Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Solution Architect Associate > New notes > Flashcards

New notes Flashcards

1
Q

What is the scope of a Virtual Private Cloud (VPC)?

A

Regional

VPCs are regional. You create VPCs in each region separately.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

At which level do you attach an Internet gateway?

A

VPC

Internet Gateways are attached to the VPC. You then need to add entries to the route tables for your public subnets to point to the IGW.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

AWS Outposts

A

An Outpost is a pool of AWS compute and storage capacity deployed at a customer site, e.g. EC2 instances

AWS operates, monitors, and manages this capacity as part of an AWS Region. You can create subnets on your Outpost and specify them when you create AWS resources such as EC2 instances, EBS volumes, ECS clusters, and RDS instances.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

RAID 0 vs RAID 1 (on EBS)

A

RAID 0 = used for performance (splits data across volumes, but if one fails then whole thing fails)
RIAD 1 = fault tolerance/failover (mirrors data)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

GaurdDuty vs Inspector vs Macie

A

Inspector = Scanning for potential vulnerabilities (EC2 mainly)

Guard Duty = Scanning for active intrusion attempts

Macie = identify and alert on sensative data such as PII (Personally Identifiable Information)

Amazon Inspector provides you with security assessments of your applications settings and configurations on your EC2 instances while Amazon GuardDuty helps with analyzing your entire AWS environment for potential threats.

Inspector only covers EC2 at the moment. GuardDuty, on the other hand, will continuously monitor your “AWS accounts, workloads, and data stored in Amazon S3” and alert you.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

VPC overview - part 1

A

VPC Peering
- Connect two or more VPC’s using AWS network (not transitive) over IPv4 or IPv6
- Private connection

VPC Endpoints
- Allows access from your VPC to AWS services (e.g. S3, DynamoDB, SNS, SQS, CloudWatch, API Gateway etc)
- Private connection

Direct Connect (DX)
- connect VPC to customer data center (over IPv4 and IPv6)
- consistent network experience
- private connection

Direct Connect Gateway
- connect one customer data center to multiple VPC on AWS
- private connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

VPC overview - part 2

A

AWS Site-to-Site VPN
- Connects customer data center to AWS VPC
- private encrypted connection, howver over the Internet

Egress-only Internet Gateway
- allows outbound only connection to your VPC (private subnet) to the internet (IPv6 only)
- public network

AWS VPN CloudHub
- Connect multiple VPC’s to multiple Customer data centers (Customer Gateway)
- public network

Transit Gateway
- Connecting multiple VPC services together (spoke and hub) and is transitive
- public network

Internet Gateway
- Allows resources (e.g.EC2) in a VPC to connect to the internet
- Public connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

SQS Visbility Timeout

A

SQS Visibility Timeout is a period of time during which Amazon SQS prevents other consumers from receiving and processing the message again.

In Visibility Timeout, a message is hidden only after it is consumed from the queue. Increasing the Visibility Timeout gives more time to the consumer to process the message and prevent duplicate reading of the message. (default: 30 sec., min.: 0 sec., max.: 12 hours)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

AWS App Runner

A

Similar to Beanstalk, but for containerised web apps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Security Groups and NACL operate at which level?

A

Security Group = EC2 instance level

Network Access Control List (NACL) = subnet level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Security Groups

A

Security groups are stateful, meaning if traffic can go out, then it can go back in.

Security Group = stateful (return traffic is automatcially allowed)

NACL = stateless (return traffic must be explicitily allowed by the rules)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Bastion Hosts

A

Bastion hosts should be deployed in a public subnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

AWS Fargate

A

AWS Fargate is a serverless compute engine for containers that works with both Amazon Elastic Container Service (ECS) and Amazon Elastic Kubernetes (EKS).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Amazon EBS root device volumes

A

By default, Amazon EBS root device volumes are automatically deleted when the instance terminates.

You can preserve the volume by setting the value of DeleteOnTermination attribute of the EBS volumes to False.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

S3 Glacier retrival

A

Expedited retrievals allow you to quickly access your data when occasional urgent requests for a subset of archives are required. For all but the largest archives (250 MB+), data accessed using Expedited retrievals are typically made available within 1–5 minutes.

Provisioned capacity ensures that your retrieval capacity for expedited retrievals is available when you need it. Each unit of capacity provides that at least three expedited retrievals can be performed every five minutes and provides up to 150 MB/s of retrieval throughput. You should purchase provisioned retrieval capacity if your workload requires highly reliable and predictable access to a subset of your data in minutes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What will occur when an EC2 instance is stopped and started

A

– The underlying host for the instance is possibly changed.

– All data on the attached instance-store devices will be lost.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Fargate

A

Fargate allocates the right amount of compute, eliminating the need to choose instances and scale cluster capacity. You only pay for the resources required to run your containers, so there is no over-provisioning and paying for additional servers.

By default, Fargate tasks are given a minimum of 20 GiB of free ephemeral storage, which meets the storage requirement in the scenario.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

AWS Cost Explorer

A

AWS Cost Explorer is a service provided by Amazon Web Services (AWS) that helps you visualize, understand, and analyze your AWS costs and usage. It provides a comprehensive set of tools and features to help you monitor and manage your AWS spending.

You can programmatically query your cost and usage data via the Cost Explorer API. You can query for aggregated data such as total monthly costs or total daily usage. You can also query for granular data, such as the number of daily write operations for DynamoDB database tables in your production environment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

S3 Pre-signed URLs vs CloudFront Signed URLs vs Origin Access Identity (OAI) vs Origin Access Control (OAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Dynamo DB auto scailing

A

DynamoDB auto scaling uses the AWS Application Auto Scaling service to dynamically adjust provisioned throughput capacity on your behalf, in response to actual traffic patterns. This enables a table or a global secondary index to increase its provisioned read and write capacity to handle sudden increases in traffic, without throttling.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

CIDR notation

A

/32 denotes one IP address
/0 refers to the entire network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

EBS costs incurred

A

EBS Volumes attached to stopped EC2 Instances incur costs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Elastic Fabric Adapter (EFA)

A

An Elastic Fabric Adapter (EFA) is a network device that you can attach to your Amazon EC2 instance to accelerate High Performance Computing (HPC) and machine learning applications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Amazon Kinesis Data Streams

A

Amazon Kinesis Data Streams enables real-time processing of streaming big data. It provides ordering of records, as well as the ability to read and/or replay records in the same order to multiple Amazon Kinesis Applications.

Consumers are: EMR, EC2, Lambda, Amazon Kinesis Data Analytics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

S3 buckets

A

S3 buckets are region specific

They are stored in 3 AZ’s per region

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

AWS ECS vs EKS

A

Elastic Container Service (ECS) = AWS proprietary service

Elastic Kubernetes Service (EKS) = open-source platform

27
Q

AWS DataSync vs Storage Gateway

A

https://tutorialsdojo.com/aws-datasync-vs-storage-gateway/

DataSync
* copy large amount of data to/from on-premise to AWS or AWS to AWS
* Copy to S3, EFS, FSx
* replications tasks can be scheduled hourly, daily, weekly

Storage Gateway
* hybrid cloud storage service that gives you on-premises access to virtually unlimited cloud storage
* S3, FSx, Volumne, Tape Gatway
* used for distaster recovery, on-premise cache & low-latency file access, backup & restore

28
Q

Site-to-Site VPN vs Direct Connect

A

Both are private connection from on-premise to AWS VPC (connects using Virtual Private Gateway on AWS)

Site-to-Site = encrypted connection, public internet
Direct Connect = NOT encrypted, private

29
Q

WAF, Shield, Firewall

A

WAF
* SQL injection, cross-site-scripting (XSS)
* Deploys on CloudFront (CDN), Appliction Load Balancer, API Gateway

Shield
* DDoS protection
* Deploys on CloudFront, ALB, Network Load Balancer

Firewall
* Applies at VPC level

30
Q

Amazon SQS

A

Uses short polling by default. To enable long polling, set
ReceiveMessageWaitTimeSeconds to greater than zero

31
Q

AppSync pipeline resolvers

A

AppSync pipeline resolvers = aggregating data from multiple database tables

32
Q

AWS CloudTrail

A

AWS CloudTrail records AWS Management Console actions and API calls. You can identify which users and accounts called AWS, the source IP address from which the calls were made, and when the calls occurred

CloudTrail event log files are encrypted using Amazon S3 server-side encryption (SSE).

33
Q

WAF

A

If CloudFront (CDN) is not an option, you can use WAF to block access based on geolocation matching or IP address in the web Access Control List (ACL)

34
Q

Interface vs Gateway endpoint

35
Q

How to scale EKS

A

Scale Elastic Kubernetes Service (EKS) by:
* Install the Kubernetes Metrics Server to the Amazon EKS cluster and activate the Horizontal Pod Autoscaling.
* Set up Karpenter to automatically adjusts the number of nodes in the EKS cluster when pods fail or are rescheduled onto other nodes.

EKS autoscailing products:
* Karpenter
* Cluster Autoscaler

36
Q

ENI vs EFA vs ENA

A

https://digitalcloud.training/aws-networking-eni-vs-efa-vs-ena/

Elastic Network Interface (ENI) - virtual network card that can be attached to any instance of the Amazon Elastic Compute Cloud (EC2)

Elastic Fabric Adapter (EFA) - accelerate high-performance computing (HPC) and machine learning on Amazon EC2 instances

Elastic Network Adapter (ENA) - high throughput and packet per second (PPS) performance, as well as consistently low latencies on Amazon EC2 instances

37
Q

What is Provisioned IOPS?

A

Provisioned IOPS, also known as Provisioned Input/Output Operations Per Second, is a significant feature offered by Amazon Web Services (AWS), designed to enhance the storage performance of Amazon Elastic Block Store (EBS) volumes.

IOPS is the standard measure of I/O operations per second on a storage device. It includes both read and write operations.

38
Q

HTTP/HTTP ports

A

HTTP = port 80
HTTPS = port 443

39
Q

EC2 Step Scailing

A

With step scaling, you choose scaling metrics and threshold values for the CloudWatch alarms that trigger the scaling process as well as define how your scalable target should be scaled when a threshold is in breach for a specified number of evaluation periods.

40
Q

AWS CloudTrail Lake

A

AWS CloudTrail Lake lets you run SQL-based queries on your event logs in AWS CloudTrail.

41
Q

EC2 Scailing

A

Target tracking scaling – Increase or decrease the current capacity of the group based on a target value for a specific metric. This is similar to the way that your thermostat maintains the temperature of your home – you select a temperature and the thermostat does the rest.

Step scaling – Increase or decrease the current capacity of the group based on a set of scaling adjustments, known as step adjustments, that vary based on the size of the alarm breach.

Simple scaling – Increase or decrease the current capacity of the group based on a single scaling adjustment.

42
Q

Volume Gateway

A

The Volume Gateway is a cloud-based iSCSI block storage volume for your on-premises applications. The Volume Gateway provides either a local cache or full volumes on-premises while also storing full copies of your volumes in the AWS cloud.

43
Q

Aurora failover

A

If you have an Amazon Aurora Replica in the same or a different Availability Zone, when failing over, Amazon Aurora flips the canonical name record (CNAME) for your DB Instance to point at the healthy replica, which in turn is promoted to become the new primary. Start-to-finish failover typically completes within 30 seconds.

If you are running Aurora Serverless and the DB instance or AZ becomes unavailable, Aurora will automatically recreate the DB instance in a different AZ.

If you do not have an Amazon Aurora Replica (i.e., single instance) and are not running Aurora Serverless, Aurora will attempt to create a new DB Instance in the same Availability Zone as the original instance. This replacement of the original instance is done on a best-effort basis and may not succeed, for example, if there is an issue that is broadly affecting the Availability Zone.

44
Q

EBS volumes

A
  • snapshots are automatially encyrpted
  • All data moving between the volume and the instance are encrypted.
45
Q

AWS Proton

A

AWS Proton is the first fully managed application deployment service for Container and Serverless Applications. We can use AWS Proton to connect and coordinate all the different tools needed for infrastructure provisioning, code deployments, monitoring, and updates

46
Q

Amazon FSx for Lustre provides two deployment options: scratch and persistent.

A

Scratch file systems are designed for temporary storage and shorter-term processing of data. Data is not replicated and does not persist if a file server fails.

Persistent file systems are designed for longer-term storage and workloads. The file servers are highly available, and data is automatically replicated within the AWS Availability Zone (AZ) that is associated with the file system. The data volumes attached to the file servers are replicated independently from the file servers to which they are attached.

47
Q

A, CNAME and ALIAS

A

The A record maps a name to one or more IP addresses when the IP are known and stable.

The CNAME record maps a name to another name. It should only be used when there are no other records on that name.

The ALIAS record maps a name to another name, but can coexist with other records on that name.

48
Q

Amazon ECS on AWS Fargate

A

Amazon ECS on AWS Fargate is a container orchestration solution. t handles infrastructure scaling (scales in/out based on demand), patching, and provisioning, giving the company more time to focus on creating and deploying applications

49
Q

Amazon QuickSight

A

Amazon QuickSight is a unified business intelligence service that makes it easier for all employees within an organization to build visualizations, perform ad hoc analysis, and quickly get business insights from their data, anytime, on any device.

50
Q

IAM policy statement

A

An IAM policy statement includes several key elements:

  • Effect: This element determines whether the statement allows or denies access. The effect can be set to “Allow” or “Deny” to permit or prohibit actions explicitly.
  • Action: The action specifies the specific AWS service actions allowed or denied. Actions are represented by unique names, such as ec2:RunInstances for launching EC2 instances or s3:GetObject for retrieving objects from S3 buckets.
  • Resource: The resource element identifies the AWS resources the actions apply. It uses Amazon Resource Names (ARNs) to specify the specific resources or resource types, such as arn:aws:s3:::my-bucket/* for all objects in an S3 bucket.
  • Condition (optional): Conditions provide additional constraints on when the policy’s effect applies. For example, you can define conditions based on time, IP address, or request parameters to further control access.
51
Q

Amazon Data Lifecycle Manager

A

Amazon Data Lifecycle Manager is a service that automates the creation, retention, and deletion of EBS snapshots. This service directly addresses the problem of increasing costs due to unused snapshots

52
Q

AWS Compute Optimize

A

AWS Compute Optimizer recommends optimal AWS resources for your workloads to reduce costs and improve performance by using machine learning to analyze historical utilization metrics.

Compute Optimizer generates recommendations for the following resources:
* Amazon Elastic Compute Cloud (Amazon EC2) instances
* Amazon EC2 Auto Scaling groups
* Amazon Elastic Block Store (Amazon EBS) volumes
* AWS Lambda functions

53
Q

Amazon Quantum Ledger Database

A

Amazon Quantum Ledger Database (Amazon QLDB) is a fully managed ledger database that provides a transparent, immutable, and cryptographically verifiable transaction log owned by a central trusted authority. Used in blockchain. Amazon QLDB can be used to track every application data change and maintains a complete and verifiable history of changes over time.

54
Q

VPN

A

VPN = goes over the Internet

VPC and Direct Connect = private connection

55
Q

Interface Endpoint vs Gateway Endpoint

A

Use Gateway Endpoint when connecting EC2 to S3 or DyanmoDB. This is the cheaper option of the two.

Use Interface endpoint for on-premise connection or other AWS services

56
Q

CloudWatch on EC2

A

Default = CPU utilization, Network utilization, Disk performance, and Disk Reads/Writes

Custom metrics = Memory utilization, Disk swap utilization, Disk space utilization, Page file utilization, Log collection

57
Q

SQS

A

Visbility time default = 30secs

Message retention period:
* default = 4 days
* min = 1
* max = 14

58
Q

Lambda

A

Time to run:
* default = 3 secs
* min = 1 sec
* max = 900 secs (15mins)

59
Q

Signed URL vs Signed Cookies

A

Use signed URLsfor the following cases:
- You want to use an RTMP distribution. Signed cookies aren’t supported for RTMP distributions.
- You want to restrict access to individual files, for example, an installation download for your application.
- Your users are using a client (for example, a custom HTTP client) that doesn’t support cookies.

Use signed cookiesfor the following cases:
- You want to provide access to multiple restricted files, for example, all of the files for a video in HLS format or all of the files in the subscribers’ area of a website.
- You don’t want to change your current URLs.

60
Q

CloudWatch EC2 monitoring

A

Default = 5mins
Detailed = 1mins

61
Q

AWS IAM Identity Center

A

AWS IAM Identity Center (successor to AWS Single Sign-On) provides single sign-on access for all of your AWS accounts and cloud applications. It connects with Microsoft Active Directory through AWS Directory Service to allow users in that directory to sign in to a personalized AWS access portal using their existing Active Directory user names and passwords

62
Q

AWS Config

A

AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources

63
Q

Kinese Data Streams vs Firehose

A

Kinesis Data Strems –> processers (EC2, Lambda, EMR, Kinesis Data analyics) —> BI tools

Firehose —> data stores (S3, Redshift data warehouse, ElasticSearch, Splunk) —> Analytics tools

AWS Solution Architect Associate (21 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions