Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

AWS DevOps Pro DOP-C02 > Cantril > Flashcards

Cantril Flashcards

(58 cards)

Start Studying
1
Q

IAM Service-linked role

A

IAM role linked to a specific AWS service
You can’t delete the role until it’s no longer needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

IAM PassRole Permissions

A

a user can (e.g.) initialize a Cloudformation stack and pass a role to it. The role may have the necessary permissions even if the user does not. The user must have permission to pass the role.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Elastic Beanstalk Application

A

A collection of things relating to an application: code and infra

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Service Control Policies

A

account permissions boundaries. And, they do not apply to the management account.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Source Bundle

A

Elastic Beanstalk Application Version

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Elastic Beanstalk Environment

A

Container of infra and configuration for a specific application version

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

EB Deployment Policy Options

A
  1. All at once
    Deploy to all at once, brief outage
    Simple, but significant limitations
  2. Rolling
    Deploy in rolling batches
    Loss in capacity during deployment
  3. Rolling with additional batch
    As above, but you pay for an additional batch so there’s no loss in capacity
    Safer, but more expensive
  4. Immutable
    New instances with new version in new autoscaling group
    When it passes its tests, the new instances are added to the original autoscaling group and the original instances are terminated
    You have to pay for double your capacity during deployment
    Lowest risk
  5. Traffic splitting
    Same as Immutable, but sends 50% of traffic to the new instances before terminating the old instances
    you can do A/B testing
    Regression path is quick
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

If you have an RDS instance inside an EB environment and you want to decouple it

A
  1. Create an RDS snapshot
  2. Enable delete protection
  3. Create a new DB environment with the same app version
  4. Ensure new env can connect to the DB that is now outside of EB
  5. Swap environments (CNAME or DNS)
  6. Terminate the old environment - this will try to terminate the RDS instance, but will fail because of step 2
  7. Locate DELETE_FAILED stack in CF and manually delete the stack, choosing to retain stuck resources
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Customize EB environments

A

CF format in yml or json, stored in .ebextensions/*.config
option_settings allows you to set options of resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Dockerrun.aws.json

A

ElasticBeanstalk and Docker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

ECS

A

Elastic Container Service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

ECR

A

Kinda like DockerHub, has container images

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

ECR Registry

A

can have many repositories

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

ECR Repository

A

can have many images

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

ECR Container Definition

A

Tells ECS where your container is, what port it uses. Just enough info about the container you want to define

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

ECR Task Definition

A

Task is a self-contained application. A task can have multiple container definitions inside it. It also contains the Task Role, which is an IAM role that the task can assume

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

ECR Service Definition

A

How we want a task to scale. It can add availability and scalability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

ECS EC2 Mode

A

Runs within a VPC. Can take advantage of MultiAZ
Not serverless

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

ECS Fargate

A

Serverless. The user is not responsible for managing EC2 instances.
Each resource that is running your tasks and services is injected into your VPC.
You only pay for the resources you consume. You don’t manage hosts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

using containers

EC2, ECS with EC2, or ECS Fargate?

A

ECS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Large consistent workload, price conscious

EC2, ECS with EC2, or ECS Fargate?

A

EC2 Mode, using Spot and Reserve Instances

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Large workload, overhead conscious, minimizing what you need to manage

EC2, ECS with EC2, or ECS Fargate?

A

Fargate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Small / Burst workloads

EC2, ECS with EC2, or ECS Fargate?

A

Fargate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Batch / Periodic

EC2, ECS with EC2, or ECS Fargate?

23
Kubernetes
Container orchestration product Automated way to manage Clusters
24
K8s Pods
Pods can contain more than one container. Pods manage the containers within them. Usually, one container per pod
25
K8s Kub-apiserver
the front end for the k8s control plane
26
K8s etcd
Highly available key value store used within the cluster. Database that is main backing store for the cluster
27
K8s Kube-scheduler
Constantly checks for pods with no nodes and assigns nodes to that pod based on availability and configuration
28
EKS Three Modes
Self Managed Managed node groups Fargate
29
OpsWorks Three modes
Puppet Enterprise - define a state and puppet handles the rest Chef Automate - IaC OpsWorks - AWS Integrated Chef, no servers - this will be the most likely one on the test
30
OpsWorks Lifecycle Events
Setup Configure Deploy Undeploy Shutdown
31
appspec.yml
Codedeploy Uses appspec.yml or appspec.json to deploy an application
32
CodeBuild can deploy into 7 services
EB OpsWorks CF ECS Service Catalog Alexa Skills Kit S3
33
CodeDeploy lifecycle event hooks (7)
1. ApplicationStop - before the app is downloaded. To prepare for the deployment 2. DownloadBundle - when it copies the app down to a temporary location 3. BeforeInstall - preinstallation tasks. Maybe make a backup? 4. Install - copies the app files from the temporary location to the active location. You can’t run any scripts here 5. AfterInstall - post-install steps. Config, file permissions, licensing maybe 6. ApplicationStart - restart any services that were stopped during the ApplicationStop event 7. ValidateService - verify that the deployment was completed
34
AWS Config
Records config changes over time on resource Great for auditing of changes, compliance with standards It’s a regional service, but supports cross-region and account aggregation Change generate SNS notifications Once enabled, the config supported resources is contantly tracked. Config Rules - evaluate resources against a customer-defined standard
35
AWS Service Catalog
An admin user will create CloudFormation templates (or groups of them) and publish them as “portfolios” to AWS Service Catalog. Other users can browse these portfolios and launch the product.
36
Amazon Inspector
Scans EC2 instances and their OS, and containers to detect vulnerabilities and deviations against best practice
37
Amazon Inspector two types
1. Network Assessment (Agentless) 2. Network and Host Assessment (Agent, because it would need access to the instance)
38
CVE
Common vulnerabilities and exposures A Rules Package that can be used by Amazon Inspector
39
CIS
Center for Internet Security (CIS) Benchmarks A Rules Package that can be used by Amazon Inspector
40
Amazon Inspector Rules Package: Security best practices for Amazon Inspector checks what 4 things
1. Disable root login over ssh 2. Using only modern version numbers for ssh 3. Password complexity checks 4. Permissions on certain folder
41
AWS Guard Duty
Continuous security monitoring service Analyzes supprted Data Sources Uses AI/ML, plus threat intelligence feeds Identifies unexpected and unauthorized activity
42
AWS Trusted Advisor
It compares what you have to what you should have, compared to AWS best practices
43
AWS Trusted Advisor checks what 5 major areas
1. Cost Optimization 2. Performance 3. Security 4. Fault Tolerance 5. Service Limits
44
AWS Trusted Advisor 7 core checks (basic and developer support plans)
1. S3 Bucket Permissions 2. Security Groups - Specific Ports Unrestricted 3. IAM Use 4. MFA on Root Account 5. EBS Public Snapshots 6. RDS Public Snapshots 7. 50 service limit checks (checks for >80% of service limits)
45
AWS Trusted Advisor Business and Enterprise Support checks what
1. The 7 Core checks 2. 115 Further checks 3. Access to the AWS Support API If you want to test for approaching service limits and automatically request an increase, you’ll need Business or Enterprise level support 4. CloudWatch Integration - reacts to changes
46
Route 53 ARC (Application Recovery Controller)
simplifies and automates the recovery of applications deployed across multiple Availability Zones (AZs) and Regions. It enhances application resilience by managing failover and recovery processes during outages
47
Amazon FSx for NetApp ONTAP
a fully managed AWS service that delivers reliable, scalable, and high-performing file storage using NetApp's ONTAP file system. It supports Linux, Windows, and macOS instances both in AWS and on-premises, offering sub-millisecond latencies and SSD-level performance while optimizing costs through automatic data tiering
48
Web Access Control List (Web ACL)
apply one of these to a resource to protect it with WAF.
49
WebACL Rule Types (2)
Regular (e.g. an IP address that can access port 22) Rate-based (e.g. the same IP address tries to connect 5000 times in 5 minutes)
50
Web Application Firewall applies to what 4 services
Cloudfront, ALB, Appsync, API Gateway
51
WebACL Rules can match on what 10 things
Origin country IP Label Header Cookies Query Parameter URI path Querystring Body (only first 8192 bytes) HTTP Method
52
WebACL Actions (6)
Allow (not valid for rate-based) Block Count - just counts the request Captcha Custom Response (Uses a header with this prefix: x-amzn-waf-) Label - can pass info to a subsequent rule
53
AWS Network Firewall Rule Groups contains what information
1. Type: Either stateless or stateful 2. Processing order and default action 3. Rules: calculates PASS, DROP, or FORWARD
54
AWS Network Firewall Rule has what 5 inputs
Protocol, source CIDR, destination CIDR, source port, destination port
55
AWS Network Firewall Rule has what 4 possible outputs
Pass Drop Forward Custom
56

AWS DevOps Pro DOP-C02 (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions