Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS > Solutions Architect - Associate > Flashcards

Solutions Architect - Associate Flashcards

1
Q

What was the first AWS service and when was it lauched?

A

SQS, 2004

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is a region?

A

Specific geography engineered for fault tolerance and high availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How many AZs are in each region (minimum)?

A

2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is an AZ?

A

Availability zone - specific DC with redundant power etc. Can be close but far enough away so local issues like flooding don’t affect multiple AZs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is an edge location?

A

Location specialised for caching content allowing faster upload/download from AWS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which services use edge locations?

A

CloudFront, S3 (accelerated transfer)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q 
Describe these IAM terms:
Users
Groups
Policies
Roles
A

Users - people/accounts
Groups - collection of users
Policies - JSON docs that define permissions
Roles - allows one part of AWS to do something with another (e.g. EC2 roles)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Is IAM regional?

A

No, it’s global

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What permissions do new users have when created?

A

None

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the structure of a policy statement?

A

Effect (Allow), Action () and Resource ().

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are AWS managed policies?

A

Read-only policies that AWS update when new features come out

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What sort of storage is S3?

A

Object-based

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What size files can be stored in S3?

A

0B to 5TB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What’s the maximum storage size of a bucket?

A

Unlimited

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What’s the URL structure of an S3 bucket?

A

s3-.amazonaws.com/
s3.amazonaws.com/

.s3.amazonaws.com
.s3-.amazonaws.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the data consistency behaviour of S3?

A

Read after write consistency for PUTs of new objects

Eventual consistency for overwrite PUTs and DELETES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What data is stored for each S3 object?

A

Key (name of object)
Value (sequence of bytes)
Version ID (for versioning)
Metadata (e.g. tags)

Subresources:
Access Control Lists
Torrent (not an exam topic)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the SLAs for S3 standard?

A

Build for 99.99% availability

Guaranteed 99.9% availability

99.99999999999% durability for S3 information (11 x 9s)

Designed to sustain the loss of 2 facilities concurrently

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What’s the use case for S3-IA?

A

Data accessed less frequently but still requires rapid access - lower standard fee but charged a retrieval fee

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What’s the use case for S3 one zone?

A

Temporary or reproducible data - no multi-AZ resilience

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the use case of S3 RRS (reduced redundancy storage)?

A

Non-critical, reproducible data. Like S3 standard but only replicated in at least 3 AZs. Legacy now - cheaper to use S3 standard.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What’s the SLA for S3 IA?

A

Availability is 99.0%, not 99.9% (but durability is the same)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is S3 intelligent tiering?

A

Changes tiers of objects depending on access behaviour to object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What’s the minimum capacity charge and storage duration of IA tier in S3?

A

128KB and 30 days

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is the first byte latency for all S3 tiers apart from Glacier?

A

Milliseconds

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are the S3 charges?

A 
Storage
Requests
Storage Management Pricing (object tagging, S3 inventory, S3 analytics storage class analysis)
Data transfer
Transfer acceleration
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is S3 transfer acceleration?

A

Transfer of files over long distances using CloudFront edge locations - data routed over optimised netowrk path

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What are the rules for bucket names?

A

Between 3 and 63 characters - DNS compliant

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Is it possible to record object-level API activity?

A

Yes, for an additional cost in CloudTrail

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What are the 4 ways to encrypt data in S3?

A

Client side
Server side - S3 managed keys (SSE-S3)
Server side - KMD (SSE-KMS)
Server side - customer provided keys (SSE-C)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is the advantage of usig SSE-KMS over SSE-S3?

A

Separate permissions and auditing for key use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Is it possible to disable S3 bucket versioning?

A

Once it’s enabled it can’t be disabled but it can be suspended

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What happens when you delete an object in a versioned S3 bucket?

A

Additional version created that is a delete marker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

How can you prevent accidental deletion of an S3 file in a versioned bucket?

A

MFA delete - can be configured via API

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Can S3 replication be used to replicate to a bucket within the same region?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What happens to delete markers with S3 replication?

A

They are not replicated (idea is to prevent deleting backups of data). Previous config (V1) did allow delete markers to be replicated.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Can you have multiple S3 replication rules?

A

Yes - each rule has a priority to determine what runs first

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

How does S3 replication handle SSE encrypted objects?

A

Decrypts and then re-encrypts in destination bucket

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is a potential risk of replicating encrypted objects using S3 replication?

A

KMS limits might be exceeded - an increase to these limits can be requested

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Can S3 replication be configured to replicate to another AWS account?

A

Yes - there’s an option to change ownership of objects to destination bucket account owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Which objects are copied as part of S3 replication?

A

New and changed objects - anything existing won’t be. Would have to use cli: aws s3 cp –recursive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Can you daisy-chain S3 replicated buckets?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Are actions performed by S3 lifecycle management replicated by S3 replication?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What is S3 lifecycle management?

A

Used to transition objects to different storage classes, or expire objects (put delete marker in)

Can also clean up multipart uploads

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

How can the scope of S3 lifecycle management be limited?

A

By prexifes or tags

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

How is behaviour defined for S3 Lifecycle management (e.g. what can be defined and what are the limits)?

A

Behaviour can be defined for current and previous versions of object.

You define the desired storage tier and the number of days after object creation or when object became a previous version.

Current versions - min 30 days
Previous versions - min 1 day

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

How can expiration and deletion be defined in S3 lifecycle management?

A

Expiration puts delete marker on the current object (min 31 days)

Can configure deletion of previous version (min 61 days)

Object delete markers clearup - when objects are expired, and previous versions deleted, current object will have delete marker. It clears these markers up. It can’t be set if rule has object expiry enabled.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What types of origin are available for CloudFront?

A

S3, EC2, ELB, Route53, Some other non-AWS origin server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What are the two types of CloudFront distribution?

A

Web Distribution

RTMP (real-time messaging protocol) - adobe flash media server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

How can you restrict bucket access so all requests must go via CloudFront?

A

Create an Origin Access Identity (essentially a new user with permission to call S3 bucket that is used by CloudFront)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What is the default CloudFront TTL?

A

24h

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

How could you restrict access to CloudFront data?

A

Signed URLs - can restrict by datetime, IP address rang etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

If a signed CloudFront URL expires while a download is in progress, does it still complete?

A

Yes - although for RTMP distributions, if user skips to another position in the media file (which triggers another play event) after expiry, CloudFront won’t serve the media file.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Can WAF be used with CloudFront

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

How do multiple origins work in CloudFormation, in terms of which origin is used?

A

Failover

Routing based on path (e.g. /images/*.jpg)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Can geo-restrictions be used with CloudFront?

A

Yes - can whitelist or blacklist particular countries

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What is AWS storage gateway?

A

Virtual appliance installed into a hypervisor running in an on-premises DC, which async replicates data to S3 of glacier

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Which hypervisors does AWS storage gateway support?

A

VMware ESXi

Microsoft Hyper-V

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What are the 4 types of AWS storage gateway?

A

File gateway - NFS
Volumes gateway (stored volumes) - iSCSI (block-based storage - vHDD stored in S3 as EBS snapshots)
Volumes gateway (cached volumes) - iSCSI (block-based storage - only most recently accessed data stored on site - rest in AWS)
Tape gateway - VTL - virtual tapes sent to S3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What are the 3 ways AWS storage gateway can communicate with S3/Glacier?

A

Direct connect
Internet
VPC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

What is iSCSI?

A

Pronounced “i-scuzzy” - internet small computer systems interface

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

How does storage gateway: volume gateway work?

A

Data written to volumes is async backed up as point-in-time snapshot and stored in S3 as EBS snapshots

Snapshots are incremental (only changed blocks captured)

Snapshot storage is compressed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

What are the two types of volume gateway?

A

Stored volumes - low-latency access to all data on-prem with incremental backups to S3 (as EBS snapshots)

Cached volumes - S3 is primary data storage while retaining frequently accessed data locally in storage gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

What is the size range for volume gateway stored volumes?

A

1GB-16TB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

What is the size range for volume gateway cached volumes?

A

1GB-32TB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

What are the 3 types of snowball and the amount of data they can handle?

A

Snowball - 80TB

Snowball edge - 100TB - has compute capability (e.g. lambda on the edge)

Snowmobile - Peta/exo-byte

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

How does S3 transfer acceleration work?

A

Uses CloudFront edge network to accelerate uploads to S3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

What is the URL format for S3 transfer acceleration?

A

.s3-accelerate.amazonaws.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

What do you pay for when S3 versioning is enabled?

A

Each version of the object - so 10 versions of a 1GB object results in charges for 10GB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

What are the time limits for lifecycle transitions?

A

Standard -> IA = 30 days after created

IA -> Glacier = 30 days

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

What is the default maximum number of S3 buckets per account?

A

100

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

What is the maximum number of PUTs per second that S3 will allow?

A

3500

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

What are the pricing options for EC2 instances?

A

On-demand: fixed rate per hour (windows) or minute (linux)

Reserved: 1-3 year contract, pay up to 100% up-front for maximum discount

Spot: bid price you want for instant capacity

Dedicated hosts - physical servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

What is the use case for on-demand EC2 instances?

A

Need for flexibility
Short-term, spiky or unpredictable workloads that cannot be interrupted
Dev/test

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

What is the use case for reserved EC2 instances?

A

Apps with steady/predictable usage

Apps that require reserved capacity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

What are the 3 types of reserved EC2 instance?

A

Standard RIs - up to 75% off on-demand price

Convertible RIs - up to 54% off - can change attributes providing creation of RIs of equal or greater value

Scheduled RIs - launch within time window you reserved on predictable recurring schedule

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

What is the use case for spot EC2 instances?

A

Workloads that can be interrupted and with flexible start/end times
Workloads only feasible at very low compute prices (e.g. genomics)
Users with urgent need for large amounts of additional capacity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

When will you be charged for a terminated spot EC2 instance?

A

If you terminate, you’ll be charged for complete hour. If EC2 terminates, you won’t be charged

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

What is the use case for dedicated EC2 instances?

A

Software licences that don’t support multi-tenant or virtualized environments
Data protection laws that prohibit multi-tenant virtualized environments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

What is EBS?

A

Elastic Block Storage - volumes that can be attached to EC2 instances

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

Is EBS durable storage?

A

Yes - an EBS instance is placed in a specific AZ and auto-replicated to protect from failure of single component

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

What is IOPS?

A

Input/output operations per second

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

What are the EBS volume types?

A

General purpose SSD - 3 IOPS per GB, max 10,000 IOPS, can burst upto 3000 IOPS for extended periods for volumes >3334GB

Provisioned IOPS (IO1) - for I/O intensive apps, up to 20,000 IOPS per volume

Throughput optimized HDD (ST1) - big data, warehousing, cannot be a boot volume

Cold HDD (SC1) - low cost, infrequently accessed workloads (e.g. file servers). Cannot be a boot volume

Magnetic (standard) - can be a boot volume, lowest cost per GB that is bootable - considered legacy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

By default, what happens to an EBS volume when the EC2 instance it is attached to is terminated?

A

It is deleted (additional volumes are not deleted by default - just the bootable volumes)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

What are the two EC2 instance status checks that AWS provides?

A

System status check - checks that packets get to instance (checking underlying hypervisor infrastructure)

Instance status check - checks packets get to OS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

Can encrypted boot volumes be created using public AMIs?

A

No. Either:
Use third party tools (e.g. BitLocker)
Make a copy of AMI and enable encryption on the copy

Additional volumes can be encrypted

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

How many security groups can a single EC2 instance be associated with?

A

Many

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

How quickly do security group changes take effect?

A

Immediately

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

Can you use security groups to DENY specific traffic?

A

Not really - everything is blocked by default. There are only ALLOW rules - which is why multiple security groups are always compatible and can’t conflict

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

Can you use security groups to block an IP address?

A

No - use network access control lists for this

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

Are security groups stateful?

A

Yes - traffic in will be allowed back out

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

Are network access control lists stateful?

A

No - have to configure both ways

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

What is the SSH port?

A

22

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

What is the RDP port?

A

3389

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

What is the MySQL/Aurora port?

A

3306

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

What are the default settings for a security group?

A

All inbound traffic is blocked

All outbound traffic is allowed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

Can volume type of EBS be changed while instance is running?

A

Yes - might be some performance degradation while it’s changing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

Which EBS volume types cannot be changed?

A

Standard (magnetic) volumes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

How can you migrate an EC2 instance to another region?

A

Copy the EBS snapshot (or AMI created from the snapshot) to another region using console/cli

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

Are volumes created from encrypted snapshots encrypted?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

What are the two types of EC2 instance/AMI?

A

EBS-backed

Instance store backed (ephemeral)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

What are the properties of instance store EC2 instances?

A

Can only be rebooted or terminated
Upon reboot or termination, any data on the instance will be lost
Longer provisioning times because store volume created from template in S3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

What are the three types of ELBs?

A

Application load balancer - great for HTTP(S) - layer 7

Network load balancer - great for TCP where extreme performance required - layer 4

Classic load balancer - layer 7 and 4 - http(s) - legacy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

What would a 504 error indicate from an ELB?

A

Struggling to communicate with whatever it’s balancing load to (e.g. EC2 instance)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

What is the purpose of the X-Forwarded-For header?

A

EC2 instances only see private IP address of load balancer, therefore application or classic load balancer will pass on user’s IPv4 address in this header

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

How are instances monitored by ELB reported?

A

InService

OutOfService

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

How can health checks be configured for ELB?

A

Requesting a particular path over a particular protocol and port

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

What are the 4 broad EC2 metrics that CloudWatch can monitor?

A

CPU (usage)
Disk (IOPS)
Network (packets in/out)
Status (e.g. failed instance/system)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

What actions can happen when a CloudWatch alarm is triggered?

A

Notification (SNS topic)
EC2 action (start, stop, restart etc.)
AutoScaling action

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
110
Q

What are CloudWatch events?

A

Events are streamed when AWS resources change state - rules can be created to match selected events in the stream and route them to targets to take action (e.g. invoke lambda, put in Kenisis stream, create an EBS snapshot etc.)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
111
Q

How can logs be sent to CloudWatch?

A

There is an agent that can be installed on EC2 instances

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
112
Q

What is the difference between CloudWatch and CloudTrail?

A

CloudWatch - logging and monitoring

CloudTrail - auditing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
113
Q

Can you change EC2 roles while the instance is running?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
114
Q

How can you get meta-data on an EC2 instance?

A

http://169.254.169.254/latest/meta-data/

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
115
Q

How can you get the IP address of an EC2 instance?

A

http://169.254.169.254/latest/meta-data/public-ipv4

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
116
Q

Is EC2 userdata suitable for sensitive information?

A

No - it’s not cryptographically stored

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
117
Q

What comes first - launch configuration or autoscaling group?

A

Autoscaling groups require a launch configuration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
118
Q

What is a launch configuration?

A

A selected AMI, instance size etc. - essentially like configuring a new instance without actually creating it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
119
Q

What is an autoscaling group?

A

Uses a launch configuration to launch a desired number of instances into specific AZs (AWS will spread instances across selected AZs)

Autoscaling groups also need to know which ELB to use and about health check configuration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
120
Q

What are the 2 types of health check that autoscaling groups support?

A

EC2 (monitor health of instances)

ELB (uses load balancer health check config)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
121
Q

What is a health check grace period on autoscaling groups?

A

Length of time in seconds before health checks start to prevent instance being regarded as unhealthy while it is still being provisioned

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
122
Q

What are auto-scaling launch templates?

A

New thing that lets you define combinations of different instance sizes etc.

123
Q

What sort of policies can drive auto-scaling groups?

A

Specific group size

Mix/max number based on CPU, ELB request count, network traffic

Can use steps to incrementally add instances when particular metrics are met, or just set a specific amount

Can disable “scale-in” (i.e. reducing number of instances after scaling - or can use a different metric to drive this)

124
Q

Which technology would be useful for mitigating EC2 regional failures?

A

Route53

125
Q

What are the three types of EC2 placement groups?

A

Clustered (usually what exam refers to) - group within single AZ - good for low latency and/or high network throughput - only certain instances (usually bigger) - no particular instance count limit advertised

Spread - each instance on distinct underlying hardware - good for small number of critical instances - can span multiple AZs - max of 7 per AZ per placement group

Partition - instances in different partitions won’t share underlying hardware (but instances in same partition might) - max 7 partitions per AZ - no limit to instance count

126
Q

What is EFS?

A

Elastic File System - elastic (like S3) file storage

127
Q

What benefit does EFS have over EBS?

A

EFS instance can be mounted on two or more EC2 instances at once - EBS instances can only be mounted to one instance at a time

128
Q

What protocol does EFS support?

A

NFSv4 (network file system version 4)

129
Q

What is the consistency model of EFS?

A

Read after write

130
Q

Is EFS regional? How does it behave with regards to AZs?

A

Yes - use select “mount targets” - essentially which AZs to use, along with subnets, IP addresses and security groups for each mount target

You get an IP address for each mount target

131
Q

What are the two ways Lambda can be invoked?

A

Event-driven (e.g. in response to a change in S3)

Request-driven - API gateway or SDK call

132
Q

Can requests share an instance of a lambda function?

A

Not concurrently - each request is routed to its own instance, but instances can be reused once a request has finished

133
Q

What are the runtimes available for Lambda functions?

A 
C# (.net core 1.0, 2.0, 2.1)
Go 1.x
Java 8
Node.js (various versions)
Python (various versions)
Ruby 2.5
134
Q

What are the triggers for lambda functions?

A 
(*** = remember for exam)
API Gateway ***
AWS IoT
Alexa Skills Kit (in response to alexa skill being invoked) ***
Alexa Smart Home
CloudFront ***
CloudWatch Events *** 
CloudWatch Logs ***
CodeCommit
Cognito Sync Trigger
Dynamo DB ***
Kinesis ***
S3 ***
SNS ***
135
Q

How is lambda priced?

A

Number of requests

Duration (per GB-second)

136
Q

What tool can assist with debugging lambda architectures?

A

AWS X-ray

137
Q

What is the maximum running time of a lambda function?

A

15 minutes

138
Q

What is CORS?

A

Cross origin resource sharing

139
Q

How can you make an unencrypted EBS-backed root volume encrypted?

A

Provision instance, take snapshot, and encrypt volume when deploying snapshot

140
Q

What’s the difference between standard and detailed CloudWatch monitoring of EC2 instances?

A

Every 5 minutes vs every 1 minute

141
Q

In addition to choosing the correct EBS volume type for your specific task, what else can be done to increase the performance of your volume?

A

Striping using RAID 0

Choose EC2 instance that supports EBS optimisation

For HDDs, ensure snapshots are done in periods of low-usage

142
Q

Can I delete a snapshot of an EBS Volume that is used as the root device of a registered AMI?

A

No

143
Q

What is the underlying Hypervisor for EC2 ?

A

Xen and Nitro

144
Q

Can I move a reserved instance from one region to another?

A

No

145
Q

How many bits make up an IPv4 address?

A

32

146
Q

How many bits make up an IPv6 address?

A

128

147
Q

Which port does DNS operate over?

A

53

148
Q

What’s the big difference between CNAME records and Route53 alias records?

A

Alias records can handle “naked” domains - CNAME can’t.

Also, alias records save time because Route53 automatically recognises changes in record sets that the alias record refers to

149
Q

Which two records does a DNS zone always contain?

A

SOA and global TTL

150
Q

What are the 6 routing policies available in Route53?

A 
Simple routing
Weighted routing
Latency-based routing
Failover routing
Geolocation routing
Multivalue answer routing
Geoproximity (traffic flow only)
151
Q

How does failover routing work in Route53?

A

Stand-alone Route53 healthchecks can monitor:
Endpoint (domain or IP)
Status of other health checks
State of CloudWatch alarm
Advanced health checks available for additional cost, e.g. string matching or latency measurement

152
Q

What is multivalue answer routing in Route53?

A

For randomly routing traffic to multiple resources - can return up to 8 healthy records in response to query in random order - if one is down, client software will try another.

Essentially simple routing with multiple records

153
Q

What is the difference between geolocation and geoproximity routing in Route53?

A

Geoproximity is only available in traffic manager

Geoproximity allows you to resize geo-regions (bias between -99 and 99). If using non-AWS resources, can specify lat/long

154
Q

What is a CNAME record?

A

It assigns an alias name to a Canonical name - essentially points to A record of the canonical name given

155
Q

What is the maximum default limit of domain names for Route53?

A

50 - more can be requested

156
Q

Which DBs are available in RDS?

A 
Microsoft SQL Server
Oracle
MySQL
PostgreSQL
Amazon Aurora
Maria DB
157
Q

What is DynamoDB?

A

Non-relational database - serverless

158
Q

What are the components of a non-relational database like DynamoDB?

A

Collection (like a table)

Document (like a row)

Key-value pairs (like a field)

159
Q

What is OLTP and OLAP?

A

Online transaction processing (RDS/No-SQL DBs)

Online analytical processing (like datawarehousing/Redshift)

160
Q

Which in-memory caching engines are supported by Elasticache?

A

Memcached

Redis

161
Q

What are the two ways to perform a backup of an RDS DB?

A

Automated backups

Database snapshots (manually initiated)

162
Q

What is the maximum retention period of an RDS backup?

A

35 days

163
Q

RDS automated backups - do they store transaction logs?

A

Yes, for the full daily snapshot. This allows point-in-time restores when recovering

164
Q

Where are RDS automated backups stored?

