AWS Dev Practice Flashcards
(145 cards)
1
Q
What are the beanstalk deployment types?
A
All at once Rolling Rolling with additional batch immutable (blue/green) traffic splitting
2
Q
EC2 instances in an ASG have only basic monitoring enabled. Why?
A
The console was used to create the launch configuration
3
Q
Kinesis data streams give a ‘ProvisionedThroughputException’ error. How do we fix it?
A
Configure data producer to retry w/ exponential backoff
Increase shards
4
Q
Which db engines can use IAM db authentication?
A
RDS MySQL
RDS PostGreSQL
5
Q
How do you retrieve only some DynamoDB items and not all?
A
use ProjectionExpression
6
Q
What AWS service uses the appspec.yaml file?
A
Code Deploy
7
Q
What does the ‘Transform’ section indicate in a CloudFormation template?
A
It is a SAM template
8
Q
What type of RI can you use in addition to a savings plan?
A
Zonal RI’s
9
Q
What service can NOT be used to authenticate w/ API gateway?
A
AWS STS
10
Q
What DynamoDB write option should you use to ensure you don’t overwrite primary key values?
A
Conditional writes
11
Q
What service gives temporary, limited-privilege credentials to AWS services using 3rd party idP’s?
A
Cognito Identity pools
12
Q
What are Kinesis Firehose destinations?
A
S3 Redshift Elasticsearch Splunk Custom HTTP Endpoint
13
Q
How do you make ‘all or nothing’ updates to DynamoDB?
A
use transactional read/write API’s
14
Q
Can you move an EBS volume between AZ’s?
A
No
15
Q
What is the limit of stored messages in SQS?
A
no limit - only ‘in flight’ messages have a limit (120K)
16
Q
What credential type is NOT supported by IAM for CodeCommit?
A
IAM username and password
17
Q
What are 2 services that can be used to deploy SSL certs?
A
IAM
Certificate Manager
18
Q
What RI type allows you to change the instance family?
A
Convertible RI
19
Q
JWT authorizer is used by what?
A
HTTP API
20
Q
Can ECS or Lambda use in-place deployments with CodeBuild?
A
No, Blue-green only
21
Q
What are DynamoDB streams?
A
Info about changes to items in a DynamoDB table
They can be used by other services to perform actions
22
Q
Websocket API’s allow what?
A
Bi-directional communications
23
Q
What service helps identify unused IAM roles & remove them without disrupting service?
A
Access Advisor
24
Q
What are 2 ways to authenticate with Cognito User Pools?
A
To the user pool directly
Federated authentication using social identities to the user pool
25
What is the max message size for SQS?
256KB
26
What is the max data size of KMS?
4KB
27
What is application discovery service?
collects usage and config data about on-prem servers
28
What API types can use Cognito?
REST
| Websocket
29
DynamoDB tables have high latency, how do you fix it?
Use Global tables
| Use eventually consistent reads
30
What API call will extend the length of time an SQS job will process?
ChangeMessageVisibility
31
If you have a web app on EC2 with a DynamoDB table, how can you make an API call from instances if no SDK exists?
Sign requests with access keys and Sig V4
Make HTTP POST request to DynamoDB API
Include the JSON document in the request body
32
What is SWF?
Task oriented API's
| Ensures task assigned only once
33
What is SQS?
Message based API's
| Messages can be delivered more than once
34
EC2 auto scaling works with what kind of load balancer?
ALB
| NLB
35
What is required for code to be executed in a Lambda function?
Lambda function handler
36
Your ALB is down or misconfigured, what error code doe you get?
503 error
37
What key requires the root user?
CloudFront key pair
38
How do you limit access to an API to users in a Cognito User Pool?
Assign an authorizer.
| Assign the authorizer to the API
39
What feature of a load balancer will let you analyze incoming requests for latency & client IP patterns?
ALB access logs
40
How do you reduce load on web servers with high CPU?
Put the certificate on the ALB
| Put a listener on the ALB with SSL termination
41
What are the SAM references?
```
API
Application
Function
HTTPAPI
LayerVersion
SimpleTable
StateMachine
```
42
If multiple apps write to the same DynamoDB table and you want to send changes to an API what do you do?
Send changes to Kinesis data streams
| Use Lambda to process changes and call an HTTP API
43
What policy types limit permissions but don't grant them?
Permissions boundary
| AWS Organization SCP
44
What can you change with standard RI's?
Instance size
Network types
AZ
45
How do you minimize impact of a full DynamoDB table scan?
parallel scans
| limit parameter
46
What is an immutable deployment for Beanstalk?
Like blue-green. New servers spun up in a new ASG
47
What are 3 options allow users to have secure access to private files in S3?
CloudFront signed URL's
CloudFront Signed cookies
CloudFront OAI
48
What do you do with a Lambda function who uses libraries that aren't available at runtime?
zip up code and dependencies
49
To implement Lambda with Step Functions what do you setup?
define step function tasks
| state machine
50
How do you migrate a Beanstalk environment from one account to another?
```
Save configuration
Export configuration
Make environment updates
Upload to S3
Create new app from saved config
```
51
How do you define an OS, programming language and tools needed when using CodeBuild?
specify a docker image in the buildspec.yml file
52
What does DynamoDB rate limit do?
Limits the throughput so you don't use it all
53
What is the only resource based policy that IAM supports?
trust policy
54
How would you design an app that uses Lambda to process HTTP requests?
create an API
| Configure proxy integration with Lambda
55
To encrypt data at rest in S3 while managing the keys, what do you do?
Upload the key when uploading to the object to S3
56
What are API mapping templates?
They map data in API's so you can have multiple versions
57
What is Kinesis data streams?
data streaming service
not auto scaling
can replay data
needs to be configured
58
What is API call used to obtain temp credentials when using Web Identity Federation?
AssumeRoelWithWebIdentity
59
PTR record vs A Record
IP to Domain
| Domain to IP
60
What is Kinesis Firehose?
Data transfer service
auto scales
cannot replay
fully managed
61
What is DynamoDB encryption client?
client side encryption at rest & in transit
62
HTTP 4XX vs 5XX errors
4XX is client side
| 5XX is server side
63
What is !FindInMap?
Think case/switch statement
64
What is the structure of !FindInMap?
[MapName, TopLevelKey, SecondLevelKey]
65
4 tasks of CloudWatch Logs?
Set log retention policy
Monitor logs from EC2
Monitor CloudTrail logged events
Query log data
66
EC2 auto scaling cannot...
add volumes to an EC2 instance when a volume is filling up
67
How do you allow Lambda in Account A access to DynamoDB in account B?
Create role in account B with access to DynamoDB
Allow the role to be called by Lambda
Have Lambda in Account A call the role with AssumeRole API
68
What is SSE-C?
Server Side Encryption - Customer managed keys
69
Where can HTTPS be enforced with CloudFront?
Before CloudFront
| After CloudFront
70
What section of a CloudFormation template does not allow conditions?
Parameters
71
What access do member accounts have to Organization trails?
Read only, not modify/delete
72
At what level does CloudTrail track S3 by default?
Bucket level only
73
What metric is not part of target tracking scaling policy?
ApproximateNumberOfMessagesVisible
74
In CloudFormation how do you reference a parameter?
!Ref
75
What is X-Forwarded-For header used for?
to get the client IP address from HTTP requests when using an ALB
76
What is the max poll time out?
20 seconds
77
What are 2 reasons to use the 'Transforms' section of a CloudFormation template?
SAM
| When you want to use code from S3
78
How can 2 docker containers share memory?
Be defined in the same task definition
79
In CloudFormation how do you use an exported value from another stack?
!ImportValue
80
What Load Balancer do you use to capture source IP w/o using X-Forwarded-For?
NLB
81
If your app uses JWT's what service do you use?
Cognito User Pools
82
What will happen to ECS if you terminate an instance that is stopped?
It will still show in the cluster
83
What is reserved concurrency in Lambda?
It guarantees concurrency for Lambda functions to use but it also acts as a limiter when you have multiple Lambda functions running
84
When using Cognito with ALB & CloudFront where does the authentication occur?
ALB
85
What can cause an ALB to send traffic to one instance or AZ over another?
Unevenly split EC2 instance types between AZ's
| Sticky sessions
86
Dedicated Instance vs Dedicated hosts
Dedicated instances are cheaper
| Dedicated hosts are good for 'bring your own license'
87
How can you have an IAM policy that allows each user access to only buckets with their user name in it?
Use policy variables
88
Which elasticache service supports replication?
Redis
89
During rollback, which instances does CodeDeploy deploy to?
failed instances
90
How can Lambda connect to an RDS instance in a private subnet?
Connect Lambda to the VPC and then allow access with security groups
91
What is the ratio of Kinesis shards to workers?
1:1
92
What service do you use to rotate secrets?
Secrets Manager
93
What service requires the appspec.yaml file?
CodeDeploy
94
What should go into a Lambda deployment package?
Compiled code and dependencies
95
What deployment types can Lambda & ECS use?
Blue/Green
96
Which ECS task placement strategy minimizes the # of instances?
binpack
97
How do you provide an on-prem app server with permissions to AWS?
Create user with access keys
| Store access keys in a credentials file
98
What service coordinates multiple AWS services using workflows?
AWS Step Functions
99
What 2 languages can the appspec file be in?
JSON
| YAML
100
Does AWS Shield protect from SQL Injection attacks?
No
101
Are KMS keys regional or global?
Regional
102
What service does X-Ray not integrate with?
S3
103
S3 buckets offer read after write consistency for PUTS
Yes
104
What service let's you troubleshoot a performance problem in a microservices app?
X-Ray
105
In CloudFormation, exported output values are unique per...
Region
106
What is the maximum ratio of provisioned IOPS to requested volume size?
50:1
107
At what size will gp2 volumes hit max IOPS?
5.3TB
108
What is CodeBuild?
A fully managed build service to compile, test, and document builds
109
What CloudTrail event isn't available for EBS when created during EC2 launch?
CreateVolume
110
How do you reduce API calls and improve latency in an API?
enable API gateway caching
111
CLI command for setting detailed monitoring on EC2?
aws ec2 monitor-instances --instance-ids i-adf8965876
112
How can you have an EC2 instance access S3 files?
use an IAM role
113
What is the total set size/number of environment variables you can create for AWS Lambda?
Total size of all environment variables cannot exceed 4KB and there is no limit on number of variables
114
Max retention period for SQS?
14 days
115
Why would you use an Elastic Beanstalk dedicated worker environment?
If your application performs tasks that take a long time to complete.
116
You have a site hosted on Bucket A and JavaScript on Bucket B, how do you enable CORS?
On Bucket B to allow Bucket A origin to make requests
117
X-Ray costs are high, how do you reduce costs while still obtaining tracing?
use X-Ray sampling
118
Does Cognito User Pools allow for use of MFA?
Yes
119
When does Lambda add a message to a DLQ?
When Lambda function is async
| When the event fails all processing attempts
120
Does S3 support object locking for concurrent udpates?
No
121
How do you increase the message size for SQS?
Use the SQS Extended library (up to 2GB)
122
Is EBS encryption region or AZ specific by default?
Region
123
How can you invalidate the API cache?
Cache-Control: max-age=0
124
Which encryption mechanism will get rejected if the connection is not using HTTPS?
SSE-C
125
When using the AWS CLI to execute commands it fails with the following exception: You are not authorized to perform this operation. Encoded authorization failure message: 6h34GtpmGjJJUm946eDVBfzWQJk6z5GePbbGDs9Z2T8xZj9EZtEduSnTbmrR7pMqpJrVYJCew2m8YBZQf4HRWEtrpncANrZMsnzk
AWS STS decode-authorization-message
126
Which header must the developers add to their request for all new objects uploaded to S3 to be encrypted using SSE-S3 at the time of upload?
'x-amz-server-side-encryption': 'AES256'
127
What is the maximum number of messages that can be retrieved at one time for SQS?
10
128
How do you encrypt an existing CloudWatch Log group using an AWS KMS customer master key (CMK)?
Use the AWS CLI associate-kms-key command and specify the KMS key ARN
129
How can you speed up a CodeBuild that has a lot of dependencies?
cache dependencies in S3
130
How do you increase performance of Kinesis Data Streams with multiple consumers?
Use enhanced fanout feature of Kinesis Data Streams
131
How can the organization ensure source code is encrypted in transit and at rest?
CodeCommit repositories are automatically encrypted at rest
132
How do you declare an Lambda function in CloudFormation?
Upload all code as a zip to S3
| Write Lambda code inline as long as there are no 3rd party dependencies
133
How can you remove older versions that are not used by Elastic Beanstalk so that new versions can be created for your applications?
Use a lifecycle policy
134
How do you search and filter through multiple X-Ray traces?
Use annotations
135
Which environment variable can be used by AWS X-Ray SDK to ensure that the daemon is correctly discovered on ECS?
AWS_XRAY_DAEMON_ADDRESS
136
What is AWS CodeStar?
service that enables you to quickly develop, build, and deploy apps on AWS. Has one UI w/ dashboards, etc
137
Which message parameter should you set for deduplicating messages?
MessageDeduplicationId
138
Which message parameter should you set the value of user_id to guarantee the ordering?
MessageGroupId
139
How do you ensure your build artifacts are automatically encrypted?
Specify a KMS key to use
140
What do you setup in X-Ray daemon when tracing across multiple accounts?
Create a role in main account and allow other accounts to assume role
Configure the X-Ray daemon to use the IAM role
141
When using Elastic Beanstalk, how do you perform repetitive/scheduled tasks?
Setup a worker environment and a cron.yaml file
142
When using a Classic Load Balancer how can you keep users from having to re-authenticate often?
Use ElastiCache
143
How do you allow a CodeBuild build environment to scale and run builds in parallel?
You don't! It automatically scales
144
What actions do you take to have an app with sign-up/sign-in functionality make API calls to a custom solution to log the sign-in events?
Use Cognito to provide sign-up/sign-in functionality
| Execute a Lambda function to make the API call triggered by the post-authentication event
145
How do you allow only IAM users from another account access to your API's?
Create IAM policy and attach to each user. Use Sig v4
| Create a resource policy for the API's that allow access for each IAM user
