devops-exercises/certificates/cloud-practitioner.md

AWS - Cloud Practitioner

A summary of what you need to know for the exam can be found here

Cloud 101

What types of Cloud Computing services are there?

IAAS PAAS SAAS

Explain each of the following and give an example:

• IAAS
• PAAS
• SAAS

What types of clouds (or cloud deployments) are there?

• Public
• Hybrid
• Private

Explain each of the following Cloud Computing Deployments:

• Public
• Hybrid
• Private

AWS Global Infrastructure

Explain the following

• Availability zone
• Region
• Edge location

AWS regions are data centers hosted across different geographical locations worldwide, each region is completely independent of one another.

Within each region, there are multiple isolated locations known as Availability Zones. Multiple availability zones ensure high availability in case one of them goes down.

Edge locations are basically content delivery network which caches data and insures lower latency and faster delivery to the users in any location. They are located in major cities in the world.

AWS Networking

What is AWS Direct Connect?

Allows you to connect your corporate network to AWS network.

What is Route 53?

"Amazon Route 53 is a highly available and scalable cloud Domain Name System (DNS) web service"

More on Route 53 here

What is VPC?

"A logically isolated section of the AWS cloud where you can launch AWS resources in a virtual network that you define" Read more about it here.

True or False? VPC spans multiple regions

False

True or False? Subnets belong to the same VPC, can be in different availability zones

True. Just to clarify, a subnet must reside entirely in one AZ.

What is an Internet Gateway?

"component that allows communication between instances in your VPC and the internet" (AWS docs). Read more about it here

Multiple Internet Gateways can be attached to one VPC

False. Only one internet gateway can be attached to a single VPC.

True or False? Route Tables used to allow or deny traffic from the internet to AWS instances

False.

Explain Security Groups and Network ACLs

• NACL - security layer on the subnet level.
• Security Group - security layer on the instance level.

Read more about it here and here

AWS Compute

What is EC2?

"a web service that provides secure, resizable compute capacity in the cloud". Read more here

What is AMI?

Amazon Machine Images is "An Amazon Machine Image (AMI) provides the information required to launch an instance". Read more here

What are the different source for AMIs?

• Personal AMIs - AMIs you create
• AWS Marketplace for AMIs - Paid AMIs usually with bundled with licensed software
• Community AMIs - Free

What is instance type?

"the instance type that you specify determines the hardware of the host computer used for your instance" Read more about instance types here

What is EBS?

"provides block level storage volumes for use with EC2 instances. EBS volumes behave like raw, unformatted block devices." More on EBS here

What EC2 pricing models are there?

On Demand - pay a fixed rate by the hour/second with no commitment. You can provision and terminate it at any given time. Reserved - you get capacity reservation, basically purchase an instance for a fixed time of period. The longer, the cheaper. Spot - Enables you to bid whatever price you want for instances or pay the spot price. Dedicated Hosts - physical EC2 server dedicated for your use.

What are Security Groups?

"A security group acts as a virtual firewall that controls the traffic for one or more instances" More on this subject here

AWS Storage

Explain what is AWS S3?

S3 stands for 3 S, Simple Storage Service. S3 is a object storage service which is fast, scalable and durable. S3 enables customers to upload, download or store any file or object that is up to 5 TB in size.

More on S3 here

What is a bucket?

An S3 bucket is a resource which is similar to folders in a file system and allows storing objects, which consist of data.

True or False? A bucket name must be globally unique

True

Explain folders and objects in regards to buckets

• Folder - any sub folder in an s3 bucket
• Object - The files which are stored in a bucket

Explain the following:

• Object Lifecycles

• Object Sharing

• Object Versioning

Object Lifecycles - Transfer objects between storage classes based on defined rules of time periods

Object Sharing - Share objects via a URL link

Object Versioning - Manage multiple versions of an object

Explain Object Durability and Object Availability

Object Durability: The percent over a one-year time period that a file will not be lost Object Availability: The percent over a one-year time period that a file will be accessible

What is a storage class? What storage classes are there?

Each object has a storage class assigned to, affecting its availability and durability. This also has effect on costs. Storage classes offered today:

• Standard:

  • Used for general, all-purpose storage (mostly storage that needs to be accessed frequently)
  • The most expensive storage class
  • 11x9% durability
  • 2x9% availability
  • Default storage class

• Standard-IA (Infrequent Access)

  • Long lived, infrequently accessed data but must be available the moment it's being accessed
  • 11x9% durability
  • 99.90% availability

• One Zone-IA (Infrequent Access):

  • Long-lived, infrequently accessed, non-critical data
  • Less expensive than Standard and Standard-IA storage classes
  • 2x9% durability
  • 99.50% availability

• Intelligent-Tiering:

  • Long-lived data with changing or unknown access patterns. Basically, In this class the data automatically moves to the class most suitable for you based on usage patterns
  • Price depends on the used class
  • 11x9% durability
  • 99.90% availability

• Glacier: Archive data with retrieval time ranging from minutes to hours

• Glacier Deep Archive: Archive data that rarely, if ever, needs to be accessed with retrieval times in hours

• Both Glacier and Glacier Deep Archive are:

  • The most cheap storage classes
  • have 9x9% durability

More on storage classes here

Explain what is Storage Gateway

"AWS Storage Gateway is a hybrid cloud storage service that gives you on-premises access to virtually unlimited cloud storage". More on Storage Gateway here

Explain the following Storage Gateway deployments types

• File Gateway
• Volume Gateway
• Tape Gateway

Explained in detail here

What is the difference between stored volumes and cached volumes?

Stored Volumes - Data is located at customer's data center and periodically backed up to AWS Cached Volumes - Data is stored in AWS cloud and cached at customer's data center for quick access

AWS IAM

What is IAM? What are some of its features?

Full explanation is here In short: it's used for managing users, groups, access policies & roles

True or False? IAM configuration is defined globally and not per region

True

Given an example of IAM best practices?

• Set up MFA
• Delete root account access keys
• Create IAM users instead of using root for daily management

What are Roles?

A way for allowing a service of AWS to use another service of AWS. You assign roles to AWS resources. For example, you can make use of a role which allows EC2 service to acesses s3 buckets (read and write).

What are Policies?

Policies documents used to give permissions as to what a user, group or role are able to do. Their format is JSON.

A user is unable to access an s3 bucket. What might be the problem?

There can be several reasons for that. One of them is lack of policy. To solve that, the admin has to attach the user with a policy what allows him to access the s3 bucket.

What should you use to:

• Grant access between two services/resources?

• Grant user access to resources/services?

Role

Policy

What permissions does a new user have?

Only a login access.

Final Note

Good luck! You can do it :)