Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Solution Architect > New > Flashcards

New Flashcards

1
Q

S3 - What are the file restrictions in S3?

A

0bytes to 5TB
Files need to be uploaded in multipart when >5GB

IA: min 128KB and min. duration of 30days

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

S3 - What are the two types of meta data?

A

System metadata: last modified, MD5 digest, Content-Type

User Metadata: key-value for user defined tags

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

S3 - How is an URL for a file in S3 structured?

A

http://[BUCKET].s3.amazonaws.com/[FILENAME]

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

S3 - What API actions can be done in S3?

A

GET, PUT, DELETE, LIST

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

S3 - How many facilities can fail in S3 at one time?

A

Two

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

S3 - What is RRS in S3?

A

Durability 99.99%

Lower costs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

S3 - What are atomic reads for eventual consistent reads?

A

An old version or the new version will be delivered, but not a mix

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

S3 - How can access be controlled in S3?

A

coarse grained: Access Control Lists

fine grained: Bucket Policy, IAM, query-string authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

S3 - What can be done with Bucket Policies?

A

Restrict access based on IP-Range, time-of-day, which bucket

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

S3 - Can you assign a IAM Policy to another account?

A

No, use roles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

S3 - How are static websites structured?

A

[BUCKET].s3-website-[REGION].amazonaws.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

S3 - What mechanisms can be used to encrypt?

A

Before sending: Client Side Encryption
In-Flight: SSL
At Rest: SSE-S3, SSE-KMS, SSE-C (All using AES 256bit)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

S3 - What is a Range GET?

A

Get the n-first bytes of S3/Glacier

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

S3 - What gets logged in S3 Access Logs?

A 
Account/IP
Bucket name
Time
Action (PUT, GET...)
Response Code
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

S3 - How are files stored in Glacier?

A

Archives (up to 40TB)
Identified with an archive ID (not user defined)
Automatically encrypted
Immutable, cannot be modified

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

EC2 - What is an EBS optimized instance?

A

Optimized configuration to take full advantage of EBS storage. Comes with an additional hourly cost

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

VPC - Can you have more than one Route Table?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

VPC - What is an ENI?

A

Elastic Network Interface
Can be attached to the Instance
Handles the Security Group
Can have one public and multiple private IPs (>1 -> Dual Homed)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

ELB - What Protocols does ELB support?

A

HTTP
HTTPS
TCP
SSL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

ELB - How to use SSL on ELB?

A

Install the SSL Certificate, which terminates the connection, decryptes the request, then sends it to the backend
If there are multiple websites, you need to use Subject Alternative Name (SAN)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

ELB - What is a Listener on the ELB?

A

Process that checks for a connection request
CNAME, A-Recored e.g.
COnfigured with a protocol and port

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

ELB - What OSI Levels does ELB use?

A

Layer 7 for applications (HTTP/HTTPS)

Layer 4 for TCP traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

ELB - What are the configurable features in ELB? (6)

A 
Idle Connection Timeout
Cross Zone Load Balancing
Connection Draining
Proxy Protocol
Sticky Sessions
Health Checks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

ELB - How can ELB help to keep instances updated?

A

By terminating long running instances and replace them with fresh AMIs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

CloudWatch - Name two types of actions that CW can send an altert/message to?

A

SNS

AutoScalingGroup

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

CloudWatch - Can CW aggregate data across regions?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

CloudWatch - What two metrics are not visible to AWS and need to be send as custom metrics?

A

Instance memory consumption

Disk metrics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

CloudWatch - How can you store logs indefinately?

A

Store the logs in S3 (else the data is retained by two weeks)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

ASG - What are the four scaling plans?

A

Maintain Current Instance Level
Manual Scaling
Scheduled Scaling
Dynmaic Scaling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

ASG - Can the AutoScalingGroup reference a spot and a on-demand instance at the same time?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

ASG - What service integrates Active Directory?

A

AWS Directory Service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

IAM - What is a principal in IAM?

A

Is the permanent or temporary right to interact with an AWS resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

IAM - For which three purposes are roles used?

A

As EC2-Role: Allows to use applications on an instance
As Cross-Account-Access
For Federation: Access granted by external system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

IAM - What is a securtiy token and who provides it?

A

The AWS Security Token Service provides it.

Allows temp. acces for 15min to 36 hrs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

IAM - What are ways to assign a policy?

A

Direcly on the IAM User
As a policy, which is then attached to the user
Directly on a Group
As a policy, which is then attached to a group

36
Q

IAM - How are permissions handeled?

A

Per default everything is denied
Only allow -> allow
Only deny -> deny
allow and deny -> deny

37
Q

Security - What is Storage Device Decommission?

A

Storage devices that reached the end of life will be decommissioned/destroyed so that no data can be exposed

38
Q

Security - Does AWS have access to the instance or the OS?

A

No

39
Q

Security - Best practise to auto update an instance

A

Launch the latest AMI

40
Q

Security - Should you use additional firewalls

A

In best case: yes, like windows firewall or IPtables

41
Q

Security - How is EBS being replicated?

A

At no additional costs, in the SAME Availability Zone

42
Q

Security - Can you share EBS snapshots and can those be altered by other accounts?

A

Yes, they can be shared.

But, they cannot be modified by other accounts

43
Q

Security - Can EBS volumes be encrypted?

A

Yes, but it requires processing power and therefore to ensure no latency this feature is only possible for more powerful EC2 instances

44
Q

Security - What is Perfect Forward Secrecy?

A

Keys used for SSL on the ELB are ephemeral and never stored

45
Q

Security - How many route tables are in a VPC?

A

One (or more) per subnet

46
Q

Security - How many NACLs are in a VPC?

A

One per routing table

47
Q

Security - What is a VPG?

A

Virtual Private Gateway, used for private connectivity between VPC and another network

48
Q

Security - Can CloudFront access be geo restricted?

A

Yes

49
Q

Security - Can you grant access to CF, but not the origin S3?

A

Yes, using the S3 ACL

50
Q

Security - Describe the four access restriction for S3

A

IAM Policies: attached to a User

ACL:Read/Write on a bucket level to users or groups

Bucket Policies: permissions to single files or the bucket for users, groups or buckets

Query String Authentication: Temporary access to a pre-sign URL for up to 7 days. Can be combined with additional rules. (Geo, IP..)

51
Q

Security - Are the meta data in S3 encrypted?

A

No

52
Q

Security - How can access to S3 be logged?

A

Using S3 Access Logs

53
Q

Security - What is the process to retrieve data from Glacier?

A

Initiate retrieval job
Wait 3-5 hrs
Data can be accessed with HTTP GET for the full or partial data
Data is available for 24 hrs

54
Q

Security - What is Storage Gateway and how are files transferred?

A

Connects on premise data with the cloud.
Used for backups and disaster recovery
Data is asynchronously transferred

55
Q

Security - How to backup DynamoDB

A

Using a special template in AWS DataPipeline for copying the tables

56
Q

Security - Describe the process of RDS snapshots and backups in detail

A 
- Backup -
Automatic (Per default enabled)
Point in time recovery
Allows to restore DB to a specific second up to 5 min of the failure
35 days retention rate
- Snapshots - 
Manually done
Full copy
Can be used to create another DB
Is using I/O therefore writes are suspended. Should be done in the Multi A/Z standby
57
Q

Security - How to first-access Linux/Windows instances

A

Linux: Using the full key pair (presenting the private key)
Windows: Using the private key to decrypt the admin password

58
Q

Security - Which seven services can use encryption at rest

A

SEGS RRW

S3
EBS
Glacier
StorageGateway
RDS
Redshift
Workspaces
59
Q

CDN - How to create a subdomain?

A

Create a CNAME record (cdn.example.com) in Route53

60
Q

CDN - What is a use case for cache behaviour?

A

Target the caching by file name (.php / .jpg)

61
Q

CDN - What are the features of cache behavoiur?

A 
Path Pattern
Origin
Should query strings to forwarded to the origin
Must have signed URLs
If it needs HTTPS
Caching time
62
Q

CDN - Use cases for CloudFront

A 
Static Websites
Dynamic Websites / Applications
Widely geographically distributed
Large Files
Streaming media
63
Q

CDN - What cases is CloudFront NOT suited for?

A

Users from a single location

Users from a corporate VPN (if the all have the same IP)

64
Q

Storage Gateway - Use cases for the three different Storage Gateway types

A

Cached volumes: expand local hardware
Stored volumes: asynchronous backup
Tape: cost effective use of already used tape licenses

65
Q

Directory - Use cases for the three Directory Services

A

AWS Direcotry Service for MS AD (Enterprise): more than 5000 users
Simple AD: Cost effective (<5000 users)
AD Connector: on premise AD service

66
Q

Security - What are the two services for encrypting with own keys and what are their use cases

A

KMS & Cloud HSM

Scalable solution for symmetric key distribution and Compliance with processes validated by a third party

67
Q

CloudTrail - Can you use CT across regions

A

Yes, the same trails will be used on all regions and then stored in one S3 Bucket

68
Q

CloudTrail - Use cases for Cloud Trail

A

External Compliance Audits

Information which service are target for unauthorized access

69
Q

Kinesis - Difference between Firehose / Streams

A

Firehose: Storing data in the appropriate system
Kinesis: real time analysis

70
Q

EMR - Use cases for Elastic Map Reduce

A

Log processing
Clickstream analysis
Genomics and Life Science

71
Q

Data Pipeline - What is the Data Pipeline?

A

Used for scheduled tasks that involve moving data to the appropriate services.
Services can be started/stopped on its behalf, and if a task fails i can be retried.
It is also possible to check for preconditions before the task is started

72
Q

Import/Export - What are the two methods

A

Using snowball as a device presented by AWS

Use your own disk

73
Q

OpsWorks - What is it based on and what does it do?

A

It is based on Chef.
Creates an application stack that can be deployed
Used to host multi-tier Web Applications and supports continious integration

74
Q

AWS Config - Use cases

A

Discovery for all used ressources
Lists all the services used in the past
Used for incidents and troubleshooting

75
Q

CloudFront - What is the use case for CF Origin Access Ientifier?

A

Makes sure that the content of a S3 bucket is only accessible with CloudFront

76
Q

DB - How can Oracle and MS SQL be encrypted?

A

Using KMS

TDE for Enterprise tier

77
Q

DB - What are the storage options for RDS?

A

Magnetic, SSD, SSD IOPS
4GB to 6TB
up to 30.000 IOPS

78
Q

DB - What is RPO / RTO ?

A

Recovery Point Objective:
Max. data loss in an event of failure (should be minutes)

Recovery Time Objective:
How long does it take for the recovery to be fully effective

79
Q

DB - How to scale vertically for writes?

A

Using partitions or shards

Problem: Client/Application must know in which shard the data is

80
Q

DB - Which engines support Read Replicas

A

MySQL
MariaDB
PostgreSQL
Aurora

81
Q

DB - How to encrypt Redshift

A

in transit: SSL

At Rest: KMS or CLoudHSM

82
Q

DB - How to improve read throughput for DynamoDB

A

Distribute Requests accross range of keys

83
Q

DB - What is a secondary key in DynamoDB?

A

Used to further index the database to avoid scan operations

Global Sec. Key: can be created at any time
Local: on partition with the primary key, can only be created when the table is created

84
Q

DB - How are IOPS generated for DynamoDB?

A

One Partition can generate 3000 IOPS, scaling would improve this.
But if all reads go to one partition it wold be stuck at 3000

85
Q

DB - What are DynamoDB Streams?

A

List of all changes of the last 24h

Solution Architect (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions