Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AD > PP ET NEW > Flashcards

PP ET NEW Flashcards

1
Q

How would you securely store and retrieve different types of variables across different environments in Amazon ECS?

A

AWS Systems Manager Parameter Store (stores environment path)

AWS Secrets Manager (stores credentials)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is an S3 Object Lambda access point?

A

a way to use a Lambda function to modify the content of s3 objects on the fly

For example, return an object with the header / without depending on who makes the get request

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How would you use SNS to notify a team if a threshold goes above 5%

A

Publish data on failure to Cloud Watch and configure an alarm to notify the existing SNS topic when error rate exceeds the specified rate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How would you avoid accidental database deletion in the future when using AWS CloudFormation?

A

Add a CloudFormation Deletion Policy attribute with the Retain value to the database resource

Update the CloudFormation stack policy to prevent updates to the database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How would you enforce encryption in transit for requests to retrieve data from the S3 bucket?

A

Define a resource-based policy on the S3 bucket

Deny access when a request meets the condition “aws:SecureTransport”: “false”:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the cheapest way to securely manage one-time fixed license keys that need to be accessed by automation scripts running in Amazon EC2 instances and AWS CloudFormation stack

A

AWS Systems Manager Parameter Store SecureString parameters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How would you troubleshoot issues with API Gateway timeouts using Cloud Watch?

A

IntegrationLatency (if high, api taking a long time to interact with lambda)

Latency (time for API to process request)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How would you store and retrieve an access token that needs to be encrypted at rest and in transit, and accessible from other AWS accounts with the least management overhead?

A

Use Secrets Manager with AWS KMS with customer managed key

Resource-based policy (allows cross account access)

IAM role of the EC2 instances (permission to get the token from secrets manager)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How would you collect all the lifecycle events of EC2 instances from multiple AWS accounts and storing them in a single Amazon SQS queue in the main AWS account?

A

An Event Bridge rule to send all EC2 lifecycle events to the main event bus to the SQS queue (which is set as the target)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How would you increase the resiliency of the application when the batch response includes values in UnprocessedKeys?

A
  • Retry the batch operation with exponential backoff and randomized delay to stop overwhelming DynamoDB with repeated requests
  • Update the application to use an AWS SDK to make request because it has built in functionality for handling error and retries
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is Secrets Manager for?

A

Storing sensitive information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How would you return a document from s3 with/without header, if you only store one copy of the document?

A

Create an S3 Object Lambda access point from the S3 console.

Call a function that removes the header

Use S3 Access Points to access the object without the header

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are you defining access to in Effect Action Resource permissions?

A

Objects in buckets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How would you extend an app to run in the destination region and make sure the AMIs are encrypted in all regions?

A
  • Create AMIs with encryption parameters
  • Copy the AMIs to the destination regions.
  • Delete the unencrypted AMIs.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How would you configure the custom domain for a API Gateway REST API that uses Cloud Front and a custom domain name with an SSL/TLS certificate from a 3rd party provider?

A

import the SSL/TLS certificate into ACM (in the same Region as the API)

Create a DNS CNAME record for the custom domain (that points to API Gateway Cloud Front distribution)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How would you avoid accidental deletion of a database when deploying an app using a Cloud Formation template?

A

Add a Cloud Formation Deletion policy attribute (Retain = database) and update the Cloud Formation Stack Policy (prevent updates to db)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How would you ensure an app on an EC2 instance can list objects from S3?

A

Update the IAM instance profile that is attached to the EC2 instance to include the S3:ListBucket permission for the S3 bucket

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How would you:
- Create a Lambda function that will retrieve data from an Aurora database that is in a private subnet in the company’s VPC called VPC1.

How would the Lambda function access the data securely?

A

Create the Lambda function

Configure VPC1 access for the function.

Assign a security group (SG1) to the Lambda function and assign a security group (SG2) to the database.

Add an inbound rule to SG1 to allow TCP traffic from Port 3306.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How would you log key events with a unique identifier associated with a specific Lambda function invocation?

A

get the AWS request ID from the context object

Configure the application to write logs to standard output.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How would a developer reduce the time before an EC2 instance becomes available, while making sure to deploy the most recent version of an app on an EC2 instance, all updates are installed and minimise the number of images created

A
  • Use EC2 Image Builder to create an AMI.
  • Install the latest version of the app and all the patches and agents needed to manage and run the application.
  • Update the Auto Scaling group launch configuration to use the AMI.

Set up AWS CodeDeploy to deploy the most recent version of the application at runtime.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

For an API Gateway app how would you simulate different backend responses without invoking the actual backend service and with the least operational overhead?

A

Use a request mapping template to select the mock integration response.

Mock integration means you can define responses in API gateway, without calling the backend

16
Q

How would you analyse an image before pushing it to an EKS cluster?

A
  • Add Deployment action to pipeline
  • Configure ECR image scanning on push
  • Lambda function to check results and fail the pipeline if issues are found.
17
Q

How would you add end-to-end testing to amplify?

A

Add a test phase to amplify.yml build settings for the app

18
Q

How would you implement a web app that receives customer requests, generates reports that can be greater than 1B in 1 hour, makes them available for 8 hours and deletes reports older than 2 days old.

A

S3 bucket (to handle messages greater than 1B)

Generate a presigned URL that contains an expiration date

Provide the URL to customers through the web application.

Add S3 Lifecycle configuration rules to the S3 bucket to delete old reports

19
Q

How would you ensure that a Lambda function can securely access the DB cluster without crossing the public internet?

A

Configure the VPC, subnets, and a security group for the Lambda functions.

  • Lambda and DB in same VPC
  • Lambda in a private subnet in the VPC
  • Security groups for Lambda function to allow outbound traffic to the DB cluster & for the DB cluster to allow inbound traffic from the Lambda function
20
Q

How would you dynamically pass a table name to a Lambda function?

A

Create a Lambda environment variable to store the table name. Use the standard method for the programming language to retrieve the variable.

21
Q

An app uses ECR, EKS and Code Pipeline.

How would a developer harden the container images?

A
  • Add a CodePipeline stage (after the container image is built, but before its pushed to ECR)
  • Configure **ECR image scanning ** (when image is pushed)
  • Lambda in the pipeline to fail if issue detected
22
Q

In the context of Websocket API, which API in your backend service sends a message to the connected client to get info or disconnect the client?

A

@Connections API

23
Q

How do you handle connect and disconnect events in Websocket APIs

A

$connect and $disconnect

24
Q

You need to test an app hosted on EC2 instances in Auto Scaling group (which acts as a target for the ALB) and uses s3 bucket to store images

How can you do this with the least effort?

A
  1. Configure a new environment (new ALB and Auto Scaling group)
  2. Configure alternate Route 53 record

Doesn’t involve complex conditional routing or services like CloudFront or @LambdaEdge

25
Q

How would you troubleshoot an EC2 instance not able to access an S3 bucket?

A
  1. Check the IAM policy is attached to the EC2 instances that grant access to S3
  2. Check the bucket policy to validate access permissions for s3 bucket
26
Q

What does AWS:Region pseudo do?

A

determines the region the template is deployed

27
Q

How do you connect Lambda functions to an SQL instance

A
  1. Create Lambda functions in the VPC
    (attach AWSLambdaVPCAccessExecutionRole policy to the Lambda execution role)
  2. Security group configuration
    (modify RDS security group. allow inbound access from Lambda security group)
28
Q

How do you encrypt S3 data in transit?

A

Add a bucket policy
(deny s3 actions if the connection is not secure. aws:secureTransport condition equals false)

29
Q

How do you fix “too many connections” error?

A
  • initialise the database connection outside of the handler function
  • increase the max user connections value on the parameter group of the DB cluster
  • restart the db cluster
30
Q

What does Macie do?

A

Use ML to identify security breaches

31
Q

How would an app identitfy users who have already created an account and keep track of the number of guests who eventually create an account?

A

Create 2 roles:
authorised and unauthorised users

Create a Cognito pool to allow unauthenticated users using temporary credentials that let them assume a role

32
Q

How would you process an image and send email notifications?

A
  • Create an SNS topic
  • Configure S3 event notifications with a destination of the SNS topic
  • Subscribe the Lambda function to the SNS topic
  • Create an email notification subscription to the topic
33
Q

How would you store the session state of an e-commerce web app that must be fault tolerant, natively highly scalable and service interruption shouldn’t affect the user experience?

A

Elasticache

34
Q

A company moved some of its secure files to a private Amazon S3 bucket that has no public access. The company wants to develop a serverless application that gives its employees the ability to log in and securely share the files with other users.

Which AWS feature should the company use to share and access the files securely?

A

Cognito Identity Pools (authentication)

not S3 presigned URLs because they are better for granting temp access to individual objects

35
Q

How to gather info on memory performance issues of an Elastic Beanstalk app if is not tracking memory?

A

Configure a Cloud Watch agent to track the memory usage of the instances

36
Q

2 ways to troubleshoot a Lambda function used by API Gateway:

A

1 Aliases (quick fix)
2 Versioning (long term)

37
Q

What does a X-Forwarded-For header and ALB show?

A

Client IP addresses

38
Q

What is the least operational overhead ffor storing reports > 1MB that need deleted after 2 days?

A

Generate, store reports with S3 encryption, share via presigned URL with expiration, and automate report deletion with S3 Lifecycle rule

39
Q

Migrate a monolithic app to Lambda?

A

Configure VPC, subnets & a security group for Lambda functions

40
Q

How do you efficiently analyse container images on a CI/CD pipeline?

A

Add a post build Code Pipeline stage and enable **ECR basic image scanning ** to happen on image push and a Lambda function to fail pipeline if issues

41
Q

How to allow unauthenticaed access to the login page while keeping private content secure?

A
  • Add a 2nd cache behaviour to the distribution (with the same origin as the default cache behaviour)
  • Set the path pattern of the 2nd cache behaviour to the login page path & make viewer access unrestricted
  • keep default cache behaviour unchanged
42
Q

How to manage credentials with the LEAST AMOUNT OF OVERHEAD?

A

AWS Secrets Manager to store credentials

Use AWS KMS key to encrypt the secret

Use the secret from secrets manager on the lambda function to connect to the database

43
Q

How to test API Gateway simulating the backend service without invoking the backend service?

A

Use mock integration

44
Q

How do you create a secure Lambda function that fetches data from Aurora DB in a private subnet (VPC1)

A

Configure the Lambda function to run within the same VPC as Aurora DB

Configure security group

45
Q

How to use cloud front and custom domain with SSL/TLS certificate from a third party provider?

A

Import SSL/TLS certificate into ACM and create a DNS CNAME record for the custom domain

46
Q

How to copy AMI to region?

A

Create new AMI. specify encryption parameters, copy encrypted AMIs to the destination region and delete the unencrypted AMIs

AD (21 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions