Cloud Computing and AWS CloudTrail Quiz

A cloud computing model where you use one public cloud provider like AWS, Azure, or Google Cloud.

A cloud computing model where you use on-premises infrastructure to create a private cloud environment. It must meet the five requirements of cloud computing.

A cloud computing model where you use multiple public cloud providers in a single deployment.

A cloud computing model where you use a mix of public and private cloud resources.

A cloud computing model where you manage all components from data to facilities.

A cloud computing model where you place your equipment in a vendor-managed building. You only pay for the facilities.

A cloud computing model where the vendor manages everything up the operating system. You pay for the resources you use.

A cloud computing model where the vendor manages the platform, allowing you to focus on your application.

A policy that defines what permissions an IAM role is allowed to perform.

A policy that defines which identities are allowed to assume an IAM role.

Temporary security credentials that are granted to an identity when they assume an IAM role. These credentials have a limited time validity and need to be renewed.

An IAM role that provides a dedicated identity for Lambda functions, allowing them to access required AWS services.

A specialized IAM role designed for emergency access to resources that are not normally accessible by a team. This allows for controlled access in critical situations.

A mechanism that allows external identity providers to manage access to AWS resources by allowing users from those providers to assume an IAM role in AWS.

A feature used to allow web applications to issue temporary AWS credentials to users, enabling broader access based on IAM roles.

An active representation of a template. It's a living, dynamic version of the template in AWS. One template can create many stacks.

A collection and management service for operational data from AWS services, applications, and on-premises solutions. It includes metrics, logs, and events.

A container for monitoring data in AWS CloudWatch. It can be named anything, as long as it's not an AWS service name. All metric data for a specific service is stored in its own namespace.

A time-ordered set of data points that monitor a specific aspect of your AWS resources or services, such as CPU usage, network traffic, or disk I/O.

A feature in AWS CloudWatch that monitors the state of a metric. When a metric reaches a predefined threshold, an alarm is triggered, which can send notifications or perform actions.

AWS is responsible for the security of the cloud infrastructure, including access control, physical security, and network security. Customer: Responsible for the security in the cloud, including data encryption, access control policies, and application security.

The ability of a system to continue operating despite failures or disruptions. It can be achieved through redundancy, fault tolerance, and disaster recovery mechanisms.

The ability of a system to withstand failures within its components without compromising its functionality. It's a critical aspect of high availability and often involves redundant components and failover mechanisms.

A process in Amazon S3 where objects automatically transition between storage classes based on access patterns, reducing storage costs.

A type of S3 lifecycle action that moves objects to a different storage class based on specified timeframes.

A type of S3 lifecycle action that removes older versions of objects after a specified time, keeping costs down.

A feature in S3 that replicates objects from a source bucket to a destination bucket, ensuring data availability and redundancy.

S3 replication that copies objects to a destination bucket within the same AWS region.

S3 replication that copies objects to a destination bucket in a different AWS region.

A configuration that defines where, when, and how S3 objects will be replicated to a destination bucket.

An IAM role that grants permission to the S3 service to access the source bucket and replicate objects to the destination bucket.

A service that records events (API calls, management actions) occurring in your AWS account, providing detailed logs for auditing, security analysis, and compliance.

Provides information about actions taken on AWS resources within your account, like creating an EC2 instance or terminating one.

Logs events related to data interactions, such as uploading objects to S3 or invoking a Lambda function. They are not enabled by default and must be explicitly activated for a trail.

A collection of trails that covers every AWS region within your account. As new regions are added, they are automatically included in the trail.

AWS services that operate globally, like Identity and Access Management (IAM), Security Token Service (STS), and CloudFront, log their events exclusively in the us-east-1 region.

A feature that allows you to combine multiple trails into a single entity, serving as a centralized management point for all API calls and management events in an organization.

CloudTrail is not real-time. There is a delay, typically around 15 minutes, between an event occurring and it being logged in CloudTrail.

CloudTrail logs events for the AWS region in which the trail is created. It's a regional service, meaning each region has its own set of trails.

A subnet is situated within a single Availability Zone (AZ). It's beneficial to organize subnets into tiers, like 'web', 'application', 'database', and 'spare'. With at least 3 AZs per Region, aim for at least one subnet per AZ plus a spare subnet.

A VPC is a secure, isolated network inside AWS. It acts like a private cloud, allowing you to control incoming and outgoing traffic. Any issues are confined to the VPC and its connections. It offers flexible configuration and allows connections to on-premises or other cloud networks.

A VPC uses one mandatory private IPv4 CIDR block. The block can range from a /28 prefix (16 IPs) to a /16 prefix (65,536 IPs). You can add up to 5 secondary IPv4 blocks.

VPCs have a single assigned IPv6 /56 CIDR block. IPv6 address ranges are either allocated by AWS, with no choice, or you can choose to use your own owned IPv6 addresses. Remember that IPv6 addresses are considered public by default unlike IPv4 private addresses.

A VPC uses DNS provided by Route 53, accessible at the VPC's base IP address plus 2. For example, a VPC with 10.0.0.0 would have DNS at 10.0.0.2. There are options to control how DNS works: edit DNS hostnames to allow instances with public IPs in the VPC to receive public DNS hostnames.

Default Tenancy allows you to choose dedicated hardware later for individual resources. Dedicated Tenancy locks all resources created in a VPC to dedicated hardware, which comes at a premium cost. It's a more secure option for sensitive workloads.

Consider the number of ranges, at 10 ranges per AWS account, and the regions (US with 3 regions, Europe and AUS with 1 region each) with 2 ranges per region. Understand the breakdown of ranges within each account.

When sizing your VPC, aim to divide subnets into tiers based on their function (e.g., web, application, database, spare). Consider splitting your network into at least 4 Availability Zones to create a spare subnet and ensure you have at least one subnet in each AZ.