AWS SysOps Administrator flashcards
AWS SysOps Administrator · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- CloudWatch alarm states
- An alarm can be in OK, ALARM, or INSUFFICIENT_DATA. The last state means too few data points were available to evaluate the configured threshold within the evaluation window.
- Detailed monitoring interval
- Enabling detailed monitoring on an EC2 instance publishes metrics to CloudWatch every 1 minute instead of the default 5 minutes, and it is billed per metric.
- CloudTrail event history retention
- The default Event history in CloudTrail stores the last 90 days of management events for an account with no trail required, and it is searchable by API name, user, and resource.
- CloudWatch Logs metric filter
- A pattern applied to a log group that increments a custom CloudWatch metric each time a matching log event appears, enabling alarms and dashboards from log content.
- AWS Config rule purpose
- Evaluates recorded resource configurations against a desired state and flags noncompliant resources after the fact, optionally invoking an SSM Automation document to remediate them.
- EventBridge remediation pattern
- An EventBridge rule matches an event pattern or schedule and routes the event to a target such as Lambda or SSM Automation, enabling automated response to operational events.
- RDS Multi-AZ behavior
- A synchronous standby replica in a second Availability Zone is maintained for automatic failover during failure. It does not serve read traffic; read replicas handle read scaling.
- Aurora storage replication factor
- Aurora keeps six copies of the cluster volume across three Availability Zones, allowing reads and writes to continue despite loss of an Availability Zone.
- S3 durability figure
- Amazon S3 Standard is designed for 99.999999999 percent durability, meaning eleven nines, which is distinct from the 99.99 percent availability service level.
- S3 replication prerequisite
- Both Same-Region and Cross-Region Replication require versioning enabled on the source bucket and on the destination bucket before replication rules can be created.
- Recovery point objective
- RPO is the maximum acceptable amount of data loss measured in time. A 15-minute RPO means backups or replicas must be no more than 15 minutes stale.
- Warm standby strategy
- A scaled-down but fully functional copy of the production workload runs in a second Region and is scaled up during disaster recovery, balancing cost against recovery time.
- CloudFormation change set
- A preview of the resource changes a stack update would make. CloudFormation does not modify any resources until the change set is explicitly executed.
- CloudFormation StackSets
- A feature that deploys a single template to multiple accounts and Regions in one operation, using an administrator account or a delegated administrator.
- DeletionPolicy Retain
- A CloudFormation attribute that keeps a resource and its data intact when the stack is deleted, preventing accidental loss of stateful resources.
- CodeDeploy AppSpec hooks
- Lifecycle event scripts run in order: BeforeInstall, AfterInstall, ApplicationStart, and ValidateService. A failing hook triggers a rollback according to the deployment configuration.
- Session Manager access
- A Systems Manager capability that provides shell access to instances without inbound ports, bastion hosts, or SSH keys, with sessions logged to S3 or CloudWatch Logs.
- IAM explicit deny
- An explicit Deny in any applicable policy always overrides an Allow, and permissions that are not explicitly allowed are implicitly denied by default.
- Permissions boundary
- An advanced IAM feature that sets the maximum permissions an identity-based policy can grant to a user or role, without granting any permissions itself.
- Service control policy
- An Organizations policy attached to an OU or account that limits the maximum permissions available to all principals in that account, including the account root user.
- Secrets Manager rotation
- Native automatic rotation of a stored secret, driven by a Lambda rotation function on a schedule, with the new credential written back to the secret.
- GuardDuty findings source
- A threat detection service that analyzes VPC Flow Logs, DNS query logs, and CloudTrail management events to identify malicious or unusual activity in an account.
- Security group statefulness
- Security groups are stateful and allow-only: return traffic for an allowed connection is automatically permitted, and rules can reference other security groups as sources.
- Network ACL statelessness
- Network ACLs are stateless and require both inbound and outbound rules. Rules are evaluated in ascending rule-number order and support both allow and deny actions.
- Transit Gateway role
- A regional hub that connects VPCs, VPNs, and Direct Connect gateways with transitive routing, replacing complex full-mesh VPC peering topologies.
- Gateway VPC endpoint
- A route-table target that provides private access to Amazon S3 or DynamoDB from a VPC without traversing the internet, NAT gateway, or a VPN connection.
- Route 53 latency routing
- A routing policy that returns the record for the Region with the lowest measured latency to the requesting resolver, improving performance for globally distributed users.
- Spot interruption notice
- EC2 Spot Instances receive a two-minute warning before capacity is reclaimed, delivered as an instance metadata notice and an EventBridge event.
- EBS gp3 baseline
- A gp3 volume delivers 3,000 IOPS and 125 MiB/s regardless of volume size, and IOPS and throughput can be provisioned independently above that baseline.
- S3 Intelligent-Tiering
- A storage class that monitors access patterns per object and automatically moves objects between frequent and infrequent access tiers, charging a small monitoring fee.
- Compute Savings Plan
- A one- or three-year commitment to an hourly spend that discounts EC2, Fargate, and Lambda usage in any Region and instance family, in exchange for the commitment.
- AWS Trusted Advisor
- A service that inspects an account against best-practice checks in cost optimization, performance, security, fault tolerance, and service quotas, with fuller checks on higher support plans.