specify which certificate authorities (CAs) are allowed to issue certificates for a domain or subdomain.
  • CNAME Record Type – a CNAME Value element is the same format as a domain name.
  • MX Record Type – each value for an MX record actually contains two values, priority and domain name.
  • NAPTR Record Type
  • NS Record Type – identifies the name servers for the hosted zone. The value for an NS record is the domain name of a name server.
  • PTR Record Type – is the same format as a domain name.
  • SOA Record Type – provides information about a domain and the corresponding Amazon Route 53 hosted zone.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How do health check evaluate the health of an endpoint?

A

Each health checker evaluates the health of the endpoint based on two values:
◦ Response time
◦ Whether the endpoint responds to a number of consecutive health checks that you specify (the failure threshold)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What can 3 things can a health check be setup to monitor?

A

Each health check that you create can monitor one of the following:
◦ The health of a specified resource, such as a web server
◦ The status of other health checks
◦ The status of an Amazon CloudWatch alarm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which AWS tool can you use to collect metrics on healthchecks?

A
  • You can use Amazon CloudWatch metrics to see the number of DNS queries served for each of your Route 53 public hosted zones. With these metrics, you can see at a glance the activity level of each hosted zone to monitor changes in traffic.
    • You can monitor your resources by creating Route 53 health checks, which use CloudWatch to collect and process raw data into readable, near real-time metrics.
    • Log API calls with CloudTrail
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Purpose of CloudFront?

A

A web service that speeds up distribution of your static and dynamic web content to your users. A Content Delivery Network (CDN) service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

How does CloudFront deliver content?

A

It delivers your content through a worldwide network of data centers called edge locations. When a user requests content that you’re serving with CloudFront, the user is routed to the edge location that provides the lowest latency, so that content is delivered with the best possible performance.

◦	If the content is already in the edge location with the lowest latency, CloudFront delivers it immediately.
◦	If the content is not in that edge location, CloudFront retrieves it from an origin that you’ve defined
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which protocols does CloudFront support?

A
CloudFront supports the WebSocket protocol as well as the HTTP protocol with the following HTTP methods:
	◦	GET
	◦	HEAD
	◦	POST
	◦	PUT
	◦	DELETE
	◦	OPTIONS
	◦	PATCH.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are the different CloudFront Origins?

A

◦ Using S3 buckets for your origin – you place any objects that you want CloudFront to deliver in an S3 bucket.
◦ Using S3 buckets configured as website endpoints for your origin
◦ Using an mediastore container or an mediapackage channel for your origin – you can set up an S3 bucket that is configured as a MediaStore container, or create a channel and endpoints with MediaPackage. Then you create and configure a distribution in CloudFront to stream the video.
◦ Using EC2 or other custom origins – A custom origin is an HTTP server, for example, a web server.
◦ Using CloudFront Origin Groups for origin failover – use origin failover to designate a primary origin for CloudFront plus a second origin that CloudFront automatically switches to when the primary origin returns specific HTTP status code failure responses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the default caching time for objects in Cloudfront?

A

Objects are cached for 24 hours by default. You can invalidate files in CloudFront edge caches even before they expire.

22
Q

What are the main configuration parameters of a CloudFront distribution?

A

You create a distribution and choose the configuration settings you want:
▪ Your content origin—that is, the Amazon S3 bucket, MediaPackage channel, or HTTP server from which CloudFront gets the files to distribute. You can specify any combination of up to 25 S3 buckets, channels, and/or HTTP servers as your origins.
▪ Access—whether you want the files to be available to everyone or restrict access to some users.
▪ Security—whether you want CloudFront to require users to use HTTPS to access your content.
▪ Cookie or query-string forwarding—whether you want CloudFront to forward cookies or query strings to your origin.
▪ Geo-restrictions—whether you want CloudFront to prevent users in selected countries from accessing your content.
▪ Access logs—whether you want CloudFront to create access logs that show viewer activity.

23
Q

What type of content can you use Cloudfront to serve?

A

You can use distributions to serve the following content over HTTP or HTTPS:
▪ Static and dynamic download content.
▪ Video on demand in different formats, such as Apple HTTP Live Streaming (HLS) and Microsoft Smooth Streaming.
▪ A live event, such as a meeting, conference, or concert, in real time.

24
Q

How can you setup redundancy in CloudFront?

A

CloudFront also allows you to set up multiple origins to enable redundancy with Origin Failover. To set up origin failover, you must have a distribution with at least two origins. Next, you create an origin group for your distribution that includes the two origins, setting one as the primary. Finally, you define a cache behavior in which you specify the origin group as your origin.
▪ The two origins in the origin group can be any combination of the following: AWS origins, like Amazon S3 buckets or Amazon EC2 instances, or custom origins, like your own HTTP web server.
▪ When you create the origin group, you configure CloudFront to failover to the second origin for GET, HEAD, and OPTIONS HTTP methods when the primary origin returns specific status codes that you configure.

25
Q

How do you record configuration changes in CloudFront distribution settings?

A

You can use AWS Config to record configuration changes for CloudFront distribution settings changes.

26
Q

How can you secure CloudFront against attacks?

A

◦ CloudFront, AWS Shield, AWS WAF, and Route 53 work seamlessly together to create a flexible, layered security perimeter against multiple types of attacks including network and application layer DDoS attacks.
◦ You can deliver your content, APIs or applications via SSL/TLS, and advanced SSL features are enabled automatically.
◦ Through geo-restriction capability, you can prevent users in specific geographic locations from accessing content that you’re distributing through CloudFront.
◦ With Origin Access Identity feature, you can restrict access to an S3 bucket to only be accessible from CloudFront.
◦ Field-Level Encryption is a feature of CloudFront that allows you to securely upload user-submitted data such as credit card numbers to your origin servers.

27
Q

Key aspects that affect pricing in CloudFront?

A

◦ Charge for storage in an S3 bucket.
◦ Charge for serving objects from edge locations.
◦ Charge for submitting data to your origin.
▪ Data Transfer Out
▪ HTTP/HTTPS Requests
▪ Invalidation Requests,
▪ Dedicated IP Custom SSL certificates associated with a CloudFront distribution.
◦ You also incur a surcharge for HTTPS requests, and an additional surcharge for requests that also have field-level encryption enabled.

28
Q

Limits in CloudFront file size, transfer rate and files you can server per distribution?

A

◦ The maximum size of a single file that can be delivered through CloudFront is 20 GB.
◦ Data transfer rate per distribution limit is 40 Gbps.
◦ Files that you can serve per distribution is unlimited.

29
Q

What are the benefits of application ELB’s?

A

▪ Support for path-based and host-based routing.
▪ Support for routing requests to multiple applications on a single EC2 instance.
▪ Support for registering targets by IP address, including targets outside the VPC for the load balancer.
▪ Support for containerized applications.
▪ Support for monitoring the health of each service independently.

30
Q

What are the benefits of network load balancers?

A

▪ Ability to handle volatile workloads and scale to millions of requests per second.
▪ Support for static IP addresses for the load balancer, or assign one Elastic IP address per subnet enabled for the load balancer.
▪ Support for registering targets by IP address.
▪ Support for routing requests to multiple applications on a single EC2 instance (register each instance or IP address with the same target group using multiple ports).
▪ Support for containerized applications.
▪ Support for monitoring the health of each service independently.

31
Q

How do you disable AZ’s on a network load balancers following creation?

A
  • You CANNOT enable or disable Availability Zones for a Network Load Balancer after you create it.
32
Q

Which protocols do ALB and ELB’s support?

A

ALB functions at layer 7:
Allows HTTP and HTTPS

NLB functions at layer 4:
Functions at the fourth layer of the Open Systems Interconnection (OSI) model. Uses TCP and UDP connections.

33
Q

Which DNS record type is how the root zone delegates control of .org to the .org registry?

A

NS

34
Q

How many subnets are in a default VPC?

A

Equal to the number of AZ’s in the region the VPCs located in

35
Q

What is the CIDR of a default VPC?

A

172.31.0.0/16

36
Q

Type of Route 53 health checks?

A

TCP - establish tsp connection within 10 seconds

HTTP/HTTPS - - establish tcp connection within 4 seconds, needs a 200 response

HTTP/HTTPS with string matching - checks application delivering content as well as network, tcp connection within 4 seconds, strong must occur in the first 5120 byes of the check

Can monitor endpoints, other health-checks and create Cloudwatch alarm

37
Q

What are the different routing policies in Route53?

A

1) Simple - route to single resource 1 DNS record can have multiple values
2) Failover - primary and secondary, 2 DNS records - E.g. Primary for EC2, Secondary for S3 (Active/Passive)
3) Weighted - weight the DNS record e.g. 90/10 - ip 1 get returned 90% of the time and 2 10% of the time. Should a record fail healthcheck (Active/Active) load balancing or testing new software versions. If record fails healtcheck then process starts again.
4) Latency-based - multiple records e.g. 2 records each may point to different locations(AZ), picks record with lowest latency, good for user experience.
5) Geolocation - matches record based on where customer is (localised content), if not default will be returned, if no default nothing returned.
6) Multi-value - all values returned to client all records can have the same time, can respond to a query with multiple healthy records, gives a bit more resillience to simple routing

38
Q

Which type of record set is user to point at AWS resources?

A

A + Alias

39
Q

What type of hosted zone is available only within 1 or more VPCs

A

Private Hosted Zone

40
Q

VPC router fundamental properties are?

A
  • Highly available
  • In every subnet with a network +1 address
  • Routes traffic between subnets
  • Main route table (subnet default) unless seperate route table defined and associated (route table can be assigned to many subnets)
41
Q

When using an IGW how many do you need to create across multiple regions and AZ’s? What is the function of an IGW?

A
  • Region resilient gateway attached to VPC
  • Only attached to 1 AZ at a time - 1 VPC = 0 or 1 IGW, 1 IGW = 0 or 1 VPC
  • Run in AWS public zone
  • Gateways traffic between the VPC and INternet or AWS public zone (S3..SQS…SNS..etc)
42
Q

How do you configure an IPv4 public address on an EC2 instance?

A
  • The OS/service will never see the public address, the public ip will be on the IGW only and associate it to the private address (IGW will change the packet address from private to public for outbound packets) and vice versa
43
Q

What resources to NACL’s affect?

A

NACL’s are associated with a subnet and only affect traffic leaving or incoming to the subnet not within (crossing subnet border)

VPC has a default NACL, which changes to custom if another is assigned

By default NACL’s do not block any traffic because of complexity particularly with multi tier because of below

Stateless - need to add ephemeral ports for response ( initiation and response seen as different)

One Subnet = one NACL at a time

44
Q

What are security groups? and differences between NACL’s

A

Cannot explicitly deny with SG’s

Security group is attached to a resource not a subnet

Stateful - response considered part of same comm therefore one rule required

Can reference resources as well as IP’s and other security groups and can ref themselves

45
Q

Scenario where you’d use NACL vs security group?

A

When adding explicit DENY (bad ip’s and actors)

On products that don’t support sg’s like NAT gateways etc.

Otherwise SG’s are better and simpler and default almost everywhere, NACL’s get v complex

46
Q

What is the NAT gateways primary job?

A

To allow multiple private IP’s to masquerade behind its public address (uses elastic IP)

NAT gw are AZ resilient e.g. hardware failure within
AZ but not AZ failure

They are managed service, can have multiple up to 45gbps

Charged hourly e.g. 4 cent per hour plus data processing charge

47
Q

Security groups and NACL’s can be used with Nat gateways True or false?

A

SG’s are no supported on a NAT gw’s can only use NACL’s

48
Q

NAT GW’s support IPV6 NAT true or false?

A

You do not need NAT with IPv6, NAT GW’s do not work with IPv6

49
Q

What is true of route tables and subnets?

A Subnet can have multiple route tables

B Subnet can have one route table attached

C Route table can be associated with one multiple subnets

D Route table can be associated with only one subnet

A

A and C

50
Q

Which load balancer is capable of handling non HTTP and HTTPS traffic?

A

Network Load Balancer