Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS > Pre-exam SSA > Flashcards

Pre-exam SSA Flashcards

1
Q

How would you connect to an RDS database using profile credentials specific to an EC2?

A

IAM DB authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

How long is an RDS auth token valid for?

A

15m

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which DB engines support IAM auth in RDS?

A

MySQL and Postgres

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Is IAM DB auth in RDS over SSL?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How would you grant access to a secret manager (e.g. parameter store or secret manager) from an ECS container, resource-based policy or IAM role?

A

IAM role - a resource based policy would be too broad

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

If you have a legacy web-app with a static hard-coded IP address, how can you introduce some fault tolerance?

A

Can’t use ELB, so use lambda script to switch elastic IP from one instance to another if health check (written in the lambda) fails

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Can a single custom aurora endpoint handle different sorts of traffic and direct them to the correct instances?

A

Yes - read and write traffic can be sent to the relevant group of instances, or for read traffic to the read endpoint (which load balances across all read-capable instances)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Does an aurora replica increase write capacity?

A

No - only read capacity. They can act as failover targets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the most cost-effective EBS volume for high-throughput access to infrequently-accessed data?

A

Cold HDD (SC1) (good for throughput compared to IOPS, and fine for IA data)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which EBS volumes can be boot volumes?

A

Provisioned IOPS (IO1) and general purpose (GP2)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the 3 deployment types available for lambda in CodeDeploy?

A

Canary (new version gets some traffic and then all the remaining later on)

Linear (more traffic shifted over time)

All at once (switch over straight away)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What can you change about an EBS volume while it’s running?

A

If using a supported instance (all current generation) and storage was attached after 3rd November 2016, you can modify the volume’s size, type and IOPS capacity without service interruptions.

You can’t decrease the size of a volume (you’d have to migrate data to a new disk).

You can’t change an attached gp1 to st1 or sc1 (any of the magnetic family) - you have to detach first

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Can you take an EBS snapshot while an app is running?

A

Yes - an in-progress snapshot is not affected by ongoing reads and writes to the volume.

If you’re using a RAID config, you need to stop things, flush caches etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How can you setup SNI SSL for a website in AWS?

A

Application Load Balancer

Cloudfront web distribution

NOT a classic load balancer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the relationship between EBS volumes, EBS snapshots and EC2 instances in terms of the AZs they’re in?

A

EBS volume in one AZ

EBS volume can only be attached to an EC2 instance in the same AZ

Snapshots redundantly stored across multiple AZs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What’s the easiest way to asynchronously process a simple request to an application?

A

Invoke a lambda function asynchronously

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Describe glacier expedited retrieval and provisioned retrieval capacity

A

Expedited retrieval is a way of retrieving archives quickly. Other ways are standard and bulk. Expedited is the most expensive, and for archives <250mb, is typically done within 1-5 minutes.

The speed of expedited retrieval will vary depending on load, so you can buy provisioned capacity to guarantee 150mb/s throughput. It’s expensive ($105 per unit per month).

Each unit guarantees 3 expedited retrievals every 5 minutes and up to 150mb/s of retrieval throughput

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Is read/write autoscaling enabled by default in DynamoDB?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is “edge to edge routing via a gateway” and is it supported?

A

Where two VPCs are peered and one of them has some gateway (e.g. a VPN or internet gateway) - the VPC without the gateway can’t route to the gateway in the other VPN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is “edge to edge routing via a gateway” and is it supported?

A

Where two VPCs are peered and one of them has some gateway (e.g. a VPN or internet gateway) - the VPC without the gateway can’t access resources on the OTHER SIDE of the gateway in the other VPC (e.g. a corporate network). Likewise, the resources in the corporate network couldn’t access the other VPC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

How can you configure active-active and active-passive routing in Route53?

A

These aren’t first class concepts in Route53.

Active-active: use any routing policy other than failover

Active-passive: use failover

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

How would you lock down files in S3 to specific clients?

A

Use pre-signed S3 URLs and remove permissions for anyone else.

Could use S3 - set up an OAI and use CloudFront URLs or signed cookies.

Beware - some questions might give part of the solutions as a potential answer but you have to make sure everything is locked down

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

How can you have SSL for multiple domains on an ALB?

A

Upload multiple certificates - ALB will use SNI to select the correct one

Use one certificate with Subject Alternative Name (SAN) - but you will have to reprovision the certificate every time you add a new domain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the block size range for a VPC?

A

Between /16 and /28

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What IP address ranges are allowed in a VPC?

A

10/8

  1. 16/12
  2. 168/16
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

In what scenario will you be billed for an on-demand instance being in the “stopping” state?

A

If it’s preparing to hibernate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

When might you use EFS over S3?

A

Low-latency file operations

28
Q

How can you enforce data retention and compliance requirements in glacier?

A

Use a vault lock policy

29
Q

How would you monitor memory usage on EC2 linux instances, and how does it relate to “Detailed monitoring”?

A

Install CloudWatch monitoring scripts to send in custom metrics.

Detailed monitoring increases the frequency of monitoring from 5 minutes to 1 minute

30
Q

How can you implement a cross-region DR plan for Redshift?

A

Enable cross-region snapshots for the Redshift cluster

31
Q

What additional info does RDS enhanced monitoring record?

A

RDS child processes
RDS processes
OS processes

32
Q

What does S3 server access logging provide that CloudTrail doesn’t?

A

Server access logging provides more detail on object-level operations, such as the referrer and turn-around time

33
Q

What are the default limits for number of EBS volumes and snapshots?

