Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Solutions Architect Associate > SAA > Flashcards

SAA Flashcards

1
Q

What are the rules concerning S3 bucket names?

A
  1. They have to be globally unique (no two buckets can have the same name, even if they are created within two different regions, or AWS accounts).
  2. They have to use DNS name-like rules (only lowercase, can’t have a - in the name, may start with a digit or character).
  3. Have to be 3-63 characters long.
  4. Cannot be IP address-like.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

EC2 health checks vs. ELB for ASG

A
  • EC2 health checks deal with HOST/INSTANCE issues
  • ELB can monitor app health
  • ASG using ELB checks detect and replace failed apps/instances
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Serverless in AWS

A 
Lambda
API Gateway
DynamoDB
Step Functions
S3
SQS/SNS
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Max managed IAM policies per group

A

10

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Role permissions policy

A

Defines what permissions STS gives the identity who assumes a role

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is split view in DNS?

A

When there are two zones, a private and a public, and they have the same DNS record

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Define what a logical resource and a physical resource is within CloudFormation.

A

A logical resource is the resource defined in code format while the physical resource is the real resource that is actually created in AWS by the logical resource.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Route targets

A
  • Can be IPs

- Can be gateway objects such as IGW, VGW, VPC endpoints, VPC peers, NAT gateways, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How many objects and how much data can S3 store?

A

S3 can store an unlimited number of objects and an unlimited amount of data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

SQS security

A 
Public service
Queue policy (resource policy)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

RTO

A

Recovery Time Objective: How long from the point of failure it will take to recover the system to an operational state

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is RTMP?

A

Real-Time Messaging Protocol, owned by Adobe. CloudFront has an option to distribute this type of content.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Snowball/Edge/Mobile

A
  • Migrate data to or from S3 faster than you could with an internet connection (high-capacity, suitcase-sized storage).
  • Consider when you have high data volume and a bad internet connection.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Bootstrap

A
  • Giving startup commands to an instance
  • Configure OS
  • Install apps
  • Configure apps
  • Steps occur after base AMI is installed
  • Done via user data for EC2
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Route 53 latency

A

Resolves to record that provides the lowest latency and so ideally best performance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the maximum retention period for RDS automatic backups?

A

35 days

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

SQS

A
  • Standard or FIFO queues
  • 256 KB messages
  • Short poll: Queue messages or nothing
  • Long poll: Wait for messages (fewer API calls)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Bucket — object versioning

A
  • Can be enabled and paused, not disabled
  • Every object gets a version ID
  • Deleted objects just have a delete marker added
  • Required for CRR
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Improving RTO

A
  • Automated recovery
  • Automated healing
  • Efficient restore processes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

VPC Flow Logs

A

Monitors IP traffic metadata -> S3 or CloudWatch Logs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

EMR

A
  • Elastic MapReduce
  • Analysis of “big data” (unstructured and semi-structured)
  • Cluster (master, core, task)
  • HDFS cluster file system
  • EMRFS: S3-based cluster file system
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the types of CloudWatch Events sources?

A
  • Pattern

- Scheduled

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Access keys

A
  • Long-term credentials associated with an IAM user
  • Give permissions the user has
  • Don’t expire
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

S3 CRR

A
  • Cross-region replication
  • Object replication from source bucket to destination bucket in a different region
  • Not retroactive; one way only
  • DR or read in different region for performance reasons
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

CloudTrail trail

A
  • Lets you configure what to log
  • What regions
  • Global events
  • Global trail
  • Where -> S3 / CloudWatch Logs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Kinesis vs. SQS

A
  • Kinesis for streaming (ingestion)
  • Multiple consumers, rolling window, no removals
  • SQS decoupling, work queue, one consumer per message
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Direct Connect encryption

A
  • No

- Can be added, public VIF + IPSec VPN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is the only way to restrict the root user?

A

When utilizing AWS Organizations, you can create a service control policy and attach it to the account OU restricting access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Internet gateway HA

A
  • It’s HA by design
  • You can’t make two for one VPC
  • You don’t need to make two for one VPC
  • One IGW covers all public subnets in the VPC
  • Works with IPv4 and IPv6
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is ::/0?

A
  • Represents all IPv6 addresses

- Generally used for the IPv6 default route

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Reserved Instances

A
  • Regional: No capacity reservation, just discount

- Zonal: Discount and capacity reservation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

DynamoDB streams

A
  • Ordered record of change to a DynamoDB table; four different view types
  • KEYS_ONLY
  • NEW_IMAGE
  • OLD_IMAGE
  • NEW_AND_OLD_IMAGE
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Describe alias records.

A

An extension of CNAME. Can be used like an A record with the functionality of a CNAME and none of the limitations. Can refer to AWS local services, and AWS doesn’t charge for queries of alias records against AWS resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is the benefit of having multiple Availability Zones within a region?

A

Availability Zones provide isolated infrastructure and services that allow for building highly available, fault-tolerant solutions within the same region.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

VPC Flow Logs monitoring points

A
  • VPC
  • Subnet
  • ENI
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

CloudWatch Logs components

A
  • Log group: Related data (/var/log/secure) settings, filters, retention
  • Log stream: Data for a specific instance or thing
  • Filled with log events (date and time; message)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

S3 object storage

A
  • Flat structure
  • Can’t be mounted as a file system (natively)
  • Can be accessed at scale, high performance
  • Media/large objects/secure
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What can assume roles in IAM?

A
  • IAM users
  • AWS services
  • External accounts
  • Web identities
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Types of IP in VPC

A
  • IPv4 internal (inside VPC CIDR)
  • IPv4 public (dynamic, it changes when EC2 is stopped and started)
  • IPv4 Elastic IP: Static, created and associated with ENI (no change if allocated)
  • IPv6: All addresses are public
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Route 53 simple

A
  • One record set
  • www -> IP
  • www -> another name
  • domain -> MX
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Instance families

A
  • Compute Optimized
  • Memory Optimized
  • Storage Optimized
  • General Purpose
  • Accelerated Computing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Private subnet

A
  • Allocate public IP set to false

- No default route to IGW

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Groups an IAM user can be a member of

A

10

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What is the maximum time a Lambda function can run?

A

15 minutes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

CloudFront

A
  • Global content delivery network for static and dynamic content
  • Accesses one or more origins (S3/custom)
  • Caches on edge locations and regional caches
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

DynamoDB indexes

A
  • Projection: What attributes are in the index
  • ALL = same as table
  • KEYS = just keys
  • Selected: Whatever you want
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

DynamoDB table

A
  • Per region
  • Unique ARN
  • PK and (optionally) SK
  • Local secondary indexes
  • Global secondary Indexes
  • Streams
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What does CloudWatch Logs do?

A
  • Log ingestions and management
  • Log search
  • Metric filter
  • App and OS logs via agent
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Kinesis Data Firehose

A
  • Persistently store data on S3
  • Send to other services (Redshift)
  • Modify in flight using SQL
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

VPC interface endpoint

A
  • Used for everything except DDB and S3
  • ENIs in VPC
  • DNS names for services resolving to endpoints
  • Private DNS overrides service default
  • No route table changes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

S3 permissions

A
  • Identity policies on USERS (same account only)
  • ACL on objects and bucket (old style)
  • Bucket policy: Applies to anyone accessing bucket (cross-account/public access)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Network sizes

A
  • /32 = 1 IP
  • /31 = 2 total addresses: point-to-point links
  • /30 = 4 total: 2 usable, 1 network, 1 broadcast
  • /29 = 8 total: 6 usable, 1 network, 1 broadcast
  • /28 = 16 total: 14 usable, 1 network, 1 broadcast
  • /24 = 256 total
  • /22 = 1024 total
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

EBS volume

A
  • gp2: General purpose SSD
  • io1: High IO SSD
  • st1: Throughput magnetic/mechanical
  • sc2: Cold storage, cheap, archival
  • Network-attached BLOCK storage
  • ONE INSTANCE AT A TIME
  • BELONGS TO ONE AZ
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

ECS

A
  • Elastic Container Service
  • EC2 container service
  • Or using Fargate (managed server) container service
  • Docker containers
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

True or False: By default, S3 content is stored encrypted.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Service control policy

A
  • A permissions boundary for a MEMBER account
  • What services an account can use
  • What services an account can’t use
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

How many resources can a CloudFormation template have?

A
  1. If additional resources are needed, you can nest and reference other stacks.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Number of access keys per IAM user

A

2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

True or False: Edge locations check the regional cache first before hitting the origin to get an object.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What is cost-effectiveness/efficiency?

A

Choosing the right products/services that have the minimum upfront and ongoing costs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Event-driven

A
  • An architecture where compute isn’t running 24/7/365. Instead, it runs in response to an event.
  • S3 upload -> Lambda
  • SQS message on queue -> Lambda
  • Change to AWS Account -> CloudWatch Events -> Lambda
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

How are Availability Zones identified?

A

With a single letter following the region’s code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

RPO

A

Recovery Point Objective: The time between a failure and the last successful backup. How much data you will lose.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Public subnet

A
  • Allocate public IP set to on
  • Route table with default route at IGW
  • VPC needs an attached IGW
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Which AWS product uses stacks, layers, and recipes?

A

OpsWorks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

SQS message lifecycle

A
  • Poll
  • Process
  • Delete

OR

  • Poll
  • Process
  • Message reappear (visibility timeout)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

SQS FIFO queue

A
  • Default 3,000 messages per second; 300 non-batching
  • Guaranteed once only
  • Guaranteed order
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

When to use SAML2.0 federation

A
  • Corporate identity store (MS/ADFS)
  • Need to get access to AWS resources using those identities
  • SAML assertion swapped by STS for temp credentials via AssumeRoleWithSAML
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

Static website

A
  • Bucket accessible with HTTP/S
  • Requires world-readable permissions
  • Can set index/error.html
  • Useful to offload static content away from expensive compute servers
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

What is a volume gateway?

A
  • Presents via iSCSI; block storage (network hard drive like EBS)
  • Volume stored: Data is on gateway; snapshots to S3
  • Volume cached: Data is on S3; local cache on virtual appliance
  • Data is stored in volumes; not accessible directly via S3
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Max size encryption/decryption using a CMK

A

4 KB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

Improving RPO

A
  • More regular backups

- Constant backups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

What are VPC endpoints?

