General Flashcards
(83 cards)
1
Q
What is one serverless AWS service for noSQL and one for SQL databases?
A
DynamoDB & Aurora Serverless
2
Q
If you want to run a custom container image on Lambda what needs to be implemented in the image and what other services should be used if it isn’t in the image?
A
Lambda Runtime API. ECS or Fargate can be used to run the image in a container on the cloud instead of Lambda.
3
Q
Is the maximum size of a DynamoDB item:
- 4 KB
- 400 KB
- 4 MB
- 40 MB
A
400 KB
4
Q
T or F: API Gateway supports WebSocket protocol
A
TRUE
5
Q
What 2 CLI commands are used to package & deploy a SAM template?
A
sam package & sam deploy
6
Q
Why kind of header is used to indicate a cloudformation is a SAM template?
A
a Transform header: Transform: AWS::Serverless-2016-10-31
7
Q
What 3 resources are specific to SAM templates?
A
AWS::Serverless::(Function, Api, SimpleTable)
8
Q
What service can be used if a custom domain or HTTPS is desired for an AppSync endpoint?
A
CloudFront
9
Q
What is used as an initial bootstrap script for EC2 instances?
A
EC2 User Data
10
Q
T or F: EBS volumes are shared across availability zones
A
FALSE
11
Q
T or F: Taking a snapshot of an EBS volume requires detaching it from any EC2 instances
A
FALSE but it is recommended to do so to get a clean snapshot.
12
Q
What is one reason you would create a custom AMI instead of using EC2 User Data for environment setup?
A
The initial boot time when an EC2 is started is significantly reduced when using an AMI instead of EC2 User Data.
13
Q
Why would someone choose an EC2 instance store over an EBS volume? What is a downside to using an instance store?
A
Better IOPS throughput/performance (~10ks vs ~100ks-1,000ks) but it is ephemeral storage (i.e. nothing is saved when instance stops running). This creates a risk of data loss if the hardware fails.
14
Q
What are the 3 major types of EBS volume?
A
General Purpose SSD (gp3 & gp2), Provisioned IOPS SSD (io2 & io1), & Throughput Optimized (st1) and Cold (sc1) HDD.
15
Q
If a Provisioned IOPS SSD EBS volume is being used what additionally is required to increase the max IOPS above 32K?
A
Nitro EC2 instance will increase the max to 64K
16
Q
What EBS volume types support multi-attach?
A
Provisioned IOPS SSD (io1 & io2)
17
Q
T or F: EFS can be used on Windows AMIs
A
FALSE only supports Linux AMIs
18
Q
What 2 performance modes are available for an EFS on creation time and what are their pros and cons?
A
General Purpose: low latency
Max I/O: higher latency but higher throughput
19
Q
What 2 throughput modes are available for an EFS and what are their pros and cons?
A
Bursting: storage/throughput ratio is set at 1TB/50MiB/s w/ burst up to 100MiB/s
Provisioned: set any throughput regardless of how much storage exists
20
Q
What 2 storage tiers are available for an EFS?
A
Standard: free to retrieve Infrequent Access (EFS-IA): cost to retrieve, lower storage price
21
Q
What are the 3 types of ELB and what web protocols do they support?
A
Classic (v1, Layer 4 or 7): HTTP, HTTPS, TCP
Application (v2, Layer 7): HTTP, HTTPS, WebSocket
Network (v2, Layer 4): TCP, TLS (secure TCP), UDP
22
Q
What are the possible target groups for an Application Load Balancer?
A
EC2 instances (could also be an ASG) ECS tasks Lambda functions (HTTP translated to JSON) IP Addresses (only private IPs)
23
Q
How would an ALB target group get a client’s IP, protocol, or port?
A
HTTP headers: X-Forwarded-(For | Port | Proto)
24
Q
List 3 reasons why an NLB would be chosen over an ALB
A
lower latency: ~100ms vs ~400ms
better scalability: millions of request/s
static IP per AZ: useful for IP whitelisting
25
I have an NLB with an EC2 target group. The EC2 security group only allows inbound traffic from the NLB's security group but traffic is being denied. What is wrong?
an NLB preserves the incoming traffic's IP and protocol when forwarding traffic so the EC2 security group needs to allow inbound traffic from all IPs.
26
What 2 ELB types are compatible with sticky sessions?
Classic & Application load balancers
27
What are the 2 basic types of cookies used for ELB sticky sessions and what are some reasons why one would be chosen over the other
Application-based cookies:
- can be custom, target generated with any
custom attributes with custom cookie name for
each target group
- expiry can be set by the application
Duration-based cookies
- expiry can be set by the load balancer
28
For which ELB type/s is it possible to disable cross-zone load balancing?
NLB & CLB
29
What is Server Name Indication used for and for what services is it compatible?
Allows loading multiple SSL certs for a single web server so a single server can route traffic to multiple target groups with different SSL certs.
Requires client to specify hostname of target server on initial SSL handshake
ELB: ALB & NLB (not CLB)
Cloudfront
30
What is a 'deregistration delay' used for on ALB/NLB's?
When a target group enters 'draining' mode as a prelude to shutting down it is the maximum time this mode is sustained in which time the EC2 instance is handling existing connections while the balancer does not send any extra traffic. Can be 0-3600 seconds. default is 300.
This is used to make sure an EC2 isn't terminated in the middle of handling a request for an ALB/NLB.
31
How are scaling actions triggered for ASGs? List some metrics that can be used to trigger these.
CloudWatch alarms
- average CPU usage
- # of requests per instance
- average Network throughput In or Out
- a preset schedule
32
What is used to launch an ASG?
Launch Configuration or the newer Launch Template
33
If an EC2 instance in an ASG becomes unhealthy will it be restarted or terminated and a new instance launched?
terminated & new instance launched
34
What is an ASG scaling cooldown?
It is the period of time after a scaling action where an ASG will not launch or terminate instances. This allows the metrics to stabilize with the new or lost instances accounted for.
After the cooldown the ASG will begin evaluating the metrics again for potential new scaling actions.
35
What is a good way to reduce the scaling cooldown needed by an ASG?
use a custom AMI instead of EC2 user data to reduce instance startup time
36
What are the 3 main types of ASG scaling policies?
Dynamic, predictive, & scheduled
37
What are the 3 types of Dynamic scaling policies for an ASG?
- Target Tracking scaling (i.e. keep CPU usage around 40%)
- Simple scaling (i.e when a CW alarm like CPU above 70% or CPU below 40% is triggered add/remove # instances)
- Step scaling is like simple scaling but allows add/removing a custom # of instances depending on how badly a metric has triggered a CW alarm.
38
Which type/s of ELB has/have a static IP?
NLB
39
What are the 6 database engines that AWS RDS supports?
Postgres, MySQL, MariaDB, Oracle, Microsoft SQL Server, Aurora
40
What is the max number of allowed read replicas for RDS?
5 for MySQL, 15 with Aurora.
41
T or F: Read replicas are only available within the same AZ as the database
False: they can be, but can also be created in a different AZ or even region.
42
T or F: RDS Read replicas are eventually consistent
True
43
In what situation would a read replica be charged a network cost for traffic between it and the database?
Only when the replica is in a different region
44
How could RDS read replicas be used to increase availability?
using an RDS Multi AZ deployment a read replica is created in a separate AZ and updated by the DB SYNCHRONOUSLY. If the DB goes down the read replica is automatically used as the new RDS DB.
45
How is a currently running RDS DB converted from single AZ to multi AZ?
you simply modify the DB configuration and the read replica is created with 0 operational downtime
46
T or F: RDS Read replicas as part of a Multi AZ deployment are eventually consistent
False
47
Describe the steps needed to encrypt an unencrypted production RDS DB
- Create a snapshot of the DB
- Copy the snapshot & enable encryption
- Start a DB from the encrypted snapshot
- Migrate applications that use the DB from the old one to the new encrypted one & delete the old one
48
What service can be used to enable encryption at rest for an RDS DB when setting up a DB?
KMS (AES-256)
49
What can be used to enable in-flight encryption with RDS?
encryption using an SSL cert. This typically must be set using a parameter inside the DB
50
T or F: RDS allows a user to SSH into a DB instance
False. As a managed service RDS does not expose the instance that runs the DB
51
For what DB engines can IAM be used to manage in-DB user creation/permissions
MySQL & PostgreSQL & Aurora
52
What is the maximum amount of data that Aurora can auto-expand to?
The Aurora shared storage volume can be between 10GB to 64TB
53
How does Aurora manage supplying the correct write/read endpoints to applications calling the DB?
A writer endpoint points to the current Master DB in the case of one writer or load balances across multiple writers if applicable
A reader endpoint that automatically implements load balancing to the autoscaling group of read replicas.
54
You expect your DB workload to be highly intermittent and unpredictable. Which DB feature should be enabled
- One Writer & Multiple readers
- Serverless
Serverless. A minimum & maximum capacity can be specified and the available capacity is automatically scaled for cost saving.
55
At a high level explain the differences between Redis & Memcached as elasticache options
- Redis (High availability features) similar to RDS in that there are read replicas, data persistence, backup/restore features, multi-AZ with failover
- Memcached (pure cache) partitions data using multinode (sharding), is nonpersistent, no backup/restore features, uses multithreaded architecture.
56
What is Lazy Loading? (also called Cache-aside, Lazy Population). Describe some of the pros and cons.
In instances of cache misses the DB response is written to the cache for subsequent calls.
pros: guarantees only useful data is cached and also means node failures of the cache will not lead to data loss but simply increased latency during the cache warm-up period.
cons: noticeable delay on a cache miss because results in 3 round trips (1 to the cache, then to the DB, and back to the cache with the data). Cache can easily contain stale data & is eventually consistent at best.
57
Describe pros & cons of the Write Through caching strategy.
pros: data is never stale. There is never a delay on read calls, only a write penalty (involves 2 calls, 1 to write to DB & 1 to write to cache).
con: data can be missing until added or updated to the DB. (Note: can be mitigated by combining this with Lazy Loading).
This strategy opens the door to cache churn. Because cache will always have the entire DB there is good chance it could contain irrelevant data that is never read.
58
What kind of data would fit setting a short TTL (time to live) for an elasticache?
data that could be changing very often:
| leaderboards, activity streams, comments
59
You've implemented a caching solution for your website but notice the cache is frequently losing useful data due to Cache Eviction. How would you solve this problem?
scale up (or out) the available data storage for the elasticache.
Cache Eviction occurs when the data limit is reached for a cache by removing data that hasn't been read in the longest time (LRU: least recently used).
60
Is Redis "cluster mode" useful for scaling Read operations or Write operations?
Write operations.
When cluster mode is on each node is a 'shard', only containing a portion of all data. Each shard can still have their own read replicas for multi-AZ availability.
61
What is the difference between a CNAME versus an alias?
CNAME points a hostname -> hostname only for non root domain urls. (ie 'app.domain.com' not 'domain.com'). Each CNAME incurs a cost.
An alias points a hostname -> AWS resource. It works for both root domain & non root domain hostnames. Aliases are free & include a native health check (ie can integrate with the health check of the load balancer being pointed to).
62
You want to implement client-side load balancing through a route 53 endpoint but you don't need any other features like health checks. Which routing policy should be selected?
Simple Routing Policy
63
How many health checkers are standard for a Route 53 Health check?
15 health checkers spread across regions.
64
A Route 53 failover routing policy involves a primary and secondary target. Which targets (if any) require a health check?
Only the primary target requires a health check because that health check will be used to trigger the failover to the secondary target.
65
You have a Route 53 'A' record pointing to an EC2 instance's public IP address. This works in production but the EC2 is briefly stopped and restarted. Route 53 is now no longer redirecting traffic to the EC2. What's wrong?
When an EC2 is stopped and restarted its public IP v4 address is changed. The route 53 record is still pointing to the old IP and needs to be updated.
66
What are the 7 available routing policies in Route 53?
Simple, Weighted, Latency, Failover, Geolocation, Geoproximity, and Multi-value.
67
What is the range of available bias values for a Route 53 Geoproximity routing policy?
-99 to 99
68
You want configure your application so that your clients,
when looking up a hostname on Route 53, are be able to select from an array of healthy ip addresses. What routing policy should be used to set up this behavior in Route 53?
Multi-value routing policy
69
Are VPCs global, regional or AZ level resources?
regional
70
Are subnets global, regional or AZ level resources?
AZ
71
What is the typical infrastructure that would allow an EC2 instance in a private subnet to access the internet?
The instance would call a route in the private subnet that goes to a NAT Gateway inside a public subnet. The NAT Gateway would then use the route in the public subnet that calls an Internet Gateway.
72
What information is provided in VPC flow logs?
It captures ALL information related to network traffic going in/out of subnets, including the ENI (Elastic Network Interface, calls to EC2, etc), calls made from/to managed services (RDS, ELB, Elasticache, etc)
73
What are NACLs used for?
They allow defining a list of ALLOW & DENY rules for specific IP addresses (or address ranges) acting as a firewall for a particular subnet.
74
What can be used to connect to an EC2 that is inside a private subnet from S3 without using public ip addresses?
use a VPC Endpoint Gateway. VPC endpoints are the only way to privately connect managed AWS resources outside the VPC to EC2s (& other things) inside.
75
What can be used to connect 2 different VPCs to each other?
VPC peering. Keep in mind that the CIDR blocks of each VPC cannot be overlapping.
76
What are the 2 methods to connect on-prem resources to an AWS VPC?
1. Site-to-site VPN. Connects an on-prem VPN to a VPC over the public internet. The connection is automatically encrypted.
2. Direct Connect. Establishes a physical connection between on-prem and AWS. This is a private connection outside the internet. Takes at least a month to establish.
NOTE: for both options VPC endpoints are unavailable to on-prem resources because they are internal to AWS only.
77
Describe the typical 3-tier architecture
Route 53 is used to get address of:
1. ) An Elastic Load Balancer inside a public subnet. The target is:
2. ) An EC2 scaling group inside a private subnet. To access application data these call:
3. ) a database/cache solution located on the data subnet.
78
Are S3 buckets global, regional or AZ level resources?
regional
NOTE: but must have globally (across all AWS accounts) unique name!
79
The max object size in S3 is:
- 5 GB
- 50 GB
- 500 GB
- 5 TB
5 TB (but anything over 5GB needs to use multi-part upload)
80
What are the 4 encryption methods for S3?
SSE-S3 keys managed by AWS
SSE-KMS use KMS to manage keys
SSE-C manage keys manually
Client Side Encryption
81
What would be 2 benefits to using SSE-KMS for S3 encryption?
1) allows setting which IAM users have access to the key
| 2) provides access to an audit trail
82
What protocol is used to do encryption in flight for S3?
HTTPS using SSL/TLS certs
83
What are the 2 major types of policies used to control access to S3 buckets?
User-based: IAM policies
Resource-based: Bucket policies (bucket-wide policies, allow cross-account), Object ACL (fine grained policies), Bucket ACL (very uncommon)
