Dev with AWS

Question 1

What is a Gateway Load Balancer

Answer 1

A Gateway Load Balancer helps you to deploy, scale, and manage your third-party appliances, such as firewalls, intrusion detection and prevention systems, and deep packet inspection systems. It provides a gateway for distributing traffic across multiple virtual appliances while scaling them up and down based on demand.

Question 2

What are the three components of Amazon EC2 Auto Scaling?

Answer 2

One component is a launch template or a launch configuration you can use as a configuration template for the EC2 instances. Another component is an Amazon EC2 Auto Scaling group you can use to specify your minimum, maximum, and desired capacity of your instances. The third component refers to scaling policies you can use to configure a group to scale based on the occurrence of specified conditions or on a schedule.

Question 3

Users in a company are authenticated in the corporate network, and they want to use AWS services without signing in again. Which AWS authentication option should the company use?

Answer 3

Instead of creating an IAM user for each employee that needs access to an AWS account, you should use IAM roles to federate users.

Question 4

What are the main components that make up Elastic Load Balancing (ELB)?

Answer 4

The ELB service is made up of these main components: rules, listeners, and target groups. Listeners will contain rules, which are used by the listeners to route requests to the target groups.

Question 5

What is Transfer Acceleration?

Answer 5

it will significantly reduce the upload time to S3. Take note that the name of the bucket used for Transfer Acceleration must be DNS-compliant and must not contain periods (“.”).

Question 6

When to use IAM Policy for S3?

Answer 6

You need to control access to AWS services other than S3. IAM policies will be easier to manage since you can centrally manage all of your permissions in IAM, instead of spreading them between IAM and S3.

You have numerous S3 buckets each with different permissions requirements. IAM policies will be easier to manage since you don’t have to define a large number of S3 bucket policies and can instead rely on fewer, more detailed IAM policies.

You prefer to keep access control policies in the IAM environment.

Question 7

When to use a S3 Bucket Policy?

Answer 7

You want a simple way to grant cross-account access to your S3 environment, without using IAM roles.

Your IAM policies bump up against the size limit (up to 2 kb for users, 5 kb for groups, and 10 kb for roles). S3 supports bucket policies of up 20 kb.

You prefer to keep access control policies in the S3 environment.

You want to apply common security controls to all principals who interact with S3 buckets, such as restricting the IP addresses or VPC a bucket can be accessed from.

Question 8

Is the “Principal” needed in a IAM Policy for S3?

Answer 8

No. The S3 bucket policy includes a “Principal” element, which lists the principals that bucket policy controls access for. The “Principal” element is unnecessary in an IAM policy, because the principal is by default the entity that the IAM policy is attached to.

Question 9

What are the 3 types of server side encryption (SSE) that S3 allows?

Answer 9

SSE-S3 - S3 Managed Keys, SSE-KMS - AWS KMS, and SSE-C - customer provided keys.

Question 10

DAX vs. ElaticCache?

Answer 10

DAX is for DynamoDB only. Simple to implement. ElastiCache can be used for DynamoDB or Relational DBs. You have to reconfigure the app to use it.

Question 11

What are the 3 request headers for SSE-C?

Answer 11

x-amz-server-side-encryption-customer-algorithm - This header specifies the encryption algorithm. The header value must be “AES256”.

x-amz-server-side-encryption-customer-key - This header provides the 256-bit, base64-encoded encryption key for Amazon S3 to use to encrypt or decrypt your data.

x-amz-server-side-encryption-customer-key-MD5 - This header provides the base64-encoded 128-bit MD5 digest of the encryption key according to RFC 1321. Amazon S3 uses this header for a message integrity check to ensure the encryption key was transmitted without error.

Question 12

What is AssumeRoleWithWebIdentity?

Answer 12

Returns a set of temporary security TheAssumeRoleWithWebIdentityAPI operation returns a set of temporary security credentials for federated users who are authenticated through a public identity provider. Examples of public identity providers include Login with Amazon, Facebook, Google, or any OpenID Connect (OIDC)-compatible identity provider. This operation is useful for creating mobile applications or client-based web applications that require access to AWS. Using this operation means that your users do not need their own AWS or IAM identities.

Question 13

What is Athena?

Answer 13

interactive query service to analyze and query data located in S3 using SQL.
serverless - pay per query / TB scanned
ETL processes not needed
commonly used to query log data in S3

Question 14

What is Macie?

Answer 14

security service which uses ML and NLP to discover, classify and protect sensitive data stored in S3.
uses AI to identify PII, suspicious API activity, preventing ID theft in PCI-DSS

Question 15

What AWS Service is ideal for data lakes?

Answer 15

S3

Question 16

Why would you get inconsistent results from a deleted object in S3?

Answer 16

because S3 has eventual consistency for overwrite PUTS and DELETES

Question 17

What is S3 Object Lambda?

Answer 17

allows you to add your own code to S3 GET requests to modify and process data as it’s being returned to an application. This feature is designed for use cases where data needs to be transformed on-the-fly without the need to store a transformed copy of the data. It’s useful in scenarios like filtering rows, redacting confidential data, dynamically resizing images and other similar situations where data transformation or processing is required during data retrieval.

Question 18

Which storage has lower latency, block or object?

Answer 18

Block because you only have to update part of the storage while object storage you would have to replace the whole object.

Question 19

What is EFS?

Answer 19

Elastic File System - is a set-and-forget file system that automatically grows and shrinks as you add and remove files. There is no need for provisioning or managing storage capacity and performance. Amazon EFS can be used with AWS compute services and on-premises resources. You can connect tens, hundreds, and even thousands of compute instances to an Amazon EFS file system at the same time, and Amazon EFS can provide consistent performance to each compute instance. offers four storage classes, where you pay for only the storage you use based on the storage class.

Question 20

What is Amazon FSx?

Answer 20

Amazon FSx is a fully managed service that offers reliability, security, scalability, and a broad set of capabilities that make it convenient and cost effective to launch, run, and scale high-performance file systems in the cloud. With Amazon FSx, you can choose between four widely used file systems: Lustre, NetApp ONTAP, OpenZFS, and Windows File Server. You can choose based on your familiarity with a file system or based on your workload requirements for feature sets, performance profiles, and data management capabilities.

Question 21

SNS vs. EventBridge?

Answer 21

Use SNS when:

Supports a handful of different targets, including SQS and Lambda.
You can’t filter messages by their content. You can only filter by messages attributes and are limited to just 10 attributes per message.
You want to publish messages to MANY different subscribers with a single action
Require high throughput and reliability for publishing and delivery to consumers
Have many subscribers

Use Eventbridge when:

Supports a total of 20 target types at the time of writing! The list includes the likes of SNS, SQS, Kinesis, ECS, Lambda as well as EventBridge on another AWS account.
Gives you a way to pattern match against the event content.
Can discover and keep a schema registry. Can transform the event before passing it on.
You want to publish messages to many subscribers, and use the event data itself to match targets interested certain patterns.
Want integration with other SaaS providers such as Shopify, Datadog, Pagerduty, or others
Want to easily discover schemas that other teams produce and incorporate them into your application.
You want to use regularly scheduled events using a cron-like expression to periodically send messages to your event bus.
You want to create one-time events that fire at a specific time.

Question 22

What is CodeArtifact?

Answer 22

AWS CodeArtifact is a secure, highly scalable, managed artifact repository service that helps organizations to store and share software packages for application development. You can use CodeArtifact with popular build tools and package managers such as the NuGet CLI, Maven, Gradle, npm, yarn, pip, and twine.

Question 23

What is Inspector?

Answer 23

an automated security assessment service that helps improve the security and compliance of applications deployed on AWS. It doesn’t have the ability to capture IP traffic of your VPC.

Question 24

What is Trusted Advisor?

Answer 24

provides recommendations that help you follow AWS best practices. Trusted Advisor evaluates your account by using checks. These checks identify ways to optimize your AWS infrastructure, improve security and performance, reduce costs, and monitor service quotas.

Question 25

MemoryDB for Redis vs. ElastiCache for Redis?

Answer 25

 Amazon ElastiCache for Redis, a fully managed in-memory caching service, as a low latency cache in front of a durable database service such as Amazon Aurora or Amazon DynamoDB to minimize data loss. However, this setup requires you to introduce custom code in your applications to keep the cache in sync with the database. You’ll also incur costs for running both a cache and a database. Amazon MemoryDB for Redis, a new Redis-compatible, durable, in-memory database. MemoryDB makes it easy and cost-effective to build applications that require microsecond read and single-digit millisecond write performance with data durability and high availability. Instead of using a low-latency cache in front of a durable database, you can now simplify your architecture and use MemoryDB as a single, primary database. With MemoryDB, all your data is stored in memory, enabling low latency and high throughput data access.

Question 26

What is Elastic Beanstalk worker environment?

Answer 26

managing the Amazon SQS queue and running a daemon process on each instance that reads from the queue for you. When the daemon pulls an item from the queue, it sends an HTTP POST request locally to http://localhost/ on port 80 with the contents of the queue message in the body. All that your application needs to do is perform the long-running task in response to the POST. You can configure the daemon to post to a different path, use a MIME type other than application/JSON, connect to an existing queue, or customize connections (maximum concurrent requests), timeouts, and retries. Also can define periodic tasks that add jobs to your worker env's queue automatically at a regular interval.

Question 27

What are the two tiers in Elastic Beanstalk?

Answer 27

Web Server Environment and Worker Environment.

Question 28

What is an elastic network interface?

Answer 28

a logical networking component in a VPC that represents a virtual network card. (Includes ip addresses and security groups) A single EC2 instance can now be attached to two ENIs, each one on a distinct subnet. The ENI (not the instance) is now associated with a subnet.

Question 29

What is Envelope Encryption?

Answer 29

encrypt plaintext data with a data key and then encrypt the data key with a top-level plaintext master key. Because the master key is stored in KMS, it’s safe and can be used in many envelope encrypted sets of data.

Question 30

What is GenerateDataKeyWithoutPlaintext ?

Answer 30

it's identical to the GenerateDataKey operation except that it does not return a plaintext copy of the data key.

Question 31

What is GenerateDataKey?

Answer 31

Returns a unique symmetric data key for use outside of KMS. This operation returns a plaintext copy of the data key and a copy that is encrypted under a symmetric encryption KMS key that you specify.

Question 32

What are the Lambda invocation types? Which is default?

Answer 32

By default, Lambda invokes your function synchronously (i.e. theInvocationType is RequestResponse). To invoke a function asynchronously, set InvocationType to Event.

Question 33

What is Lambda Traffic shifting?

Answer 33

create different versions of your function and then allow it to shift traffic between two versions, based on weights (%) that you assign to it. Create an alias and it gives options to do this.

Question 34

What is Step Functions?

Answer 34

a fully managed service that you can use to coordinate the components of distributed applications and microservices using VISUAL WORKFLOWS. You build small applications that each perform a discrete function (or step) in your workflow, which means that you can scale and change your applications quickly. Think of it as first this function runs, which invokes another function, which invokes two more functions to complete a series of steps in your workflow.  Step Functions is based on state machines and tasks. A state machine is a workflow. A task is a state in a workflow that represents a single unit of work performed by another AWS service. Each step in a workflow is a state.

Question 35

What are the two types of State Machine Workflows?

Answer 35

When you create a state machine, you can select either a Standard (default) or Express Workflow. In both cases, you define your state machine using the Amazon States Language (JSON based). Your state machine workflow runs will behave differently depending on which option you select. You cannot change the workflow type after you have created your state machine. Standard Workflows are ideal for long-running, durable, and auditable workflows.  Express Workflows are ideal for high-volume, event-processing workloads such as IoT data ingestion, streaming data processing and transformation, and mobile application backends. There are two types of Express Workflows, asynchronous and synchronous.

Question 36

What is Simple Workflow SWF?

Answer 36

A web service that makes it easy to coordinate work across distributed application components. In Amazon SWF, tasks represent invocations of logical steps in applications. Tasks are processed by workers which are programs that interact with Amazon SWF to get tasks, process them, and return their results. The coordination of tasks involves managing execution dependencies, scheduling, and concurrency in accordance with the logical flow of the application.

Question 37

Why use Web Identity Federation?

Answer 37

build your app so that it requests temporary AWS security credentials dynamically when needed using web identity federation. The supplied temporary credentials map to an AWS role that has only the permissions needed to perform the tasks required by the mobile app. you don't need to create custom sign-in code or manage your own user identities. Instead, users of your app can sign in using a well-known external identity provider (IdP), such as Login with Amazon, Facebook, Google, or any other OpenID Connect (OIDC)-compatible IdP.

Question 38

How would you use Web Identify Federation without Cognito?

Answer 38

then you must write code that interacts with a web IdP, such as Facebook, and then calls the AssumeRoleWithWebIdentity API to trade the authentication token you get from those IdPs for AWS temporary security credentials.

Question 39

Can Lambda functions work with EFS?

Answer 39

You can configure functions to mount a file system during initialization with the NFS protocol over the local network within a VPC. Lambda manages the connection and encrypts all traffic to and from the file system. The file system and the Lambda function must be in the same region. A Lambda function in one account can mount a file system in a different account. For this scenario, you configure VPC peering between the function VPC and the file system VPC.

Question 40

What header should you have if require server side encryption in your S3 bucket policy?

Answer 40

x-amz-server-side-encryption

Question 41

What header should you have if require a KMS key for encryption in your S3 bucket policy?

Answer 41

x-amz-server-side-encryption-aws-kms-key-id header which specifies the id of the KMS master encryption key. If the header is not present in the request, Amazon S3 assumes the default KMS key. Regardless, the KMS key ID that Amazon S3 uses for object encryption must match the KMS key ID in the policy, otherwise Amazon S3 denies the request. To upload an object to the S3 bucket, which uses SSE-KMS, you have to send a request with an x-amz-server-side-encryption header with the value of aws:kms

Question 42

Compare SSE-S3 and SSE-KMS.

Answer 42

SSE-S3 is an encryption key that S3 creates, manages and uses for the customer. SSE-KMS is an encryption key that AWS protects for the customer.

Question 43

What is the difference between Cognito and Identity Center (formerly SSO)?

Answer 43

an Identity Broker which handles interaction between your applications and the Web ID provider (you don’t need to write your own code to do this) Amazon Cognito is a service that helps you manage identities for your CUSTOMER facing applications; it is not a supported identity source in IAM Identity Center. Amazon Cognito is our identity management solution for developers building B2C or B2B apps for their customers, which makes it a customer-targeted IAM and user directory solution. Identity Center (SSO) is focused on SSO for employees accessing AWS and BUSINESS apps, initially with Microsoft Active Directory as the underlying employee directory. You can create and manage your workforce identities in IAM Identity Center or in your external identity source including Microsoft Active Directory, Okta Universal Directory, Azure Active Directory (Azure AD), or another supported IdP. USES SAML

Question 44

Optimistic locking vs. Pessimistic Locking?

Answer 44

Optimistic locking depends on checking a value upon save to ensure that it has not changed. Pessimistic locking prevents a value from changing by locking the item or row in the database. DynamoDB does not support item locking, and conditional writes are perfect for implementing optimistic concurrency.

Question 45

What are two types of Lambda authorizers:

Answer 45

A token-based Lambda authorizer (also called a TOKEN authorizer) receives the caller's identity in a bearer token, such as a JSON Web Token (JWT) or an OAuth token. A request parameter-based Lambda authorizer (also called a REQUEST authorizer) receives the caller's identity in a combination of headers, query string parameters, stageVariables, and $context variables. For WebSocket APIs, only request parameter-based authorizers are supported.

Question 46

Why use IAM identity provider (IdP)?

Answer 46

When you use an IAM identity provider, you don't have to create custom sign-in code or manage your own user identities. The IdP provides that for you. Your external users sign in through a well-known IdP, such as Login with Amazon, Facebook, or Google. You can give those external identities permissions to use AWS resources in your account. IAM identity providers help keep your AWS account secure because you don't have to distribute or embed long-term security credentials, such as access keys, in your application. To use an IdP, you create an IAM identity provider entity to establish a trust relationship between your AWS account and the IdP. IAM supports IdPs that are compatible with OpenID Connect (OIDC) OR SAML 2.0 (Security Assertion Markup Language 2.0).

Question 47

What are Service control policies (SCPs)?

Answer 47

are a type of organization policy that you can use to manage permissions in your organization. SCPs offer central control over the maximum available permissions for all accounts in your organization. SCPs help you to ensure your accounts stay within your organization’s access control guidelines. SCPs are available only in an organization that has all features enabled. SCPs aren't available if your organization has enabled only the consolidated billing features.

Question 48

What is a StackSet?

Answer 48

AWS CloudFormation StackSets extends the capability of stacks by enabling you to create, update, or delete stacks across multiple accounts and AWS Regions with a single operation. Using an administrator account, you define and manage an AWS CloudFormation template, and use the template as the basis for provisioning stacks into selected target accounts across specified AWS Regions.

Question 49

What is SSE-C?

Answer 49

Customer provided encryption keys.

Question 50

What are the 3 request headers for SSE-C?

Answer 50

x-amz-server-side-encryption-customer-algorithm - This header specifies the encryption algorithm. The header value must be "AES256". x-amz-server-side-encryption-customer-key - This header provides the 256-bit, base64-encoded encryption key for Amazon S3 to use to encrypt or decrypt your data. x-amz-server-side-encryption-customer-key-MD5 - This header provides the base64-encoded 128-bit MD5 digest of the encryption key according to RFC 1321. Amazon S3 uses this header for a message integrity check to ensure the encryption key was transmitted without error.

Question 51

What to consider with route tables and subnets?

Answer 51

A route table contains a set of rules, called routes, that are used to determine where network traffic is directed. Each subnet in your VPC must be associated with a route table; the table controls the routing for the subnet. A subnet can only be associated with one route table at a time, but you can associate multiple subnets with the same route table.

Question 52

What is wrong with an inline policy for an application on an EC2 instance to upload data to S3?

Answer 52

This option doesn't provide a secure way of allowing the application that is hosted in EC2 to upload data to an S3 bucket. You should use an IAM Role instead.

Question 53

What is a Kinesis Adapter?

Answer 53

The Kinesis Adapter is the recommended way to consume streams from DynamoDB for real-time processing. The DynamoDB Streams API is intentionally similar to that of Kinesis Streams, a service for real-time processing of streaming data at a massive scale. You can write applications for Kinesis Streams using the Kinesis Client Library (KCL). The KCL simplifies coding by providing useful abstractions above the low-level Kinesis Streams API. As a DynamoDB Streams user, you can leverage the design patterns found within the KCL to process DynamoDB Streams shards and stream records. To do this, you use the DynamoDB Streams Kinesis Adapter. The Kinesis Adapter implements the Kinesis Streams interface, so that the KCL can be used for consuming and processing records from DynamoDB Streams.

Question 54

A developer uses the AWS SDK for C++ to retrieve data from an Amazon DynamoDB table. The data is sometimes retrieved using a known key, and sometimes the key is not known, resulting in multiple items being returned. The developer wants to ensure the code returns only one item when retrieving data without keys. Which DynamoDB setting will meet these requirements?

Answer 54

Set the limit parameter to 1 to set the maximum number of items that need to be retrieved with a DynamoDB scan operation.

Question 55

The company plans to use the URI path pattern to access the desired environment instead of the port number. The company has created the Lambda functions for the application backend. Each Lambda function has three aliases (production, testing, and development). Which option includes the next steps the company must take to complete the process?

Answer 55

Create an API Gateway API and configure the routes to use Lambda proxy integration. Target the corresponding Lambda function Amazon Resource Name (ARN) that is concatenated with the expression ${stageVariables.LambdaAlias}. Modify the Lambda resource-based policy by adding the permission lambda:InvokeFunction. Create production, testing, and development stages. Add the LambdaAlias stage variable to the corresponding stage. To add "stageVariable" to the Lambda ARN, you should use the following format: ${stageVariable.stageVariableName}.

Question 56

How can a Lambda function reuse a db connectin?

Answer 56

The Lambda environment can reuse the same database connection for subsequent invocations when defining the database connection details in the code but outside the handler method.

Question 57

If you get a question about performance of a relational DB, which would you choose, Electicache or DAX?

Answer 57

Elaticache. DAX is only for DynamoDB. dummy.

Question 58

How to enable Lambda access to resources in a private VPC?

Answer 58

provide VPC config info to the function (private subnet ID, and security group ID)

Question 59

What services does X-Ray integrate with?

Answer 59

API Gateway, ELB, S3, Lambda, EB, SNS, and SQS.

Question 60

Cloudfront HTTP methods are grouped into 3 groups, what are they?

Answer 60

GET, HEAD: You can use CloudFront only to get objects from your origin or to get object headers. GET, HEAD, OPTIONS: You can use CloudFront only to get objects from your origin, get object headers, or retrieve a list of the options that your origin server supports. GET, HEAD, OPTIONS, PUT, POST, PATCH, DELETE: You can use CloudFront to get, add, update, and delete objects, and to get object headers. In addition, you can perform other POST operations such as submitting data from a web form.

Question 61

What is Origin protocol policy?

Answer 61

Requiring HTTPS for communication between CloudFront and your custom origin HTTPS Only – CloudFront uses only HTTPS to communicate with your custom origin. Match Viewer – CloudFront communicates with your custom origin using HTTP or HTTPS, depending on the protocol of the viewer request. For example, if you choose Match Viewer for Origin Protocol Policy and the viewer uses HTTPS to request an object from CloudFront, CloudFront also uses HTTPS to forward the request to your origin.
Choose Match Viewer only if you specify Redirect HTTP to HTTPS or HTTPS Only for Viewer Protocol Policy.
CloudFront caches the object only once even if viewers make requests using both HTTP and HTTPS protocols.

Question 62

What is Viewer protocol policy?

Answer 62

Choose the protocol policy that you want viewers to use to access your content in CloudFront edge locations: HTTP and HTTPS: Viewers can use both protocols. Redirect HTTP to HTTPS: Viewers can use both protocols, but HTTP requests are automatically redirected to HTTPS requests. HTTPS Only: Viewers can only access your content if they're using HTTPS.

Question 63

How do you create a certificate for CloudFront?

Answer 63

must be created in us-east-1

Question 64

What is Lambda@EdgeLambda?

Answer 64

Lambda@EdgeLambda, a compute service that lets you execute functions that customize the content that CloudFront delivers. You can author Node.js or Python functions in one Region, US East (N. Virginia), and then execute them in AWS locations globally that are closer to the viewer, without provisioning or managing servers.

Question 65

How do you give permissions to an application that runs on an EC2 instance?

Answer 65

Using roles to grant permissions to applications that run on EC2 instances requires a bit of extra configuration. An application running on an EC2 instance is abstracted from AWS by the virtualized operating system. Because of this extra separation, an additional step is needed to assign an AWS role and its associated permissions to an EC2 instance and make them available to its applications. This extra step is the creation of an instance profile that is attached to the instance. The instance profile contains the role and can provide the role's temporary credentials to an application that runs on the instance. Those temporary credentials can then be used in the application's API calls to access resources and to limit access to only those resources that the role specifies. Note that only one role can be assigned to an EC2 instance at a time, and all applications on the instance share the same role and permissions.

Question 66

What is AssumeRoleWithSAML?

Answer 66

The AssumeRoleWithSAML API operation returns a set of temporary security credentials for federated users who are authenticated by your organization's existing identity system. The users must also use SAML 2.0 (Security Assertion Markup Language) to pass authentication and authorization information to AWS. This API operation is useful in organizations that have integrated their identity systems (such as Windows Active Directory or OpenLDAP) with software that can produce SAML assertions. Such an integration provides information about user identity and permissions (such as Active Directory Federation Services or Shibboleth).

Question 67

What are the 3 types of EC2 Tenancy?

Answer 67

Shared (default) – Multiple AWS accounts can share the same physical hardware. Dedicated Instance (dedicated) – Your instance runs on single-tenant hardware. Dedicated Instances might share hardware with other instances from the same AWS account that are not Dedicated Instances.  You have no visibility into the underlying hardware nor control of instance placement. Dedicated Host (host) – Your instance runs on a physical server with EC2 instance capacity fully dedicated to your use. This is an isolated physical server with configurations that you can control a Dedicated Host gives you additional visibility and control over how instances are placed on a physical server. And you have greater visibility into the hardware that the instance is running on.

Question 68

What are the two types of Lambda Authorizers?

Answer 68

A token-based Lambda authorizer (also called a TOKEN authorizer) receives the caller's identity in a bearer token, such as a JSON Web Token (JWT) or an OAuth token. A request parameter-based Lambda authorizer (also called a REQUEST authorizer) receives the caller's identity in a combination of headers, query string parameters, stageVariables, and $context variables.

Question 69

If you want to setup a DLQ for a failing Lambda function, where would you implement it for SQS or SNS?

Answer 69

Add the ARN of the SQS or SNS in the Lambda function's DeadLetterConfig parameter.

Question 70

If you need to feed real-time data into your gaming platform that handles sudden influx of gamers, which service would you be best?

Answer 70

Kinesis Data Stream - which ingests and stores data streams for processing.

Question 71

What is CloudFront Functions?

Answer 71

CloudFront Functions allows you to write lightweight functions in JavaScript for high-scale, latency-sensitive CDN customizations. This feature is designed for operations that can be processed with low latency at the edge locations of AWS, such as: Cache key normalization, Header manipulation, Status code modification and body generation, URL redirects or rewrites, and Request authorization. When you associate a CloudFront function with a CloudFront distribution, it allows CloudFront to intercept requests and responses at CloudFront edge locations. CloudFront functions can only be invoked during two specific events: when CloudFront receives a request from a viewer (viewer request) and before CloudFront returns the response to the viewer (viewer response).

Question 72

An account alias substitutes for an account ID in the web address for your account. You can create and manage an account alias from the AWS Management Console, AWS CLI, or AWS API. Your sign-in page URL has the following format by default:

Answer 72

https://Your_AWS_Account_ID.signin.aws.amazon.com/console/

Question 73

If you create an AWS account alias for your AWS account ID, your sign-in page URL looks like the following example:

Answer 73

https://Your_Alias.signin.aws.amazon.com/console/

Question 74

100 active shards in a stream. Lambda takes 10 seconds to process the data and the stream is receiving 50 new items per second. How many concurrent Lambda function invocations?

Answer 74

100 (not 500) the number of concurrent executions for poll-based event sources is different from push-based event sources. This number of concurrent executions would have been correct if the Lambda function is integrated with a push-based even source such as API Gateway or Amazon S3 Events. Remember that the Kinesis and Lambda integration is using a poll-based event source, which means that the number of shards is the unit of concurrency for the function.

Question 76

DynamoDB write request with return of consumed?

Answer 76

To return the number of write capacity units consumed by any of these operations, set the ReturnConsumedCapacity parameter to one of the following: TOTAL — returns the total number of write capacity units consumed. INDEXES — returns the total number of write capacity units consumed, with subtotals for the table and any secondary indexes that were affected by the operation. NONE — no write capacity details are returned. (This is the default.)

Question 77

3 examples of deployment types that CodeDeploy supports?

Answer 77

In-place deployments to on-premises servers. B/G deployments to ECS. B/G deployments to Lambda.

Question 78

What is a Global secondary index?

Answer 78

an index with a partition key and a sort key that can be different from those on the base table. A global secondary index is considered "global" because queries on the index can span all of the data in the base table, across all partitions. You can add up to 20 global secondary indexes per table. A global secondary index (GSI) is primarily used if you want to query over the entire table, across all partitions. GSI only supports eventual consistency and not strong consistency. You have to use a local secondary index instead.

Question 79

What is a Local secondary index?

Answer 79

an index that has the same partition key as the base table, but a different sort key. A local secondary index is "local" in the sense that every partition of a local secondary index is scoped to a base table partition that has the same partition key value. For greater query or scan flexibility, you can create up to five local secondary indexes per table.

Question 80

In ECS, what is a Cluster Query Language?

Answer 80

ECS feature which provides you with expressions that you can use to group container instances by a specific attribute

Question 81

What languages does AWS Lambda support?

Answer 81

AWS Lambda natively supports Java, Go, PowerShell, Node.js, C#, Python, and Ruby code, and provides a Runtime API which allows you to use any additional programming languages to author your functions.

Question 82

What is API Gateway Integration Types?

Answer 82

AWS_PROXY: This type of integration lets an API method be integrated with the Lambda function invocation action with a flexible, versatile, and streamlined integration setup. This integration relies on direct interactions between the client and the integrated Lambda function.
With this type of integration, AKA LAMBDA PROXY INTEGRATION, you do not set the integration request or the integration response. API Gateway passes the incoming request from the client as the input to the backend Lambda function. The integrated Lambda function takes the input of this format and parses the input from all available sources, including request headers, URL path variables, query string parameters, and applicable body. The function returns the result following this output format.
This is the PREFFERED integration type to call a Lambda function through API Gateway and is not applicable to any other AWS service actions, including Lambda actions other than the function-invoking action. HTTP: This type of integration lets an API expose HTTP endpoints in the backend. With the HTTP integration, also known as the HTTP custom integration, you must configure both the integration request and integration response. You must set up necessary data mappings from the method request to the integration request, and from the integration response to the method response. HTTP_PROXY: The HTTP proxy integration allows a client to access the backend HTTP endpoints with a streamlined integration setup on single API method. You do not set the integration request or the integration response. API Gateway passes the incoming request from the client to the HTTP endpoint and passes the outgoing response from the HTTP endpoint to the client. MOCK: This type of integration lets API Gateway return a response without sending the request further to the backend. 

Question 83

dynamodb putitem vs updateitem?

Answer 83

TheupdateItem function is used to update an existing item's attributes. Overall, developers can add, edit, or delete attributes from an existing item using the updateItem function. The putItem function creates an entirely new item or replaces an existing item from a DynamoDB table. So, unlike the updateItem function, you can not use the putItem function to update existing items. The behavior of the putItem function is determined by the primary key you provide. For example, if you provide an existing primary key, it will completely replace the old item.

Question 84

Why GraphQL and what is it?

Answer 84

GraphQL is a query and manipulation language for APIs. (used by AppSync) GraphQL provides a flexible and intuitive syntax to describe data requirements and interactions. It enables developers to ask for exactly what is needed and get back predictable results. It also makes it possible to access many sources in a single request, reducing the number of network calls and bandwidth requirements, therefore saving battery life and CPU cycles consumed by applications. It's meant to improve drawbacks of a REST API. Single endpoints: GraphQL uses a single endpoint to query data. There's no need to build multiple APIs to fit the shape of the data. This results in fewer requests going over the network. Fetching: GraphQL solves the perennial issues of over- and under-fetching by simply defining the data you need. GraphQL lets you shape the data to fit your needs so you only receive what you asked for. Abstraction: GraphQL APIs contain a few components and systems that describe the data using a language-agnostic standard. In other words, the shape and structure of the data are standardized so both the front- and backends know how it will be sent over the network. This allows developers on both ends to work with GraphQL's systems and not around them. Rapid iterations: Because of the standardization of data, changes on one end of development may not be required on the other. For example, frontend presentation changes may not result in extensive backend changes because GraphQL allows the data specification to be modified readily. You can simply define or modify the shape of the data to fit the needs of the application as it grows. This results in less potential development work.

Question 85

What is the max code package size of a Lambda function? (and container image?)

Answer 85

250 MB unzipped. and container, 10 GB.

Question 86

Lambda Quotas?

Answer 86

Function memory allocation 128 MB to 10,240 MB, in 1-MB increments. Note: Lambda allocates CPU power in proportion to the amount of memory configured. You can increase or decrease the memory and CPU power allocated to your function using the Memory (MB) setting. At 1,769 MB, a function has the equivalent of one vCPU. Deployment package (.zip file archive) size 50 MB (zipped, for direct upload) 250 MB (unzipped) Container image code package size 10 GB (maximum uncompressed image size, including all layers) /tmp directory storage Between 512 MB and 10,240 MB, in 1-MB increments

Question 87

Which Amazon ElastiCache data store supports set sorting and ranking of cached datasets?

Answer 87

Redis

Question 88

A company has two AWS accounts. IAM users from Account A need to access resources in Account B.

Answer 88

1. In Account B, create an IAM role with a trust policy for the Developers in Account A. 2. Update the IAM role’s permission to access the resources in Account B 3. In Account A, update the permission of the IAM users to assume the IAM role in Account B

Question 89

How can a Developer verify permission to call a CLI command without actually making a request?

Answer 89

Use the --dry-run parameter along with the CLI command.

Question 90

A Developer needs to deploy a CloudFormation template from a local computer.

Answer 90

Use the aws cloudformation package and aws cloudformation deploy command

Question 91

A Developer has created an IAM Role for an application that uploads files to an S3 bucket. Which API call should the Developer use to allow the application to make upload requests?

Answer 91

Use the AssumeRole API

Question 92

An application uses Amazon CloudFront to distribute a static website. The developer wants to redirect requests to specific URLs based on the user’s location.

Answer 92

Create a CloudFront URL that redirects requests based on the CloudFront-Viewer-Country header’s value. Associate the CloudFront URL with the distribution’s Viewer Request event.

Question 93

An application uses a DynamoDB table with Global Secondary Index. DynamoDB requests are returning an ProvisionedThroughputExceededException error even though the table has sufficient capacity. Why is this happening?

Answer 93

The write capacity of the GSI is less than the base table.

Question 94

A serverless application is composed of AWS Lambda, DynamoDB, and API Gateway. Users are complaining about getting HTTP 504 errors.

Answer 94

The API requests are reaching the maximum integration timeout for API Gateway (29 seconds)

Question 95

How do you configure Memory/CPU with Lambda?

Answer 95

Lambda allocates CPU power in proportion to the amount of memory configured. By increasing the function memory, you will increase the CPU allocation.