A

Gateway objects created within a VPC. They can be used to connect to AWS public services without the need for the VPC to have an attached internet gateway and be public.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

What are the two types of application state?

A
  • Stateful (stored on the server)

- Stateless (stored outside of the server)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

Describe a DNS TXT record.

A

Used for descriptive text in a domain. Often used to verify domain ownership.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

Which AWS service is a PaaS environment designed for developers to host their code?

A

Elastic Beanstalk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

What are the advantages of asymmetric keys?

A
  • Doesn’t require sharing a common secret; the key holder holds the private key that needs to be kept secret and safe while anyone can have and use the public key to encrypt text that is only intended for the key holder or decrypt text that is created by the key holder
  • Therefore, not easy to impersonate the key holder (unless private key is itself compromised)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

Sticky sessions

A

Send incoming connections to the same instance for the duration of the session (LB generates a cookie).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

IaaS

A
  • Infrastructure as a Service (e.g., EC2)

- You purchase a VM or an operating system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

Elasticity

A
  • Automation of the provisioning and un-provisioning of resources
  • Horizontal scaling
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

DB types/engines

A
  • Key-value = DDB
  • Wide column key-value = DDB
  • Document DB = DocumentDB
  • Columnar DB = Redshift
  • Relational = Aurora/RDS
  • Ad-hoc = Athena
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

AssumeRole

A
  • Not login
  • You become the role temporarily
  • STS gives you short-term credentials
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

Step Functions

A
  • Handle long-running tasks involving AWS services and humans
  • Can coordinate Lambda
  • Decisions/parallel flows
  • Serverless via “state machines”
  • Like Simple Workflow service (without servers)
  • Use it if you need serverless flows longer than 15 minutes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

Direct Connect

A
  • Physical 1 or 10 Gbps connection
  • Requires BGP
  • Public VIF (public services) and private VIF (VPC) run on top
  • NOT ENCRYPTED
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

Instance types

A
  • T3
  • T2
  • M5
  • C3, etc.
  • Governs the capabilities (CPU type, mem type, GPU, burst, etc.)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

Route 53 geolocation

A
  • Allows resolution to occur to a local area-based record
  • Country
  • Continent
  • Global default
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

Give five examples of when to use an IAM role.

A
  1. Company merger
  2. Grant access to an AWS service
  3. Cross-account access
  4. Web identity federation
  5. Break-glass–style extra access
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

AMI

A
  • Amazon Machine Image
  • Config container + EBS snapshot(s)
  • Base system install
  • Custom AMI with prebakes config/applications
  • Can be shared and copied between regions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

EBS encryption

A
  • EBS encryption uses an AWS/EBS KMS CMK
  • EC2 host performs encryption and decryption on data to and from EBS (at-rest encryption)
  • Any snapshots are encrypted
  • OS is unaware
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

If you lose your secret access key, can you generate a new one?

A

No. You will need to create a new access key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

Default max managed policies per role and per user

A

10

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

CloudFront regional cache

A

Larger cache that can hold objects for longer. Can deliver to edge location rather than origin fetch.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

Can you edit a launch template or launch configuration?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

True or False: Read replicas can be Multi-AZ.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

SSE-S3

A
  • S3 handles keys and encryption/decryption
  • S3 admin can always decrypt objects
  • AES-256
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

Route 53 failover

A
  • Primary and secondary
  • Primary passes health check = used
  • Primary fails health check = secondary used
  • Used for HA/maintenance
  • S3 backup for website
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

Load balancer architecture

A
  • Nodes in each subnet
  • Nodes have public IP (internet facing) or private (internal)
  • Each node gets one/number of nodes percentage of traffic
  • Nodes distribute to back-end instances (or just in AZ if cross-zone is disabled)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

Instance metadata

A
  • http://169.254.169.254/latest/meta-data/
  • It’s where role credentials are taken from
  • It’s where cloud-init gets the bootstrap comments from
  • It’s where an instance can find out its public IP/DNS
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

DynamoDB trigger

A

Lambda function being invoked when records are added to the stream

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

EBS snapshots

A
  • Stored in S3
  • Incremental: First = full; second = change from first
  • If volume is encrypted, the SNAP is encrypted
  • Can be copied between regions
  • Can be used to create new volumes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

Athena

A
  • Serverless querying
  • Ad-hoc querying
  • Billed for data scanned
  • Great for a wide range of data formats
  • No modification to source data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

PaaS

A
  • Platform as a Service (e.g., Elastic Beanstalk)

- You provide code/application; the vendor supplies the environment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

What are roles for?

A
  • Services can assume to get permissions
  • External identities can assume to get permissions
  • IAM users can assume to get different permissions
  • ALL ARE TEMP CREDENTIALS
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

Multipart upload

A
  • Splits object into X parts; uploads in parallel
  • Speed benefit, reliability benefits
  • Recommended for 100 MB+
  • Required for 5 GB+
  • If a part fails, just that part is retried
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

Trust policy

A

Defines what can assume a role

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

Bastion host/jump box

A

EC2 instance in a public subnet configured to accept connections (usually RDP or SSH). Once connected, can “jump” and access private resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

What is a monolithic architecture?

A

An architecture in which all the application layers are coupled within the same application

108
Q

Cluster placement group

A
  • Locate EC2 instances close
  • Full bandwidth between all instances in placement group
  • AZ locked when first instance launched
  • Ideally, launch all instances at once and same type. Otherwise, you may have capacity issues.
109
Q

Do instance OS’s have public IPs?

A

No. An EC2 instance’s OS never sees its IPv4 public IP. The internet gateway converts the private IPv4 to public IPv4 or elastic when traffic leaves.

110
Q
  • Principal:
  • Authorization:
  • Identity:
  • Authentication:
A
  • Principal: The account or system requesting access or authorization
  • Authorization: Verifying the principal against the identity
  • Identity: Objects that are authorized and require authentication to access resources
  • Authentication: Checking if the identity is allowed or denied access to a resource
111
Q

What is 0.0.0.0/0?

A
  • Represents all IPs

- Usually used for the default IPv4 route

112
Q

SSE-KMS

A
  • S3 handles encryption and decryption
  • KMS handles keys
  • S3 admin can’t by default access objects; needs KMS - CMK permissions too
113
Q

Instance roles

A
  • IAM role
  • Instance profile
  • STS temp credentials available from metadata
  • http://169.254.169.254/latest/meta-data/
114
Q

AWS organization

A
  • MASTER ACCOUNT
  • MEMBER ACCOUNTS
  • Consolidated billing
  • Account restrictions
115
Q

CloudWatch components

A
  • Data points: CPU usage at this time
  • Metrics: Data points (CPU) over time
  • Alarm: If metric = this, more than this, less than this -> ALARM
  • Alarm state = OK, ALARM, INSUFFICIENT DATA
  • Alarm can notify (SNS) take action ASG/EC2
116
Q

SNS

A
  • Publisher/subscriber
  • Messages 256 K -> Topics
  • Topics send all to subscribers
  • Can have filters for subscribers
  • Subscribers can be email, Lambda, queues, mobile push, HTTPS
117
Q

Which AWS product uses applications, environments, and application versions?

A

Elastic Beanstalk

118
Q

Vertical scaling

A
  • SCALE-UP
  • SCALE-DOWN
  • Increasing or decreasing the size of a compute resource
119
Q

CloudTrail

A
  • Captures account events (APIs/logins)
  • Management events
  • Optionally data events (S3 and Lambda)
120
Q

What is an IAM policy?

A

It is a JSON document that defines whether requests are allowed or denied. On its own, it does nothing. Needs to be associated.

121
Q

S3 Intelligent-Tiering

A
  • Moves between Standard and IA
  • No movement fee
  • No retrieval fee
  • Just an object-based admin fee
  • Use for uncertain access patterns
122
Q

Egress-only internet gateway

A
  • Used for IPv6 to allow outgoing only
  • IPv6 are all public IPs
  • An internet gateway allows incoming and outgoing for IPv6
  • Otherwise the same
123
Q

Max IAM users in one AWS account

A

5,000

124
Q

Asymmetric encryption

A

A public key can be used to encrypt data that only a corresponding private key can decrypt.

A private key can sign data that can be confirmed as valid using a public key.

125
Q

What is a tape gateway?

A
  • Virtual Tape Library
  • Presents via iSCSI
  • Virtual Tape Drive / Library -> S3
  • Virtual Tape Shelf -> Glacier
  • Migrate backups to AWS or reduce backup overhead.
126
Q

S3 One Zone-IA

A
  • Replicated in only one AZ, not three
  • Cheaper, better value
  • Less important data or reproducible
127
Q

S3 Transfer Acceleration

A
  • Uploads from a local endpoint through to the bucket
  • Uses AWS global network
  • Speed improvements
128
Q

Redshift

A
  • Column based
  • Not for transactions
  • For reporting
  • Petabyte
  • Can be copied and have snapshots taken
129
Q

NAT

A
  • Network address translation
  • Allowing multiple private IPs to access the internet in an outgoing way via one public IP
  • It’s what your home internet router does
130
Q

DynamoDB local secondary index

A
  • Created with table
  • Share RCU and WCU with table
  • Alternative SK; must already have an SK on table
131
Q

Name the three types of placement groups.

A
  1. Cluster
  2. Partition
  3. Spread
132
Q

7-layer OSI model

A
  1. Physical
  2. Data Link
  3. Network
  4. Transport
  5. Session
  6. Presentation
  7. Application
133
Q

DBaaS

A
  • Database as a Service (e.g., DynamoDB/RDS — RDS is between DBaaS and IaaS)
  • You purchase a “database” or “table.”
134
Q

Long-term credentials

A
  • Username and password

- Access keys

135
Q

What are groups for?

A

Container/organizing users

136
Q

Pre-signed URL

A
  • Generates a URL for an object with security included
  • Can be used for reads and writes
  • The URL has the permissions of the person generating it
  • Can generate URLs for objects you can’t access
137
Q

What type of structure is S3?

A

S3 is a flat file structure. It cannot contain folders. When you create a “folder” within S3, it is actually not a folder — it is an object.

138
Q

Partition

A
  • Provide the performance of DDB
  • 1,000 WCU
  • 3,000 RCU
  • 10 GB data
139
Q

When to use scheduled ASG scaling

A
  • When you have a known event
  • Busy periods of the month/week
  • Busy times of the day
  • Non-busy times
  • Can pre-launch so things are ready before
140
Q

Are VPC flow logs updated in real time?

A

No

141
Q

IAM resilience

A

IAM is a global service.

142
Q

What storage can be mounted in EC2?

A
  • EBS: One EC2 instance
  • EFS: Many Linux instances
  • Storage Gateway: Edge case, iSCSI
  • Not S3
143
Q

OAI

A
  • Origin access identity
  • Virtual identity that can be associated with a CloudFront distribution and then used to restrict a bucket to that distribution
144
Q

DynamoDB ITEM

A
  • One partition key (PK)
  • And optionally one sort key (SK)
  • Up to 400 KB of data per ITEM
  • Attribute length + attribute names + keys
145
Q

What are the three types of DNS health checks?

A
  1. Endpoint
  2. Status of other health checks
  3. State of CloudWatch alarms
146
Q

Fanout

A
  • PUBLISHER -> SNS -> QUEUE1/2/3 … SUBSCRIBERS
  • Message duplication
  • Parallel processing
  • Different bit rates
147
Q

DMS

A
  • Database Migration Service
  • Replication instance
  • Source -> target
  • Allows gradual migration; no admin overhead
  • Schema Conversion Tool (SCT)
148
Q

What ways can a user get IAM policies?

A
  • Inline: User or groups they are a member of

- Managed: Associated with user or groups they are a member of

149
Q

Which AWS service is based on Chef?

A

OpsWorks

150
Q

Console login

A

Normally username, password, and optionally MFA

151
Q

Enhanced networking

A
  • SR-IOV
  • Lower CPU usage for higher speeds
  • Higher speeds
  • Lower, more consistent latency
  • Less jitter (latency variance)
152
Q

Lifecycle policies

A
  • Move objects between tiers
  • Remove objects after a period
  • Works with versioning
153
Q

What is elasticity?

A

The ability of a system to dynamically scale up or down to manage the increase or decrease in demand

154
Q

EC2 resilience

A

EC2 occupies one subnet, one AZ, uses EBS, one AZ. If the AZ fails, the instance fails.

155
Q

S3 Standard

A
  • The default storage tier

- High availability, high durability

156
Q

DynamoDB global secondary index

A
  • Created at any time
  • Own RCU and WCU
  • Alternative PK and SK
  • Data is replicated from table; always eventually consistent
157
Q

VPC IPs

A
  • VPC has a CIDR
  • Subnets have a range
  • In every subnet
  • Normally .0 (or whatever the network IP is) is reserved
  • Network+1 is the VPC router in each subnet
  • Network+2 is the DNS in the subnet
  • Network+3 is reserved
  • Broadcast (subnet last IP) is reserved
158
Q

When to use Snow*

A
  • Snowball Edge: 10 TB -> 10 PB

- Snowmobile: Single location, 10 PB+, max 100 PB

159
Q

Role switching

A

Assuming a role in another AWS account via the console UI — you become the role in the other account and have its permissions via the console

160
Q

When to use on-demand instances

A
  • Short term
  • Unknown usage
  • Can’t tolerate interruption
  • Bridge the gap between reserved and spot
161
Q

Docker

A
  • Container
  • Runs on top of a base OS and Docker host
  • Lightweight
  • Contains only the differences made from the base image, apps, dependencies, etc.
162
Q

RDS and Aurora security

A
  • Security group associated with the instance

- NACL on the subnets

163
Q

Firewall

A
  • An appliance that can filter incoming or outgoing IP traffic
  • Allowing it, blocking it
  • NACLs and security groups are similar to firewalls
164
Q

Kinesis

A
  • Real-time streaming (IoT/sensor)
  • Stores 24 hours of rolling data; can be seven days
  • Shards allow scaling
  • 1 shard = 1,000 records/s, 1 MB in, 2 MB out
165
Q

Short-term/temporary credentials

A
  • Generated by STS
  • Time limited
  • IAM role
166
Q

VPC IPv6

A
  • AWS-allocated IPv6 range
  • Allocate subsets to subnets
  • Configure instance/other service to use
  • Needs IPv6 routes
  • IGW or egress-only internet gateway
167
Q

Lambda

A
  • Function as a Service
  • Runtime up to 15 minutes
  • Pay only for time running
  • Execution role (IAM role) provides permissions
  • Can be invoked by CloudWatch Events, S3, SNS, and much more
  • Can integrate with ALB/API Gateway
  • Public or private (VPC)
168
Q

API Gateway

A
  • API hosting endpoints as a service
  • HA/scalable
  • Can invoke Lambda, and store directly into DDB
  • Public service
  • Avoids the need to self-host APIs
169
Q

What is KMS?

A
  • Key Management Service
  • Manages CMKs (customer master keys)
  • Encrypt and decrypt
170
Q

Lambda execution role

A

The IAM role a Lambda function assumes when it invokes

171
Q

NAT gateway

A
  • NAT as a service
  • Occupies a public subnet, uses an Elastic IP, needs an IGW
  • Not HA — you need one per AZ for true HA
  • Private subnets need default route pointing at NATGW
172
Q

Envelope encryption

A
  • Using multiple keys to encrypt
  • Data -> Key A -> Encrypted Data
  • Encrypted Data -> Key B -> Encrypted Encrypted Data
173
Q

ASG 1:1:1

A
  • Quick way of doing HA
  • Min 1, Max 1, Desired 1
  • Failed instances are instantly rebuilt
  • Good for smaller sites
174
Q

IAM

A
  • Identity and Access Management
  • Trusted by the account
  • IAM can create and trust identities
175
Q

S3 limits

A
  • 100 buckets per account
  • No limit on number of objects
  • Objects = 0 bytes to 5 TB per object
  • GLOBALLY UNIQUE BUCKET NAME
176
Q

What is an ARN?

A
  • Unique identifier for any AWS thing

- arn:::::

177
Q

What does a launch template/configuration do?

A
  • Contains the WHAT
  • What you want to launch (AMI, keys, size, config)
  • Used by ASGs
178
Q

Glacier

A
  • Data archiving
  • Not immediate access; retrieval time takes
    minutes to hours
179
Q

VPC VPN

A
  • Highly available IPSec VPN
  • VGW (one per VPC) -> Customer Gateway (CGW) via one VPN connection (two tunnels)
  • HA = two CGWs and two VPNs
180
Q

What is the EC2 instance metadata URL?

A

http://169.254.169.254/latest/meta-data/

181
Q

Bucket default encryption

A
  • Default to apply if object PUT doesn’t specify anything

- Can be overridden

182
Q

ENI

A
  • Elastic network interface
  • VPC network interface
  • SGs are attached to ENIs, not instances
  • Instance has a default ENI
  • Can have others — each with its own set of SGs
  • ENIs have private IPs
183
Q

If groups are not real identities, then why is it possible to attach policies to them?

A

Attaching policies to groups is, in effect, attaching the policy to the users who are members of the group.

184
Q

Aurora and RDS backups

A
  • Up to 35 days automatic backup
  • Manual snapshots (last until deleted)
  • Point in time
185
Q

Benefits of SQS queue

A
  • Decoupling

- Scaling working group (using ASG + CW + SQS)

186
Q

Elastic Transcoder

A
  • Serverless transcoding of media
  • SRC -> DESTINATION
  • Can be manual; can be automatic using S3 events + Lambda
187
Q

Horizontal scaling

A
  • SCALE-OUT
  • SCALE-IN
  • Adding or removing compute resources
188
Q

Network ACL

A
  • Stateless: All traffic consists of initiating and return
  • Accessing EC2 on port 80 incoming = return traffic on a high random port outgoing
  • NACL needs two rules (in and out) for everything
  • NACL can explicitly DENY
  • NACLs apply to subnets; only affect traffic crossing subnet
  • Cannot reference logical objects
  • Cannot apply to instances
189
Q

Lambda vs. Step Functions vs. EC2

A
  • EC2 if heavy CPU and constant need
  • Lambda for event-based, less than 15 minutes, serverless
  • Step Functions for longer multi-Lambda flows
190
Q

Max IAM users in a group

A

Equal to max IAM users in an account

191
Q

Standard-IA

A
  • Designed for less frequently accessed data — same levels of durability and availability. Retrieval fee.
  • Important data but not commonly accessed
192
Q

Route 53

A
  • Global DNS service
  • Public and private (inside one or more VPCs)
  • Globally resilient
193
Q

EFS

A
  • Network file system (Elastic File System)
  • Uses S3 — Standard and IA
  • Accessible from Linux EC2 or Linux on-prem
  • Can be mounted as a file system; good for shared storage
  • Not public
194
Q
  • Can a CMK leave the region?

- Can a CMK leave KMS?

A
  • No

- No

195
Q

Encryption at rest

A

Data is encrypted before being written to disk and decrypted when read from disk.

196
Q

When to use web identity federation

A
  • When you have a “web scale”/”mobile app”
  • More than 5,000 users or don’t want to make IAM users
  • Or users have their own IDs (Twitter/FB/Amazon/Google)
  • Swap ID token for temp credentials via STS AssumeRoleWithWebIdentity
197
Q

Is EBS a shared file system?

A

No

198
Q

EBS resilience

A
  • EBS volume = one AZ
  • AZ fails, EBS volume fails
  • EBS volume attached to instances in the same AZ only
  • Snapshots to S3
199
Q

What credentials can a group have?

A

None

200
Q

When to use ID federation in general

A
  • Too many users for 5,000 IAM limit

- Same reason you want to use external identities (admin overhead, efficiency, minimize duplication)

201
Q

Proxy server

A
  • Accepts a connection (e.g., HTTP)
  • Makes a connection on your behalf and passes the response to you
  • Corporate web caches are a proxy server
  • Can filter based on DNS name
202
Q

Identity federation

A
  • Trusting another IdP to verify someone is who they say they are. Using that trusted identity to allow access to your systems via an ID swap.
  • SAML 2.0
  • Web identity
203
Q

What is the maximum configurable IOPs on a volume and instance?

A

64,000 for a volume and 80,000 for an instance

204
Q

Route 53 weighted

A
  • Record weight / total weight = chance of being used
  • Allows gradual migration
  • Allows distribution
  • A/B testing
205
Q

What is STS?

A

Security Token Service: It is responsible for creating short-term access keys that can be used by principals who have assumed a role to access the resources that the role has permissions for.

206
Q

Instance role

A

IAM role + instance profile allows an instance to assume a role and STS temp credentials to be available in the metadata

207
Q

Subnets

A
  • Subnet belongs to a VPC and an AZ
  • Subnet has a range of IPs inside the range of the VPC
  • Subnet ranges cannot overlap in the VPC or be outside of the VPC range
  • Can have IPv4 or IPv6
208
Q

What happens when an object is deleted from a versioned bucket?

A

The object versions are not actually deleted; S3 adds a marker to indicate the object was deleted.

209
Q

What is the benefit of having multiple Availability Zones within a region?

A

Availability Zones provide isolated infrastructure and services that allow for building highly available, fault-tolerant solutions within the same region.

210
Q

CloudWatch metrics that need agent

A
  • Memory utilization
  • Process memory utilization
  • Process CPU utilization
211
Q

Direct Connect HA

A

No… 1 physical connection

HA = 2 Direct Connects or 1 Direct Connect and 1+ VPN

212
Q

Consolidated billing

A

MASTER ACCOUNT gets billing for all member accounts. Volume discounts and reservations are pooled.

213
Q

EC2 startup priority

A
  • Reserved (with capacity reservation)
  • On-demand
  • Spot
214
Q

What is an EC2 instance?

A
  • Virtual machine running on an EC2 host
  • Allocation of vCPU and vMem
  • Attached network (ENI)
  • Attached storage (EBS)
215
Q

VPC peering

A
  • Links two VPCs with a private, software-based, HA connection
  • Is not transitive routing
  • VPC 1VPC 2VPC 3 does not mean 1 and 3 can connect.
  • Routes need adding (peer is a gateway object)
  • Can secure using SG and NACL
216
Q

True or False: Restoring an RDS snapshot requires re-configuration of security groups.

A

True

217
Q

Internet gateway (IGW)

A
  • 1:1 relationship between IGW and VPC
  • IGW is normally the default route for IPv4 and IPv6
  • Converts between private IP and public IP
  • Allows public instances to access the internet
218
Q

Fault tolerant/fault tolerance

A

A system designed to work through failure without any user impact. ASG + LB and external session state.

219
Q

Virtual private cloud (VPC)

A
  • A private network

- Isolated from other VPCs in your account in your region. Highly available, assuming you make subnets in multiple AZs.

220
Q

Standard SQS queue

A
  • At least once delivery
  • Best effort ordering
  • Scale to nearly infinite levels
221
Q

Symmetric encryption

A
  • The same key is used to encrypt and decrypt.

- Fast, but you need to worry about how to get the key to the other party.

222
Q

Encryption in transit

A

Data is encrypted before being sent to a server or sent from a server

223
Q

Serverless

A
  • Architecture where you manage little to no constantly running compute
  • Function as a service (FaaS), event-driven and third-party services are used to build a service
224
Q

What does CloudWatch Events do?

A
  • Takes an event source
  • Delivers to a target
  • Event-driven actions
225
Q

CLB -> ALB

A
  • Almost always cheaper
  • Multiple SSL per ALB
  • Content rules (DNS name/path)
  • More services as targets (Lambda, containers, etc.)
226
Q

ASG

A
  • Auto Scaling groups
  • Support elasticity
  • Use the what from templates/configs
  • Control the where/how
  • Min/Max/Desired/Subnets
  • Scaling policies: Simple/stepped/target tracking/scheduled
227
Q

Aurora

A
  • Enhancement of RDS MySQL/PostgreSQL
  • Cluster shared storage (no need to allocate upfront)
  • Replica (writer/reader) in as many AZs as you need
  • Reader = scaled reads
  • Much faster, all SSD vs. RDS
228
Q

Types of CMK

A
  • Customer Managed Key: Rotation and key policy
  • AWS Managed Key: Service default
  • AWS Owned Key: Not visible, cross-client functions
229
Q

FaaS

A
  • Function as a Service (e.g., Lambda)

- You provide a function; the vendor provides a runtime environment and everything else. Huge scalability, low cost.

230
Q

Security group

A
  • Stateful (one rule, allows return traffic)
  • Applied to ENIs (and thus instances)
  • Can’t explicitly DENY, only ALLOW
  • Default is to DENY
  • Can reference other SG, other objects, themselves, and IP/CIDR
231
Q

RDS

A
  • MySQL/PostgreSQL/MariaDB/Oracle/MSSQL
  • HA: Single-AZ or Multi-AZ — standby not usable
  • Read replicas can scale reads
  • Not cluster-based; each instance has own storage
232
Q

1 RCU

A
  • 1 operation of 4 KB max p/s strongly consistent

- 2 x eventual consistent

233
Q

What are the contents of an IAM trust policy?

A
  • Principal: The entity (or type of entities) that can assume the role
  • Effect: Allow or Deny
  • Action: STS:AssumeRole
234
Q

When to use reserved instances

A
  • Known usage patterns
  • Constant CPU
  • Unchanging
  • One to three years
  • Cost-conscious
  • Want to reserve capacity
235
Q

Permission priority

A
  1. Explicit Deny
  2. Explicit Allow
  3. Implicit Deny (Default)
236
Q

VPN vs. Direct Connect

A
  • VPN: Quick to set up, cheap, can be moved, supports cheaper non-BGP consumer hardware, uses internet data
  • Direct Connect: Longer to set up, lower latency, better consistency of latency, better performance
237
Q

IAM users

A
  • Identity
  • Can have policies
  • Can be in groups
  • Can be referenced via ARN
  • U & P, access keys
  • Can have MFA
  • NO TEMP CREDENTIALS
238
Q

S3 SSE-C

A
  • S3 handles encryption and decryption

- Customer supplies keys and plaintext data

239
Q

SaaS

A
  • Software as a Service (e.g., Netflix, O365, Spotify)

- An application, end to end, is provided.

240
Q

Dedicated hosts

A
  • EC2 hosts that are dedicated to you
  • Useful for restrictive licensing
  • Or security concerns/restrictions
241
Q

EBS optimized

A
  • Dedicated network path for storage
  • Independent of data networking
  • High speeds, less contention
242
Q

High availability vs. fault tolerance

A
  • HA: Allows systems to recover quickly after failures

- FT: Allows systems to operate through a failure with no user impact

243
Q

High availability

A
  • A system that can automatically and quickly recover from failure; designed to maximize availability.
  • ASG + LB
244
Q

Aurora Serverless

A
  • Serverless relational DB
  • Uses Aurora Capacity Units (ACUs)
  • Can scale all the way to zero, and spin up when data access needed (10–20 seconds)
  • Very good option for variable load relational DB
245
Q

VPN HA

A
  • At the AWS side, assuming two tunnels. Not at the customer side (one CGW).
  • Two VPN connections and two CGWs required for HA
246
Q

Bootstrap vs. AMI bake

A
  • Bootstrap: More customizable
  • AMI bake: Faster and immutable
  • If software takes 20 mins, and you need new instances up quicker, then AMI bake.
  • Can do a mixture
247
Q

Does VPC Flow Logs capture traffic contents?

A

No

248
Q

When to use spot instances

A
  • When you want the cheapest EC2 compute
  • When you can tolerate failure/restarts/interruptions
  • Great for ad-hoc scaling, worker pools, analysis with EMR
249
Q

1 WCU

A

= 1 operation of 1 KB max per second

250
Q

API and CLI login

A
  • Access keys

- Not username and password

251
Q

Routes and route tables

A
  • A route says, “for traffic to this destination, send it here”
  • A route table is a group of routes
  • Traffic matches a route
  • For multiple matches, the higher the prefix (/XX), the more priority the match
  • If equal prefix, static routes are preferred, then dynamically learned
  • Direct Connect is preferred over dynamic VPN
252
Q

What is DAX?

A
  • In-memory cache for DynamoDB reads
  • Microsecond response
  • Specifically designed for DDB
253
Q

What are the well-architected pillars?

A
  • Operational excellence
  • Security
  • Reliability
  • Performance efficiency
  • Cost optimization
254
Q

DynamoDB table performance

A
  • On-Demand: Per operation charge

- Provisioned: Charge per WCU and RCU

255
Q

Instance sizes

A
  • Governs memory, CPU, and general speed
  • nano
  • micro
  • small
  • medium
  • So on…
256
Q

CloudTrail event history

A
  • Default configuration

- 90-day history

257
Q

Billing models

A
  • On-Demand: Default, per second
  • Spot: Using AWS spare capacity, can be interrupted, ~80% discounts
  • Reserved: Pay upfront for discounted rate, good for known usage
258
Q

What is Storage Gateway?

A
  • Allows storage migration
  • Allows storage extension
  • Uses S3 as backing store
  • Public service: Public internet connection or DX public VIF
  • Tape gateway (VTL), file gateway, volume gateway
259
Q

What are IAM users for?

A

Identities: Human, application, service

260
Q

VPC gateway endpoint

A
  • Used for S3 and DynamoDB
  • Access to public endpoints for those services without IGW or NATGW
  • Uses prefix lists with the target of the endpoint
  • No DNS used
261
Q

CloudWatch

A
  • Monitoring and metrics for AWS services

- Custom things with agent, including on-premises

262
Q

What is a file gateway?

A
  • Storage Gateway
  • Shares via SMB (Windows sharing)
  • Files are stored as S3 objects
  • Capacity extension or back up to S3
263
Q

Glacier Deep Archive

A
  • Cold archive

- Hours retrieval time

264
Q

VPC endpoints

A
  • Provide secure access to public services in a VPC
    without needing IGW or NATGW
  • Used to highly secure private VPCs
265
Q

NAT instance

A
  • EC2 instance configured to perform NAT

- SRC/DST Check = off

266
Q

What is ElastiCache?

A
  • In-memory cache; key-value and simple data types
  • MemcacheD (simple, fast)
  • Redis (more fully featured, complex)
267
Q

Why are launch templates better than launch configurations?

A
  • New features (e.g., T3 unlimited, elastic GPU)
  • Versions
  • Inheritance
  • Can be used to manually launch instances

AWS Solutions Architect Associate (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions