Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Certified Solution Architect Associate > S3 > Flashcards

S3 Flashcards

This deck aims to help retain concepts related to the AWS S3 service.

1
Q

Which S3 security feature allows to define principals that are allowed to access S3 resources under certain conditions?

A

S3 Bucket policy (resource-based policy)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which S3 security feature provides controls across an entire AWS Account or at the individual S3 bucket level to ensure that objects will never be accessed publicly?

A

S3 Block Public Access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Name the S3 (legacy) security feature that defines which AWS accounts or groups are granted access and the type of access to both buckets and individual objects within a bucket.

A

S3 Access Control Lists (ACLs)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Provide a good use case for utilizing a bucket policy (resource-based policy) when configuring bucket access permissions.

A

For permissions that require anonymous user access or cross-account access, or when controlling access to a single S3 resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Provide a good use case for utilizing an IAM policy (identity-based policy) when configuring bucket access permissions.

A

For permissions required within the same account, or when controlling access to a range of different resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which S3 feature allows you to keep multiple variations of an object and provides the ability to preserve, retrieve, and restore every variation?

A

S3 Bucket Versioning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

When you create an S3 bucket, is versioning enabled by default?

A

No, by default versioning is disabled

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Can versioning be disabled on the S3 bucket?

A

No, once enabled, versioning cannot be disabled, but it can be suspended and re-enabled when required

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which S3 security feature requires additional authentication to allow permanent object version deletion or changing the versioning state of the bucket?

A

MFA delete

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which S3 feature allows an application to upload a large object as a set of smaller parts uploaded in parallel?

A

S3 Multipart upload

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Is it S3’s responsibility to combine smaller pieces into the original object during a multipart upload?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the recommended minimum file size to start considering S3 multipart upload?

A

100MiB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the minimum and maximum part size for an S3 multipart upload?

A

The minimum part size is 5MiB, and the maximum part size is 5GiB, the last part (leftover) can be less than 5MiB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which S3 feature reduces the variability in internet routing, congestion, and speeds that can affect transfers, and logically shortens the distance to S3, resulting in faster uploads?

A

S3 Transfer Acceleration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the maximum number of data parts for an S3 multipart upload?

A

10,000 parts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which components of AWS global infrastructure does S3 Transfer Acceleration utilize?

A

Edge Locations, to transfer data over the AWS Global Network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which naming restriction may apply to the S3 bucket to enable the Global Acceleration feature?

A

The bucket name cannot contain periods and must be DNS-compatible

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Is S3 Transfer Acceleration enabled by default?

A

No, it is disabled by default

Enabling Transfer Acceleration incurs additional costs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Are S3 buckets encrypted?

A

No, buckets are not encrypted but objects are

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which types of encryption does S3 support?

A

Client-side and server-side (SSE-S3, SSE-KMS, and SSE-C)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which type of encryption protects data in transit and at rest so that data is never exposed to any third parties, including AWS?
Hint: Using this encryption type, you are responsible for key management as well as the encryption and decryption process.

A

Client-side encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Which type of S3 encryption automatically encrypts data at the object level as it is written and decrypts it for you when you access it?

A

Server-side encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Name a type of S3 server-side encryption, where S3 handles key management as well as the encryption and decryption process but provides no control over encryption keys and no role separation.

A

SSE-S3 (server-side encryption with S3-managed keys)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Name a type of S3 server-side encryption where S3 handles the encryption and decryption process while delegating KMS to manage encryption keys, providing key rotation control and role separation.

A

SSE-KMS (server-side encryption with KMS-managed keys)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Name a type of S3 server-side encryption where S3 handles the encryption and decryption process while delegating customers to manage encryption keys (customers provide encryption keys for each encryption or decryption operation).

A

SSE-C (server-side encryption with customer-provided keys)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Which S3 feature can reduce KMS request costs by decreasing the request traffic from S3 to KMS?

A

S3 Bucket-level keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What S3 storage classes are there?

A
  • Standard
  • Standard IA
  • One Zone IA
  • Intelligent Tiering
  • Glacier:
    • Instant Retrieval
    • Flexible Retrieval
    • Deep Archive
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Which S3 storage class should be used to store frequently accessed non-replaceable data?

A

Standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Which S3 storage class has no retrieval fee but the most expensive storage fee?

A

Standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Which S3 storage class should be used to store infrequently accessed, important, and non-replaceable data?

A

Standard IA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Which S3 storage class should be used to store infrequently accessed, non-critical data that can be easily recreated?

A

One Zone IA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Which S3 storage classes replicate data across 3 AZs?

A
  • Standard
  • Standard IA
  • S3 Intelligent-Tiering
  • Glacier IR, FR, DA
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

How is S3 billed?

A
  • S3 incurs a GB/month storage fee
  • Transfer out fee, and per 1k requests fee
  • Some storage classes incur an additional retrieval fee and a minimum capacity charge (40-128KB), which can vary based on the storage class
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Which S3 storage classes have a duration charge for a minimum of 30 days of storage?

A
  • Standard IA
  • One Zone IA
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Which storage classes have a duration charge for a minimum of 90 days of storage?

A
  • Glacier Instant Retrieval
  • Glacier Flexible Retrieval
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Which storage classes have a duration charge for a minimum of 180 days of storage?

A

Glacier Deep Archive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Which S3 storage class should be used to store non-replicable data that is not often accessed but requires access in real-time?

A

Glacier Instant Retrieval

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Which S3 storage class should be used to store archival data, where frequent or real-time access is not required but can be accessed within a 12-hour window?

A

Glacier Flexible Retrieval

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Which S3 storage class should be used to store archival data, where frequent or real-time access is not required but can be accessed within a 48-hour window?

A

Glacier Deep Archive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

In which S3 storage class is data cold and not instantly accessible but can be temporarily retrieved to S3 Standard IA via Expedited (1-5 min), Standard (3-5 h), or Bulk (5-12 h) jobs (faster = more expensive)?

A

Glacier Flexible Retrieval

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

In which S3 storage class is data frozen and not instantly accessible but can be temporarily retrieved to S3 Standard IA via Standard (12 h) or Bulk (48 h) jobs (faster = more expensive)?

A

Glacier Deep Archive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Which S3 storage class should be used for cases where data access patterns are unknown?

A

Intelligent Tiering

40
Q

What tiers are present in the Intelligent Tiering storage class?

A
  • Frequent Access
  • Infrequent Access
  • Archive Instant Access
  • Archive Access
  • Deep Archive Access tiers
41
Q

In the S3 Intelligent Tiering storage class, how long does it take for an object to transfer from one tier to another?

A

For non-archival tiers, 30 days; for archival tiers, 90-180 days

42
Q

Which feature of S3 provides a set of rules that can define actions that S3 applies to a group of objects ensuring cost-effective management through their lifecycle?

A

S3 Lifecycle configuration

43
Q

What types of actions can be configured in the S3 lifecycle configuration?

A

Transition actions, Expiration actions

44
Q

What kind of S3 lifecycle configuration action defines when an object transitions to another storage class?

A

Transition actions

45
Q

What kind of S3 lifecycle configuration action defines when an object expires so that S3 deletes these objects on your behalf?

A

Expiration actions

46
Q

What is the minimum timeframe required for the S3 lifecycle configuration transition action to occur?

A

30 days

47
Q

With S3 lifecycle configuration, can an object be transitioned to any storage class?

A

No, the transitioning process follows a waterfall model: Standard -> Standard IA -> Intelligent Tiering -> One Zone IA -> Glacier IR -> Glacier FR -> Glacier DA.

48
Q

Which S3 feature allows objects to be copied between SOURCE and DESTINATION buckets in the same or different AWS Accounts?

A

S3Replication

49
Q

Which types of replication does S3 offer?

A

Cross-Region Replication (CRR) and Same-Region Replication (SRR)

50
Q

When would you use S3 Cross-Region Replication over Same-Region Replication?

A
  • CRR is used for architecting globally-resilient environments or implementing latency reduction
  • SRR is used for resilience with strict sovereignty, logs aggregation, and PROD/TEST environment synchronization
51
Q

Which feature of S3 adds a guaranteed 15-minute replication SLA?

A

S3 Replication Time Control (RTC)

52
Q

When replication is configured in S3, are all objects being replicated?

A

Replication options allow configuration to replicate all objects or a subset of objects based on prefixes

53
Q

When replication is configured in S3, what storage class do objects belong to in the DESTINATION bucket, and what’s their ownership?

A

Replication options allow configuration of the objects’ storage class and ownership; by default, it’s the same as the SOURCE bucket

54
Q

Once replication is configured for the S3 bucket, will it retroactively replicate objects that existed in the bucket before replication was configured?

A

No, to replicate existing objects, batch replication must be performed

55
Q

To configure replication in S3, what must be enabled on both SOURCE and DESTINATION buckets?

A

S3 Versioning

56
Q

Is S3 replication a one-way process?

A

By default, yes, however, it can be configured to be bi-directional

57
Q

Can objects in S3 Glacier Flexible Retrieval (FR) or Glacier Deep Archive (DA) be replicated?

A

No

58
Q

When S3 replication is configured, will deleting an object operation replicate?

A

No, by default, this requires the configuration of DeleteMarkerReplication

59
Q

Can S3 replication handle both encrypted and unencrypted objects?

A

Yes, with some extra configuration

60
Q

When configuring S3 replication, which permissions does the SOURCE bucket owner require?

A

The owner of the SOURCE bucket requires permission for objects that will be replicated

61
Q

When configuring S3 replication, will system events such as lifecycle management events also be replicated?

A

No, system events are not replicated.

62
Q

Which S3 security feature allows generating a URL with encoded access permissions for a specific bucket or object, valid for a certain period of time?

A

S3 PreSigned URLs

63
Q

When you generate an S3 PreSigned URL, whose permissions are attached to the URL?

A

The permissions belong to the identity (user or role) that generated the URL (right now)

63
Q

Is it possible to generate S3 PreSigned URLs for objects that you do not have access to?

A

Yes, you can generate a PreSigned URL by specifying the object and expiration time, but access to this object will be denied if you don’t have permission

64
Q

What does an “Access Denied” error message mean when accessing an object via a PreSigned URL?

A

It indicates that the identity used to generate the PreSigned URL either no longer has permission to access the object or never had permission

65
Q

Can you use an IAM Role to generate an S3 PreSigned URL?

A

Yes, although it’s not recommended practice because PreSigned URLs become invalid as soon as the temporary credentials associated with the IAM Role expire, generally should use IAM user

66
Q

What is the maximum validity period for an S3 PreSigned URL?

A

7 days

67
Q

Which feature of S3 lets you specify targeted portions of an object (a range of bytes in SQL-like statements) to retrieve and return rather than returning the entire contents of the object?

A

S3 Select, or Glacier Select

68
Q

Which feature of S3, once configured by identifying the event to be published, sends notifications when certain events happen in the bucket?

A

S3 Event Notifications

69
Q

What kinds of events can S3 Event Notifications publish?

A

ObjectCreated, ObjectRemoved, ObjectRestore

70
Q

To which AWS services can S3 Event Notifications be delivered as targets?

A

SNS topics, SQS queues, Lambda, EventBridge

71
Q

Which feature of S3 enables access to information about requests made to a bucket for security and access audits and helps you understand the S3 bill?

A

S3 Access Logs

71
Q

Once enabled, where are S3 Access Logs delivered?

A

Access logs are delivered to a specified destination S3 bucket, the logs are newline-delimited records with space-delimited attributes

71
Q

When enabling S3 Access Logs, which limitations of the destination bucket must be considered?

A

The destination bucket should not have access logs, object lock, and requester pays features enabled

72
Q

Which S3 feature stores objects using a write-once-read-many (WORM) model to prevent objects from being deleted or overwritten for a fixed amount of time or indefinitely?

A

S3 Object Lock

73
Q

Does the Object Lock feature of S3 require versioning to be enabled?

A

Yes, Object Lock can only be enabled on versioned buckets, individual versions of objects are locked

74
Q

Once enabled, can the Object Lock feature of S3 be disabled?

A

No, once enabled, Object Lock cannot be disabled

75
Q

Can you suspend versioning on S3 buckets with the Object Lock feature enabled?

A

No, versioning cannot be suspended on Object Locked buckets

76
Q

List the main components of the S3 Object Lock feature used to protect object versions from deletion.

A

Retention periods and Legal Hold

77
Q

Which types of retention modes are supported by the S3 Object Lock feature?

A

Compliance Mode and Governance Mode

78
Q

Which S3 Object Lock component protects an object version for a fixed amount of time?

A

Retention periods

79
Q

When S3 Object Lock is enabled, using which retention mode can a protected object version not be overwritten or deleted by any user, including the root user?

A

Compliance Mode

80
Q

When S3 Object Lock is enabled, using which retention mode can users not overwrite or delete an object version or alter its lock settings unless they have special permissions?

A

Governance Mode

81
Q

Which S3 Object Lock permissions are required to adjust object lock settings in Governance Mode?

A

The permissions required are s3:BypassGovernanceRetention and the header x-amz-bypass-governance-retention:true

82
Q

Which S3 Object Lock component prevents an object version from being overwritten or deleted without a fixed amount of time and remains in effect until removed?

A

Legal Hold

83
Q

Which S3 Object Lock permission is required to turn off Legal Hold?

A

s3:PutObjectLegalHold

84
Q

When the S3 Object Lock feature is enabled, can an individual object version have both Retention Periods and Legal Hold enabled?

A

Yes, an object version can have both, one of, or none

85
Q

What feature of S3 simplifies data access at scale for applications using shared data sets on S3, representing unique hostnames that can be created to enforce distinct permissions and network controls for any request made through it?

A

S3 Access Points

86
Q

What are the benefits of utilizing the S3 Access Points feature?

A

Each access point has a unique DNS address and can have different policies and network access control, which reduces the burden of managing complex bucket policies

87
Q

Can the S3 Access Point feature restrict access to specific prefixes, tags, or actions?

A

Absolutely

88
Q

What is considered the best practice when using the S3 Access Points feature?

A

Implementing permissions delegation, where the bucket policy grants wide open access to the access points, and the access points policy restricts access as needed, providing more granularity over the objects

89
Q

Which CLI command can be used to create an S3 Access Point?

A

aws s3control create-access-point –name <name> --account-id <acc_id> --bucket <bucket></bucket></acc_id></name>

90
Q

What would you use Amazon S3 for?

A

Web serving and content management, media and entertainment, retaining backups, big data analytics, and data lakes

91
Q

What’s a key limitation to consider when naming an S3 bucket?

A
  • S3 bucket names must be globally unique, 3-63 characters long, lowercase letters, numbers, periods, or hyphens only (no underscores), start with a letter or number, and cannot be in IP format
  • There’s a soft limit of 100 buckets and a hard limit of 1,000 per AWS account
  • Each bucket can hold an unlimited number of objects, ranging from 0 bytes to 5 TB in size
92
Q

What AWS S3 feature allows the user downloading data from the bucket to pay the transfer-out fees?

A

The Requester Pays feature

93
Q

What bucket-level configuration must be updated to enable the Requester Pays feature in AWS S3?

A

Change the bucket’s setting fromPayer=Owner to Payer=Requester

94
Q

Can the AWS S3 Requester Pays feature be enabled for individual objects within a bucket?

A

No, it is a bucket-level feature and applies to the entire bucket

95
Q

Does the AWS S3 Requester Pays feature support BitTorrents or Static Website Hosting?

A

No, it is not compatible with these functionalities

96
Q

Is unauthenticated access supported by AWS S3 buckets with the Requester Pays feature enabled?

A

No, authenticated access is required, as AWS S3 must allocate billing to a specific identity

97
Q

What header must be included in requests to AWS S3 buckets with the Requester Pays feature enabled to confirm payment responsibility?

A

The x-amz-request-payer header must be supplied

98
Q

Which AWS encryption type enhances data protection by applying two layers of encryption using keys managed by AWS Key Management Service (KMS)?

A

DSSE-KMS (Dual-layer Server-Side Encryption with AWS KMS keys) enhances security by encrypting data twice, with each layer managed by AWS KMS

AWS Certified Solution Architect Associate (46 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions