Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Cloud Practitioner > S3/IAM > Flashcards

S3/IAM Flashcards

1
Q

What does S3 stand for?

A

Simple Storage Service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is S3 used for?

A
  • S3 provides developers and IT teams with secure, durable, highly-scalable object storage.
  • S3 allows the storage and retrieval of any amount of data from anywhere on the web.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What type of storage does S3 use?

A

S3 uses object-based storage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the maximum allowable storage you can have in S3 for a single object?

A

S3 files can be from 0 Bytes to 5TB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the maximum allowable storage you can have in S3?

A

The total volume of data and number of objects you can store is unlimited

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is IAM?

A

​

  • AWS Identity and Access Management (IAM) is a web service that helps you securely control access to AWS resources.
  • MANAGES
    • who is authenticated (signed in)
    • who is authorized (has permissions) to use resources.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

List the key features of IAM

A
  • CENTRALIZED CONTROL of your account
  • CUSTOM PASSWORD ROTATION POLICY
  • EVENTUALLY CONSISTENT
  • GRANULAR PERMISSIONS
  • IDENTITY FEDERATION (Active Directory, Facebook, LinkedIn)
  • IDENTITY INFO for assurance
  • INTEGRATED with aws services
  • MFA (multi-factor authentication)
  • PCI DSS COMPLIANCE
  • SECURE ACCESS to aws resources for apps on EC2
  • SHARED ACCESS to your account
  • TEMP ACCESS for users/devices and services where necessary
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How do you access IAM?

A

​

  • AWS Management Console
  • AWS Command Line Tools
  • AWS SDKs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are IAM users?

A

IAM users are end users such as people, employees of an organzation, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are IAM groups?

A

​

  • IAM groups are collections of users
  • Each user in a group inherits the permissions of the group
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are IAM permission policies?

A

Permission policies:

  • consist of Policy Documents,
  • are formated as JSON,
  • give permissions as to what a User/Group/Role is able to do.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are IAM roles?

A

An IAM role is an IAM identity that defines a set of permissions for making AWS service requests.

IAM roles are not associated with a specific user or group; instead, trusted identities assume roles (such as IAM users, applications or services such as EC2).

A role does not have standard long-term credentials such as a password or access keys associated with it. Instead, when a trusted identity assumes a role, it provides you with temporary security credentials for your role session.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How are IAM roles and users similar?

A

An IAM role is similar to an IAM user, in that BOTH ARE

  • an AWS identity with permission policies
  • that determine what the identity can and cannot do in AWS.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How are IAM roles and users different?

A
  • A user is uniquely associated with one person.
  • A role is intended to be assumable by anyone who needs it.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What entities can use roles?

A

Roles can be used by the following:

  • An IAM user in the same AWS account as the role
  • An IAM user in a different AWS account than the role
  • A web service offered by AWS such as Amazon Elastic Compute Cloud (Amazon EC2)
  • An external user authenticated by an external identity provider (IdP) service that is compatible with SAML 2.0 or OpenID Connect, or a custom-built identity broker.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is an AWS service role?

A

A role that a service assumes to perform actions in your account on your behalf.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is an AWS service role for an EC2 instance?

A

A special type of service role that an application running on an Amazon EC2 instance can assume to perform actions in your account.

18
Q

What is an AWS service-linked role?

A
  • A unique type of service role that is linked directly to an AWS service.
  • Service-linked roles are predefined by the service and include all the permissions that the service requires to call other AWS services on your behalf.
19
Q

What is role chaining?

A

Role chaining occurs when you use a role to assume a second role through the AWS CLI or API.

20
Q

What is role delegation?

A

The granting of permissions to someone to allow access to resources that you control.

21
Q

What is role federation?

A

The creation of a trust relationship between an external identity provider and AWS.

22
Q

What are federated users?

A

Federated users are existing identities from AWS Directory Service, your enterprise user directory, or a web identity provider.

23
Q

What is a trust policy?

A

A JSON policy document in which you define the principals that you trust to assume the role.

The principals that you can specify in the trust policy include

  • users
  • roles
  • accounts
  • services
24
Q

What is a permissions policy?

A

A permissions document in JSON format in which you define what actions and resources the role can use.

The document is written according to the rules of the IAM policy language.

25
Q

What is a permissions boundary?

A

An advanced feature in which you use policies to limit the maximum permissions that an identity-based policy can grant to a role.

You cannot apply a permissions boundary to a service-linked role

26
Q

What is a principal?

A

An entity in AWS that can perform actions and access resources. A principal can be an AWS account root user, an IAM user, or a role.

27
Q

What are the two ways to grant permissions to access a resource?

A
  • You can attach a permissions policy to a user (directly, or indirectly through a group) or to a role.
  • For those services that support resource-based policies, you can identify the principal in the Principal element of a policy attached to the resource.
28
Q

TRUE or FALSE?

IAM is universal, and does not apply to regions specifically.

A

TRUE

29
Q

How broad is the IAM namespace?

A

IAM has a global namespace

30
Q

What permissions does an IAM user have when first created?

A

A user has NO permissions when first created (least privileges)

31
Q

Which account is the root account in IAM?

A

The root account is the account created when you first set up your AWS account.

32
Q

What access does the root account have?

A

The root account has complete admin access

33
Q

What are the Access Key ID and Secret Access Key used for?

A
  • Access Key ID and Secret Access Key are used for programmatic access (AWS APIs and CLI)
  • Think of it as the username and password for programmatic access
  • Cannot be used to log in to console.
34
Q

How are Access Key IDs and Secret Access Keys assigned?

A
  • Access Key IDs and Secret Access Keys are assigned to new users upon creation
  • You can only view them ONCE
35
Q

If you lose your AWS Access Key ID and Secret Access Key, how can you recover them?

A

You can’t.

You will need to generate a new pair from within the console (under My Security Credentials -> Access keys

36
Q

What are common use cases for EC2 Spot Instances?

A
  • Batch jobs- Data analysis- Workloads resilient to failures
37
Q

When would you NOT use EC2 Spot Instances?

A
  • Critical jobs- Databases
38
Q

What is the discount provided for using EC2 Spot Instances?

A

90%

39
Q

What is a Spot Block?

A

It’s a block on a spot instance for a specified time frame (1 to 6 hours) where the instance cannot be interrupted or reclaimed

40
Q

What is a Spot Fleet?

A

A set of Spot Instances, and optionally, on-demand instances.

41
Q

What are the various strategies available to allocate Spot Instances

A
  • lowestPrice: from the pool with lowest price- diversified: distributed across all pools- capacityOptimized: pool w/optimal capacity

AWS Cloud Practitioner (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions