Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Certified Developer - Associate > Flashcards from AWS Course > Flashcards

Flashcards from AWS Course

1
Q

What is AWS Serverless Application Model (AWS SAM)?

A

A framework for building serverless applications in AWS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

How do you share AWS CloudFormation templates across multiple AWS accounts?

A

Use CloudFormation StackSets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Where do you store files for an AWS Lambda function that needs temporary storage during execution?

A

/tmp directory.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

In Amazon Elastic Container Server (Amazon ECS), where are port mappings located and where are they configured?

A

Port mappings are part of the container definition and are configured in the task definition.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the unit of scale for Lambda?

A

Concurrent executions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What condition keys would you use to limit the execution of a Lambda function to a particular Amazon VPC?

A

lambda:VpcIds – Allow or deny one or more VPCs.

lambda:SubnetIds – Allow or deny one or more subnets.

lambda:SecurityGroupIds – Allow or deny one or more security groups.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Global secondary index queries support what type of consistency?

A

Eventual consistency only.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are best practices for partition keys in Amazon DynamoDB?

A

Use high-cardinality attributes which are attributes that have distinct values for each item.

Use composite attributes to combine more than one attribute to form a unique key.

Cache the popular items when there is a high volume of read traffic using Amazon DynamoDB Accelerator (DAX).

Add random numbers or digits from a predetermined range for write-heavy use cases.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How do you ensure that your applications cannot retrieve a message from an Amazon Simple Queue Service (Amazon SQS) queue that is being processed or has already been processed?

A

Increase the VisibilityTimeout value from the ChangeMessageVisibility API and delete the message using the DeleteMessage API.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What API call do you use to give the ability to the application so that it can use an IAM role?

A

AssumeRole API.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What do you use to authenticate users for a website using identity profiles?

A

Amazon Cognito identity pools.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a role-based access control (RBAC) models?

A

It is the traditional authorization model used in IAM and it defines the permissions based on a user’s job.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is an attribute-based access control (ABAC) model?

A

An authorization model that defines permissions based on attributes or tags.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the AWS Directory Services and when are they used?

A

Simple AD is compatible with basic Active Directory functions and can handle 500 users to 5000 users. Simple AD is for simple requirements.

AWS Managed Microsoft AD is an actual Microsoft Active Directory service. You can create a trust relationship with your on premises directory.

AD Connector provides proxy requests back to an on premises directory. It is great for proxy identities to integrate with AWS services when you do not want to store any directory information in the cloud.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the three types of identity federation?

A

Cross account role: When a remote account, so a remote identity provider (IdP), is allowed to assume a role and access your account resources. Look further into AssumeRole and cross-account access as well as AssumeRoleWithSAML and AssumeRoleWithWebIdentity.

SAML 2.0: A standard that is used mostly for on premises, for example, Microsoft Active Directory or others. Users can log in to AWS with their on premises credentials.

Web identity federation: When you use IdPs (for example, Amazon, Google, and Facebook) to allow users to assume roles and access your AWS resources using their IdP credentials.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the differences between STS Get Tokens, GetFederationToken, and GetSessionToken and when you would use each?

A

GetFederationToken could be used in a proxy application that gets temporary security credentials for a distributed application in a corporate network.

GetSessionToken could be used if you want to use multi-factor authentication to protect programmatic calls to specific AWS API operations.

You can also use roles to delegate access to not only users and services, but also applications that do not have access to your AWS resources (for example, access to resources or services that a user does not usually have access to or to grant access for users in a different AWS account).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the two types of Lambda authorizers used with Amazon API Gateway?

A

Lambda authorizer and REQUEST authorizer.

A token-based Lambda authorizer is the answer for this scenario because a TOKEN authorizer receives the caller’s identity in a bearer token, such as a JSON Web Token (JWT) or an OAuth token.

A request parameter-based Lambda authorizer, also known as REQUEST authorizer, receives the caller’s identity in a combination of headers, query string parameters, StageVariables, and $context variables.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are Amazon Cognito user pools and identity pools?

A

User pools are user directories that provide sign-up or sign-in for users and authenticate a user to obtain tokens related to user identity and access policies.

Identity pools help to grant temporary and limited credentials for your users to access AWS services and resources and federate them with identity providers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What additional protection does tokenization provide?

A

Tokenization adds additional protection for your data and can help to meet compliance requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are the two options AWS offers to customers deploying managed X.509 certificates?

A

AWS Certificate Manager (ACM) is for enterprise customers who need a secure web presence using TLS.

AWS Private CA is for enterprise customers building a public key infrastructure (PKI) inside the AWS cloud and intended for private use within an organization.

21
Q

What are the three main categories of preventative controls?

A

IAM
Infrastructure security
Data protection (encryption and tokenization)

22
Q

What AWS services can you use for detective controls?

A

You can see detection of unauthorized traffic by continuous monitoring of VPC flow logs to identify and remediate any security anomalies along with Amazon GuardDuty to manage threat intelligence in the cloud.

And then you can consume these findings as Amazon CloudWatch events to drive automated responses. Under detective controls is also configuration drift and you can use AWS Config with Amazon DynamoDB to detect configuration drift easily at the table level and with Amazon Relational Database Service (Amazon RDS) for database instances, security groups, snapshots, subnet groups, and event subscriptions.

23
Q

What is a canary deployment?

A

Incoming traffic is shifted in two increments. 10% of the traffic must be shifted in the first increment, and then remaining 90% should be deployed after some minutes.

24
Q

What are the Lambda types of deployment packages?

A

Container images and .zip file archives.

25
Q

What is AWS AppConfig?

A

AWS AppConfig helps to create, manage, and quickly deploy application configurations. It supports controlled deployments to applications of any size and includes built-in validation checks and monitoring.

26
Q

What are the AWS CodeDeploy deployment configurations for Amazon ECS deployments?

A

CodeDeployDefault.ECSLinear10PercentEvery1Minutes
CodeDeployDefault.ECSLinear10PercentEvery3Minutes
CodeDeployDefault.ECSCanary10Percent5Minutes
CodeDeployDefault.ECSCanary10Percent15Minutes

27
Q

What are the AWS CodeDeploy deployment configurations for Amazon Elastic Compute Cloud (Amazon EC2) or on premises?

A

CodeDeployDefault.OneAtATime: Deploys the application revision to only one instance at a time

CodeDeployDefault.HalfAtATime: Deploys to up to half of the instances at a time (with fractions rounded down)

CodeDeployDefault.AllAtOnce: Attempts to deploy an application revision to as many instances as possible at once

28
Q

What are the CloudFormation set of helper scripts?

A

cfn-init, cfn-signal, cfn-get-metadata, and cfn-hup.

29
Q

When would you use cfn-init?

A

You would use cfn-init to retrieve metadata, install packages, start services, or create files.

30
Q

What is the run order of hooks in an Amazon ECS deployment for CodeDeploy?

A

Start, BeforeInstall, Install, AfterInstall, AllowTestTraffic, AfterAllowTestTraffic, BeforeAllowTraffic, AllowTraffic, AfterAllowTraffic, and end.

31
Q

What is the run order of hooks in an AWS Lambda function for CodeDeploy?

A

Start, BeforeAllowTraffic, AllowTraffic, AfterAllowTraffic, and end.

32
Q

For AWS STS API who can call AssumeRole?

A

An IAM user or IAM role with existing temporary security credentials.

33
Q

For AWS STS API who can call AssumeRoleWithSAML?

A

Any user, but the caller must pass a SAML authentication response that indicates authentication from a known identity provider.

34
Q

For AWS STS API who can call AssumeRoleWithWebIdentity?

A

Any user, but the caller must pass a web identity token that indicates authentication from a known identity provider

35
Q

For AWS STS API who can call GetFederationToken?

A

An IAM user or an AWS account root user.

36
Q

For AWS STS API who can call GetSessionToken?

A

An IAM user or an AWS account root user

37
Q

What is the run order of hooks in blue/green deployments for CodeDeploy?

A

Start, ApplicationStop, DownloadBundle, BeforeInstall, Install, AfterInstall, ApplicationStart, ValidateService, BeforeAllowTraffic, AllowTraffic, AfterAllowTraffic, BeforeBlockTraffic, BlockTraffic, AfterBlockTraffic, and end.

38
Q

How do you monitor API endpoints in Amazon API Gateway?

A

In the API Gateway dashboard.

39
Q

Which environment variables are used by Lambda to communicate with AWS X-Ray?

A

_X_AMZN_TRACE_ID

40
Q

Why would you use the aws sts decode-authorization-message command?

A

To decode an encoded authorization failure message.

41
Q

Why would you use the –dry-run parameter along with the command line interface (CLI) command?

A

To verify permission to call a CLI command without actually making a request.

42
Q

How do you monitor the end-to-end view of your application?

A

Using AWS X-Ray or Amazon CloudWatch ServiceLens.

43
Q

What is the environment variable AWS_XRAY_CONTEXT_MISSING?

A

The X-Ray SDK uses this variable to determine its behavior if your function tries to record X-Ray data, but a tracing header is not available. Lambda sets this value to LOG_ERROR by default.

44
Q

What does active tracing with X-Ray provide?

A

Active tracing with AWS X-Ray provides distributed tracing capabilities and visual service maps for faster troubleshooting while identifying degradation, anomalies, and latency.

45
Q

What AWS service helps you use subscription filter policies to optimize messaging?

A

Amazon Simple Notification Service (Amazon SNS) and Amazon EventBridge Pipes which is a new service and will not appear on the exam for a while.

46
Q

How do you choose the most efficient partition key for the DynamoDB table?

A

The partition key with the highest cardinality based on user access patterns.

47
Q

What AWS service can be used to reduce the DynamoDB response times?

A

Amazon DynamoDB Accelerator (DAX) and Amazon ElastiCache.

48
Q

How do you invalidate Amazon API Gateway cache?

A

First send a request with a Cache-Control: max-age header.
Then enable the Require Authorization option on your API cache settings.

AWS Certified Developer - Associate (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions