Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS SAA-C03_2024-1204 > TD Exam 1 > Flashcards

TD Exam 1 Flashcards

1
Q

What are the four reasons to use CLoudHsm

A
  • Have keys that are explicitly required to be protected in single-tenant HSM
  • Keys that need to be stored in an HSM that is compliant with FIPS 140-2 Level 3
  • Need ability to immediately remove key material from aws KMW and prove you have done so by independent means
  • Requirement to be able to audit all use of keys independently of KMS and CloudTrail
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What should you use if you need to comply to FIPS 140-2 Level3?

A

Use CloudHSM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What should you use if you need the ability to remove immediately key material from KMS

A

CloudHSM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What should you use if you need to be able to audit key usage independently from KMS and CloudTrail

A

CloudHSM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What should you do if you have an Amazon Aurora db for which the read replica struggles to keep up with increasing read traffic

A

Use Aurora Auto Scaling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the difference between Canary deployment and Blue/Green?

A

Canary starts with a small subset of nodes/servers while Blue/Green is half/half of env

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which is more complex with API Gateway: Canary deployment or Blue/Green

A

Blue/Green is more complex since you need to configure a new Environment. Canary is very simple to do with API Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are some services with which AWS WAF is tightly integrated?

A

Cloudfront, ALB, API Gateway, AWS AppSync

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Where do AWS WAF rules run if you configured them for CloudFront

A

Edge location

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What should you do if you have a large number of illegitimate requests from constantly changing IPs

A

Rate-based rule in AWS WAF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What should you use if you need a POSIX-compliant filesystem

A

EFS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Why would using many instances acccessing EBS be slow

A

Does not allow parallel access (or do up to provisioned capacity for aggregate)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a limitation of attaching an EBS volume to multiple EC2 instances

A

They have to be in the same AZ

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is best for file storage: EFS or S3

A

EFS, S3 is object storage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are advantages of EFS

A

POSIX-Compliant
HA
Scalable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What should be a first choice when Schema Change is mentioned

A

DynamoDB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is Amazon Redshift used for mostly

A

Online Analytical Processing (OLAP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is Amazon Redshift

A

A Cloud-based data warehouse service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What should you do to prevent accidental deletion of S3 objects

A

Enable versioning\Enable MFA Delete

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

When is Web Identity Federation used

A

To let users sign in using a well-known external idp

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What can be used to allow devs to log into AWS with onprem AD

A

SAML 2.0 Federation by using Microsoft AD Federation Service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the default termination policy algorithm for an auto-scaling group

A

1) Pick AZ with most instances and at least one instance not protected from scaling. If multiple, pick the one with instances that use the oldest template
2) Pick unprotected instance with the oldest launch template
3) If many based on above criteria, pick the one closest to the next billing hour
4) If many based on above criteria, pick one at random

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

How can you protect Lambda/API Gateway based system from traffic surges

A

Enable throttling limits and result caching in API Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are the 2 levels you can set API Gateway throttling

A

Global and by service call

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What are the 2 types of throttling you can set for API Gateway

A

Standard rates and burst

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is the response given by API Gateway if you go over the throttling limit

A

429

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Can you set a cache for API Gateway

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Which AWS DB service can fulfill a requirement of Recovery Point Objective of 1 second and a Recovery Time Objective of less than 1 minute in case of multi-region failure?

A

Aurora Global Databse

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is Recovery Point Objective

A

Maximum of data (in terms of time) loss that is acceptable in case of failure (so time since last backup)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is Recovery Time Objective

A

The amount of time the system can be down

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is Amazon Aurora Global Database

A

It allows a single Aurora DB to span multiple AWS regions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What are some advantages of Aurora Global Database

A
  • It replicates data with no impact of performance
  • It enables fast local reads with low latency in each region
  • It provides disaster recovery from region-wide outages
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is the latency of the storage-based replication in Aurora Global Database?

A

Less than one second

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

How long does it take to promote a read replica to read/write in Amazon Aurora Global Database?

A

Less than one minute

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is Amazon Quantum Ledger Database

A

A ledger database (not relational), fully-managed, transparent, immutable and cryptographically verifiable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is a difference between Multi-AZ RDS database with cross-region read replicas and Aurora Global Database

A

Multi-AZ is only applicable inside a single region
Also, no RPO of 1s and RTO of 1 min
Also cross-region RDS replication is less fast than Aurora

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is Amazon Timestream

A

A Serverless time series database service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What should you do to migrate Microsoft SharePoint server to have something HA and that can be integrated with AD for acess control and auth

A

Create file system using Amazon FSx for Windows File Server and join it to an AD domain in AWS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What protocol is used to access files from Amazon FSx for Windows File Server

A

Service Message Block (SMB)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What OS instances can access Amazon FSx

A

Windows, Linux and MaxOS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Can multiple devices access FSx concurrently

A

Yes, thousands

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What are some characteristics of Amazon FSx Windows File Server

A

Fully managed
Highly reliable
Scalable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

How can you change the config of AD for a FSx file system

A

You can’t, you have to create a new file system from a backup and change the AD config there.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What OS is supported by EFS

A

Linux only , not windows

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What is NFS (Network File System) mostly used with

A

Linux systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

How do you secure an ElastiCache cluster with Redis to require other devs to enter a password before being able to enter Redis commands

A

Authenticate the users using Redis AUTH by creating a new Redis Cluster with both the –transit-encryption-enabled and –auth-token parameters enabled

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

How do you do synchronous data replication for RDS

A

RDS DB instance running as a Multi-AZ deployment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What is the difference between RDS Multi-AZ Deployment and Read Replicas in terms of replication

A

Multi-AZ: Synchronous - highly durable
Read Replica: Asynchronous replication - highly scalable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What is the difference between RDS Multi-AZ Deployment and Read Replicas in terms of which instance can be accessed

A

Multi-AZ: Only db engine on primary instance is active
Read Replica: All read replicas are accessible and can be used for read scaling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What is the difference between RDS Multi-AZ Deployment and Read Replicas in terms of backups

A

Multi-AZ: Automated backups are taken from standby
Read Replica: No backups configured by default

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What is the difference between RDS Multi-AZ Deployment and Read Replicas in terms of AZ

A

Multi-AZ: Always spans 2 AZs within a single region
Read Replica: Can be within an AZ, cross-AZ or cross-region

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What is the difference between RDS Multi-AZ Deployment and Read Replicas in terms of db upgrades

A

Multi-AZ: Db engine version upgrade happens on primary
Read Replica: Db engine version upgrade is independent from source instance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What is the difference between RDS Multi-AZ Deployment and Read Replicas in terms of failover

A

Multi-AZ: Automatic failover to standby when a problem is detectedy
Read Replica: Can be manually promoted to a standalone database instance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What is a NAT Gateway

A

HA, managed NAT service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What is a NAT Gateway used for

A

Is is created in a public subnet to enable instances in a private subnet to connect to the internet, but prevent the internet from initiating connections to them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What does Elastic Beanstalk provide

A

You upload it and then it automatically handles capacity provisioning, load balancing, scaling and application health monitoring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

How can you use SFTP to upload files to S3

A

Use AWS Transfer for SFTP endpoint

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What are the 2 types of actions you can define in S3 Lifecycle

A

Transition actions
Expiration actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What can you do with EFS Lifecycle management

A

Transition files in and out of Infrequent Access tier

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What is a characteristic of an API Gateway-generated SDK

A

If it gets 429 because of throttling, it will retry the call automatically

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

What can you do to get all compliance-related documents

A

Use AWS Artifact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Do you need special permissions to use AWS Artifact

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

What is Amazon Inspector used for

A

To detect vulnerabilities in AWS workloads.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

What is AWS Security Hub

A

It provides you a comprehensive view of your high-priority security alerts and security posture across your AWS accounts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

How do you secure access to RDS from an app running on EC2

A

Enable IAM DB Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

With what does IAM DB Authentication work in RDS

A

MySQL and PostgreSQL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

What is the lifetime of an auth token for RDS

A

15 minutes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

What are some benefits of IAM DB auth

A

Traffic encrypted with SSL
Can use IAM to centrally manage access
Can use profile credentials of EC2 instance instead of password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

What are the metrics from EC2 not available by default to cloudWatch

A

Memory utilization
Disk swap utilisation
Disk space utilization
Page file utilization
Log collection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

What metrics are available for EC2 by default in CLoudWatch

A

CPU Utilization
Network utilization
Disk performance
Disk Read/Write

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

What do you do to gain access to unavailable EC2 metrics in cloudwatch

A

Install a CloudWatch Agemt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

Can you use a CloudWatch agent elsewhere than EC2

A

Yes, onprem servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

What OS are supported by CloudWatch agent

A

Windows and Linux

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

What is Enhanced Monitoring for

A

RDS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

What is Amazon Kinesis

A

A massively scalable and durable real-time data streaming service

76
Q

What is Amazon Redshift

A

A Data warehousing solution build on a relational database model

77
Q

How do you restrict access to an S3 bucket from a VPC only

A

S3 Access Point

78
Q

Can you do a multi-region S3 access point

79
Q

What is a characteristic of requests made to a Multi-region S3 endpoint

A

They use the global accelerator

80
Q

Can you integrate S3 with a firewall

A

No, not directly

81
Q

What is a requirement for Object Lock

A

Versioning. You cannot disable it when you have object lock on

82
Q

How do you prevent accidental deletion of s3 files

A

Enable S3 versioning and MFA Delete on the bucket

83
Q

What do you need to create to use step and simple scaling policies

A

CloudWatch alarms

84
Q

What is a difference between simple and step scaling

A

Simple scaling has a cooldown

85
Q

What is a way of preventing SQL injection attacks

A

WAF with a managed rule

86
Q

When are messages removed from an SQS queue

A

When they are explicitly deleted

87
Q

Is there polling in SNS

A

No, it is for SQS

88
Q

What is Amazon EventBridge (Amazon CloudWatch Events)

A

It is a serverless event bus

89
Q

What is the difference between compliance mode and governance mode?

A

Governance can be overwritten

90
Q

What is legal hold

A

It prevents objects from being deleted until it is removed

91
Q

What is retention period in compliance mode

A

It completely prevents deletion until the delay has passed

92
Q

Does legal hold expire

A

No, it is disabled manually by someone with the proper permission

93
Q

What should you do to prevent losing access to RDS db in case of AZ failure

A

Enable Multi-AZ failover

94
Q

Why not use a read replica to prevent losing access to RDS db in case of AZ failure

A

This is meant to enhance performance for read-heavy workload. You can promote it, but it has asynchronous replication so you might not get the latest version of the db

95
Q

What EC2 scaling policy should you use when you have regular, predictable traffic?

A

Scheduled policy

96
Q

What is the most appropriate service to handle large bursts of traffic within seconds

97
Q

What does S3 Acelerated Transfer do

A

It can speed up data transfer over long distances to S3 by 50%-500%

98
Q

What is MultiPart Upload

A

It allows you to upload an object as multiple parts

99
Q

What is DynamoDB Streams

A

It is an ordered flow of information about changes to items in a DynamoDB Table

100
Q

How should you implement something that triggers a Lambda every time an object is modified in DynamoDB

A

Use DynamoDB Stream

101
Q

What does DynamoDB Accelerator do

A

It significantly improves the in-memory performance of the database

102
Q

What is an endpoint in Amazon Aurora

A

It is an intermediate used to connect to Aurora instances. It makes it so you don’t have to hard-code host names and handle load-balancing

103
Q

What can Aurora Replicas handle

104
Q

What is the maximum number of Aurora Replicas

105
Q

What can you configure with custom Aurora endpoints

A

Connections to specific instances or subsets of instances

106
Q

What do Aurora custom endpoints provide

A

Load-balanced DB connexions based on other criteria than read-only and read-write capability

107
Q

What is a clusterEndpoint in Aurora

A

It connects to primary instance, aka writer endpoint

108
Q

How do you allow private communication with S3 or Dynamodb

A

Use VPC endpoints

109
Q

What do VPC endpoints do

A

They allow you to connect your VPC to supported services without needing all the infrastructure required to connect to the public internet.

110
Q

What does Transit Gateway do

A

It connects your VPC to onprem network through a central hub. It acts as a cloud router that allows you to integrate multiple networks

111
Q

What does AWS Direct Connect do

A

It establishes a direct connection between onprem network and AWS

112
Q

What does VPN CloudHub do

A

It is used to create secure communication with remote sites

113
Q

What is etcd

A

A distributed key-value store used by kubernetes to hold secrets

114
Q

Where are EKS secrets kept

A

They are persisted in etcd as base64 encoded strings with etcd nodes using EBS volumes encrypted with EBS encryption

115
Q

What are external secrets provider you can use for EKS

A

AWS Secrets Manager or Hashicorp Vault

116
Q

Is secret encryption with KMS enough to ensure data is encrypted in EKS etcd store?

A

No, it only adds encryption at rest

117
Q

How do you prevent other devs from accessing Lambda secrets

A

Create new KMS key and use it with encryption helpers

118
Q

Does Lambda encrypt secrets with KMS by default

A

Yes, but it uses a default service key and people that have access to lambda have access to it

119
Q

What is AWS Lake Formation

A

A service that makes it easy to set up a secure data lake

120
Q

What is used as the storage layer for Lake Formation

121
Q

Can Lake Formation allow you to set up permissions to access data

122
Q

What is Kinesis Firehose

A

A Fully-Managed service used to load data for data lakes, data stores and archival services

123
Q

How do you implement events from db events in Aurora

A

With a native function or stored procedure

124
Q

What information is provided by RDS events

A

Only operational events, like db instance events

125
Q

What are the 2 services that allow you to move files to different storage class

A

S3 and EFS

126
Q

What are lmitations of EFS lifecycle policies

A

It can only move a file to IA up to after 90 days

127
Q

What is the speed of S3 Glacier expedited retrieval?

A

1-5 minutes

128
Q

What is AWS Glue

A

ETL Service

129
Q

What is a key advantage of AWS Glue

A

Automatic Schema Discovery and mapping

130
Q

What are examples of sources supported by AWS Glue

A

S3, RDS, Redshift

131
Q

What are limitations when using lambda to do file conversions

A

It has a maximum execution time, so large files may result in time out

132
Q

How can you make AWS Glue be triggered by the upload of a file in S3

A

By using SQS

133
Q

What are some metrics you need a CloudWatch Agent for

A
  • Memory Utilization
  • Disk swap utilization
  • Disk space utilization
  • Page file utilization
  • Log collection
134
Q

What metrics are available in CloudWatch by default (without an agent)

A

CPU Utilization
Network utilization
Disk performance
Disk Read/Write

135
Q

What are the 3 destinations available for S3 notification

A

SNS topic
SQS queue
Lambda

136
Q

What do you do if you want to send a message from S3 notification to multiple places

A

Use SNS fanout with multiple SQS queues subscribed to the topic

137
Q

What are possible fanout destinations for SNS

A

SQS, http endpoints and Lambda functions

138
Q

How many destinations can S3 event notification deliver to

A

One only, and message is delivered at least onceC

139
Q

Can you poll SNS

140
Q

To what can you assign IAM roles in an AD

A

To users and groups

141
Q

What is used to integrate a corporate AD with AWS

A

AD Connector

142
Q

What is HTTP 504

A

Gateway timeout

143
Q

What does cloudfront origin failover do

A

Makes CloudFront automatically switch to secondary origin when primary fails

144
Q

What is an egress-only internet gateway

A

MUST be used with IPv6
Horizontally scaled, redundant, HA

145
Q

What is AWS Network Firewall

A

A stateful firewall

146
Q

What is AWS PrivateLink

A

Allows your VPC to connect to public AWS Services without going through the public internet

147
Q

What is a dynamodb partition key

A

It is a simple primary key, composed of one attribute known as the partition key

148
Q

What are the 2 options for primary key in dynamodb

A

Partition key
Partition key and sort key

149
Q

In DynamoDB, what is a Local Secondary Index

A

It allows you to create a view using a different sort key

150
Q

In DynamoDB, what is a Global Secondary Index

A

It allows you to create a view using a different partition key and sort key

151
Q

What is Amazon FSx for Windows File Server

A

It provides fully-managed Microsoft Windows File servers

152
Q

What protocol is used to access File Share

153
Q

What should you use when you need SMB

A

Amazon FSx for Windows File Server

154
Q

What is AWS Resource Access Manager

A

A service that enables you to easily and securely share AWS resources with any AWS account or within your AWS Organization

155
Q

What can you share with AWS RAM

A

AWS Transit Gateways, Subnets, AWS License Manager configurations and Amazon route 53 Resolver rules resources

156
Q

What are the steps to share resources using RAM

A

Create a Resource Share
Specify resources
Specify accounts

157
Q

Why should you not use IAM to set up cross-account access in an orgnaization

A

IT is tedious and has a lot of operational overhead

158
Q

Can AWS Control Tower be used to share access to resources

A

Maybe, but it is not the most suitable

159
Q

What should you to to monitor percentage CPU bandwidth and total memory consumed for each process/thread in RDS

A

Use RDS Enhanced Monitoring

160
Q

Where are RDS Enhanced Monitoring logs

A

In CloudWatch

161
Q

Where does RDS Enhanced Monitoring gather it’s information

A

From an agent on the instance

162
Q

For RDS, where does CLoudWatch get the metrics about CPU Utilization

A

From the hypervisor for a DB instance

163
Q

What are the 2 options for client-side encryption

A

Use KMS-managed customer master key
Use a client-side master key

164
Q

What does RDS Multi-AZ Deployment do

A

IT creates a standby instance in a different AZ to which the primary instance synchronously replicates data
In case of failure, automatic failover

165
Q

When should Aurora Single-insance be used

A

For non-critical applications or environment (dev or testing)

166
Q

What needs to be done to use company AD for everyone to have their own S3 bucket

A

Set up a Federation proxy or identity provider
Set up AWS Security Token Service to generate temporary tokens
Configure an IAM role and an IAM policy to access the bucket

167
Q

What is Amazon Macie

A

It scans data in S3 to check for PII, uses ML

168
Q

What is Amazon Polly

A

Text to speech

169
Q

What is Kendra

A

Enterprise search service

170
Q

What protocols are supported by File-mode Storage Gateway

A

NFS and SMB

171
Q

What storage service should be used for high-performance workloads

A

FSx for Lustre

172
Q

Where does cold data go in FSx for Lustre

173
Q

What OS is supported for FSx for Lustre

A

Linux (POSIX-compliant)

174
Q

What is a security group

A

A virtual firewall for your instance to control inbound and outbound traffic
Stateful

175
Q

What is the port and protocol for SSH

A

TCP and port 22

176
Q

If your app needs to be HA, and needs 2 instances minimum, how many instances will you need in 2 AZ?

A

2 in each, so 4 minimum

177
Q

How do you limit access to files in CloudFront to certain users if you can’t modify the url?

A

Use signed cookies
Also, it is recommended to require accessing content using CF urls to prevent bypass

178
Q

Are signed cookies (CloudFront) supported for RTMP distribution

179
Q

What should you use in cloudfront if you want to restrict access to individual files

A

Signed urls

180
Q

What are the 3 cases where you should use a signed url to restrict access in CloudFront

A
  • Use RTMP distribution
  • Restrict access to individual files
  • Users are using a client that does not support cookies
181
Q

What are the 2 cases where you should use signed cookies to restrict access in CloudFront

A
  • Want to provide access to multiple restricted files
  • Don’t want to change current URLs
182
Q

What is used to protect against DDoS attacks

A

AWS Shield Advanced

183
Q

What are some ressources that can be protected by AWS Shield

A

EC2, ELB, CloudFront, R53 resources

184
Q

What are some functionalities of base Amazon Shield

A

Network and transport layer protections

185
Q

What are some features of AWS Shield Advanced

A

Additional detection and mitigation against large and sophisticated DDoS attacks
Near RT visibility into attackd
Integration with AWS WAF
24x7 access to AWS DDoS Response Team
Protection from DDoS-related spikes in charges for supported services

AWS SAA-C03_2024-1204 (18 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions