AWS Solutions Architect: Core Services Flashcards

Question 1

Define IAM User.

Accepted Answer

An identity inside one AWS account that represents a single person or application and holds long-term credentials, such as a password for the console or access keys for the API.

Question 2

Define IAM Group.

Accepted Answer

A collection of IAM users that share the same attached policies, so permissions are managed once for the group instead of user by user. Groups cannot contain other groups.

Question 3

Define IAM Role.

Accepted Answer

An identity with permissions but no long-term password or keys; a trusted user, service or account assumes it and receives temporary security credentials that expire.

Question 4

Define IAM Policy.

Accepted Answer

A JSON document listing which actions are allowed or denied on which resources, optionally under conditions, that AWS checks every time a request is made.

Question 5

Define Principle of Least Privilege.

Accepted Answer

The security practice of granting each identity only the permissions it needs to do its task, and no more, so a leaked credential can do as little damage as possible.

Question 6

Define Root User.

Accepted Answer

The identity created with a new AWS account, signed in with the account email address, that has complete access to every resource and billing setting and cannot be limited by IAM policies.

Question 7

Define Service Control Policy (SCP).

Accepted Answer

An AWS Organizations policy that sets the maximum permissions available to member accounts; it grants nothing itself, it only limits what IAM policies in those accounts can allow.

Question 8

Define Amazon Resource Name (ARN).

Accepted Answer

A unique identifier for an AWS resource, built from the partition, service, Region, account ID and resource path, used in policies to name exactly which resource a rule covers.

Question 9

Define Explicit Deny.

Accepted Answer

A policy statement with the Deny effect; during evaluation it overrides every allow from any policy, which makes it the strongest rule in AWS permissions logic.

Question 10

Define S3 Bucket.

Accepted Answer

A container for objects in Amazon S3, created in one Region, whose name must be unique across all AWS accounts worldwide and forms part of every object's address.

Question 11

Define S3 Standard.

Accepted Answer

The default S3 storage class for frequently accessed data, storing copies across at least three Availability Zones with millisecond access and no retrieval fee.

Question 12

Define S3 Standard-Infrequent Access.

Accepted Answer

An S3 storage class for data read rarely but needed quickly, with lower storage cost than Standard, a per-GB retrieval fee and a 30-day minimum storage charge.

Question 13

Define S3 One Zone-Infrequent Access.

Accepted Answer

A cheaper infrequent-access storage class that keeps data in a single Availability Zone, so the data is lost if that zone is destroyed.

Question 14

Define S3 Intelligent-Tiering.

Accepted Answer

A storage class that moves each object between access tiers based on how often it is used, charging a small monitoring fee but no retrieval fee.

Question 15

Define S3 Glacier Deep Archive.

Accepted Answer

The lowest-cost S3 storage class, for data kept for years and almost never read, with standard retrievals finishing within 12 hours and a 180-day minimum storage charge.

Question 16

Define S3 Lifecycle Rule.

Accepted Answer

A bucket configuration that automatically moves objects to cheaper storage classes or deletes them once they reach a set age, so storage cost drops without manual work.

Question 17

Define S3 Versioning.

Accepted Answer

A bucket setting that keeps every version of every object, so an overwrite or delete can be undone by restoring an earlier version.

Question 18

Define Bucket Policy.

Accepted Answer

A resource-based JSON policy attached to an S3 bucket that controls which principals, including other accounts, may perform which actions on the bucket and its objects.

Question 19

Define S3 Block Public Access.

Accepted Answer

A set of S3 settings, on by default for new buckets, that override any policy or ACL that would make a bucket or its objects open to the public internet.

Question 20

Define Amazon Machine Image (AMI).

Accepted Answer

A template that holds an operating system, software and launch settings, from which any number of identical EC2 instances can be started.

Question 21

Define On-Demand Instance.

Accepted Answer

EC2 capacity paid for by the second or hour with no commitment, which costs the most per hour but suits short, spiky or unpredictable workloads.

Question 22

Define Reserved Instance.

Accepted Answer

A billing discount on EC2 in exchange for committing to a specific instance configuration for a one- or three-year term, suited to steady workloads that run all the time.

Question 23

Define Savings Plans.

Accepted Answer

A pricing model where you commit to a fixed amount of compute spend per hour for one or three years and receive discounted rates on usage up to that amount.

Question 24

Define Spot Instance.

Accepted Answer

Spare EC2 capacity sold at up to 90% off the On-Demand price that AWS can reclaim with a two-minute warning, suited to flexible or interruptible work.

Question 25

Define Amazon EBS.

Accepted Answer

Block storage volumes that attach to EC2 instances like network hard drives, persist independently of the instance and live in a single Availability Zone.

Question 26

Define Instance Store.

Accepted Answer

Temporary block storage on disks physically attached to the host computer, very fast but lost when the instance stops, terminates or its hardware fails.

Question 27

Define Amazon EFS.

Accepted Answer

A managed NFS file system for Linux that many EC2 instances across multiple Availability Zones can mount and share at once, growing and shrinking automatically.

Question 28

Define Auto Scaling Group.

Accepted Answer

A collection of EC2 instances that AWS keeps at a desired count, launching replacements for unhealthy ones and adding or removing instances as demand changes.

Question 29

Define EC2 User Data.

Accepted Answer

A script or set of instructions passed to an instance at launch that runs automatically on first boot, used to install software and configure the server.

Question 30

Define Virtual Private Cloud (VPC).

Accepted Answer

A logically isolated private network in one AWS Region, defined by an IP address range, in which you launch resources and control routing and traffic rules.

Question 31

What is Subnet?

Accepted Answer

A range of IP addresses inside a VPC that sits in exactly one Availability Zone; AWS reserves five addresses in every subnet.

Question 32

Define CIDR Block.

Accepted Answer

Notation for an IP address range written as an address plus a prefix length, where a smaller prefix number means a larger range of addresses.

Question 33

Define Internet Gateway.

Accepted Answer

A horizontally scaled VPC component that allows communication between the VPC and the internet in both directions for resources with public IP addresses.

Question 34

Define NAT Gateway.

Accepted Answer

A managed AWS service, placed in a public subnet, that lets instances in private subnets start connections to the internet while blocking connections started from outside.

Question 35

Define Route Table.

Accepted Answer

A set of rules attached to subnets that decides where network traffic leaving the subnet is sent, matching each destination to a target such as a gateway.

Question 36

Define Security Group.

Accepted Answer

A stateful virtual firewall attached to an instance's network interface that only has allow rules, so return traffic for an allowed connection is permitted automatically.

Question 37

Define Network ACL.

Accepted Answer

A stateless firewall at the subnet boundary with numbered allow and deny rules evaluated lowest number first, which must permit return traffic explicitly.

Question 38

Define VPC Peering.

Accepted Answer

A private network connection between two VPCs, in the same or different accounts or Regions, that lets them route traffic to each other using private IP addresses.

Question 39

Define VPC Gateway Endpoint.

Accepted Answer

A free VPC endpoint, available for Amazon S3 and DynamoDB, that adds a route so traffic to those services stays on the AWS network instead of going through the internet.

Question 40

Define Availability Zone.

Accepted Answer

One or more discrete data centers with separate power, networking and connectivity inside an AWS Region, close enough to others for low-latency links but isolated from their failures.