Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Developer Certification > S3 > Flashcards

S3 Flashcards

1
Q

What is the max object size that can be uploaded?

A

5TB (5000GB)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

How can you upload an object larger than 5GB?

A

Must use ‘multi-part upload’ for greater than 5GB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Under what conditions can an IAM principal access an S3 object?

A
  • The user IAM permissions ALLOW it OR the resource policy ALLOWS it
  • AND there is no explicit DENY
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How could you allow an EC2 instance to access an S3 bucket?

A

Create an IAM Role, assign the correct permissions, and assign the role to the EC2 instance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How would you allow another user to access a bucket you have created?

A

Create a bucket policy for the S3 bucket that allows cross-account.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the two types of S3 replication?

A

CRR (cross region replication) and SRR (same region replication)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the requirements for replication?

A
  • Must enable Versioning in source and destination buckets
  • Must give proper IAM permissions to S3
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the use cases for S3 replication (for both types)?

A

CRR - compliance, lower latency access, replication across accounts
SRR - log aggregation, live replication between production and test accounts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a limitation of replication?

A

Only new objects are replicated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is S3 Batch Replication?

A

S3 Batch Replication - replicates existing objects and objects that failed replication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are delete markers, and how do they (optionally) tie in to replication?

A

With versioning turned on, a delete marker is a marker placed on an object that has been deleted - this allows a roll-back of the delete using the delete marker version.

For replication, delete markers (if enabled) are replicated from source to target. Deletions with a version ID (i.e., a permanent delete) are not replicated (to avoid malicious deletes).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

List the S3 Storage Classes

A
  • Standard - General Purpose
  • Standard-Infrequent Access (IA)
  • One Zone-Infrequent Access
  • Glacier Instant Retrieval
  • Glacier Flexible Retrieval
  • Glacier Deep Archive
  • Intelligent Tiering
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is meant by Durability?

A
  • How many times an object is going to be lost by S3
  • Same Durability for all storage classes
    99.999999999% (11 9s) durability.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is meant by Availability?

A
  • How available a service is (i.e., uptime vs downtime)
  • Varies depending on storage class
    S3 standard is 99.99% available (53 minute downtime per year)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Describe S3 Standard - General Purpose, and give a use case.

A
  • 99.99% availability
  • Used for frequently accessed data
  • Low latency and high throughput
  • Sustain 2 concurrent facility failures

Big data analytics, mobile & gaming applications, content distribution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Describe S3 Standard & One Zone - Infrequent Access, and give a use case.

A
  • Used for less frequently accessed data, but rapid access when needed
  • Lower cost than Standard

Standard-IA:
99.9% available
Disaster recovery, backups

One Zone-IA
Single AZ - data lost when AZ is destroyed
99.5% available
Storing secondary backup copies of on-premise data, or data you can recreate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Describe S3 Glacier Storage Classes in general

A

Low cost object storage meant for archiving/backup
Pricing: Price for storage + object retrieval cost

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Describe S3 Glacier Storage Class - Instant Retrieval

A

Millisecond retrieval, great for data accessed once a quarter
Minimum storage duration of 90 days

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Describe S3 Glacier Storage Class - Flexible Retrieval

A

Expedited (1 to 5 minutes), Standard (3 to 5 hours), Bulk (5 to 12 hours) - bulk is free
Minimum storage duration of 90 days

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Describe S3 Glacier Storage Class - Deep Archive

A

Standard (12 hours), Bulk (48 hours)
Minimum storage duration of 180 days

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Describe S3 Intelligent Tiering

A
  • Small monthly monitoring and auto-tiering fee
  • Moves objects automatically between access tiers based on usage
  • No retrieval charges in Intelligent Tiering
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What lifecycle rule would you use to move an object to another storage class after a certain period of time?

A

Transition Action

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What lifecycle rule would you use to delete an object to another storage class after a certain period of time?

A

Expiration action

24
Q

How can you assign rules to objects?

A

Can be specified for a certain prefix, or for object tags.

25
Q

How can you work out what rules to apply to different objects? What is a limitation of this?

A

Storage Class Analysis
- Provides recommendations for Standard and Standard IA tier storage
- Daily report
- Allow for 24-48 hours to start seeing analysis

Does not cover One-Zone IA or Glacier

26
Q

What are the request rate limits for S3 files?

A

3500 writes and 5500 reads per second per prefix in a bucket.

27
Q

How does S3 Transfer Acceleration work?

A

Increase transfer speed by transferring file to an AWS edge location which will forward the data to the S3 bucket in the target region
- Minimize transfer over public internet and maximize transfer over private AWS network
- Compatible with multi-part upload

28
Q

How can you speed up the download of a file, or retrieve partial data from the file?

