Aws Sysops Administrator Associate Flashcards

Host Level Metrics Consist of (4)?

CPUNetworkDiskStatus Check

True/False: Ram Utilization is a custom metric?

True

Default monitoring is _ minutes of granularity while detailed monitoring is minute(s) of granularity.

5, 1

What is the API call to retrieve metrics data from cloudwatch?

GetMetricStatistics

Cloudwatch stores logs _______ by default.

Indefinitely

True/False: You can retrieve data form any terminated EC2/ELB instance after termination.

True

In order to use cloudwatch to monitor on-premise, what two items must you download & install?

SSM AgentCloudwatch Agent

What are the 4 types of EBS Storage?

GP2 (General Purpose SSD)io1 (Provisioned IOPS SSD)st1 (Throughput Optimized HDD)sc1 (Cold HDD)

What metrics return the total number of I/O operations in a specified period of time?

VolumeReadOps, VolumeWriteOps

What metric return the number of read and write operation requests waiting to be completed in a specified period of time?

VolumeQueueLength

Also referred to as the layer 7 load balancer and typically used for HTTP/HTTPS traffic.

Application Load Balancer

Also referred to as the layer 4 load balancer and typically used for high performance and network throughput demands.

Network Load Balancer

What are the 4 ways to monitor ELB's?

Cloud Watch MetricsAccess LogsRequest TracingCloudtrail Logs

True/False: As soon as you provision an ELB, you must turn on Cloud Watch metrics.

False, CW metrics are turned on by default when you provision an ELB.

These logs provide detailed information about requests sent to your load balancer and contain information such as time request received, clientIP, latencies, request paths, and server responses.

Access Logs

Access Logs are an ___ feature (disabled by default). They are stored in _.

optional, s3

True/False: Access logs can store data where EC2 instances have been deleted?

True

This monitoring feature of ELB's track http requests from clients to targets or other services using the X-Amzn-Trace-ID header which is added or updated to the client request.

Request Tracing

What is the only load balancer type that Request Tracing is supported for?

Application Load Balancer

For memcached, when monitoring CPU utilization, if the load is greater than __%, more nodes must be added to the cluster.

90

For memcached, when monitoring Swap file usage, the swap should be around mb most of the time and should not exceed mb.

0, 50

For memcached, if the swap file usage is greater than 50mb, increase the ___________________________ parameter.

memcached_connections_overhead

For evictions monitoring of memcached, you can _- (increase memory of existing nodes) OR _-___ (add more nodes).

scale-up, scale-out

For evictions monitoring of redis, you can only _-_ (add more nodes).

scale-out

For elasticache, it is important to set an alarm for the number of _____________ connections.

concurrent

multi-regional

Allows you to manage multiple AWS accounts at once. Centrally manage policies, control access to AWS services, automate AWS account creation & management, and consolidate billing across all your AWS accounts.

AWS Organizations

These make it easier to group your resources using the tags that are assigned to them.

Resource Groups

What are the 4 EC2 pricing models?

On demandReservedSpotDedicated host

Fully managed service that provides you with an AWS resource inventory, configuration, history, and configuration change notifications to enable security and governance.

AWS Config

(AWS Config) Point in time attributes of the resource

Configuration Items

(AWS Config) Collection of config items

Configuration Snapshots

(AWS Config) Stream of changed config items

Configuration Stream

True/False: AWS Config is regional.

True

What are the two types of health dashboards?

-Service-Personal

What CloudWatch metrics can you use to determine the percentage of I/O operations delivered of the total IOPS provisioned for an EBS volume?

VolumeThroughputPercentage

EC2 instance launch error you receive when you have exceeded the default soft limit of the number of EC2 instances you can launch.

InstanceLimitExceeded

EC2 instance launch error you receive when AWS does not currently have the on-demand capacity to serve your request(s).

InsufficientInstanceCapacity

What is the soft limit of the number of EC2 instances you can launch per region?

20

If you need more than _____ IOPS (New number as of 2018), you must change your storage class to ProvisionedIOPS.

16000

If you need more than ____ IOPS (Old number pre 2018), you must change your storage class to ProvisionedIOPS.

10000

IOPS Capability of your volume is dependent on the ____ of your volume.

Size

Instance located in public subnet which allows you to connect and administer EC2 instances using RDP/SSH without exposing them to the internet.

Bastion Host

This load balancer is often referred to as the smart load balancer utilizing layer 7 technology, it is best for balancing HTTP and HTTPS traffic

Application Load Balancer

TRUE/FALSE: You can only resolve the DNS of an ELB, not the public IP

TRUE, AWS Elastic load balancers only resolve from their DNS, the IP's are controlled entirely by Amazon.

This load balancer is often referred to as the fast load balancer (performance focused) and is best for balancing TCP traffic for extreme performance utilizing layer 4 technology

Network Load Balancer

This load balancer is a basic load balancer with a mix of layer 4 and layer 7 technology. It is not as efficient as the other newer load balancers.

Classic Load Balancer

If you are expecting a sudden dramatic spike in traffic to your web-servers (fronted by ELB's), what should you contact AWS to do?

Pre-warm load balancers

If you require static IP addresses or elastic IP addresses for your clients to connect to your load balancers (1 per subnet) and to ensure simple firewall rules, which load balancer should you use?

Network Load Balancer

A successful response code will return? (ELB)

200

4xx

5xx

(Client Side Error) Bad or malformed request i.e. header is malformed

400

(Server Side Error) Internal server error i.e. error on the load balancer.

500

ELB Cloudwatch Metrics are gathered at ___ second intervals (by default)

60

(ELB CW General Health Metric) Number of unsuccessful connections to backend instances.

BackendConnectionErrors

(ELB CW General Health Metric) Number of healthy instances registered

HealthyHostCount

(ELB CW General Health Metric) number of unhealthy instances

UnHealthyHostCount

(ELB CW General Health Metric) Returns number of 2xx, 3xx, 4xx, 5xx http code responses.

HttpCode_backend

(ELB CW Performance Metrics) Number of seconds taken for registered instances to respond/connect

Latency

(ELB CW Performance Metrics) Number of requests completed/connections made during the specified interval (1 or 5 mins)

RequestCount

A count of the total number of requests that are pending submission to a registered instance.

SurgeQueueLength

A count of the total number of requests that were rejected due to the queue being full.

SpilloverCount

Management tool which gives you visibility and control over your AWS infrastructure. It integrates with CloudWatch allowing you to view your dashboards, view operational data and detect problems.

Systems Manager (SSM)

This feature of SSM allows you to run pre-defined commands on one or more EC2 instances.

Run Command

This high availability term refers to scaling with demand and is short term.

Elasticity

This high availability term refers to scaling out infrastructure with demand and is long term.

Scalability

RDS practice of keeping a separate copy of your production database in a separate AZ. in the event of a failure or disaster, AWS managed the fail-over and re-routes your DB DNS endpoint accordingly.

Multi-AZ

With RDS Multi-AZ, your backup and restore processes are taken from your _ DB to prevent I/O content on the _ DB instance.

secondary, primary

True/False: With RDS Multi-AZ, you can force an AZ fail-over by rebooting your instance.

True

Read-replicas of RDS instances support ______ replication.

Asynchronous

Multi-AZ RDS instances support _____ replication.

Synchronous

What RDS instance types support read replicas?

MySQLPostgreSQLMariaDBAurora

You can have up to ____ read replicas for MySQL, PostgreSQL, and MariaDB.

5

They key metric to look out for when doing Read Replicas is __ _

REPLICA LAG

In order to create Read-Replicas from the console, _____ must be turned ON.

backups

Which Elasticache type supports Multi-AZ?

Redis

object caching, scaling cache horizontally (scale out), and simplicity

Memcached

Advanced data types, sorting and ranking, data persistence and multi-az.

Redis

A My-SQL compatible, relational database engine that combines the speed and availability of high-end commercial databases with the simplicity and cost effectiveness of open source databases.

Aurora

Amazon Aurora keeps _ copies of your data in each AZ with a minimum of 3 AZ's. This means that at a minimum, there are _ copies of your data.

2, 6

If your Aurora instance is at 100% CPU and writes are causing the performance issues, what should you do?

scale-up (increase instance size)

If your Aurora instance is at 100% CPU and reads are causing the performance issues, what should you do?

scale-out (increase number of read replicas)

On-demand, auto-scaling configuration for Aurora where the DB will automatically start up, shutdown, and scale up or down capacity based on your app's needs.

Aurora Serverless

Amazon Aurora is highly _ and -_.

redundant, self-healing

For Aurora, encryption at rest is turned _____ by default.

On

True/False: Once encryption at rest is turned on for Aurora, all read replicas will also be encrypted.

True

Aurora fail-over is defined by ___. The lower the value the higher the priority with _ being the highest.

Tiers, 0

Spread Placement groups can only have __ instances running per AZ.

7

Data consistency for S3?

Read after write for PUT of new objectsEventually consistent for overwrite PUT and DELETE

What is the durability & availability of S3 Standard?

Durability: 99.99.... (11 9's)Availability: 99.99%

What is the durability & availability of S3 IA?

Durability: 99.99... (11 9's)Availability: 99.9%

What is the durability & availability of One zone IA?

Durability: 99.99 (11 9's)Availability: 99.5%

What is the durability & availability of Glacier?

Durability: 99.99 (11 9's)Availability: 99.99%

What is the durability & availability of RRS?

Durability: 99.99%Availability: 99.99%

Access control lists apply at the -level while Bucket Policies apply at the _-level.

object, bucket

S3 encrypts data in transit using _ and .

SSL, TLS

S3 encrypts data at rest using?

Server Side (sse-s3, sse-kms, ss3-c)Client Side

(S3) If the file is to be encrypted at upload time, the _-_-___-_-_______ parameter will be included in the request header.

x-amz-server-side-encryption

Dedicated hardware security module instance. The hardware is not shared and can be used to generate/store/manage your encryption keys.

Cloud HSM

Multi-tenant security module which shares hardware with other AWS customers. Allows you to generate/store/manage your encryption keys.

KMS

KMS supports only ___ keys while Cloud HSM supports either _/____ keys.

symmetric, symmetric/asymmetric

AMI's are -_. Meaning an AMI registered in US-EAST-1 cannot be directly used in EU-WEST-2 without being copied.

region-bound

The difference between Snowball and Snowball edge is that Snowball edge also features onboard _____ capabilities.

compute

(Volume Gateway) All data is stored locally, only backup data to AWS

Stored Volumes

(Volume Gateway) S3 is primary storage, cache most frequently accessed data locally

Cached Volumes

Flat files stored on S3, accessed using NFS or SMB.

File Gateway

Used for archiving your backups to Glacier. Can be used with or without your own backup application.

Tape Gateway

Interactive query service which enables you to analyze and query data in S3 using SQL.

Athena

Service that protects all AWS customers on ELB, Cloudfront, and Route53 from DDOS attacks.

AWS Shield

In order to run penetration tests on AWS, you must obtain ______ from AWS beforehand.

permission

AWS Service which grants users limited and temporary access to AWS resources coming from Federation, Federation with mobile (Google, Facebook, Amazon), or Cross Account Access.

STS (Simple Token Service)

Dedicated Instance

Amazon EC2 instances on physical servers that are dedicated for your use. Give you much better visibility into things like sockets, cores, and host ID and allows you to use your current server-bound software licenses.

Dedicated Host

A service embedded within EC2 that allows you to store sensitive/confidential information such as passwords, DB connection strings, and license codes. These values can be stored as plain text or encrypted and can later be referenced by their names.

Systems Manager Parameter Store

Automated security assessment service that helps improve the security and compliance of applications deployed on AWS. Automatically assesses apps for vulnerabilities or deviations from best practices.

AWS Inspector

Online resource to help you reduce cost, increase performance, and improve security by optimizing your AWS environment. Advises on cost optimization, performance, security, and fault tolerance.

Trusted Advisor

Security groups are while NACL's are .

Stateful, stateless

Provides on-demand downloads of security and compliance documents such as AWS ISO certifications, PCI, and SOC reports.

AWS Artifact

A subnet can only be associated with _____ NACL at a time.

One

True/False: A NACL can be associated with many subnet.

True (but subnet can only be associated with one NACL)

True/False: There is transitive peering with VPC's.

False

/24 = how many IP addresses?

256

/25 = how many IP addresses?

128

/26 = how many IP addresses?

64

/27 = how many IP addresses?

32

/28 = how many IP addresses?

16

AWS Always reserves __ IP addresses within your CIDR block.

5

BGP

This AWS Service allows you to automate your service configuration using managed instances of Puppet or Chef.

Opsworks

What are the three valid alarm statuses in CloudWatch?

OKALARMINSUFFICIENT_DATA

This load balancer is the only one that supports the use of a single fixed IP address.

Network Load Balancer

Your VPC can operate in _-__ mode â your resources can communicate over IPv4, or IPv6, or both. IPv4 and IPv6 communication are independent of each other.

dual-stack

When fault tolerance is more important than I/O performance, this RAID configuration is ideal.

RAID 1

When I/O performance is more important than fault tolerance, this RAID configuration is ideal.

RAID 0

True/False: You can set DurationSessions parameter for IAM roles

True

To avoid initial latency with new EBS volumes, you should make sure you read all the blocks that have data before using the volume. This is called?

initialization

You can use _ _ ___ to monitor traffic going to and from your VPC as well as your network load balancer(s)

VPC Flow Logs

Ability to sustain high CPU performance over any desired time frame while still keeping your costs as low as possible while utilizing T2 instances/prices

T2 Unlimited

In order to publish custom metrics in Cloud Watch, you must use the AWS ______.

CLI

You can modify the ________________ file on an EBS backed volume (attach to a new instance) if you lose access to your instance.

authorized_keys

You can enable billing alerts in your _ _.

Account preferences

In order to aggregate statistics from your EC2 instances across multiple Regions, you must enable ________ monitoring in CloudWatch.

Detailed

True/False: Provisioned IOPS instances automatically send one-minute metrics to CloudWatch.

True

With the ________________ attribute in CloudFormation, you can specify that the creation of a specific resource follows another.

DependsOn

This feature expands on existing Amazon RDS monitoring features to illustrate your database's performance and help you analyze any issues that may affect it.

Performance Insights

A VPC Endpoint Gateway is only for which two AWS services?

S3DynamoDB

The __________________ attribute for a CloudFormation stack resource dictates whether you can preserve/backup resources created as part of a CF stack.

DeletionPolicy

You can associate the _________________ attribute with a resource to prevent its status from reaching create complete until AWS CloudFormation receives a specified number of success signals or the timeout period is exceeded.

CreationPolicy

The Cloud formation _______________ attribute is primarily handles updates to the AWS::AutoScaling::AutoScalingGroup, AWS::Lambda::Alias, or AWS::ElastiCache::ReplicationGroup resources.

UpdatePolicy

The Cloud Formation ________________________ attribute is primarily used to retain or in some cases, backup the existing physical instance of a resource when it is replaced during a stack update operation.

UpdateReplacePolicy

What are the three types of Route 53 health checks you can create?

EndpointCloudWatch AlarmsOther Health Checks

What are the two flavors of snowball edge?

Storage Optimized Compute Optimized

Redshift feature that allows you to efficiently query and retrieve structured and semistructured data from files in Amazon S3 without having to load the data into Amazon Redshift tables.

Redshift Spectrum

The _________ ACL permission allows grantee to create, overwrite, and delete any object in the bucket

WRITE

The ______________ allows grantee to write the ACL for the applicable bucket.

WRITE_ACP

Name some reasons why your EC2 instance may go from pending to terminated immediately:

EBS Volume Limit ReachedRoot EBS volume encrypted, you don't have permsEBS Snapshot corrupt

For CloudWatch, what type of EC2 monitoring metric is only for Instance store backed instances?

DISK

True/False: You can monitor AWS resources in multiple Regions using a single CloudWatch dashboard, but you cannot aggregate the data across Regions.

TRUE

A useful tool for analyzing storage access patterns to help you determine when to transition less frequently accessed Standard storage to the IA storage class.

S3 Analytics

Feature of ELB's in which the load balancer selects the first cipher in its list that is in the client's list of ciphers is called?

Server Order Preference

You can create a load balancer with what three security features?

SSL Server CertsSSL NegotiationBack-end Server Authentication

Access Logging for ELB's is ______ by default.

Disabled

________ optimized instances are designed for workloads that require high, sequential read and write access to very large data sets on local storage. They are optimized to deliver tens of thousands of low-latency, random I/O operations per second to applications compared with EBS-backed EC2 instances.

Storage

Route 53 HTTP Status Codes that indicate healthy connections?

2xx, 3xx

For VPC's with IPV6, you can only use - Internet gateways.

Egress-only

What are the options for the --on-failure parameter for Cloud Formation create-stack CLI command? What is the default action?

DO_NOTHINGROLLBACKDELETEDefault: ROLLBACK

When you need to make changes to a stack's settings or change its resources, you __________ the stack instead of deleting it and creating a new stack.

update

AWS CloudFormation _ _ extends the functionality of stacks by enabling you to create, update, or delete stacks across multiple accounts and regions with a single operation.

Stack Sets

_ _ allow you to preview how proposed changes to a stack might impact your running resources.

Change Sets

The optional _ section matches a key to a corresponding set of named values. For example, if you want to set values based on a region, you can create a that uses the region name as a key and contains the values you want to specify for each specific region.

Mapping

(Cloud Formation) The __________ section is used to include statements that define when a resource is created or when a property is defined.

Conditions

AWSELB

By the default, the enableDnsHostNames is set to _____ for VPC's created via the CLI.

false

The _________________ attribute is required if you have any VPC-gateway attachment in your CF Stack.

DependsOn

If you are adding a record in Route 53 for an ELB, you should use an _______ Record.

Alias

Unlike a _ record, you can create an _ record at the top node of a DNS namespace (zone apex).

CNAME, Alias

Aws Sysops Administrator Associate Flashcards ionicons-v5-c

Aws Sysops Administrator Associate Flashcards