Episode 5.5: Exam Q&A - 30 Rapid-Fire Questions on EC2, IAM, Global Infrastructure & ELB | SAA-C03

Hey everyone, Baloo here. Welcome to a special supplement episode of Tech Talk with Baloo. We have covered a lot of ground in episodes one through five. We've covered EC2, IAM, global infrastructure and elastic load balancing. Now that's a massive amount of information. So today we're going to do something very different. This is a rapid fire exam question session. I'm going to throw exam style questions at you. Give you a few seconds to think and then walk you through the answers and why it's correct. Think of this as a practice test. If you can answer these questions confidently, you're in great shape for the exam. I've got 30 questions covering all the five episodes. Some are straightforward, some are tricky and some have exam traps built in. So grab a pen and paper if you want to keep score and let's see how many you get right. So ready, let's go. Let's start with EC2 fundamentals. Question one, a company needs EC2 instances for a batch processing job that runs overnight and can handle interruptions. Which purchasing option minimizes cost? The answer is spot instances. Well, then if you got that right. Why? The job can handle interruptions, which is the key requirement for spot. Spot instances can be up to 90% cheaper than on demand. Remember that batch processing that's flexible on timings is the perfect use case for spot. The wrong answer would be on demand because that's more expensive. There's no commitment needed, but you're paying full price reserved instances on the other hand requires one or three years of commitment and that's not suitable for short term jobs. Of course, saving plans is not suitable as well because that requires commitment. So the exam keyword can handle interruptions, think spot instances. Onto question two, an application requires 16 GB of RAM and high network performance for the next three years with steady state usage. How should the company optimize costs? The answer is purchase a reserved instance with memory optimized that's our family instance type for three years. Why? Steady state usage for three years, three years reserved instance, you get up to 72% discount compared to on demand instance and we want memory optimized that's our family for the 16 GB RAM requirement. So the exam keyword would be steady state usage plus three years, you want to think reserved instances. Question number three, an EBS volume in US East 1A needs to be moved to US East 1B. What's the process? The answer is to create a snapshot of the EBS volume then created new volume from the snapshot in US East 1B. And why is that? EBS volumes are easy locked. Remember that they cannot span availability zones. The only way to move them is snapshot and then restore. This is one of the most tested concepts on the exam. So memorize it, EBS volumes cannot cross AZs without a snapshot. So the wrong answer would be just to detach and reattach, nope that's physically impossible. The volume is tied to that particular AZ. Onto question four, an application on EC2 needs to read objects from S3. What's the most secure way to grant permissions? The answer is to create an IAM role with S3 read permissions and attach it to the EC2 instance. And why is that? Roles use temporary credentials to rotate automatically. Never use access keys on EC2 instances. So the wrong answers would have been generate access keys and store them on the instance. That's a big security risk. Keys can be compromised. Never, ever use root for applications. An embed credentials in application called that is a terrible security practice. So the exam keyword EC2 needs to access AWS service, think IAM role not access keys. Onto question five, an instance is stopped then started again. What changes? The answer is public IP address changes. The private IP address stays the same. Public IPs are dynamic and released when instances stop. Private IPs are permanent for the life of the instance. If you need a persistent public IP, then you want to use an elastic IP. So memorize the state change matrix. Stop or start, public IP changes. Private IP stays, instance ID stays. You reboot the instance, everything stays the same. And if you terminate, everything is released. Onto question number six, what's the maximum duration and EC2 instance can hybridate? If you got 60 days, that is correct. Why? That's the hard limit after 60 days. AWS stops the hibernation automatically. Also remember, the RAM must be less than 150 GB. The root volume must be EBS and encrypted, not all instance families support hibernate. The families that support are CM and R. So the exam tip, if they ask about preserving RAM state or fast startup from stopped state, then the answer is always hinting at hibernation. Onto the next section, IAM question number seven, a user is in group A that allows all S3 actions and group B which denies specifically S3 delete object operation. Can the user delete S3 objects? The answer is no. Why? Explosive deny always wins. It doesn't matter how many allows exist in the rule one deny overrides everything. This is a fundamental IAM concept deny always precedes allow the value share logic default is deny everything evaluate all applicable policies. If any deny exists, then it's denied. If no deny, but an allow exists is allowed. If no explicit allow exist, it's denied least privilege concept. So the exam pattern you want to be familiar with is multiple policies one has deny, then the action is denied. Onto question number eight, a company needs to enforce MFA for all IAM users. Can this be done with IAM policies? The answer is yes, create an IAM policy that denies all actions unless MFA is authenticated, then attach it to users or groups. This denies all actions if MFA is not present, users literally cannot do anything without first authenticating with MFA. So the exam keywords you want to look out for are if they talk about enforce MFA, then you want to think about IAM policy with MFA condition. Onto question number nine, how many access keys can an IAM user have? The answer is maximum of two. Why two? That is to enable key rotation without downtime. Let's look at the rotation policy real quick. Number one, create second key while the first one is active, update applications to use the second key, then test everything works okay, and then you want to delete the first key. With only one key allowed, you'd have no downtime during rotation. So exam trap, if they ask unlimited or just one wrong, always two is the maximum. Onto question number 10, what's the difference between IAM credentials report and IAM access advisor? So the answer is credentials report is account level, shows all users and their credential statuses. So that's password, keys, MFA, so and so forth. Access advisor on the other hand is user level, so that shows which services a specific user has access and when. So they are different scopes meant for different purposes and use cases. So credentials report would lead you to which users don't have MFA enabled for example, where is access advisor gives you information like desk bob actually need dynamo DB permissions, he hasn't used it for six months. So the exam key what you're looking for is if they specify all users, then it points to credential reports. If it's related to specific user access patterns, then you want to think access advisor. Onto the next section, that's global infrastructure. Question number 11, a company must keep customer data in Germany due to GDPR requirements, which factor is important in choosing an AWS region. The answer is compliance and data governance. Why? When legal or regulatory requirements exist, they override everything else. Cost doesn't matter here, latency doesn't matter here, compliance is mandatory. The company must use EU central one that's Frankfurt or EU west one island. That's European regions where GDPR applies. So the decision priority for regions I wanted to remember is if it talks about compliance, then that decides everything. Number two, we want to think about is latency or proximity to users. Number three is service availability and then you think about cost finally. So the exam keyword here is GDPR, data, residency, regulatory requirement, then you want to think compliance and that determines the region. Onto question number 12, can an ebius volume in US East 1A be attached to an instance in US East 1B? The answer is no. EBS volumes are AZ locked. This is the same concept we discussed in question 3, but phrased slightly differently. The exam will test this in multiple ways. EBS volumes are tied to availability zone. They cannot attach across AZs even if they are within the same region. To use the volume in US East 1B, what you have to do is create a snapshot and restore that in US East 1B. And remember this appears on virtually every exam, so memorize this code, you will definitely benefit from it. On to question number 13. A website serves users globally. Startic content that's images, videos, they load slowly for users in Asia. The application runs in US East 1. What's the most cost effective solution here? Correct, use Amazon Cloud Front to cache content at edge locations worldwide. Why would you do that? Cloud Front is perfect for this. Cache static content at 400+ edge locations uses an Asia then can get content from nearby edge locations instead of fetching that from Virginia. The wrong answers would be to deploy the application in multiple regions because that's over-engineering and it's expensive for just that static content. And another wrong answer would be to use S3 transfer acceleration. Remember that's for uploads and not for downloads. So the exam keyword I want you to be familiar with is global users plus static content plus load downloads you want to think cloud front. On to question 14. Are easy to instances and compute services available at edge locations? As there is no edge locations only support cloud front and route 53. This is a major exam trap. Edge locations are not many regions. You cannot run easy to, ideas lambda or any compute services at edge locations. Edge locations remember are for caching content that's cloud front or DNS route 53. That's it. To run compute near users, deploy in the actual AWS region closest to them like AP Northeast 1 for Tokyo. So this is heavily tested again in the exam. They love asking this in different ways. Question number 15. A network load balancer shows uneven traffic distribution across instances in different ACs. What's the likely cost? Yeah, the answer is cross zone load balancing is disabled. It's disabled by default. Remember for NLB. Now without cross zone load balancing, each NLB node only distributes to targets in its own easy. If AZs have different numbers of instances, traffic just becomes uneven. So solution is to enable cross zone load balancing. Just a note, this costs money for NLB. Inter AZ data transfer charges apply. So default settings that I want you to memorize. ALB, cross zone is enabled for free. For an LB, cross zone is disabled. If enabled, it costs money. Now for GWLB, cross zone is again also disabled. Same like NLB and it costs money if it's enabled. So the exam keywords, NLB plus uneven traffic, you know, you want to enable cross zone. Now onto question number 16. Which services are global? That's not region scoped. The answer is IAM, Route 53, Cloud Front and WAF. Everything else is regional. That's easy to, RDSS3, Lambda, DynamoDB, VPC, etc. This matters because IAM users exist globally. They can access any region. Route 53 is global DNS. Cloud Front edge locations are worldwide and WF rules apply globally. So an exam scenario could be an IAM user created in US East 1, can access EU West 1. That is true because IAM is global. So for the next section, we are going to look at Elastic Load Balancing. Question number 17. An application needs to route slash users request to user service and slash products request to product service. Which load balancer should we use? Yep, the answer is application load balancer. Why? Part-based routing is an ALB feature. ALB operates at last 7. That's HTTP and can see the URL path. NLB operates at layer 4, which is TCP and cannot see the HTTP paths. So the exam keyword I want you to remember is if they ask about part-based routing or route based on URL or microservices, then the answer leads to ALB. Now question number 18. A client's firewall requires white listing specific IP addresses. Which load balancer provides static IPs? The answer is network load balancer. NLB provides one static IP per AZ. You can even assign your own elastic IPs. So the exam keyword you want to look for is static IP white list IP addresses, specific IP required that points to NLB. Question number 19. An application behind NLB needs to log the client's real IP address. Where is this information? The answer is stored in the x-forwarded for HTTP header. ALB terminates the client connection and creates a new connection to the backend. The backend sees the ALB's IP and not the clients. The ALB then inserts the client IP into the x-forwarded for header. Also what is available is the x-forwarded port. That's the original port of the request. x-forwarded proto, that's the original protocol, whether it's HTTP or HTTPS. For NLB remember the backend sees the client's IP directly in the source IP. There's no header needed. So exam patterns if asked about ALB that needs client IP, then remember it can be received from the x-forwarded for header. Now onto question number 20. Can one ALB host multiple domains? That's example.com, api.example.com, admin.example.com, each with its own SSL certificate. The answer is yes, you can use server name indication or SNI. ALB supports SNI which allows multiple SSL certificates on one load balancer. Remember that? The ALB selects the correct certificate based on the host name on the client's request. Client load balancer does not support SNI. That's important to remember. It only supports one SSL certificate. That's the classic load balancer. So an exam trap would be multiple SSL certificates on CLB. No, you must use ALB or NLB. Next question, question number 21. What are the default settings for crozone load balancing on ALB? The answer is it's enabled by default and there are no charges for inter-AZ data transfer. For ALB, crozone is on by default. It costs free. There is no inter-AZ charges. Whereas for NLB, crozone is off by default, you pay for inter-AZ data if you enable it. It's a very frequently asked question like I've mentioned before and they test this with different phrasing. So remember that. Question number 22. Instances behind a load balancer are running but marked as unhealthy. What should be checked? The answer is multiple things. The answer is the health check checking the right port and then you finally want to check the thresholds. The answer is the same as the one in the first place. So solution 1 which is a good solution is to enable sticky sessions on the load balancer. System user always goes to the same instance. Even a better solution is to store session data in elastic cache or dynamo DB. Any instances then can retrieve the session data. Why is the second solution even better? There is no load imbalance from sticky sessions. With the second option, it's better for horizontal scaling and the session also survives instance termination. So an exam pattern here is if asked about session management, both the answers work but external session storage is generally more preferred. Now onto the next section. It's interesting it's mixed topics. Let's go on to question number 24. A company runs a web application on EC2 instances across three A's behind and ALB. One A's fails completely what happens. The answer is the application continues running with zero downtime. And why is that? The multi-AZ architecture. In one A's fails, load balancer detects instances in that A's or unhealthy. Hell check fails. The load balancer then stops sending traffic to that A's. Traffic is then redistributed to the instances in that healthy A's. So typically. the user's experience no downtime. This is the power of multi-az+load balancer plus auto scaling. So an exam keyword would be survives azfailure remember multi-az deployment with load balancer would be where you want to point to. On to question number 25. What's the difference between rds multi-az and read replicas? So the answer is multi-az let's look about the purpose is high availability and fail-over synchronous replication automatic failure in less than one minute if the primary fails it cannot read from standby no performance improvements for reads whereas the read replicas performance is read scaling and performance its asynchronous replication can have up to 15 read replicas can read from replicas improves read performance and can be in different regions. So an exam trap now. If the question asked about need better performance then the option of enabling multi-az is typically wrong that's for availability but not for performance you want to use read replicas remember that. On to question 26. An auto scaling group terminates instances during scaling uses complain about errors what should be configured. The answer is to configure connection draining or de-registration delay on the load balancer. Why? Without connection draining instances are terminated immediately killing all the active connections now with connection draining load balancer stops sending new requests to the instance existing requests are not allowed to complete and after a timeout or all requests are finished the instance is finally terminated there's no user-facing errors so you want to set the timeouts based on the request duration short duration would be 30 to 60 seconds whereas long requests would be typically 300 to 600 seconds for example keyword you see errors during scaling or graceful termination then you know it's related to connection training. Question number 27. A startup needs to minimize costs they have unpredictable traffic that spikes occasionally what architecture would you choose. The answer is auto scaling group with target tracking policy starting with minimum capacity. Why? Minimum capacity you want to use one to two instances that's low cost during off-peak you want to use auto scaling that automatically adds instances during traffic spikes you want to use target tracking that scale based on CPU or request count and after spike you want it to automatically scale down to save costs even better consider lambda for unpredictable workload that's pay only for requests so exam keywords you want to look for is unpredictable traffic plus minimize costs you want to think auto scaling now we look at question number 28 what's the difference between security groups and nacls so the answer is security groups so that's at instance level so it's stateful that means return traffic is automatically allowed only allow rules are allowed there's no deny rules it evaluates all rules before allowing traffic nacls on the other hand is at subnet level it's stateless that means it must explicitly allow return traffic both allow and deny rules exist rules are evaluated in order lowest number is first and now for an exam scenario the question asks about needing to block a specific IP address at the subnet level you want to use nacl because there is deny rules in it security groups cannot have deny rules remember that question 29 an application experiences high CPU during business hours that's 9 a.m. to 5 p.m. every weekday how to scale that efficiently the answer is scheduled scaling configure auto scaling to scale up at let's say 845 a.m. every weekday that's before the traffic arrives then you want to scale that down at 5 15 p.m. every weekday that's after the traffic ends now this is more efficient than reactive scaling because instances are ready before the traffic arrives there is no lag time waiting for scale out and there are predictable costs associated so for exam keyword predictable traffic pattern or specific times all related to scheduled scaling now on to question number 30 and I am role attached to an easy to instance provides what type of credentials so the answer is temporary security credentials that rotate automatically these credentials include access key ID secret access key session tokens and expiration timestamp they typically last 15 minutes to 12 hours then a.w.s automatically rotates them this is why roles are better than access keys there's no long term credentials stored on the instance automatic rotation that means you don't have to manually manage key rotation and if an instance is compromised credentials expire quickly for an exam keyword easy to needs a.w.s access if asked always use iam role never hard coded keys all right that's 30 rapid fire questions covering episodes one through five let's do a quick score check shall we if you scored between 25 30 correct you are crushing it you are exam ready if your score was between 20 to 24 correct then you do have a solid foundation just review the ones that you have missed if you had about 15 to 19 correct that's a very good start and if you scored less than under 15 don't worry just go and relish in the episodes and practice a bit more so I want to leave you with the key themes that keep appearing eBS is easy locked this appears everywhere iam roles for easy to never use access keys explicit deny wins in an iam policy evaluation cross zone load balancing defaults know them cold multi-az for availability that's the foundation of high availability cloud front for global content delivery it's not multi-region deployment alb for HTTP routing and lb for performance or static ip that's the decision criteria and finally x forwarded for client ip that's alb specific if you enjoyed this supplement episode we will have the next supplement episode that will cover episodes from 6 to 10 when we finish those episodes so keep studying keep practicing and i will see you in the next episode this is baloo signing off thank you very much