Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Cert > S3 > Flashcards

S3 Flashcards

1
Q
  • Backup and storage
  • Disaster Recovery
  • Archive
  • Hybrid Cloud storage * Application hosting
  • Media hosting
  • Data lakes & big data analytics * Software delivery
  • Static website
A

Amazon S3 Use cases

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Amazon S3 allows people to store __________ in ___________.

A

objects (files)
“buckets” (directories)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Buckets must have a ___________ (across all regions all accounts)

A

globally unique name

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What level are Buckets defined at?

A

region level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Amazon S3 Objects (files) have a ______?

A

Key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the max size of an Object?

A

5TB (5000GB)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

If uploading more than 5GB, must use _____________?

A

“multi-part upload”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

3 things that an object can have other than the body??

A
  • Metadata (list of text key / value pairs – system or user metadata)
  • Tags (Unicode key / value pair – up to 10) – useful for security / lifecycle
  • Version ID (if versioning is enabled)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

2 ways to grant access to a S3 bucket?

A

User-Based
Resource-Based

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which API calls should be allowed for a specific user

A

IAM Policies (User-Based)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the 3 Resource-Based Amazon S3 – Security?

A

Bucket Policies
Object Access Control List (ACL)
Bucket Access Control List (ACL)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Bucket wide rules from the S3 console - allows cross account

A

Bucket Policies (Resource-Based)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which resouce based security is finer grain and can be disabled

A

Object Access Control List (ACL) (Resource-Based)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which resouce based security is less common and can be disabled

A

Bucket Access Control List (ACL) (Resource-Based)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

an IAM principal can access an S3 object if …..

A
  • The user IAM permissions ALLOW it OR the resource policy ALLOWS it
  • AND there’s no explicit DENY
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

S3 Bucket Policies JSON based policies (4)

A
  • Resources: buckets and objects
  • Effect: Allow / Deny
  • Actions: Set of API to Allow or Deny
  • Principal:The account or user to apply the policy to
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Bucket Policies JSON based policies - buckets and objects

A

Resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Bucket Policies JSON based policies - Allow / Deny

A

Effect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Bucket Policies JSON based policies - Set of API to Allow or Deny

A

Actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Bucket Policies JSON based policies - The account or user to apply the policy to

A

Principal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Use S3 bucket for policy to:

A
  • Grant public access to the bucket
  • Force objects to be encrypted at upload
  • Grant access to another account (Cross Account)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Can be set at the account level

A

Bucket settings for Block Public Access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

S3 can host __________ and have them accessible on the Internet

A

static websites

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

f you get a _________ error, make sure the bucket policy allows public reads!

A

403 Forbidden

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Amazon S3 - Versioning is enabled at what level???

A

Bucket Level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

2 best practices to version your buckets

A
  • Protect against unintended deletes (ability to restore a version)
  • Easy roll back to previous version
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Any file that is not versioned prior to enabling versioning will
have version ______

A

“null”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Suspending versioning does OR does not delete the previous versions

A

DOES NOT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

2 types of Amazon S3 – Replication

A
  • Cross-Region Replication (CRR)
  • Same-Region Replication (SRR)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

When using S3 replication, you must enable Versioning in _______ AND ________ buckets

A

source
destination

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Can buckets be in different AWS accounts??

A

YES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Replication copying what kind of synchronized???

A

asynchronous

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

DO you need to give proper IAM permissions to S3

A

YES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Compliance, lower latency access, replication across accounts

A

CRR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Log aggregation, live replication between production and test accounts

A

SRR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

After you enable Replication, only __________ are replicated

A

new objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

You can replicate existing objects using __________?

A

S3 Batch Replication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Replicates existing objects and objects that failed replication

A

S3 Batch Replication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q
  • Can replicate delete markers from source to target (optional setting)
  • Deletions with a version ID are not replicated (to avoid malicious deletes)
A

Replication DELETE operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

There is no _________ of replication

A

“chaining”
* If bucket 1 has replication into bucket 2, which has replication into bucket 3
* Then objects created in bucket 1 are not replicated to bucket 3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

S3 Storage Classes (7)

A
  • Amazon S3 Standard - General Purpose
  • Amazon S3 Standard-Infrequent Access (IA)
  • Amazon S3 One Zone-Infrequent Access
  • Amazon S3 Glacier Instant Retrieval
  • Amazon S3 Glacier Flexible Retrieval
  • Amazon S3 Glacier Deep Archive
  • Amazon S3 Intelligent Tiering
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Can you move between classes manually or using S3 Lifecycle configurations

A

YES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q
  • 99.99% Availability
  • Used for frequently accessed data
  • Low latency and high throughput
  • Sustain 2 concurrent facility failures
  • Use Cases: Big Data analytics, mobile & gaming applications, content distribution…
A

S3 Standard – General Purpose

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q
  • For data that is less frequently accessed, but requires rapid access when needed
  • Lower cost than S3 Standard
A

S3 Storage Classes – Infrequent Access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q
  • 99.9% Availability
  • Use cases: Disaster Recovery, backups
A

Amazon S3 Standard-Infrequent Access (S3 Standard-IA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q
  • High durability (99.999999999%) in a single AZ; data lost when AZ is destroyed
  • 99.5% Availability
  • Use Cases: Storing secondary backup copies of on-premises data, or data you can recreate
A

Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

2 types of S3 Storage Classes – Infrequent Access

A

Amazon S3 Standard-Infrequent Access (S3 Standard-IA)
Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

3 types of Amazon S3 Glacier Storage Classes

A

Amazon S3 Glacier Instant Retrieval
Amazon S3 Glacier Flexible Retrieval (formerly Amazon S3 Glacier)
Amazon S3 Glacier Deep Archive

49
Q
  • Low-cost object storage meant for archiving / backup
  • Pricing: price for storage + object retrieval cost
A

Amazon S3 Glacier Storage Classes

50
Q
  • Millisecond retrieval, great for data accessed once a quarter
  • Minimum storage duration of 90 days
A

Amazon S3 Glacier Instant Retrieval

51
Q
  • Expedited (1 to 5 minutes), Standard (3 to 5 hours), Bulk (5 to 12 hours) – free
  • Minimum storage duration of 90 days
A

Amazon S3 Glacier Flexible Retrieval

52
Q
  • Standard (12 hours), Bulk (48 hours)
  • Minimum storage duration of 180 days
A

Amazon S3 Glacier Deep Archive

53
Q
  • Small monthly monitoring and auto-tiering fee
  • Moves objects automatically between Access Tiers based on usage
  • There are no retrieval charges
A

S3 Intelligent-Tiering

54
Q

5 types of S3 Intelligent-Tiering

A

Frequent Access tier
Infrequent Access tier
Archive Instant Access tier
Archive Access tier
Deep Archive Access tier

55
Q

S3 Intelligent-Tiering - (automatic): default tier

A

Frequent Access tier

56
Q

S3 Intelligent-Tiering - (automatic): objects not accessed for 30 days

A

Infrequent Access tier

57
Q

S3 Intelligent-Tiering - (automatic): objects not accessed for 90 days

A

Archive Instant Access tier

58
Q

S3 Intelligent-Tiering - (optional): configurable from 90 days to 700+ days

A

Archive Access tier

59
Q

S3 Intelligent-Tiering - (optional): config. from 180 days to 700+ days

A

Deep Archive Access tier

60
Q

2 types of Amazon S3 – Lifecycle Rules

A

Transition Actions
Expiration actions

61
Q

configure objects to move to another storage class
* Move objects to Standard IA class 60 days after creation
* Move to Glacier for archiving after 6 mont

A

Transition Actions

62
Q

configure objects to expire (delete) after some time
* Access log files can be set to delete after a 365 days
* Can be used to delete old versions of files (if versioning is enabled)
* Can be used to delete incomplete Multi-Part uploads

A

Expiration actions

63
Q

Can rules be created for a certain prefix

A

YES

64
Q

Can rules be created for certain objectsTags

A

YES

65
Q
  • Help you decide when to transition objects to the right storage class
  • Recommendations for Standard and Standard IA
  • Does NOT work for One-Zone IA or Glacier
  • Report is updated daily
  • 24 to 48 hours to start seeing data analysis
  • Good first step to put together Lifecycle Rules (or improve them)!
A

Amazon S3 Analytics – Storage Class Analysis

66
Q

In general, ______________ pay for all Amazon S3 storage and data transfer costs associated with their bucket

A

Bucket owners

67
Q

The requester instead of the bucket owner pays the cost of the request and the data download from the bucket

A

Requester Pays buckets

68
Q
  • Helpful when you want to share large datasets with other accounts
  • The requester must be authenticated in AWS (cannot be anonymous)
A

S3 – Requester Pays

69
Q

For S3 Event Notifications, is Object name filtering possible??

A

YES

70
Q

How many “S3 events” can you create??

A

As many as you want

71
Q

S3 event notifications typically deliver events in _______ but can sometimes take __________?

A

seconds
a minute or longer

72
Q

What are the 4 places S3 Event Notifications can send notifications?

A

SNS
SQS
Lambda Functions
Eventbridge

73
Q
  • Advanced filtering options with JSON rules (metadata, object size, name…)
  • Multiple Destinations – ex Step Functions, Kinesis Streams / Firehose…
  • Capabilities – Archive, Replay Events, Reliable delivery
A

S3 Event Notifications with Amazon EventBridge

74
Q

Your application can achieve at least ________ PUT/COPY/POST/DELETE or _______ GET/HEAD requests per second per prefix in a bucket.

A

3500
5500

75
Q

What is the limits to the number of prefixes in a bucket??

A

No limits

76
Q
  • recommended for files > 100MB, must use for files > 5GB
  • Can help parallelize uploads (speed up transfers)
A

Multi-Par t upload

77
Q
  • Increase transfer speed by transferring file to an AWS edge location which will forward the data to the S3 bucket in the target region
  • Compatible with multi-part upload
A

S3 Transfer Acceleration

78
Q
  • Retrieve less data using SQL by performing server-side filtering
  • Can filter by rows & columns (simple SQL statements)
  • Less network transfer, less CPU cost client-side
A

S3 Select & Glacier Select

79
Q

What are examples of S3 batch operations?

A
  • Modify object metadata & properties
  • Copy objects between S3 buckets
  • Encrypt un-encrypted objects
  • Modify ACLs, tags
  • Restore objects from S3 Glacier
  • Invoke Lambda function to perform custom action on each object
80
Q

Perform bulk operations on existing S3 objects with a single request

A

S3 Batch Operations

81
Q

What does a S3 Batch Operation job consist of?? (3)

A

a list of objects
the action to perform
optional parameters

82
Q

S3 Batch Operations manages (4)

A

retries
tracks progress
sends completion notifications
generate reports

83
Q

You can use ___________ to get object list and use ________ to filter your objects

A

S3 Inventory
S3 Select

84
Q

You can encrypt objects in S3 buckets using one of 4 methods

A

Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)
Server-Side Encryption with KMS Keys stored in AWS KMS (SSE-KMS)
Server-Side Encryption with Customer-Provided Keys (SSE-C)
Client-Side Encryption

85
Q
  • Encryption using keys handled, managed, and owned by AWS * Object is encrypted server-side
  • Encryption type is AES-256
  • Must set header “x-amz-server-side-encryption”: “AES256”
  • Enabled by default for new buckets & new objects
A

Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)

85
Q
  • Encryption using keys handled and managed by AWS KMS (Key Management Service)
  • KMS advantages: user control + audit key usage using CloudTrail
  • Object is encrypted server side
  • Must set header “x-amz-server-side-encryption”: “aws:kms”
A

Server-Side Encryption with KMS Keys stored in AWS KMS (SSE-KMS)

86
Q
  • Server-Side Encryption using keys fully managed by the customer outside of AWS * Amazon S3 does NOT store the encryption key you provide
  • HTTPS must be used
  • Encryption key must provided in HTTP headers, for every HTTP request made
A

Server-Side Encryption with Customer-Provided Keys (SSE-C)

87
Q
  • Use client libraries such as Amazon S3 Client-Side Encryption Library
  • Clients must encrypt data themselves before sending to Amazon S3
  • Clients must decrypt data themselves when retrieving from Amazon S3
  • Customer fully manages the keys and encryption cycle
A

Client-Side Encryption

88
Q

SSE-KMS Limitation

A
  • If you use SSE-KMS, you may be impacted by the KMS limits
  • When you upload, it calls the GenerateDataKey KMS API
  • When you download, it calls the Decrypt KMS API
  • Count towards the KMS quota per second (5500, 10000, 30000 req/s based on region)
  • You can request a quota increase using the Service Quotas Console
89
Q

Encryption in flight is also called?

A

SSL/TLS

90
Q

Amazon S3 – Encryption in transit (SSL/TLS) - HTTPS is mandatory for _______

A

SSE-C

91
Q

Amazon S3 – Encryption in transit (SSL/TLS) - HTTPS is ________

A

recommended

92
Q

Can you for encryption in Transit??

A

YES

93
Q

What does CORS stand for??

A

Cross-Origin Resource Sharing

94
Q

The requests won’t be fulfilled unless the other origin allows for the requests, using_________?

A

CORS Headers

95
Q

If a client makes a cross-origin request on our S3 bucket, What do we need to do??

A

enable the correct CORS headers

96
Q

Which CORS, You can allow for ____________

A

specific origin or for * (all origins)

97
Q

Amazon S3 – MFA Delete will be required to ……

A
  • Permanently delete an object version
  • Suspend Versioning on the bucket
98
Q

Amazon S3 – MFA Delete will NOT be required to ……

A
  • Enable Versioning
  • List deleted versions
99
Q

To use MFA Delete, Versioning must be __________ on the bucket

A

enabled

100
Q

Only the bucket ______________ can enable/disable MFA Delete

A

owner (root account)

101
Q

S3 Access Logs - The target logging bucket ________ be in the same AWS region

A

MUST

102
Q

How can you generate pre-signed URLs?

A

S3 Console, AWS CLI or SDK

103
Q

What are the pre-signed URL’s expirations?

A
  • S3 Console – 1 min up to 720 mins (12 hours)
  • AWS CLI – configure expiration with –expires-in parameter in seconds (default 3600 secs, max. 604800 secs ~ 168 hours)
104
Q

Examples of Amazon S3 – Pre-Signed URLs

A
  • Allow only logged-in users to download a premium video from your S3 bucket
  • Allow an ever-changing list of users to download files by generating URLs dynamically
  • Allow temporarily a user to upload a file to a precise location in your S3 bucket
105
Q
  • Adopt a WORM (Write Once Read Many) model
  • Create a Vault Lock Policy
  • Lock the policy for future edits
    (can no longer be changed or deleted)
  • Helpful for compliance and data retention
A

S3 Glacier Vault Lock

106
Q
  • Adopt a WORM (Write Once Read Many) model
  • Block an object version deletion for a specified amount of time
A

S3 Object Lock

107
Q

2 types of Retention Modes for S3 Object Lock

A

Retention mode - Compliance
Retention mode - Governance

108
Q
  • Object versions can’t be overwritten or deleted by any user, including the root user
  • Objects retention modes can’t be changed, and retention periods can’t be shortened
A

Retention mode - Compliance

109
Q
  • Most users can’t overwrite or delete an object version or alter its lock settings
  • Some users have special permissions to change the retention or delete the object
A

Retention mode - Governance

110
Q

S3 Object Lock - protect the object for a fixed period, it can be extended

A

Retention Period

111
Q
  • protect the object indefinitely, independent from retention period
  • can be freely placed and removed using the s3:PutObjectLegalHold IAM permission
A

Legal Hold

112
Q

Simplify security management for S3 Buckets

A

Access Points

113
Q

Each Access Point has (2)

A
  • its own DNS name (Internet Origin or VPC Origin)
  • an access point policy (similar to bucket policy) – manage security at scale
114
Q

We can define the access point to be accessible ________?

A

only from within the VPC

115
Q

You must create a __________ to access the
Access Point (Gateway or Interface Endpoint)

A

VPC Endpoint

116
Q

The VPC Endpoint Policy __________ allow access to the target bucket and Access Point

A

MUST

117
Q

To change the object before it is retrieved by the caller application

A

AWS Lambda Functions

118
Q
A

AWS Cert (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions