TD Exam 2 - Long review Flashcards
Why should classic load balancers be avoided
Each unique HTTPS name requires an individual CLB, so it does not scale
Which layer is ALB
Layer 7
Which protocols are supported by ALB
HTTP and HTTPS
What are some Layer 7 protocols not understood by ALB
SMTP, SSH, custom gaming protocols…
What are some listeners not supported by ALB
TCP, UDP, TLS
What load balancer should you use if you need to make decisions based on L7 content (cookies, custom header, user location, etc)
ALB
What is a security trade-off of ALB
SSL always terminates on ALB - No unbroken SSL chain
A new connection is made to the application
What is needed if ALB uses HTTPS
The ALB must have SSL cert(s)
Which is faster, ALB or NLB
NLB
What is an advantage of ALB with regards to Healthchecks
ALB evaluates app health at layer 7 (can make an app-layer request)
What can be used to direct connections in ALB
Rules
What can ALB rule conditions be based on
Host header
Http header
Http request method
Path pattern
Query string
Source IP
What are some actions ALB can do with rules
Forward
Redirect
Fixed response
Authenticate-oidc
Authenticate-cognito
What should you do if you need to forward connections to the instance without terminating it on load balancer
Use NLB
Which layer do NLBs work on
Layer 4
What protocols are supported by NLB
TCP, TLS, UDP, TCP_UDP
How much faster are NLBs compared to ALBs
Much faster (1/4 of latency)
What is a limitation of Healthchecks for NLB
Only checks ICMP / TCP handshakes
Which Load Balancer can have a static IP
NLB; ALB can with workarounds I think
What is a security advantage of NLB
They forward TCP to instances, the HTTPS encryption is unbroken
(With TCP listener)
Which Load Balancers can be used with Private Link
NLB
Can Lambda@Edge run inside a VPC
No
Which languages are supported by Lambda@Edge
Node and Python
Where would you place your Lambda@Edge to perform A/B testing
Viewer request
In CloudFront, how can you have a different version of an image depending on the customer without redirects or url changes
With a Lambda@Edge function on the viewer request
Change the url with the Lambda
How can you do a gradual S3 origin migration in CLoudFront
With Lambda@Edge on the origin request
How can you deliver different objects based on device in CLoudFront
Lambda@Edge Origin Request
How can you vary the content displayed by country in CloudFront
Lambda@Edge Origin Request
What are the units of distribution in CloudFront
Distributions
What are the price classes in CloudFront
Which edge locations to use
In CloudFront, where do you associate WAF
At a distribution level
In CloudFront, where do you specify an alternate domain name
In the distribution
In CloudFront, where do you specify TLS and certifications
At the distribution level
What are the protocols supported by DataSync
SMB and NFS
Where does DataSync run
As a VM onprem
What are some features of DataSync
Schedule, throttle, recover from failure
What are some destinations of DataSync
S3, EFS, FSx
When should you use DataSync
When you need reliable transfer of large amounts of data
What is redshift
A PB-scale data warehouse
What type of db is Redshift
OLAP (Column-based)
What is OLTP
Online Transaction Processing, row/transactions
What is OLAP
Online Analytical Processing (Column based)
What does Redshift allow with S3
Direct query to S3 using REdshift Spectrum
What does Redshift allow with other DBs
Direct query with federated query
What interface is supported by Readshift
SQL-like (JDBC/ODBC)
Is Redshift serverless
No
What should you use for ad-hoc queries of S3 objects
Athena
How are rules processed for NACLs
In order, lowest rule number first. Once match occurs, processing stops. * is an implicit deny if nothing else matches
What type of firewall are NACLs
Seubnet-level stateless firewall
Why do should NACLs be used in conjunction with SGs
To add explicit denys
How many NACLs can a subnet have
One
How many subnets can a NACL be associated with
Many
Are Security Groups stateless or stateful
Stateful
What is a major limitation of Security Groups
You cannot do specific deny (like block bad actor IPs)
What do SGs support
IP/CIDR and logical AWS ressources, including other SGs and itself
What are SGs attached to
To an Elastic Network Interface
What actually happens when you attach an SG to an instance
It is attached to it’s primary ENI
How can you use SGs to allow 2 instances to communicate
Reference each other’s SGs in it’s own SG rules
What do SG references apply to
Anything which has the SG attached
What are benefits of SG references
It scales well (new instances)
No need to handle changing IPs
What is an advantage of self-referencing SGs
Means intra-app communication is allowed if you have multiple instances running an app
What are the 3 important values associated to ASG
Minimum, Desired and Maximum
What is used to update ASGs based on metrics
Scaling policies
Where do auto-scaling groups run
On a VPC across one or more subnets
What are the 2 potential sources for instance config for ASG
Launch templates or launch configurations
What do Scaling Policies adjust
The desired capacity
What do ASGs define
Where instances are launched
What are the 3 types of scaling policies
Manual
Scheduled
Dynamic scalings
What are the 3 subtypes of dynamic scaling
Simple
Stepped scaling
Target tracking
What is a Cooldown Period in ASGs
Period to wait after a scaling event before another one can happen
What is an advantage of an ASG using an ALB Healthcheck rather than EC2 status check
Can monitor state of HTTP/HTTPS requests
Why is RDS Proxy needed
Prevent constant open/closing of DB connections (like with Lambda)
Helps with handling db failure
Where does RDS Proxy run
In a VPC (Across all AZs)
Is RDS Proxy managed
Yes
What is behind RDS Proxy
Long-term connection pool
What does RDS Proxy do in practice
Makes connections much faster than connecting directly to db
Connections to RDS from proxy can be reused
Multiplexing
What happens with RDS Proxy if db is unresponsive
It waits, the connection between client and RDS proxy is established anyways
Can RDS Proxy be used with Aurora
Yes
Where is an RDS Proxy accessible from
Only from a VPC
When using RDS Proxy, do you need to change your app
No, the app sees it as a normal db endpoint
Can RDS enforce SSL/TLS
Yes
What are some characteristics of API Gateway
HA, Scalable, handles authorization, throttling, caching, transformations, openapi spec, direct integration
Can API Gateway connect to onprem service
Yes
What APIs are supported by API Gateway
HTTP, REST and WebSocket
What are the endpoint types for API Gateway
Edge Optimized
Regional
Private (only accessed within a VPC)