Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Certified Solutions Architect - Learn Cantrill Course > SIMPLE STORAGE SERVICE (S3) > Flashcards

SIMPLE STORAGE SERVICE (S3) Flashcards

1
Q

Is S3 accessible to the public by default ?

A

No it’s private by default

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

S3 Bucket Policies

A

a form of resource policy that is attached to a bucket

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Identity Policy

A

control what that identity can Access

can only be attached to identities in your account

has to be attached to a valid identity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Resource Policy

A

controls who can access that resource

Allow/Deny same or different accounts

Allow/Deny anonymous principals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How can you tell the difference between a resource policy and Identity policy

A

if there is a principle component it’s a resource policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

If your trying to control different resources in the same account. Would you implement a resource policy or Identity policy ?

A

IAM Policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Would you use a IAM or Resource Policy if you

want one central place to control access

A

IAM Policies are the only single place in AWS you can control permissions for everything. you can use resource policies sometimes but you can use IAM policies all the time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What would you use to control

permissions within the same account

A

IAM policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What would you use to control the permissions

on one resource like S3

A

resource policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

When to use IAM vs Resource Policy:

Anonymous or cross-account

A

resource policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are ACLs ?

A

Access control list Amazon legacy service user before S3 bucket policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

When to use IAM vs Resource Policy:

How about ACLs?

A

never unless you must

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Explain Static Website Hosting in S3

A

Normal access is via AWS APIs

allows access via HTTP

Index and Error documents are set

Website endpoint is created

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Do bucket names matter when hosting a static site in S3?

A

yes if you have a custom domain via R53

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Pricing structure for S3 ?

A

storage per gb/monthly charge

data transfer in (Free)/out(not fee)

requests and data retrievals per/1,00 requests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How would you disable S3 versioning on an s3 bucket ?

A

you can’t once it’s been turn on the only way to stop is to suspend that bucket

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Object Versioning

A

versioning lets you store multiple versions of objects within a bucket.Operations which would modify objects generate a new version.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Delete Marker

A

special version of an object which hides all previous versions of that object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What does deleting the delete marker do ?

A

restores the deleted version to being active again

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Version Delete

A

you can delete an object by specifying the version. When deleting a current version the prev = current version

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

How can you reduce cost on a versioned bucket ?

A

space is consumed by all versions

you are billed for all versions

only way to cut cost to zero is to delete the bucket

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

MFA Delete

A

-can be enabled in versioning configuration

MFA is required to change bucket versioning state and delete versions

serial number(MFA) + code is passed with API calls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

S3 Performance optimization :

Single Put upload

A

single data stream to S3

stream fails- upload fails

requires full restart

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

S3 Performance optimization :

Multipart upload

A

Data is broken up

min data size 100MB for Multipart

10,00 max part, 5mb → 5gb

last part can be smaller than 5MB

parts can fail, an be restarted

25
Q

S3 Transfer Acceleration

A

normally there is no control of how data is routed in the public internet

TA users the network of AWS edge locations

this needs to be enabled in the S3 bucket

once enabled data transmits to the closest edge location which transmits through fewer networks

normal internet is like CT transit and AWS is like CT Express

26
Q

TA Naming restrictions for Buckets

A

can’t contain periods

has to be DNS compatible in it’s naming

27
Q

ciphertext

A

encrypted data

28
Q

Symmetric Encryption

A

the same key is used for encryption and decryption

transfer of the key has to be done in advance

good for local data

29
Q

Signing

A

Taking the senders private key and signing a document with it

the public key can then verify that the document was signed by it’s matching public key `

30
Q

stenography

A

allows you to embed data in another piece of data like a picture

31
Q

Key Management Service (KMS)

A

regional and public service

create,store,and manage keys

symmetric and asymmetric keys

can encrypt and decrypt data

Keys never leave KMS- provides FIPs 140-2(L2)

32
Q

Customer Master Keys (CMK)

A

contains : ID,data, policy, description and state

backed by physical key material

can be generated or imported

CMK can be user for up to 4KB of data

33
Q

Data Encryption Keys (DEKS)

A

encrypt data using plaintext key

plaintext key is discarded

stores encrypted key with data

KMS doesn’t perform the encryption of decryption with data larger than 4KB in size using data encryption keys you do or KMS does

34
Q

Can you use CMKs across region ?

A

CMKs are isolated to a region and never leave

35
Q

AWS managed Keys vs Customer managed CMKs?

A

customer managed keys are more configurable

36
Q

Aliases

A

shortcut to a CMK/per region

37
Q

S3 Encryption

A

Buckets aren’t encrypted objects are

38
Q

S3 Encryption:

Client side encryption

A

the data being uploaded are encrypted by the client before they leave meaning you control everything

39
Q

S3 Encryption:

Server side Encryption

A

the data being uploaded are only encrypted after they hit the S3 endpoint

40
Q

Server-side Encryption with customer -Provided Keys SSE-C

A

if key is provided during decryption the has can identify if the key was used during encryption or not

  • user still responsible for key management
  • Aws manages encryption and decryption
41
Q

Server-side Encryption wih Amazon s3-managed Keys SSE-S3

A

AWS handled keys, encryption and decryption

not good for regulatory environments where you need to control key access or role sepration

42
Q

What is the encryption type used with Server-side encryption with amazon s3-Managed keys?

A

SSE-S3(AES256) ≤=> encryption algorithm

43
Q

Server -Side encryption with customer Master Keys (CMK) stored in AWS key management service

A

you manage the keys ,rotation control

AWS manages the encryption/decryption and role seperation

44
Q

S3 Standard

A

best use for frequently accessed data which is important and non replaceable

99.999999999% (11 nines) durability means that if you store 10 million objects, then you expect to lose an object of your data every 10,000 years

replication over 3 AZ’s

billed a GB/ per month fee for data stored. A $ per GB charge for transfer out(in is free) and a price per 1,00 requests No specified retrieval fee, no minimum duration no minimum size

45
Q

S3 standard-IA

A

should be used for long lived data which is important but where access is infrequent

has a per Gb data retrieval fee has a minimum duration charge of 30 days

minimum

everything else the same as s3 standard

46
Q

S3 One Zone IA

A

should be used for long-lived data, which is non-critical and replaceable and where access infrequent

does not provide the multi-AZ resilience model only one AZ is used within the region

11 9s durability unless Az fails

47
Q

S3 Glacier

A

used for situation which you need to store archival data

first byte latency = minutes or hours

objects are consider cold and aren’t ready for use immediately

you pay for retrieval

they are stores in s3 standard infrequent access until they are access and then they are removed

40 kb minimum billable size

90 days minimum billable duration

48
Q

S3 Glacier deep Archive

A

used for Archival data that is really if ever needs to be access-hours or days for retrieval e.g legal or regulatory data storage

First byte latency = hours or days

40kb

180 day min duration

49
Q

S3 Select and Glacier Select

A

lets you use SQL-like statements to select part of the object, pre-filtered by s3

accepted file formats CSV, JSON, parquet, bzip2 compression for CSV and JSON

50
Q

S3 intelligent Tiering

A

Should be used for log-lived data with changing or unknown patterns

manages the object s3 storage class based on usage or how frequent data is accessed

30 day minimum duration no retrieval fees

monitoring and automation cost per 1,000 objects

51
Q

PreSigned URL

A

a way for you to give another person or application access to an object inside an s3 bucket using your credentials

52
Q

can you generate a pre-signed URL for an object you have no access to ?

A

yes but your url would also not have access

53
Q

Can a pre-signed Url be generated with a role?

A

yes but bad idea URL stop working when temporary credentials expire

54
Q

can you generated presigned url for an objects that don’t exist ?

A

yes lol

55
Q

S3 Event Notification

A

notifications generated when events occur in a bucket

can be delivered to SNS,SQS and Lambda function

notifications can be for object creation, delete, restore, and replication

56
Q

S3 Access Logs

A

provides detailed records for the requests that are made to a bucket. Server access logs are useful for many applications. For example, access log information can be useful in security and access audits.

57
Q

Who manages Access logs if enabled on a bucket ?

A

your responsible to the Lifecyle and deletion of log files

58
Q

What system manages S3 Access logs ?

A

s3 Log Delivery group

59
Q

How would you setup S3 Access Logging on a bucket?

A
  1. enable log on source bucket via console UI or Put bucket logging operation using the CLI or the API
  2. S3 Log Delivery Group reads the configuration within a few hours
  3. the S3 Log Delivery Group has to have access to the target bucket done by Bucket ACL

AWS Certified Solutions Architect - Learn Cantrill Course (20 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions