SWE II > AWS/CLOUD > Flashcards

AWS/CLOUD Flashcards

(64 cards)

Study These Flashcards
1
Q

What is AWS IAM?

A

Identity and Access Management: controls who/what can access AWS resources and what actions they can perform (users, roles, policies).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

IAM: User vs Role vs Policy

A

User = human identity; Role = assumable identity (by services or users) with temporary credentials; Policy = permissions document attached to a user/role/resource.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What does “least privilege” mean in IAM?

A

Grant only the minimum permissions required to perform a task; avoid broad actions/resources like ‘*’ unless necessary.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Why avoid long-lived access keys in production?

A

They are easy to leak and hard to rotate; prefer IAM roles with temporary credentials or secret managers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is an IAM role used for in services?

A

To give AWS services (EC2/ECS/Lambda) permissions via temporary credentials without embedding secrets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is a VPC?

A

A Virtual Private Cloud: your isolated virtual network in AWS where you place subnets, routing, security controls, and resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Public subnet vs private subnet

A

Public subnet routes to an Internet Gateway; Private subnet has no direct inbound internet route (often uses NAT for outbound internet).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is an Internet Gateway (IGW)?

A

A gateway that enables resources in a VPC public subnet to have internet connectivity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a NAT Gateway used for?

A

Allows instances in private subnets to make outbound internet connections without being directly reachable from the internet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Security Group vs NACL

A

Security Group = stateful firewall at instance/ENI level; NACL = stateless firewall at subnet level.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What does “stateful” mean for Security Groups?

A

Return traffic is automatically allowed if inbound/outbound is permitted; you don’t need explicit rules for response traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is EC2?

A

Elastic Compute Cloud: virtual machines where you manage OS-level configuration and scaling (with ASG).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is ECS?

A

Elastic Container Service: runs containerized applications; integrates with load balancers, IAM roles, and can run on Fargate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is Fargate?

A

Serverless compute for containers: run ECS tasks without managing EC2 instances.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is EKS?

A

Elastic Kubernetes Service: managed Kubernetes control plane to run container workloads.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is Lambda?

A

Serverless function compute: event-driven, auto-scaling, pay-per-invocation; best for short-lived tasks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

EC2 vs Containers vs Lambda (quick selection)

A

EC2 = full control; Containers (ECS/EKS) = standardized app packaging + scalability; Lambda = event-driven, minimal ops, some limits (timeouts/cold starts).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is RDS?

A

Managed relational database service (e.g., PostgreSQL, Oracle) with backups, patching, and HA options.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

When choose RDS (relational DB)?

A

When you need transactions, strong consistency, joins, constraints, and rich SQL querying.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is DynamoDB?

A

Managed NoSQL key-value/document database with low latency and horizontal scalability; designed around access patterns.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

When choose DynamoDB?

A

High throughput/scale needs with predictable key-based access; where joins/complex relational queries are not required.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is S3?

A

Object storage for files/blobs (logs, backups, assets), highly durable and scalable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

S3: common use cases

A

Storing documents/images, backups, static web assets, data lakes, logs and artifacts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is CloudWatch Logs?

A

AWS logging service to collect, store, and query logs from apps and AWS services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What is CloudWatch Metrics?
Time-series metrics for resources and apps (CPU, latency, error rate, queue depth, etc.).
26
What is a CloudWatch Alarm?
A rule that triggers notifications/actions when a metric crosses a threshold (e.g., high 5xx rate).
27
What metrics matter most for an API?
Latency (p95/p99), error rate (4xx/5xx), traffic/throughput, and saturation (CPU/memory/DB connections).
28
What is an ALB?
Application Load Balancer: layer 7 load balancing for HTTP/HTTPS with routing rules.
29
What is an NLB?
Network Load Balancer: layer 4 load balancing for TCP/UDP; low latency, high throughput.
30
What is API Gateway?
Managed service to create, publish, secure, and monitor APIs; common with serverless/Lambda.
31
Why are timeouts essential in service-to-service calls?
To prevent requests from hanging and causing resource exhaustion and cascading failures.
32
What are retries and when are they safe?
Retrying failed calls; safest for idempotent operations (GET/PUT) and with backoff/jitter to avoid thundering herd.
33
What is exponential backoff?
A retry strategy where delay increases after each failure (often with jitter) to reduce load during outages.
34
What is a circuit breaker?
Stops calls to an unhealthy dependency after failures, allowing recovery and preventing cascading failures.
35
What is “cascading failure” in microservices?
When one failing dependency causes timeouts/retries that overload other services, spreading the outage.
36
What is SQS?
A managed message queue for decoupling producers/consumers and smoothing traffic spikes.
37
SQS delivery semantics
Typically 'at least once' delivery: consumers must handle duplicate messages safely.
38
What does “idempotent consumer” mean?
Processing the same message multiple times produces the same end result (no double-charging, no duplicate records).
39
What is SNS?
A pub/sub service to fan out notifications to multiple subscribers (queues, lambdas, HTTP endpoints).
40
What is EventBridge?
An event bus for routing events based on rules to targets (lambda, queues, etc.) for event-driven architectures.
41
When prefer async (SQS/events) over sync REST?
For non-real-time tasks, resilience, decoupling, spike handling, and when eventual consistency is acceptable.
42
What is “eventual consistency”?
System state becomes consistent over time; changes propagate asynchronously rather than instantly.
43
Microservice definition
An independently deployable service that owns a focused capability and often its own data.
44
Key microservice principles
Independent deployability, clear boundaries, strong observability, resilience, and careful API versioning.
45
Why is a shared database across services a smell?
Tight coupling; schema changes become coordinated; it undermines independent deployability and ownership.
46
What is “observability”?
Ability to understand system behavior from logs, metrics, and traces to debug issues quickly.
47
What is a correlation ID?
An identifier propagated across services to connect logs/traces for a single request flow.
48
What is “encryption in transit”?
Protecting data over the network using TLS/HTTPS.
49
What is “encryption at rest”?
Encrypting stored data (e.g., RDS storage encryption, S3 SSE) to protect from disk-level exposure.
50
What is AWS Secrets Manager?
Service to store and rotate secrets securely and inject them into apps at runtime.
51
Parameter Store (SSM) vs Secrets Manager (basic)
Both store configuration; Secrets Manager adds rotation and is specialized for secrets management.
52
What is “immutable artifact”?
A build output (jar/docker image) that doesn't change; build once and deploy the same artifact across environments.
53
Why “build once, deploy many”?
Reduces environment drift; increases reproducibility and reliability.
54
What is blue/green deployment?
Two environments (blue and green); switch traffic to the new version; rollback by switching back.
55
What is canary deployment?
Roll out to a small percentage of traffic first; monitor metrics; expand or rollback based on health.
56
What is a feature flag?
A runtime toggle to enable/disable features without redeploying; useful for safe releases and quick rollback.
57
How to troubleshoot an AWS production issue (high-level)?
Check CloudWatch metrics/alarms and logs, confirm recent deploys, isolate app vs DB vs network vs downstream, mitigate/rollback, and add prevention.
58
What is “saturation” in monitoring?
Resource capacity usage nearing limits (CPU, memory, threads, DB connections, queue depth).
59
What is an SLO/SLI (basic)?
SLI = measurable indicator (latency, availability); SLO = target for that indicator (e.g., 99.9% availability).
60
Common pitfalls in cloud services
Missing timeouts, overly broad IAM permissions, secrets in code, lack of monitoring, chatty sync calls, no rollback plan.
61
What is “cold start” in Lambda?
Extra latency when Lambda initializes a new execution environment, especially after inactivity.
62
Why separate config from code in cloud?
So you can deploy the same artifact and adjust behavior per environment safely (12-factor principle).
63
What is an IAM “resource ARN”?
A unique identifier for an AWS resource used in policies to scope permissions.
64
What is “throttling” in APIs?
Rate limiting to protect systems from overload; often configured in API Gateway or at service level.
SWE II
flashcards
Decks in class (10)
# Cards
Brainscape helps you reach your goals faster, through stronger study habits.
© 2026 Bold Learning Solutions. Terms and Conditions