Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS misc tips > ACG Exam Tips - student feedback > Flashcards

ACG Exam Tips - student feedback Flashcards

1
Q

What is Kinesis

A

Look for language in questions:
If they say big data think Kinesis
if they say BI, think Redshift
if they say big data processing think Elastic Map Reduce

Service for real time processing of streaming data at massive scale. Configure producers to send data to a Kinesis Stream

Way to consume big data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

EBS Backed vs Instance Store

A

On the exam, look for long term storage and think EBS backed. For short term think instance store volumes

EBS backed volumes are persistent
Instance Store backed volumes are ephemeral

EBS volumes can be detached and reattached to other EC2 instances

EBS volumes can be stopped and data will be persist
instance store volumes can’t be stopped without losing data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is opsworks

A

orchestration service that uses Chef

For exam, just look for terms like chef, recipes or cookbooks and associate them with OpsWorks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Elastic Transcoder

A

cloud based media transcoding

has presets for common formats, does that for you

pricing based on minutes transcoded and resolution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

3 SWF Actors

A

Workflow Starters - app that initiates a workflow. ie. commence website

Deciders - control flow of activity tasks in the workflow execution

Activity Workers - carry out activity tasks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How to query metadata to get public IP addresses

A

curl http://169.254.169.254/latest/meta-data

get http://169.254.169.254/latest/meta-data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

AWS Organizations

A

Account management service that lets you consolidate multiple AWS accounts for central management

2 feature sets:
consolidated billing
all features

Have an Organization with OU’s under it, with AWS accounts associated to them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Consolidated billing

A

paying account with linked accounts (ie dev, production, back office)

Monthly bill reflects each linked account

paying account can’t access resources of the linked accounts

linked accounts (limit of 20) are independent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

advantages of consolidated billing

A

one bill per account
volume pricing discount
unused reserved instances for EC2 applied across the group
east to track charges, allocate costs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

consolidated billing best practices

A

enable MFA and strong password on root account

use paying account only for billing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

how many linked accounts by default

A

20, can request more

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

billing alerts for linked accounts

A

when monitoring is enabled for paying account, billing data for linked accounts included

can create billing alerts for individual accounts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Describe Cloud trail in terms of logging for multiple AWS accounts

A

is per account and enabled per region

can consolidate the logs between accounts using an S3 bucket and cloud trail

  1. turn on cloud trail in paying account
  2. create bucket policy allowing cross-account access
  3. turn on cloud trail in all accounts and use bucket in paying account
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is Cross Account Access?

A

lets you easily work with a multi-account AWS environment by letting you easily switch roles in the AWS Console

Can sign into console with your IAM username, then switch to manage other account without having to enter another name and password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Steps required to implement Cross Account Access

A

Identity account numbers
Create a group in IAM, and a user for it (Dev, John)
Log into production account, create new policy
create the cross account role
apply new policy to the role
login to the developer account, create new policy there
apply new policy to the developer group
log in as John
switch accounts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

AWS Document for creating Cross Account Access

A

Create IAM role in the AWS account that users want to sign into (Prod). (need the account ID)

Give users in the original account (Dev) permissions to assume the role in the target account (Prod)

Create a script allowing user to sign into the Prod account console

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Tag overview

A

Tags can be inherited, ie from autoscaling, cloud formation, elastic beanstalk

Tags can be nested

Tags are metadata

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

resource groups overview

A

let you group resources using tags

contain info like region, name, health checks

contain specific details:
IP addresses, port configs, DB engine types

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

One big big benefit of Resource Groups

A

great for tracking who is using what

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

tag editor

A

lets you view all resources both tagged and untagged

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

VPC Peering overview

A

connection between two VPC’s letting you route between them with private IP addresses

Can only peer within a single region

Can peer with a VPC in another account

peering connection is not a gateway or VPN. It uses the existing VPC infrastructure

No single point of failure for peering

22
Q

is transitive peering supported in VPC peering?

A

no

23
Q

can overlapping IP blocks use VPC peering?

A

no

24
Q

Direct Connect benefits

A

reduce costs with large amounts of traffic

increase reliability

increase bandwidth

25
Q

Direct Connect vs VPN

A

VPN can be setup quickly, generally low bandwidth and more variability

Direct Connect like a leased line. It is a dedicated line to a peering facility where it cross connects to AWS

Can take weeks, months to set up

26
Q

Direct Connect bandwidths available

A

1 Gb
10 Gb

sub 1Gb available through AWS direct connect partners

27
Q

Direct connect vlan tagging

A

Direct connect uses 802.1q vlan tagging, allows you to reach multiple parts of AWS network over one link

28
Q

(STS) Security Token Service

A

grants users limited, temporary access to AWS resources

Users come from 3 sources

  1. Federation (SAML, typically with AD)
  2. Federation with mobile apps
  3. Cross-Account access
29
Q

STS Key Terms

A

Federation
combining list of users in one domain with another one

Identity Broker
Service that allows you to take identity from A and federate it to B
Usually you have to create your own

identity store
service like AD, facebook, google, etc

identities
user in an identity store

30
Q

do you usually have to create your own identity broker?

A

yes

31
Q

Scenario for setting up Identity Broker to authenticate an EC2 application in a VPC to an Active Director over a VPN, so application can write to S3

A

user enters account and password

app calls Identity Broker which captures credentials

ID Broker uses LDAP to validate the credentials

ID Broker uses IAM credentials to call new GetFederationToken Function. Includes an IAM policy, duration and policy for permissions to be granted

STS confirms policy of IAM user making the call gives the permission to create new tokens and then gives 4 values to application
access key, secret access key, token and token lifetime

ID Broker returns temp credentials to app

app uses temp credential to make requests to S3

S3 uses IAM to verify credentials

IAM allows S3 to perform requested operation

32
Q

Federate Active Directory with AWS

A

User brows to AD Federated Services website

Sign-on page authenticates user against AT

Users’s browser gets SAML assertion in form of authentication response from ADFS

User’s browser posts the SAML assertion to AWS sign-on endpoint. Sign-on uses “AssumeRoleWithSAML API to get temporary credentials and creates a sign-on URL for the console

User’s browser receives sign-on URL and is redirected to the console

33
Q

AWS Workspaces (read FAQ)

A

A VDI, cloud based replacement for desktops

User can login with existing AD credentials if integrated with AD

But don’t need AD domain.

Also don’t need AWS account to login to workspaces

workspaces are persistent

by default users given local admin rights

34
Q

ECS and Docker Part 1 - what is docker?

A

It packages software into standard units called Containers

They let you package application code, configurations and dependencies into building blocks, providing consistency efficiency

35
Q

VM vs Container

A

Each VM has to have a guest OS

Container doesn’t have a guest OS, only dependencies

Docker gains higher density because of this

36
Q

Container benefits

A

reduces dependencies

increased consistency from dev - test - qa - prod

containers don’t affect each other

increased portability

37
Q

Docker components

A

Docker image - like an ISO or AMI but has only files required to boot container

Docker Container - isolated application platform

Layers / Union File System -

Docker File - images built from base images, contains instructions

Docker daemon / engine -

Docker client - interface to the docker engine

Docker registries / hubs - host images for people to share

38
Q

Elastic Container Service

A

ECS eliminates need for your own container management system, or worry about scaling your infrastructure

Regional Service you can use in one or more AZ’s to schedule placement of containers across your cluster

ECS can create a consistent deployment and build experience, manage and scale workloads and build application architectures

39
Q

What is a Docker Image?

A

read only template with instructions for creating a docker container

like cloudformation

Collection of root filesystem changes and execution parameters for use in a container runtime

It’s created from a docker file that specifies components to install

40
Q

What is ECR - EC2 Container Registry?

A

Managed AWS Docker Registry Service (AWS Docker Hub)

41
Q

What are ECS Task definitions?

A

text files in JSON format describing one or more containers that form your application

Describes a docker container in JSON

42
Q

ECS Services

A

lets you run and maintain instances in an ECS cluster

Like Auto-Scaling Groups but for ECS

43
Q

ECS Clusters

A

grouping of container instances you can place tasks on.

Contain multipole container instance types

region specific

can only be part of one cluster at a time

Can use IAM polices to manage access

44
Q

ECS Scheduling

A

Service Scheduler
ensures specified number of tasks are constantly running. Reschedules tasks if they fail

Custom Scheduler
create own schedulers, use 3rd party schedulers

45
Q

ECS Container Agent

A

lets container instances connect to your cluster

Can install on any EC2 Linux instance that supports ECS specification

46
Q

ECS Secirotu

A

IAM Roles control EC2 instance access to ECS. ECS tasks use IAM to access services, resources

Security Groups at host level, not task or container level

Configure OS of EC2 instances in ECS cluster

47
Q

ECS Soft Limits

A

Clusters per region = 1000
Instances per cluster = 1000
Services per cluster = 500

48
Q

ECS Hard Limits

A

One load balancer per service
1000 tasks per service
10 containers per task definition
10 tasks per instance (hosts)

49
Q

ECS Exam Tips 1

A

ECS - AWS managed EC2 containers

Containers = method of OS virtualization

Containers created from read-only template called image

Image has instructions for creating the container

Images stored in a registry like AWS ECR or DockerHub

50
Q

ECS Exam Tips 2

A

Task Definition required to run containers in ECS

Task Definitions are JSON files describing containers (CPU, RAM, etc)

Task Definitions are like cloud formation templates

ECS Services lets you run and maintain “desired count” of instances in an ECS cluster

Services are like AutoScaling Groups for ECS

ECS Cluster is logical grouping of container instances you can put tasks on

51
Q

ECS Exam Tips 3

A

clusters can have multipole container instance types

clusters are region specific

container instances can only be part of one cluster at a time

can create IAM policies for clusters

Schedule ECS 2 ways: Service or Customer

ECS agent (linux only) connects EC2 instances to ECS cluster

IAM and ECS for access control

Security Groups work at instance not container or task level

AWS misc tips (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions