Quick Facts Flashcards

Question

AWS Local Zones

Answer 1

There's no additional charge for enabling Local Zones. You pay only for the resources that you deploy in your Local Zones. AWS resources in Local Zones have different prices than they do in parent AWS Regions Local Zones have their own connections to the internet and support AWS Direct Connect To use a Local Zone, you must first enable it. Next, you create a subnet in the Local Zone. Finally, you launch resources in the Local Zone subnet

Answer 2

An Amazon ECR private registry is provided to each AWS account; you can create one or more repositories in your registry and store Docker images, Open Container Initiative (OCI) images, and OCI compatible artifacts in them Image scanning helps in identifying software vulnerabilities in your container images Cross-Region and cross-account replication Amazon ECR stores images in Amazon S3 buckets By default, Amazon ECR uses server-side encryption with Amazon S3-managed encryption keys Use the CloudWatch console to visualize your service quotas

Answer 3

There are three layers in Amazon ECS: Capacity - The infrastructure where your containers run Controller - Deploy and manage your applications that run on the containers Provisioning - The tools that you can use to interface with the scheduler to deploy and manage your applications and containers Runtime Monitoring in GuardDuty is an intelligent threat detection service that protects workloads running on Fargate and EC2 container instances by continuously monitoring AWS log and networking activity to identify malicious or unauthorized behavior

Answer 4

Create multi-Region keys, which act like copies of the same KMS key in different AWS Regions. Each AWS KMS key that you create in AWS KMS costs $1/month (prorated hourly) You are not charged for the following: Creation and storage of AWS managed or AWS owned KMS keys There is no charge for customer managed KMS keys that you manage and are scheduled for deletion By default, AWS KMS generates and protects the cryptographic key material for KMS keys

Answer 5

AWS IQ connects you to AWS Certified experts for hands-on help for your AWS projects. You create a request and choose from experts who respond

Answer 6

All AWS customers automatically have 24x7 access to these features of Basic Support: 1. One-on-one responses to account and billing questions 2. Support forums 3. Service health checks 4. Documentation, technical papers, and best practice guides Developer Support plan have access to these additional features: 1. Best practice guidance 2. Client-side diagnostic tools 3. Building-block architecture support: guidance on how to use AWS products, features, and services together 4. Supports an unlimited number of support cases that can be opened by one primary contact, which is the AWS account root user. In addition, Business, Enterprise On-Ramp, or Enterprise Support plan have access to these features: 1. Use-case guidance 2. AWS Trusted Advisor 3. The AWS Support API 4. Third-party software support 5. Supports an unlimited number of AWS (IAM) users In addition, Enterprise On-Ramp or Enterprise Support plan have access to these features: 1. Application architecture guidance 2. Infrastructure event management 3. Technical account manager 4. White-glove case routing 5. Management business reviews

Answer 7

Developer: General guidance: < 24 hours System impaired: < 12 hours Additional in Business: Production system impaired: < 4 hours Production system down: < 1 hour Additional in Enterprise-onramp: Business-critical system down: < 30 minutes Additional in Enterprise: Business/Mission-critical system down: < 15 minutes

Answer 8

Compatible with MySQL and PostgreSQL Aurora stores copies of the data in a DB cluster across multiple Availability Zones in a single AWS Region For high availability across multiple AWS Regions, you can set up Aurora global databases An Aurora global database consists of one primary AWS Region where your data is written, and up to five read-only secondary AWS Regions Aurora global databases currently don't support Aurora Auto Scaling for secondary DB clusters Amazon Aurora can encrypt your Amazon Aurora DB clusters. Data that is encrypted at rest includes the underlying storage for DB clusters, its automated backups, read replicas, and snapshots You can't turn off encryption on an encrypted DB cluster Aurora backs up your cluster volume automatically and retains restore data for the length of the backup retention period

Answer 9

Amazon DocumentDB supports two types of clusters: instance-based clusters and elastic clusters. Elastic clusters support workloads with millions of reads/writes per second and petabytes of storage capacity Instance based: Amazon DocumentDB automatically grows the size of your storage volume Amazon DocumentDB lets you scale the compute and memory resources for each of your instances up or down Amazon DocumentDB runs in Amazon Virtual Private Cloud (Amazon VPC) Amazon DocumentDB continuously monitors the health of your cluster On instance failure, Amazon DocumentDB automates failover to one of up to 15 Amazon DocumentDB replicas that you create in other Availability Zones. If no replicas have been provisioned and a failure occurs, Amazon DocumentDB tries to create a new Amazon DocumentDB instance automatically backup capability allows you to restore your cluster to any second during your retention period, up to the last 5 minutes

Answer 10

MemoryDB at-rest encryption is always enabled

Answer 11

Fully managed graph database service that makes it easy to build and run applications that work with highly connected datasets With Amazon Neptune, you don’t have to worry about database management tasks like hardware provisioning, software patching, setup, configuration, or backups.

Answer 12

You can use Amazon QLDB to track all application data changes, and maintain a complete and verifiable history of changes over time All data stored in Amazon QLDB is fully encrypted at rest by default QLDB doesn't provide a dedicated backup and related restore feature at this time

Answer 13

Database on EC2, customer is responsible for: Application optimization, Scaling, High availability, Database backups, Database software patching, Database software install, OS patching, OS installation Using Amazon RDS, customer is responsible for: Application optimization Db2, MariaDB, Microsoft SQL Server, MySQL, Oracle, and PostgreSQL Amazon RDS Custom is an RDS management type that gives you full access to your database and operating system You can also subscribe to Amazon RDS events to be notified about changes to a DB instance, DB snapshot, or DB parameter group Pricing = DB instance hours + Provisioned Storage + (I/O) requests (for Amazon RDS magnetic storage only) + Provisioned IOPS + Backup storage + Data transfer in and out of your DB instance from or to the internet and other AWS Regions To copy an encrypted snapshot from one AWS Region to another, you must specify the KMS key in the destination AWS Region. This is because KMS keys are specific to the AWS Region that they are created in

Answer 14

Use cases: Monitoring metrics to improve the performance and availability of your applications. Storage and analysis of industrial telemetry to streamline equipment management and maintenance. Tracking user interaction with an application over time. Storage and analysis of IoT sensor data.

Answer 15

With the shell that's created for AWS CloudShell sessions, you can switch seamlessly between your preferred command line shells. More specifically, you can switch between Bash, PowerShell, and Z shell AWS CloudShell is an AWS service that's available at no additional charge. However, you pay for other AWS resources that you run with AWS CloudShell. Moreover, standard data transfer rates also apply

Answer 16

The CodeBuild console also provides a way to quickly search for your resources, such as repositories, build projects, deployment applications, and pipelines

Answer 17

CodeCatalyst provides one place where you can plan work, collaborate on code, and build, test, and deploy applications with continuous integration/continuous delivery (CI/CD) tools. Its similar to AWS CodeStar

Answer 18

Anyone with an AWS account can get started with AWS CodeCommit for free. Your account gets 5 active users per month for free (within limits), after which you pay $1.00 per additional active user per month. There are no upfront fees or commitments. CodeCommit is not integrated with gitHUB Things not to use for CodeCommit: Large files that change frequently - Use S3 Audit trails - Use S3 Backups - AWS Backup and Restore Large numbers of branches or references - We recommend using CodeCommit, but delete branches and tags that are no longer needed

Answer 19

CodeDeploy is able to deploy applications to three compute platforms: EC2/On-Premises AWS Lambda Amazon ECS Customer code is not stored in CodeDeploy Service model data for deployments, deployment configuration, deployment groups, applications, and application revisions are stored in Amazon DynamoDB and encrypted at rest using an AWS owned key, owned and managed by CodeDeploy

Answer 20

A streaming instance (also known as a fleet instance) is an EC2 instance that is made available to a single user for application streaming. After the user’s session completes, the instance is terminated by EC2

Answer 21

WorkSpaces uses your Simple AD, AD Connector, or AWS Managed Microsoft AD directory to authenticate users

Answer 22

Designed to facilitate secure browser access to internal websites and software-as-a-service (SaaS) applications

Answer 23

Managed virtual desktop infrastructure designed to work with third-party VDI solutions

Answer 24

Enables frontend web and mobile developers to quickly and easily build full-stack applications on AWS Amplify uses Amazon CloudFront to serve your app to your customers

Answer 25

Enables developers to connect their applications and services to data and events with secure, serverless and high-performing GraphQL and Pub/Sub APIs

Answer 26

You can't use IAM policies to deny the root user access to resources explicitly. You can only use an AWS Organizations service control policy (SCP) to limit the permissions of the root user If you lose your root user access keys, you must be able to sign in to your account as the root user to create new ones Only Root User can: 1. Change account settings 2. Restore IAM user permissions. 3. Close account 4. Activate IAM access to the Billing and Cost Management console 5. Register as a seller 6. Configure an Amazon S3 bucket to enable MFA 7. Edit or delete an Amazon SQS resource policy that denies all principals 8. Edit or delete an Amazon S3 bucket policy that denies all principals 9. Sign up for AWS GovCloud (US) Don't create long-term access keys for human users who need access to applications or AWS services Don't store long-term access keys within an AWS compute service Use IAM roles to generate temporary security credentials whenever possible Don't embed long-term access keys and secret access keys in your application code or in a code repository AWS IAM Access Analyzer does the following: 1. Identify resources that are shared with an external entity 2. Identify unused access 3. Validates IAM policies against AWS best practices 4. Validate IAM policies against your specified security standards 5. Generates IAM policies based on access activity in your AWS CloudTrail logs

Answer 27

Service General EndPoint supported by : EC2, ASG, EMR When you use a general endpoint, AWS routes the API request to US East (N. Virginia) (us-east-1), which is the default Region for API calls

Answer 28

Each resource can have a maximum of 50 user created tags For each resource, each tag key must be unique, and each tag key can have only one value The tag value must be a minimum of 0 and a maximum of 256 Unicode characters in UTF-8 Allowed characters are letters, numbers, spaces representable in UTF-8, and the following characters: _ . : / = + - @ Tag keys and values are case sensitive Tags for automation Tags for access control

Answer 29

Use secure tunneling to establish bidirectional communication to remote devices over a secure connection that is managed by AWS IoT Using FleetIndexing you can query a group of devices AWS IoT Device Defender is a security service that allows you to audit the configuration of your devices, monitor connected devices to detect abnormal behavior, and mitigate security risks Device Advisor is a cloud-based, fully managed test capability for validating IoT devices during device software development

Answer 30

AWS IoT Greengrass is an open source Internet of Things (IoT) edge runtime and cloud service that helps you build, deploy and manage IoT applications on your devices

Answer 31

Find the documents about a particular subject using Amazon Comprehend topic modeling. Scan a set of documents to determine the topics discussed, and to find the documents associated with each topic. You can specify the number of topics that Amazon Comprehend should return from the document set. If your company publishes a catalog, let Amazon Comprehend tell you what customers think of your products Use Amazon Comprehend topic modeling to discover the topics that your customers are talking about on your forums and message boards, then use entity detection to determine the people, places, and things that they associate with the topic. Use sentiment analysis to determine how your customers feel about a topic

Answer 32

CodeGuru Security is a rearchitected and redesigned version of CodeGuru Reviewer Currently, CodeGuru Security is in preview release and is free to use Types of code scans 1. Code security analysis 2. Code quality analysis 3. Secrets detection

Answer 33

AWS Billing Conductor is a custom billing service that can support the showback and chargeback workflows of AWS Solution Providers and Enterprise customers Group your accounts into a set of mutually exclusive set of accounts (billing groups) Apply custom pricing plans Create and apply one-time or recurring charges or credits to your billing groups

Answer 34

You can create groupings of costs using cost categories. For example, assume that your business is organized by teams and that each team has multiple accounts within. To build this structure in cost categories, create a cost category named Team. Then, you can map costs to a cost category value that's named Team 1.

Answer 35

The order of how credits apply if an AWS account has more than one credit: 1. The soonest to expire amongst the credits 2. The credit with the least number of eligible services 3. The oldest of all credits

Answer 36

Reserved Instances and Savings Plans discount sharing: To share an Reserved Instance or Savings Plans discount with an account, both accounts must have sharing activated

Answer 37

Common use cases for using Amazon Rekognition include the following: Searchable image and video libraries Face Liveness Detection : helps you verify that a user is physically present in front of the camera and isn’t a bad actor spoofing Face-based user verification Facial detection and analysis - can detect and analyze different facial components and attributes, such as: emotional expressions (like happy, sad, or surprised), demographic information (like gender or age) Facial Search Unsafe content detection - can detect inappropriate, unwanted, or offensive content Celebrity recognition Text detection Custom labels - you can find your logo in social media posts, identify your products on store shelves

Answer 38

Safely release new capabilities to your customers in a controlled environment Carefully introduce application changes while testing the impact of those changes with users in production environments Control access to premium features or instantly block specific users without deploying new code Keep your configuration data organized and consistent across all of your workloads

Answer 39

Better fault tolerance Better availability Better cost management Strategies: Maintain a fixed number of instances Scale based on a schedule - This is useful when you know exactly when to increase or decrease the number of instances in your group Scale dynamically based on demand a) Step scaling b) Simple scaling c) Target tracking scaling Step Scaling e.g. : You can define different step adjustments based on the breach size of the alarm. You can define separate scaling policies to handle scaling out (increasing capacity) and scaling in (decreasing capacity) when an alarm threshold is breached For example: Scale out by 10 instances if the alarm metric reaches 60 percent Scale out by 30 instances if the alarm metric reaches 75 percent Scale out by 40 instances if the alarm metric reaches 85 percent Simple scaling policies are similar to step scaling policies, except they're based on a single scaling adjustment Target tracking scaling e.g. : You can meet this need by creating a target tracking scaling policy that targets an average CPU utilization of 50 percent. Then, your Auto Scaling group will scale out (increase capacity) when CPU exceeds 50 percent to handle increased load. It will scale in (decrease capacity) when CPU drops below 50 percent to optimize costs during periods of low utilization. Predictive scaling e.g. : Consider an application that has high usage during business hours and low usage overnight. At the start of each business day, predictive scaling can add capacity before the first influx of traffic. This helps your application maintain high availability and performance when going from a period of lower utilization to a period of higher utilization

Answer 40

Public and Private extensions Public extensions - AWS Lambda functions or Amazon S3 buckets Private extensions - Custom resource types like third party resources

Answer 41

CloudTrail provides three ways to record events: 1. Event history 2. CloudTrail Lake 3. Trails

Answer 42

Services used along with Amazon CloudWatch 1. SNS 2. EC2 Auto Scaling 3. CloudTrail 4. iAM CloudWatch cross-account observability is used to get cross-account, cross-Region metrics, logs, and traces CloudWatch agent can collect metrics from 1. Amazon EC2 instances across operating systems 2. System-level metrics from on-premises servers 3. Custom metrics from your applications or services 4. Collect logs from Amazon EC2 instances and on-premises servers You can use Amazon CloudWatch Synthetics to create canaries, configurable scripts that run on a schedule, to monitor your endpoints and APIs. Canaries check the availability and latency of your endpoints and can store load time data and screenshots of the UI. By using canaries, you can discover issues before your customers do Amazon EC2 detailed monitoring provides more frequent metrics, published at one-minute intervals, instead of the five-minute intervals used in Amazon EC2 basic monitoring

Answer 43

Compute Optimizer generates recommendations for the following resources: 1. EC2 2. EC2 ASG 3. EBS 4. Lambda functions 5. ECS 6. Commercial software licenses Recommendation preferences 1. Rightsizing recommendation preferences - Free 2. Enhanced infrastructure metrics for ASG - Paid 3. Savings estimation mode - Allows Compute Optimizer to analyze specific pricing discounts when generating the estimated cost savings of rightsizing recommendations

Answer 44

AWS Control Tower offers the easiest way to set up and govern a secure, compliant, multi-account AWS environment AWS Control Tower has the following features: 1. Landing zone 2. Controls 3. Account Factory 4. Dashboard

Answer 45

AWS OpsWorks is a configuration management service that helps you configure and operate applications in a cloud enterprise by using Puppet or Chef AWS OpsWorks Services 1. AWS OpsWorks for Puppet Enterprise 2. AWS OpsWorks for Chef Automate 3. AWS OpsWorks Stacks (to be migrated to AWS Systems Manager)

Answer 46

In SCPs, you can restrict which AWS services, resources, and individual API actions the users and roles in each member account can access. You can also define conditions for when to restrict access to AWS services, resources, and API actions You can use backup policies to configure and automatically apply AWS Backup plans to resources across all your organization's accounts The user can access only what is allowed by both the AWS Organizations policies and IAM policies AWS Organizations is a global service with a single endpoint that works from any and all AWS Regions. You don't need to explicitly select a region to operate in

Answer 47

Their Data Plane is in different regions AWS IAM AWS Organizations AWS Account Management Route 53 Application Recovery Controller (ARC) AWS Network Manager Route 53 Private DNS Their Data Plane is on Point of Presence(PoP) Amazon CloudFront AWS WAF for CloudFront AWS Global Accelerator AWS Shield Advanced Some operations of these services have global impact: Route 53 Amazon S3 CloudFront AWS STS AWS IAM Identity Center Amazon S3 Storage Lens

Answer 48

Capabilities: 1. Application Manager helps DevOps engineers investigate and remediate issues with their AWS resources. 2. Change Manager is for requesting, approving, implementing, and reporting on operational changes to your application configuration and infrastructure 3. Use Compliance to scan your fleet of managed nodes for patch compliance and configuration inconsistencies 4. Incident Manager is an incident management console that helps users mitigate and recover from incidents affecting their AWS hosted applications 5. Use Quick Setup to configure frequently used AWS services and features with recommended best practices

Answer 49

You can convert large, high-quality digital media files into formats that users can play back on mobile devices, tablets, web browsers, and connected televisions You can protect your Elastic Transcoder data by encrypting any input and output files using S3 Server-Side Encryption or Client-Side Encryption Using Customer-Provided Keys

Answer 50

Application Discovery Service integrates with application discovery solutions from AWS Partner Network (APN) partners. These third-party solutions can help you import details about your on-premises environment directly into Migration Hub, without using any agentless collector or discovery agent.

Answer 51

Retire: Retiring the application means that you can shut down the servers within that application stack. Retain: This is the migration strategy for applications that you want to keep in your source environment or applications that you are not ready to migrate. You might choose to migrate these applications in the future. Rehost (lift and shift): Rehost is the process of moving applications from your source environment to the AWS Cloud without making any changes to the application. Relocate: Relocate is transferring a large number of servers, comprising one or more applications, at a given time from on-premises platform to a cloud version of the platform. For example, you can use this strategy to transfer servers in bulk from VMware software-defined data center (SDDC) to VMware Cloud on AWS. Repurchase (drop and shop): Repurchase means replacing your application with a different version or product. Replatform (lift, tinker, and shift): Replatform is moving an application to the cloud and introducing some level of optimization in order to operate the application efficiently, reduce costs, or take advantage of cloud capabilities. Refactor: Refactor is moving an application to the cloud, and modifying its architecture by taking full advantage of cloud-native features to improve agility, performance, and scalability.

Answer 52

DataSync works with the following on-premises storage systems: Network File System (NFS) Server Message Block (SMB) Hadoop Distributed File Systems (HDFS) Object storage The only data that DataSync handles at rest relates to the information that it discovers about your on-premises storage system and the details needs to complete your transfer. DataSync stores the following data with full at-rest encryption in Amazon DynamoDB

Answer 53

AWS Transfer Family supports transferring data from or to the following AWS storage services. Amazon S3 and Amazon EFS AWS Transfer Family supports transferring data over the following protocols: Secure Shell (SSH) File Transfer Protocol (SFTP): version 3 File Transfer Protocol Secure (FTPS) File Transfer Protocol (FTP) Applicability Statement 2 (AS2)

Answer 54

Optimization: Enabling API caching to enhance responsiveness Enabling payload compression for an API

Answer 55

Function code and configuration in CloudFront Functions is always stored in an encrypted format on the edge location POPs, and in other storage locations used by CloudFront You can improve resiliency and increase availability for specific scenarios by setting up CloudFront with origin failover

Answer 56

AWS Direct Connect links your internal network to an AWS Direct Connect location over a standard Ethernet fiber-optic cable. AWS Direct Connect does not encrypt your traffic that is in transit by default

Answer 57

Application Load Balancer (Layer 7) Protocols : HTTP or HTTPS Target Types are: 1. InstanceID 2. ip Address 3. Lambda Function When the target type is ip, you can specify IP addresses from one of the following CIDR blocks: 1. The subnets of the VPC for the target group 2. List as specified by AWS You can't specify publicly routable IP addresses. Network Load Balancers(Layer 4) Protocols: TCP, TLS, UDP, TCP_UDP Target Types are: 1. InstanceID 2. ip Address 3. Application Load Balancer Gateway Load Balancer (Gateway Load Balancers listen for all IP packets across all ports. Layer 3) Protocol : GENEVE Target Types are: 1. InstanceID 2. ip Address

Answer 58

The static IP addresses provided by AWS Global Accelerator serve as single fixed entry points for your clients. The static IP addresses accept incoming traffic onto the AWS global network from the edge location that is closest to your users By using a standard accelerator, you can improve the availability and performance of your applications running on Application Load Balancers, Network Load Balancers, or Amazon EC2 instances

Answer 59

Three main functions: 1. Register domain names 2. Route internet traffic to the resources for your domain 3. Check the health of your resources If Route 53 considers the endpoint unhealthy and if you configured notification for the health check, Route 53 notifies CloudWatch AWS Direct Connect - Describes establishing a private, logical connection from your remote network to Amazon VPC, using AWS Direct Connect. AWS Direct Connect + AWS Site-to-Site VPN – Describes establishing a private, encrypted connection from your remote network to Amazon VPC, using AWS Direct Connect and AWS Site-to-Site VPN. AWS VPN CloudHub – Describes establishing a hub-and-spoke model for connecting remote branch offices.

Answer 60

A Site-to-Site VPN connection has the following limitations. IPv6 traffic is not supported for VPN connections on a virtual private gateway. An AWS VPN connection does not support Path MTU Discovery. When connecting your VPCs to a common on-premises network, we recommend that you use non-overlapping CIDR blocks for your networks

Answer 61

AWS Ground Station is a fully managed service that enables you to control satellite communications, process satellite data, and scale your satellite operations

Answer 62

Intrusion detection and prevention service for your AWS VPC Filtering traffic going to and coming from an internet gateway, NAT gateway, or over VPN or AWS Direct Connect Tasks: Pass traffic through only from known AWS service domains or IP address endpoints, such as Amazon S3. Use custom lists of known bad domains to limit the types of domain names that your applications can access. Perform deep packet inspection on traffic entering or leaving your VPC. Use stateful protocol detection to filter protocols like HTTPS, independent of the port used.

Answer 63

Monitor the HTTP(S) requests that are forwarded to your protected web application resources. Protect the following resources: CloudFront API Gateway REST API ALB AppSync GraphQL API Amazon Cognito App Runner AWS Verified Access instance You protect by defining a web access control list (ACL) Tasks: Allow the requests to go to the protected resource for processing and response. Block the requests. Count the requests. Run CAPTCHA or challenge checks

Answer 64

We recommend Amazon EBS for data that must be quickly accessible and requires long-term persistence. Primary storage for file systems, databases You can attach multiple EBS volumes to a single instance The volume and instance must be in the same Availability Zone You create an EBS volume in a specific Availability Zone, and then attach it to an instance in that same Availability Zone. To make a volume available outside of the Availability Zone, you can create a snapshot and restore that snapshot to a new volume anywhere in that Region. You can copy snapshots to other Regions and then restore them to new volumes there, making it easier to leverage multiple AWS Regions for geographical expansion, data center migration, and disaster recovery When you create snapshots, you incur charges in Amazon S3 based on the size of the data being backed up, not the size of the source volume. Subsequent snapshots of the same volume are incremental snapshots. They include only changed and new data written to the volume since the last snapshot was created, and you are charged only for this changed and new data

Answer 65

Instance store volumes can be attached to an instance only when you launch it. You can't attach instance store volumes to an instance after you've launched it After you launch an instance with attached instance store volumes, you must mount the volumes before you can access them The data on an instance store volume persists even if the instance is rebooted. However, the data does not persist if the instance is stopped, hibernated, or terminated

Answer 66

Use Amazon S3 with Amazon EC2 Use Amazon EFS with Amazon EC2 Use Amazon FSx with Amazon EC2 Use Amazon File Cache with Amazon EC2 Amazon EFS is not supported on Windows instances. EFS automatically grows and shrinks as you add and remove files

Answer 67

The focus is on main focus is on ensuring responsible and legal use of AWS services which is "Security, Compliance, Data Protection, and Intellectual Property"