A

S3 Byte-Range Fetches
- Parallelize GETs by requesting specific byte ranges (i.e., break the file down into byte-sized pieces)
- Better resilience in case of failures

29
Q

What are S3 Byte-Range Fetches?

A

A method of speeding up the download of a file, or retrieving partial data from the file
- Parallelize GETs by requesting specific byte ranges (i.e., break the file down into byte-sized pieces)
- Better resilience in case of failures

30
Q

What is S3 Select & Glacier Select?

A
  • Retrieve less data using SQL by performing server-side filtering
  • Can filter by rows & columns (simple SQL statements)
31
Q

What is an advantage of S3 Select & Glacier Select?

A

Less network transfer, less CPU cost client-side

32
Q

How can you automate the transition of S3 objects between their different tiers?

A

S3 Lifecycle Rules

33
Q

What are the four methods of S3 encryption?

A

Server-Side Encryption (SSE) with:
- S3 Managed Keys (SSE-S3) (Default)
- KMS Keys stored in AWS KMS (SSE-KMS)
- Customer-Provided Keys (SSE-C)
Client-Side Encryption

34
Q

What is SSE-S3?

A

Default S3 Encryption - Encryption of S3 objects using keys handled, managed and owned by AWS (encrypts the object using an S3 owned key)

35
Q

What is SSE-KMS?

A

Leverage AWS Key Management Service (AWS KMS) to manage encryption keys

36
Q

What is SSE-C?

A

Use customer provided keys, and manage your own encryption keys

37
Q

What is the encryption type for SSE-S3, and how would you include it in a request?

A

AES-256
Set header “x-amz-server-side-encryption”:”AES256”

38
Q

What are the advantages of SSE-KMS?

A
  • User control over keys
  • Audit key usage using CloudTrail (any key usage of a KMS key is tracked in CloudTrail)
39
Q

How would you include SSE-KMS in a request?

A

Set header “x-amz-server-side-encryption”:”aws:kms”

40
Q

What are the limitations of SSE-KMS?

A
  • May be impacted by KMS limits: upload and download via KMS API (via GenerateDataKey and Decrypt)
  • These count towards KMS quota per second
  • Can request quota increase using the Service Quotas Console
41
Q

How would you include SSE-C in a request?

A

Encryption key must be provided in HTTP headers for every request made

42
Q

How does AWS managed SSE-C keys?

A

It doesn’t - S3 does not store these encryption keys

43
Q

What protocol does SSE-C require to be used and why?

A

HTTPS - Encryption key is passed into request via headers

44
Q

What is Encryption in Transit otherwise known as?

A

SSL/TLS

45
Q

How can you force encryption to be via SSE-KMS or SSE-C, and why doesn’t default encryption take place?

A

Use a bucket policy to enforce the condition that there is an encryption header for SSE-KMS or SSE-C
- Bucket policies are evaluated before default encryption

46
Q

What is CORS?

A

Cross Origin Resource Sharing - a web browser security that allows you to enable object retrieval from a different origin

47
Q

How is the O is CORS composed?

A

Origin = scheme (protocol) + host (domain) + port
e.g., https://www.example.com (with an implied port of 443 as HTTPS)
The same origin would be https://www.example.com/app1
Different origin would be https://other.example.com

48
Q

How do you enable a cross-origin request to an S3 bucket?

A

Use CORS headers (e.g., Access-Control-Allow-Origin)

49
Q

What does MFA delete do?

A

MFA will be required for potentially destructive actions:
- Permanently delete an object version
- Suspend Versioning on the bucket
MFA will not be required to:
- Enable versioning
- List deleted versions

50
Q

What are the requirements for enabling MFA delete?

A
  • Must be bucket owner (root account)
  • Bucket must be using versioning
51
Q

What should you avoid when setting up a logging bucket for S3 access logs?

A

Don’t set the logging bucket to be the same as the monitored bucket
- Will create a logging loop, causing the bucket to grow exponentially

52
Q

What is S3 Access Logging?

A

Option to enable logging of all access (put, get etc.) for a specific bucket, to a specific bucket (in the same region)

53
Q

How could you allow a user temporary access to a file in an S3 bucket?

A

Generate a pre-signed URL from S3 console, CLI or SDK
- Can set expiration time on the URL
- URL inherits permissions of user that generated it.

54
Q

What is an S3 Access Point?

A
  • An access point is an endpoint in the bucket which points to one or more bucket prefixes.
  • A policy can be attached to this access point which allows access for a specific group.
55
Q

What is S3 Object Lambda?

A

A lambda function attached to an S3 Access Point which can alter the retrieved object.
An S3 Object Lambda Access Point is then attached to the lambda, allowing an application to access the altered object.

56
Q

What is a use case for S3 Object Lambda?

A
  • Redact personally identifiable information for analytics or non-production environments.
  • Converting data across data formats (e.g., XML to JSON)

AWS Developer Certification (27 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions