TD Exam 2 - Long review Flashcards

1
Q

Why should classic load balancers be avoided

A

Each unique HTTPS name requires an individual CLB, so it does not scale

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which layer is ALB

A

Layer 7

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which protocols are supported by ALB

A

HTTP and HTTPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are some Layer 7 protocols not understood by ALB

A

SMTP, SSH, custom gaming protocols…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are some listeners not supported by ALB

A

TCP, UDP, TLS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What load balancer should you use if you need to make decisions based on L7 content (cookies, custom header, user location, etc)

A

ALB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a security trade-off of ALB

A

SSL always terminates on ALB - No unbroken SSL chain
A new connection is made to the application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is needed if ALB uses HTTPS

A

The ALB must have SSL cert(s)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which is faster, ALB or NLB

A

NLB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is an advantage of ALB with regards to Healthchecks

A

ALB evaluates app health at layer 7 (can make an app-layer request)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What can be used to direct connections in ALB

A

Rules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What can ALB rule conditions be based on

A

Host header
Http header
Http request method
Path pattern
Query string
Source IP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are some actions ALB can do with rules

A

Forward
Redirect
Fixed response
Authenticate-oidc
Authenticate-cognito

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What should you do if you need to forward connections to the instance without terminating it on load balancer

A

Use NLB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which layer do NLBs work on

A

Layer 4

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What protocols are supported by NLB

A

TCP, TLS, UDP, TCP_UDP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How much faster are NLBs compared to ALBs

A

Much faster (1/4 of latency)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is a limitation of Healthchecks for NLB

A

Only checks ICMP / TCP handshakes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which Load Balancer can have a static IP

A

NLB; ALB can with workarounds I think

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is a security advantage of NLB

A

They forward TCP to instances, the HTTPS encryption is unbroken
(With TCP listener)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which Load Balancers can be used with Private Link

A

NLB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Can Lambda@Edge run inside a VPC

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Which languages are supported by Lambda@Edge

A

Node and Python

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Where would you place your Lambda@Edge to perform A/B testing

A

Viewer request

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

In CloudFront, how can you have a different version of an image depending on the customer without redirects or url changes

A

With a Lambda@Edge function on the viewer request
Change the url with the Lambda

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

How can you do a gradual S3 origin migration in CLoudFront

A

With Lambda@Edge on the origin request

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

How can you deliver different objects based on device in CLoudFront

A

Lambda@Edge Origin Request

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

How can you vary the content displayed by country in CloudFront

A

Lambda@Edge Origin Request

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What are the units of distribution in CloudFront

A

Distributions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What are the price classes in CloudFront

A

Which edge locations to use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

In CloudFront, where do you associate WAF

A

At a distribution level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

In CloudFront, where do you specify an alternate domain name

A

In the distribution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

In CloudFront, where do you specify TLS and certifications

A

At the distribution level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What are the protocols supported by DataSync

A

SMB and NFS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Where does DataSync run

A

As a VM onprem

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What are some features of DataSync

A

Schedule, throttle, recover from failure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What are some destinations of DataSync

A

S3, EFS, FSx

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

When should you use DataSync

A

When you need reliable transfer of large amounts of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is redshift

A

A PB-scale data warehouse

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What type of db is Redshift

A

OLAP (Column-based)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What is OLTP

A

Online Transaction Processing, row/transactions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is OLAP

A

Online Analytical Processing (Column based)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What does Redshift allow with S3

A

Direct query to S3 using REdshift Spectrum

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What does Redshift allow with other DBs

A

Direct query with federated query

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What interface is supported by Readshift

A

SQL-like (JDBC/ODBC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Is Redshift serverless

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What should you use for ad-hoc queries of S3 objects

A

Athena

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

How are rules processed for NACLs

A

In order, lowest rule number first. Once match occurs, processing stops. * is an implicit deny if nothing else matches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What type of firewall are NACLs

A

Seubnet-level stateless firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Why do should NACLs be used in conjunction with SGs

A

To add explicit denys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

How many NACLs can a subnet have

A

One

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

How many subnets can a NACL be associated with

A

Many

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Are Security Groups stateless or stateful

A

Stateful

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What is a major limitation of Security Groups

A

You cannot do specific deny (like block bad actor IPs)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What do SGs support

A

IP/CIDR and logical AWS ressources, including other SGs and itself

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What are SGs attached to

A

To an Elastic Network Interface

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What actually happens when you attach an SG to an instance

A

It is attached to it’s primary ENI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

How can you use SGs to allow 2 instances to communicate

A

Reference each other’s SGs in it’s own SG rules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What do SG references apply to

A

Anything which has the SG attached

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What are benefits of SG references

A

It scales well (new instances)
No need to handle changing IPs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

What is an advantage of self-referencing SGs

A

Means intra-app communication is allowed if you have multiple instances running an app

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

What are the 3 important values associated to ASG

A

Minimum, Desired and Maximum

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

What is used to update ASGs based on metrics

A

Scaling policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Where do auto-scaling groups run

A

On a VPC across one or more subnets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

What are the 2 potential sources for instance config for ASG

A

Launch templates or launch configurations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

What do Scaling Policies adjust

A

The desired capacity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

What do ASGs define

A

Where instances are launched

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

What are the 3 types of scaling policies

A

Manual
Scheduled
Dynamic scalings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

What are the 3 subtypes of dynamic scaling

A

Simple
Stepped scaling
Target tracking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

What is a Cooldown Period in ASGs

A

Period to wait after a scaling event before another one can happen

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

What is an advantage of an ASG using an ALB Healthcheck rather than EC2 status check

A

Can monitor state of HTTP/HTTPS requests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

Why is RDS Proxy needed

A

Prevent constant open/closing of DB connections (like with Lambda)
Helps with handling db failure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

Where does RDS Proxy run

A

In a VPC (Across all AZs)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

Is RDS Proxy managed

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

What is behind RDS Proxy

A

Long-term connection pool

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

What does RDS Proxy do in practice

A

Makes connections much faster than connecting directly to db
Connections to RDS from proxy can be reused
Multiplexing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

What happens with RDS Proxy if db is unresponsive

A

It waits, the connection between client and RDS proxy is established anyways

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

Can RDS Proxy be used with Aurora

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

Where is an RDS Proxy accessible from

A

Only from a VPC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

When using RDS Proxy, do you need to change your app

A

No, the app sees it as a normal db endpoint

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

Can RDS enforce SSL/TLS

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

What are some characteristics of API Gateway

A

HA, Scalable, handles authorization, throttling, caching, transformations, openapi spec, direct integration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

Can API Gateway connect to onprem service

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

What APIs are supported by API Gateway

A

HTTP, REST and WebSocket

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

What are the endpoint types for API Gateway

A

Edge Optimized
Regional
Private (only accessed within a VPC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

Does API Gateway support stages

A

Yes

87
Q

Where do you enable canary for API Gateway

A

It is on a specific stage

88
Q

What does API Gateway give when the throtting limit is reached

A

429

89
Q

What does a 502 from API Gateway mean

A

Bad Gateway exception - the lambda is returning something invalid

90
Q

What is the timeout for API Gateway

A

29s

91
Q

What do you get when you go beyond the timeout for API Gateway

A

504

92
Q

What does 503 mean from API Gateway

A

Backing endpoint is offline; Major service issue

93
Q

What is AWS Config used for

A

Record configuration changes over time on resources
Auditing of changes, compliance with standards

94
Q

Does AWS Config prevent changes happening

A

No

95
Q

What type of service is AWS Config

A

Regional service

96
Q

What can AWS Config be integrated with

A

SNS
EventBridge & Lambda

97
Q

Where does AWS Config store it’s data

A

S3

98
Q

What does AWS Inspector do

A

It scans EC2 instances and its OS (also containers) for vulnerabilities and deviations against best practices

99
Q

What does AWS Inspector output

A

A report of findings ordered by priority

100
Q

Does Inspector need an agent

A

Not for Network assessment, but for network and host assessment yes

101
Q

Can Inspector check CVEs

A

Yes

102
Q

What do you use to check for CVEs and CIS of EC2

A

Inspector

103
Q

What does GuardDuty do

A

It is a continues security monitoring service
Analyses supported data sources
Uses AI
Identifies unexpected and unauthorised activity

104
Q

What does synchronous data replication

A

RDS Multi-AZ Instance mode

105
Q

How do you access the primary db instance in RDS multi-AZ

A

With the database CNAME (DNS record)

106
Q

What can happen from the standby in RDS Multi-AZ

A

Backups & snapshots (to S3)

107
Q

Do reads occur in the secondary instance in instance-mode multi-AZ RDS

A

no

108
Q

How long does the failover take in RDS multi-AZ

A

60-120 seconds

109
Q

What happens during failover for RDS multi-az instance mode

A

DNS CNAME changes to point to secondary

110
Q

How can you reduce failover time for RDS multi-AZ instance mode

A

Remove DNS caching in app for the dns name

111
Q

How many standby replicas can you have in multi-az instance mode rds

A

Only one

112
Q

What are differences between multi-az RDS cluster mode and Aurora

A

You can have more than 2 readers in Aurora
Instances have separate local storage in cluster mode

113
Q

What is RDS multi-AZ cluster mode

A

One write, many readers, still synchronous replication

114
Q

How many instances can you have in RDS multi-AZ cluster mode

A

2 readers and one writer

115
Q

What are differences between RDS multi-AZ instance and cluster mode

A

You can use reader instances in cluster mode, and you can have 2

116
Q

Do you need to change app code to take advantage of RDS multi az cluster mode

A

Yes, to handle the fact that there are read-only instances

117
Q

In RDS multi-AZ cluster mode, when is data seen as committed

A

When 1+ read finishes writing

118
Q

In RDS multi-AZ Cluster mode, where does the cluster endpoint point

A

To the writer

119
Q

In RDS multi-AZ Cluster mode, what is the cluster endpoint point used for

A

Read, Writes and admin

120
Q

What does a reader endpoint do in RDS multi-az cluster mode

A

Directs reads to an available reader (can include writer)

121
Q

What are instance endpoints in RDS ulti-AZ cluster mode

A

They point at specific instances, used for testing and fault finding

122
Q

What is the failover in RDS cluster mode multi-AZ

A

35s

123
Q

What is Amazon Database Migration Service

A

A managed database migration service

124
Q

What does DMS use

A

A Replication instance running on ec2

125
Q

What are the 3 modes you can run DMS jobs

A

Full load (transfer everything)
CDC (Change data capture)
Or both

126
Q

What is a use case for CDC mode of DMS job

A

If you’re using another service to transfer the bulk of the data

127
Q

How can you do schema conversion with DMS

A

Using Schema Conversion Tool

128
Q

When is Schema Conversion Tool Used

A

When converting from one db type to another

129
Q

What should you do about DMS when having a large amount of Data

A

You can use Snowball
Use SCT locally to write to snowball
Load data from snowball into s3, then from s3 to target db
Then do CDC

130
Q

What does AWS Control Tower do

A

Enables Quick and easy setup of multi-account env

131
Q

What is the difference between Control Tower and AWS Organizations

A

Control Tower uses other AWS services, including orgnizations

132
Q

What is a Control Tower Landing Zone

A

It is the multi-account environment

133
Q

What are some features of Landing Zone

A

SSO/ID Federation, Centralised Logging and Auditing

134
Q

What is Landing Zone Guard Rails

A

It is used to detect/mandate rules/standards across all accounts

135
Q

What is Landing Zone Account Factory

A

It Automates and Standardises new account creation

136
Q

Where do you create a Control Tower Landing zone

A

From an account that becomes the management account

137
Q

What provides the SSO for aws

A

IAM Identity center

138
Q

What are some AWS services used by Control Tower

A

AWS Organizations, AWS Config, CloudFormation

139
Q

What are the 3 types of Control Tower Guard rails

A

Mandatory, Strongly recommended or elective

140
Q

What are Control Tower preventive Guard rails

A

They stop you from doing things, they use AWS ORG Service Control Policy

141
Q

What are Control Tower detective guard rails

A

They do compliance checks using AWS Config

142
Q

What are the 2 types of identities in AWS

A

IAM User and IAM Role

143
Q

What is the number limit of IAM Users

A

5000

144
Q

What are the 2 types of policies associated with a role

A

Trust policy and Permissions policy

145
Q

What is a roleTrust Policy

A

Who can assume the role

146
Q

What generates temporary credentials

A

Security Token Service

147
Q

Where do you specify the role of an ECS task

A

in the task definition, in the taskRoleArn section

148
Q

What is Kinesis Firehose

A

Fully managed service to load data for data lakes, data stores and analytics service
Fully serverless

149
Q

Is FireHose Real-Time

A

Near-Real-Time (60s)

150
Q

What are the valid destinations for Kinesis Firehose

A

HTTP endpoints
splunk
Redshift
ElasticSearch
Destination bucket

151
Q

Are Kinesis streams real-time

A

Yes, 200 ms

152
Q

How many master accounts can an organization have

A

One

153
Q

Can organizations pool service usage to get discounts

A

Yes

154
Q

What are Service Control Policies

A

They are account permissions boundaries

155
Q

What can SCPs be attached to

A

It can be attached to accounts, OUs or the whole organization

156
Q

Can all accounts be affected by SCPs

A

No, the management account ignores SCPs

157
Q

Can SCPs affect root users

A

Yes, the SCP restricts the whole account

158
Q

Do SCPs grant permissions

A

No

159
Q

What do SCPs do

A

They limit permissions that can be assigned

160
Q

How many VPCs are involved in VPC peering

A

2

161
Q

Can you do VPC peering with 3 VPCs

A

No

162
Q

What is VPC peering

A

A direct encrypted network link between 2 vpcs

163
Q

Can you do VPC peering cross-region

A

Yes

164
Q

Can you do VPC peering cross-account

A

Yes

165
Q

Can you use Security Groups over vpc peers

A

Yes, but only in the same region

166
Q

Does VPC peering support transitive peering

A

No

167
Q

What configs are necessary to ensure peering works

A

Routing (route tables in both vpcs), Sgs and NACL could filter also

168
Q

What is a limitation of VPC peering

A

Cannot be done if the VPCs have CIDR range overlap

169
Q

Is site-to-site HA

A

Yes, if designed and implemented correctly

170
Q

Do you need a static IP for onprem when setting up VPN

A

yes

171
Q

What is geolocation routing

A

You tag records with country, continent, subdivision or default
Then check location of user (normally the resolver)

172
Q

What is the order of checking in geolocation routing

A

Starts with state, if match returns record
Then Country
Then continent
Then default (optionally)
It returns the most specific record or NO ANSWER

173
Q

What can geolocation routing be used for

A

Regional restrictions, language-specific content or load balancing across regional endpoints

174
Q

Does geolocation routing return the closest record

A

No, just the most relevant

175
Q

What does geoproximity routing do

A

It gives the CLOSEST record

176
Q

What can resources be tagged with in R53 geoproximity routing

A

AWS region, or lat and long

177
Q

What does a bias do in geoproximity routing

A

Affects the effective area of a resource

178
Q

What kind of storage does EBS provide

A

Block storage

179
Q

Can EBS be encrypted

A

Yes, using KMS

180
Q

Can EBS be across AZs

A

No

181
Q

What kind of resiliency does EBS have

A

Some built-in resiliency if a physical device fails, but it can<t withstand an AZ failure

182
Q

Can you attach EBS to multiple instances

A

Yes, but app needs to manage concurrency
By default, think of it as being attached to one instance at a time

183
Q

Can you backup EBS

A

Yes, with a snapshot in S3

184
Q

How can you migrate EBS between AZs

A

Create a snapshot, then create a volume in a different az from the snapshot

185
Q

How can you configure private access to AWS Public services from a private VPC

A

Use VPC Gateway endpoints or VPC interface endpoints

186
Q

What services are supported by VPC Gateway endpoints

A

DynamoDB and S3

187
Q

What services are supported by VPC Interface Endpoint

A

Everything but DynamoDB

188
Q

What is a Gateway endpoint associated with

A

It is per service per region

189
Q

How does a Gateway endpoint work

A

A prefix list is added to the route table

190
Q

Which type of VPC endpoint is HA by default (Gateway or interface)

A

Gateway

191
Q

How do you change what a Gateway endpoint can access

A

Endpoint policy

192
Q

Can Gateway endpoint access inter-region services

A

No

193
Q

How can you make sure a bucket can only be used from within a specific VPC

A

Set up a bucket policy

194
Q

If you don’t use a VPC endpoint, what do you need to access AWS public services from within a VPC

A

NAT GW or public subnet

195
Q

Where is a Gateway endpoint located

A

From within a VPC, but it has a private tunnel to the service

196
Q

Are gateway endpoints accessible from outside it’s VPC

A

No

197
Q

Are interface endpoints HA

A

Not by default

198
Q

How do you control access to interface endpoints

A

Via Security Groups

199
Q

What protocols are supported by interface endpoints

A

TCP only

200
Q

What IP version can you use with interface endpoints

A

IPv4 only

201
Q

What is used by interface endpoints

A

PrivateLink

202
Q

What does a PrivateLink do

A

It allows you to inject AWS or 3rd party services in a VPC

203
Q

How do you specify what can be done with an interface endpoint

A

Endpoint policies

204
Q

How do interface endpoints work

A

They have a DNS name

205
Q

What are the different ways to un interface endpoints with regards to DNS

A

Use AZ DNS name
Use region DNS name
Use provateDNS to force it’s usage when the public DNS name of the service is called

206
Q

Which kind of VPC endpoint use routing to give private access to AWS public services

A

Gateway endpoint

207
Q

What is Glue

A

Serverless ETL and data catalog
Moves and transforms data between source and destination

208
Q

What is datapipeline

A

It can do ETL using EMR (uses server)

209
Q

What does Glue generate

A

AWS Glue Data Catalog

210
Q

What is a data catalog

A

Persistent metadata about data sources in a region
One catalog per region per account

211
Q

How are catalogs discovered

A

Using crawlers

212
Q

What do crawlers do

A

Connect to data stores, determine schema and create metadata in the catalog

213
Q
A