Aws Certification Flashcards ionicons-v5-c

Which statement best describes IAM?

IAM allows you to manage users, groups, roles, and their corresponding level of access to the AWS Platform.

You have created a new AWS account for your company, and you have also configured multi-factor authentication on the root account. You are about to create your new users. What strategy should you consider in order to ensure that there is good security on this account.

Enact a strong password policy: user passwords must be changed every 45 days, with each password containing a combination of capital letters, lower case letters, numbers, and special symbols.

When you create a new user, that user ________.

Will be able to interact with AWS using their access key ID and secret access key using the API, CLI, or the AWS SDKs.

Which of the following is not a feature of IAM?

IAM allows you to setup biometric authentication, so that no passwords are required.

Power User Access allows ________.

Access to all AWS services except the management of groups and users within IAM.

You are a developer at a fast growing start up. Until now, you have used the root account to log in to the AWS console. However, as you have taken on more staff, you will now need to stop sharing the root account to prevent accidental damage to your AWS infrastructure. What should you do so that everyone can access the AWS resources they need to do their jobs? (Select 2)

Create individual user accounts with minimum necessary rights and tell the staff to log in to the console using the credentials provided. Create a customized sign in link such as "yourcompany.signin.aws.amazon.com/console" for your new users to use to sign in with.

What is an AWS region?

A region is a geographical area divided into Availability Zones. Each region contains at least two Availability Zones.

What is a VPC?

Virtual Private Cloud

What does an AWS Region consist of?

A distinct location within a geographic area designed to provide high availability to a specific geography.

Which statement best describes Availability Zones?

Distinct locations from within an AWS region that are engineered to be isolated from failures.

What is the fundamental difference between Elastic Beanstalk & CloudFormation?

Elastic Beanstalk automatically handles the deployment of your code -- from capacity provisioning, load balancing, auto-scaling to application health monitoring -- based on the code you upload to it, whereas CloudFormation is an automated provisioning engine designed to deploy entire cloud environments via a JSON script.

What is AWS Storage Gateway?

It's an on-premise virtual appliance that can be used to cache S3 locally at a customers site.

What is Amazon Glacier?

An AWS service designed for long term data archival.

What does S3 stand for?

Simple Storage Service

The use of a placement group is ideal _______

Your fleet of EC2 instances requires high network throughput and low latency within a single availability zone.

Route53 is named so because________.

The DNS Port is on Port 53 and Route53 is a DNS Service.

True or False: There is a limit to the number of domain names that you can manage using Route 53.

True and False. With Route 53, there is a default limit of 50 domain names. However, this limit can be increased by contacting AWS support.

What happens to the I/O operations of an RDS instance during a database snapshot or backup?

I/O operations to the database are suspended for the duration of the snapshot if it is a single AZ RDS instance.

VPC stands for

Virtual Private Cloud

What is the difference between SNS and SQS?

SNS is a push notification service, whereas SQS is message system that requires worker nodes to poll a queue.

In SWF, what does a "domain" refer to?

A collection of related workflows

What happens when you create a topic on Amazon SNS?

An Amazon Resource Name is created.

What does Amazon SES stand for?

Simple Email Service

Amazon Corporate Segregation

Logically, the AWS Production network is segregated from the Amazon Corporate network by means of a complex set of network security / segregation devices.

IP Spoofing

The AWS-controlled, host-based firewall infrastructure will not permit an instance to send traffic with a source IP or MAC address other than its own. These scans must be limited to your own instances and must not violate the AWS Acceptable Use Policy. You must request a vulnerability scan in advanced.

Trusted Advisor

Inspects your AWS environment and makes recommendations when opportunities may exist to save money, improve system performance, or close security gaps.

Instance Isolation

Different instances running on the same physical machine are isolated from each other via the Xen hypervisor.

Guest Operating System

Virtual instances are completely controlled by you, the customer. You have full root access or administrative control over accounts, services, and applications. AWS does not have any access rights to your instances or guest OS.

Firewall

Amazon EC2 provides a complete firewall solution; this mandatory inbound firewall is configured in a default deny-all mode and Amazon EC2 customers must explicitly open the ports needed to allow inbound traffic.

Guest Operating System

AWS provides the ability to encrypt EBS volumes and their snapshots with AES-256. The encryption occurs on the servers that host the EC2 instances, providing encryption of data as it moves between EC2 instances and EBS storage.

Elastic Load Balancing

SSL Termination on the load balance is supported. This allows you to identify the originating IP address of a client connecting to your servers, whether you're using HTTPS or TCP load balancing.

Direct Connect

Bypass internet service providers in your network path. You can procure rack space within the facility housing the AWS Direct Connect location and deploy your equipment nearby. Once deployed, you can connect this equipment to AWS Direct Connect using a cross-connect.

Risk

AWS management re-evaluates the strategic business plan at least biannually. AWS Security regularly scans all internet facing service endpoint IP addresses for vulnerabilities. In addition, external vulnerability threat assessments are performed regularly by independent security firms.