A

S3

165
Q

When restoring an RDS automated backup or snapshot, what happens to the RDS instance?

A

It is re-created with a new DNS enpoint

166
Q

Which RDS DBs support encryption at rest?

A

All of them

167
Q

What is RDS Multi-AZs used for?

A

DR

168
Q

How is data replicated to multi-AZ in RDS?

A

Synchronously replicated to the other (stand-by) instances

169
Q

What are RDS read-replicas used for?

A

To scale out read capacity

170
Q

How is data replicated to read-replicas in RDS?

A

Asynchronously

171
Q

What must be enabled to deploy read replicas in RDS?

A

Automatic backups

172
Q

Can RDS read-replicas have multi-AZ, and multi-AZ instances have read-replicas?

A

Yes

173
Q

Which RDS DB types are read-replicas available for?

A

MySQL
PostegreSQL
MariaDB
(Not SQL Server, Oracle or Aurora)

(Aurora works a bit differently but you can get the same benefits)

174
Q

How can you scale write capacity in RDS?

A

Vertically scale the instance (this will result in downtime or failover to multi-AZ instance)

175
Q

What data models does DynamoDB support?

A

Document

Key-value pairs

176
Q

What storage medium type does DynamoDB use?

A

SSD

177
Q

What are the two consistency models available for DynamoDB?

A

Eventually consistent reads (default - consistency usually within 1 second - best performance)

Strongly consistent reads - all writes that received success response can be read immediately

178
Q

How does DynamoDB pricing work?

A

It’s based on provisioned throughput capacity

Write throughput and read throughput are priced differently - writes are more expensive

A unit is 1 read or 1 write per second

Billed in blocks of 50 read capacity units and 10 write capacity units

Can work out requirements by dividing number of reads/writes by seconds in a day, and rounding to nearest block amount

179
Q

Can reserved capacity be purchased for DynamoDB?

A

Yes

180
Q

What are the properties of a DynamoDB table?

A

Each table has a name and a primary key (can be string, binary or number)

Read/write capacity can be adjusted per table

Tables contain “items” - JSON documents

These items can have key/value pairs in addition to primary key of table

181
Q

What is Redshift?

A

Data Warehouse as a service in AWS

182
Q

What are the two configurations of Redshift?

A

Single node - up to 160GB - good for starting out

Multi-node - lead node and up to 128 compute nodes

183
Q

How does Redshift store data in comparison to relatonal databases?

A

It uses columnar storage, as opposed to rows (results in fewer I/Os as data stored sequentially on storage media and only columns needed are there)

184
Q

How does Redshift handle compression?

A

Data automatically sampled and most appropriate compression scheme is selected

185
Q

How is encryption managed in Redshift?

A

Can use KMS or manage own keys through HSM

186
Q

How is Redshift priced?

A

Compute node hours (not charged for lead node hours - just sum of compute node hours)

Backup

Data transfer

187
Q

Is Redshift highly available?

A

Only 1 AZ supported currently - can restore snapshots to another AZ in event of an outage

188
Q

What is the difference between Memcached and Redis?

A

Memcached is an in-memory object caching system, whereas Redis is an in-memory key/value store

189
Q

Which caching engines support multi-AZ in Elasticache?

A

Redis - supports master/slave replication across multiple AZs to achieve redundancy

190
Q

What are the data transfer charges in DynamoDB?

A

No charges for transferring data in, providing you stay within single region (cross region - charged at both ends for data transfer)

191
Q

What is Aurora?

A

Highly available relational database - x5 speed of MySql

192
Q

What are the data redundancy properties of Aurora?

A

2 copies of data in each AZ, with a minimum of 3 AZs (so 6 copies of data)

Designed to lose two copies of data without affecting DB write availability and 3 copies without affecting read availability (note - this is the physical storage volume - use Aurora replicas for additional instances)

Storage is self healing

193
Q

How many Aurora replicas can you have?

A

Up to 15

194
Q

How many Aurora (MySql) read recplicas can you have?

A

Up to 5 (no failover if primary is lost)

195
Q

How to Aurora replicas and failovers relate?

A

Primary instance can failover to any Aurora replica.
Replicas have failover priorities.
If replica is not the primary, it’s used as a read replica.

196
Q

How are Aurora replicas addressed?

A

Each replica gets an instance DNS address.

Primary instance has cluster address - can be used by apps (in event of failover DNS is automatically updated)

197
Q

Are automated backups in RDS enabled by default?

A

Yes

198
Q

What is the SQL Server port?

A

1433

199
Q

Can you get reserved instances for RDS?

A

Yes, for multi-AZ deployments

200
Q

How is a VPC address range defined?

A

CIDR (classless inter-domain routing) block

201
Q

What is a high level overview of how traffic might flow through from the internet to an EC2 instance?

A 
Internet Gateway
Router (invisible)
Route table
Network ACL
Security Group
EC2 instance
202
Q

Can subnets span multiple AZs?

A

No

203
Q

What are the 3 internal IP address schemes allowed (for use by subnets)?

A

10/8 - biggest address range

  1. 16/12
  2. 168/16 - smallest address range
204
Q

What’s the soft limit for VPCs in a region?

A

5

205
Q

How would you block an IP address?

A

Using a network ACL

206
Q

What is the default VPC?

A

Automatically created in every region, allowing instant deployment of instances

207
Q

What IP addresses does an EC2 instance get?

A

Public and private, unless deployed in a private subnet, in which case you only get a private IP address

208
Q

What is VPC peering?

A

Allows you to connect one VPC with another via a direct network route using a private IP address

Instances behave as if they’re on the same network

Can peer VPCs with other AWS accounts

Transitive peering is not supported

209
Q

Do VPCs have a router?

A

Yes - it’s implicit - you can’t modify it

210
Q

What are the tenancy options for a VPC?

A

Shared (default)

Dedicated (dedicated hardware - expensive)

211
Q

What do you get on creation of a VPC?

A

Route table (allows subnets to communicate by default)

Network ACL (allows all out/in traffic by default)

Security group

(No subnets or internet gateway)

212
Q

Which 5 private IP addresses does AWS reserve in a VPC?

A

First: network address

Second: VPC router

Third: to do with DNS

Fourth: reserved for use

Last: Network broadcast address (AWS don’t support broadcast in a VPC, and therefore reserve this address)

213
Q

How many internet gateways can be attached to a VPC?

A

1

214
Q

How many VPCs can an internet gateway be attached to?

A

1

215
Q

What routes is the default route table created with?

A

IPv4 and IPv6 rules allowing subnets to communicate (destination is subnet mask of entire VPC)

216
Q

What subnet associations does the default route have?

A

None - any subnets not explicitly associated with any route table are associated with the default route table by default

217
Q

How would you enable internet access for a subnet?

A

Add a new route to the route table that the subnet is associated with that takes all traffic and targets the internet gateway

So, destination: 0.0.0.0/0 and ::/0

Target: internet gateway

218
Q

What’s the default setting for auto-assigning public IPv4 addresses in a VPC?

A

Set to “yes” - would need to explicitly disable this behaviour if desired

219
Q

Can security groups be shared across VPCs?

A

No

220
Q

What are the two options for NAT?

A

NAT gateway (serverless)

NAT instance (set up yourself - AMIs available)

221
Q

Why might you use a NAT instance or NAT gateway?

A

To provide internet access to private subnets (because the private instances within won’t have public IP addresses)

222
Q

If you’re using IPv6, how could you provide internet access to a private subnet?

A

Egress only internet gateway (works because all instances do have an IP address)

223
Q

What are the high level steps for setting up a NAT gateway?

A

Create NAT instance in a PUBLIC subnet

Disable source/destination checks for NAT instance

Configure route table to route all traffic in subnet to NAT instance

Set up any scaling or redundancy needed

224
Q

Why might you use a NAT instance over a NAT gateway?

A

Can be used as a bastion server (not supported with NAT gateways) - allows SSH to private instances

225
Q

What ports does the NAT gateway use?

A

Ephemeral ports (1024-65535)

226
Q

What is the ephemeral port range?

A

1024-65535

227
Q

What are the relationships between Network ACLs, subnets and VPCs

A

Many subnets to one Network ACL

One network ACL per subnet

One VPC per network ACL

228
Q

What is assessed first - network ACLs or security groups?

A

Network ACLs, then security groups

229
Q

What are the requirements for creating an ELB in a custom VPC?

A

ELB must be in at least 2 AZs for redundancy

Subnets must be public (have an internet gateway)

230
Q

What are the 3 levels of VPC flow logs?

A

VPC (captures all Elastic Network Interface traffic)

Subnet (only EC2/ENIs in that subnet)

Network interface

231
Q

Can you enable flow logs for a peered VPC?

A

Yes if that VPC is in the same account

232
Q

Which traffic is excluded from VPC flow logs?

A

Amazon DNS server traffic

Amazon windows licence activation

169.254.169.254 (instance metadata)

Traffic to default VPC router (reserved IP address)

DHCP traffic

233
Q

What is a bastion/jump box?

A

Allows connection to instances in private subnet (e.g. via SSH or RDP)

234
Q

What are the two types of VPC endpoints?

A

Interface (an ENI attached to an EC2 instance)

Gateway (managed, HA, target for route in route table, can be used by all instances - it’s not attached to them).

235
Q

What are VPC gateway endpoints?

A

Gateway (managed, HA, target for route in route table, can be used by all instances - it’s not attached to them).

Different gateways for different services, e.g. DynamoDB, S3.

Can define policy for VPC endpoint in terms of what it can access

236
Q

If an EC2 instance doesn’t already have a public IP address, how can it be made public?

A

Create elastic IP address and internet gateway. Associate the elastic IP with the EC2 instance.

237
Q

What are the default settings of a newly created security group?

A

All OUTBOUND traffic is allowed by default

238
Q

What is the policy on conducting your own vulnerability scans on your own VPC?

A

Can’t do it without alerting AWS first

239
Q

What’s the difference between SQS and SNS?

A

SQS is a pull-based message queue

SNS is push-based (pub/sub)

240
Q

What’s the maximum size of an SQS message?

A

256 KB

241
Q

How many attributes (metadata) can an SQS message have?

A

Up to 10

242
Q

What are the two types of SQS queues?

A

Standard

FIFO

243
Q

What are the maximum transactions per second (TPS) for each type of SQS queue?

A

Standard - virtually unlimited

FIFO - 300 TPS (could be up to 3000 with batching (can process 10 at a time))

244
Q

What are the message delivery guarantees of each type of SQS queue?

A

Standard - message delivered at least once

FIFO - message delivered exactly once

245
Q

What are the ordering properties of each type of SQS queue?

A

Standard - best effort ordering

FIFO - guaranteed ordering

246
Q

What is the purpose of message groups in SQS?

A

Used in FIFO queues

Messages with the same MessageGroupID will be processed in order. Messages with different MessageGroupIDs might be processed out of order

247
Q

What are the minimum, maximum and default retention periods for a message in an SQS queue?

A

1 minute - 14 days

Default: 4 days

248
Q

What properties must the name of an SQS FIFO queue have?

A

Ends in .fifo

249
Q

How to message deduplication IDs work in SQS?

A

Any message with the same deduplication ID will be successfully accepted but won’t be delivered within the 5 minute deduplication window

Applies to entire queue, not just individual message groups

SQS keeps track of deduplication IDs even after message is received and deleted

250
Q

What is an SQS sequence number?

A

Large, non-consecutive number that SQS assigns to each message

251
Q

What is SQS visibility timeout?

A

Amount of time a message is invisible in the queue after a reader picks up the message

Provided the job is processed before the visibility timeout expires, the message will then be deleted from the queue. If not, the message becomes visible again and another reader will process it

This could result in the same message being delivered twice

252
Q

What is the default and maximum visibility timeout of SQS?

A

Default: 30s

Max: 12h

253
Q

What’s the difference between SQS short and long polling?

A

Short polling returns immediately, even if queue is empty

Long polling doesn’t return until message is on the queue, or long poll times out (can save money)

254
Q

What is SWF?

A

Simple Workflow Service

Used to co-ordinate tasks across distributed application components, as a distribution of tasks

Tasks can include executable code, web api calls, human intervention etc.

255
Q

What are the following components in SWF?

Workflow starters
Worker
Decider

A

Workflow starters: App that can initiate workflow

Worker: Programs that interact with SWF to get and process tasks and return the result

Decider: Program that controls coordination of tasks (ordering, concurrency, scheduling)

256
Q

Could a task be duplicated in SWF?

A

No. Unlike SQS (where message visibility timeout could expire or duplicated on standard queue), SWF ensures no duplication of tasks

257
Q

What is an SWF domain?

A

Workflow and activity types and the workflow execution itself are all scoped to a domain.
Domains isolate a set of types, executions, and task lists from others within the same account.

258
Q

What is the maximum SWF workflow length (i.e. maximum idle time)?

A

1 year - value always measured in seconds

259
Q

What is the SWF retention period and the maximum value?

A

Days that history of workflow executions is retained.

Maximum: 90 days

260
Q

What is the difference between SQS and SWF?

A

SWF presents a task-oriented API, SQS is message-oriented API

SWF ensures a task is assigned only once and is never duplicated. SQS - need to handle duplicate messages and may also need to ensure a message is processed only once

SWF - keeps track of all tasks and events in an app SQS - need to implement app-level tracking, especially if app uses multiple queues

261
Q

Why might you use SWF over SQS?

A

If a process will take longer than 12h (because that’s the maximum visibility timeout in SQS)

262
Q

What subscribers does SNS support?

A

HTTP

HTTPS

Email

Email-JSON

SQS

Application

Lambda

263
Q

What is an SNS topic?

A

Group multiple recipients

Access point for allowing recipients to dynamically subscribe for identical copies of the same notification

One topic supports deliveries to multiple endpoint types

When you publish once to a topic, SNS delivers appropriately formatted copies of your message to each subscriber

264
Q

What is Elastic Transcoder?

A

Media transcoder in the cloud

Convert media files into other formats

Provides transcoding presets for popular output formats (takes away guessing about which settings work best on particular devices)

Pay based on minutes that you transcode and resolution at which you transcode

265
Q

What is Kinesis?

A

Kinesis is a service that you send streaming data to. Allows data to be loaded and analyzed.

266
Q

What are the 3 core Kinesis services?

A

Kinesis Streams

Kinesis Firehouse

Kinesis Analytics

267
Q

What is Kinesis Streams?

A

Producers send data in, which is retained for 24h - 7 days, and read by consumers (e.g. EC2 instances)

Data stored in shards. Each shard provides capacity, so data capacity of stream is a function of the number of shards in the stream.

268
Q

What is Kinesis Firehose?

A

Producers send data in, but unlike Kinesis Streams there is no data retention - data goes straight to a destination (e.g. S3)

Can optionally use lambda to transform data in real-time

CAn write directly to elasticache clusters

Can’t write directly to redshift (need to save to S3 first and then copy over)

269
Q

What is Kinesis Analytics?

A

Allows you to run SQL-like queries on data in Kinesis streams or Kinesis Firehose - can store results somewhere else (e.g. S3)

270
Q

What are the 5 pillars of the AWS well architected framework?

A

Security

Reliability

Performance Efficiency

Cost Optimization

Operational Excellence

271
Q

In the AWS well architected framework, what are the areas of Security?

A

Data Protection

Privilege management

Infrastructure protection

Detective controls

272
Q

In the AWS well architected framework, what are the areas of Reliability?

A

Foundations

Change management

Failure management

273
Q

In the AWS well architected framework, what are the areas of Performance Efficiency?

A

Compute

Storage

Database

Space-time trafeoff

274
Q

In the AWS well architected framework, what are the areas of Cost Optimization?

A

Matched supply and demand

Cost effective resources

Expenditure awareness

Optimizing over time

275
Q

In the AWS well architected framework, what are the areas of Operational Excellence?

A

Preparation

Operation

Response

276
Q

What is OpsWorks?

A

Orchestration service that uses Chef and Puppet

A way of using infrastructure as code to ensure desired state across resources

Contains “recipes” to maintain a consistent state

Look for terms chef, recipes or “cook books” and think OpsWorks

277
Q

What are the 2 feature sets of AWS organisations?

A

Consolidated billing (just having a single payer and consolidated bill)

All features (consolidated billing features AND policy-based controls and hierarchical management of accounts)

278
Q

What is the default maximum of linked AWS accounts?

A

20 accounts

279
Q

How does volume discounts and RIs work with linked accounts?

A

You get the volume discount of all resources used across accounts, and unused RIs will be used by other accounts that need them

280
Q

How can you consolidate CloudTrail logs?

A

Turn on CloudTrail in paying account

Create bucket policy that allows cross-account access

Turn on CloudTrail in other accounts and use bucket in paying account

281
Q

What is an SCP?

A

SCP - Service Control Policy - control AWS service use across multiple AWS accounts (e.g. deny use of DynamoDB to some group within an organisation) - even if IAM in that account allows it, SCP will override it

Overall effect of an SCP can be to allow or deny specific services and actions

Can be applied to accounts and/or OUs

282
Q

How can cross-account access be configured?

A

Using roles.

Assuming a prod account with resources and a corporate account with users:

Create policy in prod account that grants access to stuff

Create role in prod account that uses that new policy (you also have to provide account ID of corporate account here)

In corporate account, create group policy that allows users to assume that role (will need arn of role in production account. Action is sts:AssumeRole).

283
Q

What are the two types of resource group?

A

Classic - global groups

AWS systems manager - regional groups, groups themselves can be tagged, much more powerful (can do stuff like execute automations and get detailed insights)

284
Q

Is cross-region VPC peering supported?

A

Yes

285
Q

Can you peer VPCs with overlapping CIDR blocks?

A

No

286
Q

What is AWS Direct Connect?

A

Dedicated line from on-prem to AWS. Can reduce network cost, increase throughput and maintain consistency. Can also increase reliability.

287
Q

What’s the difference between direct connect and VPN?

A

VPN is quickly configured and good for immediate need
Low-modest bandwidth requirements
Can tolerate variability in internet-based connectivity

AWS Direct Connect does not involve the internet
Private network connection between on-prem and Amazon VPC

288
Q

What are the available connection speeds with AWS Direct Connect?

A

10 Gbps

1 Gbps

<1 Gbps (through AWS Direct Connect Partners)

289
Q

What is STS?

A

Security Token Service

Grants users limited and temporary access to AWS resources

290
Q

Where can users come from with respect to STS?

A

Federation - e.g. AD, uses SAML

Federation with mobile apps - e.g. Fb, Google, other OpenID providers…

Cross account access - roles issue temp credentials via STS

291
Q

What is LDAP?

A

Lightweight Directory Access Protocol - industry standard for accessing directory services (AD supports LDAP)

292
Q

What is AWS Workspaces?

A

VDI: Virtual Desktop Infrastructure

Replacement for traditional desktop

Can connect from many devices via AWS client app

Supports windows and linux desktops

293
Q

How is AWS Workspaces backed up?

A

All data on D drive (user’s volume) is backed up every 12 hours (or if WorkDocs Sync is enabled on WorkSpace, folder a user chooses to sync will be continuously backed up and stored in Amazon WorkDocs)

294
Q

What is ECS?

A

Elastic Container Service

295
Q

What are the high-level components of Docker?

A

DockerFile - creates a layer in a docker image

Docker image - like an AMI

Docker container - initialised docker image

Layers/union file system - allows the file systems of container and host to be transparently overlaid to provide single file system

Docker engine/daemon - runs containers

Docker client - UI for daemon

Docker registries - store and download docker images

296
Q

What is ECR?

A

Elastic Container Registry

297
Q

Is ECS a regional service?

A

Yes

298
Q

What does ECS do?

A

Schedules placement of containers on a cluster based on resource needs, isolation policies and availability requirements

Abstracts the operation of cluster management

Can also be used to manage and scale batch and ETL workloads

299
Q

What is an ECS task definiton and ECS scheduling?

A

JSON file that describes one or more containers that form an app. Define stuff like the docker images to use, CPU allocation, networking, IAM roles, desired container count etc.

ECS scheduler ensures desired number of tasks are running and are registered with an ELB (if desired). Can create your own or use a third-party

300
Q

What is ECS container agent?

A

Allows cluster instance to connect to cluster

Included in ECS-optimized AMI

Can be installed separately

Linux based (windows support??)

301
Q

In ECS, at what level do security groups attach?

A

At the instance level (the host - not the task or a container)

302
Q

What is SAML?

A

Security Assertion Markup Language

303
Q

High level, how might AD integration work with AWS in terms of signing into the AWS console with AD credentials?

A

Active Directory Federation Services (ADFS) is installed at company

User goes to some internal site hosted by domain

SSO page prompts for AD credentials (or this is handled by browser - reverse proxy magic)

ADFS authenticates user with AD

User receives SAML assertion in form of authentication response from ADFS

User posts SAML assertion to AWS sign-in endpoint for SAML (https://signin.aws.amaozn.com/saml)

Behind the scenes, sign-in uses AssumeRoleWithSAML API to get temp creds and the constructs sign-in URL for console

User redirected to this address

304
Q

At a high level, how can AD integration be configured in AWS?

A

Configure in IAM.

Create new Identity Provider in IAM (will need to upload FederationMetadata.xml from ADFS that defines the trust)

Create roles for AD users to assume.

Configure relay in ADFS and configure SAML attributes required by AWS. (So there’s two-way trust that must be configured).

AWS (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions