Tutorial Dojo - DVA-C02 - Timed Mode Set 2

Test time: 9h45 - 10h28 (00:47:24)

Score: 50/65 (76.92%):

  • CDA – Development with AWS Services 79.49%
  • CDA – Security 77.78%
  • CDA – Deployment 87.5%
  • CDA – Troubleshooting and Optimization 55.56%

Domain 1: Development with AWS Services

NoQARef
1✅RDS + Lambda + Translate text with Amazone Translate. Improve performance, reduce load to RDS?Use Lambda execution environemnt /tmp as cache store
2✅DynamoDB: Employee info. Which attribute use as primary key?employee_id
3✅Run a Lambda function every 30min?Use EventBridge Schedule Rule to create scheduled events -> target the Lambda function
4✅ECS intergate with API Gateway. Which integration make no intervention?HTTP_PROXY
5✅Which API to call to get permission (from a IAM Role) to interact with S3 APIAWS STS AssumeRole API (or AssumeRoleWithWebIdentity, AssumeRoleWithSAML) (optionally pass an SessionPolicy)
6✅Asynchronous invoke Lambda function with Invoke APIPass parameter InvocationType - Event
7❌Tracking number of visitors on website (use DynamoDB)1. (May over/under count) “Atomic counter” - just increase the counter without checking current value
2. Use condition write to only update the counter item if (…) - too complicated to knowConditional Writes - DynamoDB Conditional Updates - DynamoDB
8❌Kinesis Data Streams: Duplicate Records- Two primary reasons: 1. Producer retries; 2. Consumer retries.Handling Duplicate Records - Kinesis
- Manually assign sequence number to record with Kinesis PutRecord SequenceNumberForOrdering.Adding a Single Record - Kinesis
(Same idea as assign an ID to message SQS SendMessage MessageDeduplicationId )
9❌X-Ray: Include info about calls to AWS servicesInclude sub-segment in the segment document
10❌DynamoDB: Forum (PK) - Subject (SK) - LastPostUpdateTime. Finds on posts of a forum in last 3 monthsAdd LSI: Forum (PK) - LastPostUpdatTime (SK). Use Query opeartion.
11✅DynamoDB: Write heavy - ProvisionedThroughputExceededException. Why?RCU/WCU of GSI is seperate from base table
- A Query on a GSI consume RCU from the GSI, not the base table.Data synchronization between tables & GSIs
- When you Put/Update/Delete items in a DynamoDB table, any GSIs on that table are also updated asynchronously (and consume RCU/WCU from the GSI).Provisioned throughput considerations for GSIs
12✅CodeCommit: Permission to fetch, clone, pushcodecommit:GitPull, codecommit:GitPush
13✅Elastic Beanstalk: Deploy new version with CLIPackage app as zip/war file. Deploy with eb deploy (EB CLI is a different package. It’s not packaged with AWS CLI, not aws eb)
14✅Internal app: elastic, cost-effectiveDynamoDB, EC2 Spot Fleet
15✅Build an CI/CD to deploy to both EC2 & on-premise. Which service?CodeDeploy
16✅DynamoDB: 10 RCU, each item 4KB. How much read request/s the table can hanlde?10 RCU: 10 Strong Consistency Read - 20 Eventually Consistency Read
17✅Prototype microservices on ECS. Which task placement minimize cost?Binpack, random, spread
18✅Temporary AWS credential for both authenticated/unauthenticated. Which service?Cognito Identity Pool (Federated Identity)
19❌Elastic Beanstalk: Deploy infrastructure has an RDS instance coupling with EB. How to migrate RDS?1. Create RDS snapshot; enable RDS deletion protection
2. Remove SG attached to RDS (before delete EB app’s environment)
3. Terminate the EB app’s environment
20✅SQS: Duplicated messages. How to fix?For SQS, when call SendMessage API, add MessageDeduplicationId param
(For Kinesis, when call PutRecord API, add SegmentID to SequenceNumberForOrdering param)
21✅DynamoDB: Protect from overwritten?Implement optimistic locking with version number (ensure update the right version item)Optimistic locking with version number - DynamoDB
22✅Lambda: Asynchronous invoke, exponential back-off, then send un-processed messages to another service.Lambda supports Dead Letter Queue (just as SQS DLQ)
23✅Collect visistor click to ads. Which service?DynamoDB: Use UpdateItem to implement atomic counter (Approximately ~ Add 1 to previous value)
24✅DynamoDB: Read 100 items. Which API?BatchGetItem (instead of GetItem) then BatchWriteItem
25✅DynamoDB: Store recent updated item automatically1. DynamoDB Streams + Lambda (not recommnend)
2. DynamoDB Streams + DynamoDB Streams Kinesis Adapter (recommend)
26✅DynamoDB: Session data. Reduce storage without using provision throughputUse DynamoDB TTL
27✅Kinesis Data Streams: How to handle data flow (Scaling)?1. Split shards to increase stream capacity; 2. Merge shards to decrease stream capacity.
28✅Kinesis Data Streams: Consumer process every other day & store to S3. S3 only has half of the data?Kinesis Data Streams default retention period is 24h (up to 365 days)
29✅An AWS account has 2 Lambda function. 1 works optimal, 1 is throttled. Why?The reserve concurrency execution of function 1 is higher
30✅Lambda: Process events from S3 Events. 10 events/s, each event takes 3s. How much concurrency?Concurrency: number of in-flight request AWS Lambda function is handling at the same time.
Concurrency = (Number of request/s) x (Time to process a request)
31❌Lambda: Concurrency quotas- Account-level: 1.000 unit of concurrencyLambda Concurrency Quotas
- Function-level: Up-to 900 unit of concurrency. AWS reservers 100 for functions without reserved concurrency
32✅Protect AWS APIs call with MFAMFA-enabled IAM users must call GetSessionToken and submit an MFA code that is associated with their MFA device.
33❌Elastic Beanstalk: Environment manifest (environment name, solution stack…)- Environment manifest: /env.yamlEnvironment manifest (env.yaml) - Elastic Beanstalk
- Advance config: /.ebextensions/***.config (YAML or JSON)Advanced environment customization with configuration files (.ebextensions)
34✅Website hosted on S3 bucket_A, make GET request to S3 bucket_B. API calls are blocked by browers?Enable CORS on bucket_B
35✅Migrate repos from Github to CodeCommit1. Create repos on CodeCommit; 2. Clone repos from Github; 3. Push to CodeCommit repos
36✅Lambda: Increase CPU?By increase memory
37✅ECS: Integrate with X-Ray. How to provide more granular timing information?Use sub-segment
38✅Version control system. Which service?CodeCommit
39✅API Gateway: Non-proxy integration with Lambda. How to ensure consumer include a query tring?Use method request

Domain 2: Security

NoQARef
1✅Cognito - Enforce MFA for suspicious login attemptUser Pool / Adaptive Authentication / Automatic risk responseAdaptive Authentication - User Pool
2✅EC2 instance - Upload images to S3. How to give EC2 instance permission?IAM Role (Instance Profile)
3✅Dev needs to access Test/Prod accounts. How to give permission?Grant cross-account access:
- In Test/Prod accounts, create IAM Role (with permissons)
- In Dev account, grant access to assume that IAM Role
4✅API Gateway - Lambda Authorizer: Implement one that same as OAuth, SAMLAPI Gateway - Lambda Authorizer (Custom Authorizer) has 2 types:
- Token-based Lambda Authorizer <= Bearer token: OAuth token, JWT
- Request parameter-based Lambda Authorizer <= aka REQUEST authorizer (supports a lot of data: headers, query string, stageVariales, $context…)
5✅EC2 instance has both credentials & Instance ProfileAWS CLI credentials precedence: CLI options > ENVVAR > Assumed Role > IAM Idendity (/.aws/config) > Credential file (/.aws/credentials) > EC2 instance profile > Container credentalAWS CLI Credentials Precedence
6❌Provide application in ECS access to the required AWS resourcesFargate: IAM Role -> attach to task
EC2: Container Instance Role
7❌KMS: Envelope Encryption1. encrypt plaintext data with a data key
2. encrypt the data key with a top-level plaintext master key
8✅S3 - Encryption using KMS-C. How to upload object?Include the headers: x-amz-server-side​-encryption​-customer- + algorithm/key/key-MD5
9✅IAM, SCP - How to test IAM policy?IAM Policy Simulator

Domain 3: Deployment

NoQARef
1✅SAM: workflow redeploy1. sam build; 2. sam deploy
2✅Elastic Beanstalk: Dev/Test - Reploy ASAPEB deployment strategy: AllAtOnce
3✅SAM: deploy 10% every 10minSAM Linear 10min
4✅Lambda: package deployment take too much time to deploy? How increase deploy speed?Lambda package deployment quota (for a function) is 50 MB (zipped; includes runtimes, layer…)
- Extract shared dependencies to layer.
- (Or upload to S3)
5❌CodeDeploy AppSpec - Run a task before traffic is shifted to a Lambda functionAppSpec hook
- Lambda: (Before) - AllowTraffic - (After)
6✅CloudFormation: Easiest way to deploy a hello_world lambda functionIncline the function in AWS::Lambda::Function Properties / Code / Zipfile
7✅Elastic Beanstalk: Upgrade from Java 7 to 8. Shift all traffic to the new one, revert if something’s wrongBlue/Green Deployment: EB AllAtOnce + EB swap environent URLs (EB will use Route 53 to swap CNAMEs)Blue/Green deployments with Elastic Beanstalk
8✅CodeDeploy: Deploy to where? How?CodeDeploy deploy configuration:
- EC2, on-premise: AllAtOnce, HalfAtATime, OneAtATime (Can be Blue/Green or in-place)
- Lambda, ECS: AllAtOnce, Canary, Linear

Domain 4: Troubleshooting and Optimization

NoQARef
1✅DynamoDB: ProvisionedThroughputExceededOptimize DynamoDB:
1. Use Query instead of Scan
2. Use Eventually Consistent Read instead of Strongly Consistent Read
3. Use DAX
2✅X-Ray: View full trace without using consoleUse GetTraceSummaries, BatchGetTraces
3✅ECS + Docker app: How to setup tracing with X-Ray?- Run xray-daemon inside docker imageAWS X-Ray daemon
- Config port mapping (UDP:2000) in ECS task definition
4✅AWS CLI - TimeoutUse pagination: --page-size (request less items) --max-items (show less items)AWS CLI pagination options
5❌Kinesis Data Streams: Not enough shards & Instances CPU 100%1. Increase number of shards (shard splitting). 2. Increase instance size
6❌RDS can’t handle read1. Use RDS Multi-AZ Cluster (not Multi-AZ Instance)
2. Create Read Replica, then update app to read from replica
7❌X-Ray - namespace, metadataX-Ray namespace: distinguish AWS/remote
8❌CloudWatch - namespaceCloudWatch namespace: container for metrics, e.g. aws/lambda
9✅X-Ray: From where, IP address is fetch?X-Forwarded-For header