A

5,000 volumes

10,000 snapshots

34
Q

What is the storage to burst ratio for an EBS provisioned IOPS (IO1) volume?

A

It doesn’t have one - the IOPS are provisioned

35
Q

What does Systems Manager Agent (SSM Agent) do?

A

Allows actions from Systems Manager to be executed on the instance that it is installed on

36
Q

What is GuardDuty?

A

Intelligent threat detection. Monitors stuff like unusual API call patterns in your AWS account

37
Q

If you need to integrate an identity provider that uses LDAP with your VPC using IAM, what must you do?

A

Create a custom identity broker on the client side that uses STS to get short-lived credentials

38
Q

Can CloudTrail receive custom logs?

A

No

39
Q

Which service can help you make sure resources don’t go beyond service limits?

A

AWS Trusted Advisor

40
Q

What dynamic scaling policies does EC2 autoscaling support?

A

Target tracking scaling - increase/decrease capacity of group - bit like a boiler thermostat

Step scaling - vary capacity of group based on set of scaling adjustments (step adjustments) - different size steps depending on size of threshold breach (e.g. add 1 instance when cpu between 40 and 50, 2 instances when between 60 and 70 etc)

Simple scaling - based on single scaling adjustment

(Scheduled scaling is not considered dynamic)

41
Q

Are data moving between an encrypted EBS volume and an EC2 instance encrypted?

A

Yes. Encryption operations occur on the underlying servers that host the EC2 instances

42
Q

How can you remotely configure EC2 instances without using RDP/SSH?

A

Use Run Command, part of AWS Systems Manager

43
Q

What is EC2Config and EC2Launch?

A

EC2Launch replaces EC2Config. Both perform common configurations on Windows servers, e.g. routing and setting wallpaper to display instance info.

EC2Launch is a set of PowerShell scripts

44
Q

Are CloudTrail logs encrypted by default?

A

Yes, using S3 Server Side Encryption

45
Q

What CLI command might you use to find out why an instance was terminated?

A

aws ec2 describe-instances

Gives you a StateReason

46
Q

What’s the minimum file size for transitioning to standard_IA or onezone_IA?

A

128kb

47
Q

What’s the minimum storage time before transitioning current or previous objects between standard, standard_IA and onezone_IA?

A

30 days - this is the minimum storage time for these classes

48
Q

What’s the minimum storage time before transitioning current or previous objects from standard, standard_ia or onezone_IA to intelligent_tiering or glacier or glacier_deep_archive?

A

0 days

49
Q

What is File Gateway?

A

Part of Storage Gateway - provides NFS mounting and is only for flat files (it’s not block storage). Has a local cache for low-latency access to frequently accessed files.

Files are stored as S3 objects

50
Q

What sort of storage does Cached volumes and Stored volumes provide?

A

Block storage

51
Q

What is AWS Systems Manager Session Manager?

A

Allows management of EC2 instances via CLI or browser-based shell

52
Q

How does spot instance pricing work?

A

Not charge if AWS interrupt in first hour

If you interrupt in first hour, charged for whole hour

After first hour, charged to nearest second no matter who interrupts (apart from windows where you’ll pay for whole hour)

53
Q

What is AWS PrivateLink?

A

Allows IP-based connections within a VPC to AWS servies so traffic doesn’t leave the AWS network

You get ENIs to connect to

PrivateLink doesn’t yet support S3 or DynamoDB. You have to use a gateway, where you set up a route for traffic going to a particular IP address to direct it to an AWS service

54
Q

How can you prevent cryptographic data being lost in Cloud HSMs?

A

Daily backups

Multi-AZ

Secure with SGs

Don’t let admins enter an incorrect password more than twice!

55
Q

What are the maximum sizes of the EBS volumes?

A

GP2: 1GiB - 16TiB
IO1: 4GiB - 16TiB
ST1: 500GiB - 16TiB
SC1: 500GiB - 15TiB

56
Q

How can you capture detail about all requests going through an ALB? Where are the logs stored?

A

Enable access logging

Logs are stored as compressed files in S3 bucket that you specify

57
Q

How can you increase availability in RDS to accomodate OS patches and upgrades?

A

Multi-AZ. RDS applies updates by:

  1. Upgrading the standby
  2. Promoting the standby to primary
  3. Upgrade new standby
58
Q

How can you control caching of objects in S3 behind CloudFront?

A

Use versioning

59
Q

Where are app and server logs stored when using Elastic Beanstalk?

A

App logs stored in S3.

Server logs optionally stored in S3 or CloudWatch.

60
Q

How can you resolve “insufficient capacity error” placement group errors?

A

Stop and restart instances in placement group (in an attempt to trigger migration to new hardware)

61
Q

How can you setup SSL comms between EC2 and RDS

A

Set rds.force_ssl parameter to true

Get AWS root cert and install on EC2 boxes and use to initiate connections

62
Q

What are the reserved private IPs in a VPC?

A

First 4 and last 1 addresses in each subnet CIDR block.

.0 - Network address
.1 - Router
.2 - DNS
.3 - reserved for future use by AWS
.4 - multicast networking
63
Q

What is EC2 enhanced networking?

A

Provides high-performance networking on supported instances.

Uses single-root I/O virtualisation (SR-IOV) - method of device virtualization that provides higher IO and lower CPU utilisation compared to traditional virtualised network interfaces.

No additional charge

64
Q

What hypervisor is used for EC2?

A

Nitro (KVM)

Was Xen

65
Q

What are the virtualization types?

A

Paravirtual (PV) - historically performed better

Hardware Virtual Machine (HVM) - can take advantage of special hardware extensions

PV recommended

AWS (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions