Showing posts with label Security Of Virtualization Solutions. Show all posts
Showing posts with label Security Of Virtualization Solutions. Show all posts

Friday, 14 December 2018

Amazon Web Services (AWS) Explained

Q1) What is AWS?

AWS stands for Amazon Web Services. AWS is a platform that provides on-demand resources for hosting web services, storage, networking, databases and other resources over the internet with a pay-as-you-go pricing.

Q2)  What are the components of AWS?

EC2 – Elastic Compute Cloud, S3 – Simple Storage Service, Route53, EBS – Elastic Block Store, Cloudwatch, Key-Paris are few of the components of AWS.

Q3)  What are key-pairs?

Key-pairs are secure login information for your instances/virtual machines. To connect to the instances we use key-pairs that contain a public-key and private-key.

Q4)  What is S3?

S3 stands for Simple Storage Service. It is a storage service that provides an interface that you can use to store any amount of data, at any time, from anywhere in the world. With S3 you pay only for what you use and the payment model is pay-as-you-go.

Q5)  What are the pricing models for EC2instances?

The different pricing model for EC2 instances are as below,

On-demandReservedSpotScheduledDedicatedQ6) What are the types of volumes for EC2 instances?There are two types of volumes,Instance store volumesEBS – Elastic Block StoresQ7) What are EBS volumes?

EBS stands for Elastic Block Stores. They are persistent volumes that you can attach to the instances. With EBS volumes, your data will be preserved even when you stop your instances, unlike your instance store volumes where the data is deleted when you stop the instances.

Q8) What are the types of volumes in EBS?

Following are the types of volumes in EBS,

General purposeProvisioned IOPSMagneticCold HDDThroughput optimizedQ9) What are the different types of instances?

Following are the types of instances,

General purposeComputer OptimizedStorage OptimizedMemory OptimizedAccelerated ComputingQ10) What is an auto-scaling and what are the components?

Auto scaling allows you to automatically scale-up and scale-down the number of instances depending on the CPU utilization or memory utilization. There are 2 components in Auto scaling, they are Auto-scaling groups and Launch Configuration.

Q11) What are reserved instances?

Reserved instances are the instance that you can reserve a fixed capacity of EC2 instances. In reserved instances you will have to get into a contract of 1 year or 3 years.

Q12)What is an AMI?

AMI stands for Amazon Machine Image. AMI is a template that contains the software configurations, launch permission and a block device mapping that specifies the volume to attach to the instance when it is launched.

Q13) What is an EIP?

EIP stands for Elastic IP address. It is designed for dynamic cloud computing. When you want to have a static IP address for your instances when you stop and restart your instances, you will be using EIP address.

Q14) What is Cloudwatch?

Cloudwatch is a monitoring tool that you can use to monitor your various AWS resources. Like health check, network, Application, etc.

Q15) What are the types in cloudwatch?

There are 2 types in cloudwatch. Basic monitoring and detailed monitoring. Basic monitoring is free and detailed monitoring is chargeable.

Q16) What are the cloudwatch metrics that are available for EC2 instances?

Diskreads, Diskwrites, CPU utilization, networkpacketsIn, networkpacketsOut, networkIn, networkOut, CPUCreditUsage, CPUCreditBalance.

Q17) What is the minimum and maximum size of individual objects that you can store in S3

The minimum size of individual objects that you can store in S3 is 0 bytes and the maximum bytes that you can store for individual objects is 5TB.

Q18) What are the different storage classes in S3?

Following are the types of storage classes in S3,

Standard frequently accessedStandard infrequently accessedOne-zone infrequently accessed.GlacierRRS – reduced redundancy storage Q19) What is the default storage class in S3?

The default storage class in S3 in Standard frequently accessed.

 Q20) What is glacier?

Glacier is the back up or archival tool that you use to back up your data in S3.

 Q21) How can you secure the access to your S3 bucket?

There are two ways that you can control the access to your S3 buckets,

ACL – Access Control ListBucket polices Q22) How can you encrypt data in S3?

You can encrypt the data by using the below methods,

Server Side Encryption – S3 (AES 256 encryption)Server Side Encryption – KMS (Key management Service)Server Side Encryption – C (Client Side) Q23) What are the parameters for S3 pricing?

The pricing model for S3 is as below,

Storage usedNumber of requests you makeStorage managementData transferTransfer acceleration Q24) What is the pre-requisite to work with Cross region replication in S3?

You need to enable versioning on both source bucket and destination to work with cross region replication. Also both the source and destination bucket should be in different region.

 Q25) What are roles?

Roles are used to provide permissions to entities that you trust within your AWS account. Roles are users in another account. Roles are similar to users but with roles you do not need to create any username and password to work with the resources.

 Q26) What are policies and what are the types of policies?

Policies are permissions that you can attach to the users that you create. These policies will contain that access that you have provided to the users that you have created. There are 2 types of policies.

Managed policiesInline policies Q27) What is cloudfront?

Cloudfront is an AWS web service that provided businesses and application developers an easy and efficient way to distribute their content with low latency and high data transfer speeds. Cloudfront is content delivery network of AWS.

 Q28) What are edge locations?

Edge location is the place where the contents will be cached. When a user tries to access some content, the content will be searched in the edge location. If it is not available then the content will be made available from the origin location and a copy will be stored in the edge location.

Q29) What is the maximum individual archive that you can store in glacier?

You can store a maximum individual archive of upto 40 TB.

 Q30) What is VPC?

VPC stands for Virtual Private Cloud. VPC allows you to easily customize your networking configuration. VPC is a network that is logically isolated from other network in the cloud. It allows you to have your own IP address range, subnets, internet gateways, NAT gateways and security groups.

 Q31) What is VPC peering connection?

VPC peering connection allows you to connect 1 VPC with another VPC. Instances in these VPC behave as if they are in the same network.

 Q32) What are NAT gateways?

NAT stands for Network Address Translation. NAT gateways enables instances in a private subnet to connect to the internet but prevent the internet from initiating a connection with those instances.

 Q33) How can you control the security to your VPC?

You can use security groups and NACL (Network Access Control List) to control the security to your

VPC.

 Q34) What are the different types of storage gateway?

Following are the types of storage gateway.

File gatewayVolume gatewayTape gateway Q35) What is a snowball?

Snowball is a data transport solution that used source appliances to transfer large amounts of data into and out of AWS. Using snowball, you can move huge amount of data from one place to another which reduces your network costs, long transfer times and also provides better security.

 Q36) What are the database types in RDS?

Following are the types of databases in RDS,

AuroraOracleMYSQL serverPostgresqlMariaDBSQL server Q37) What is a redshift?

Amazon redshift is a data warehouse product. It is a fast and powerful, fully managed, petabyte scale data warehouse service in the cloud.

 Q38) What is SNS?

SNS stands for Simple Notification Service. SNS is a web service that makes it easy to notifications from the cloud. You can set up SNS to receive email notification or message notification.

 Q39) What are the types of routing polices in route53?

Following are the types of routing policies in route53,

Simple routingLatency routingFailover routingGeolocation routingWeighted routingMultivalue answer Q40) What is the maximum size of messages in SQS?

The maximum size of messages in SQS is 256 KB.

Q41) What are the types of queues in SQS?

There are 2 types of queues in SQS.

Standard queueFIFO (First In First Out) Q42) What is multi-AZ RDS?

Multi-AZ (Availability Zone) RDS allows you to have a replica of your production database in another availability zone. Multi-AZ (Availability Zone) database is used for disaster recovery. You will have an exact copy of your database. So when your primary database goes down, your application will automatically failover to the standby database.

Q43) What are the types of backups in RDS database?

There are 2 types of backups in RDS database.

Automated backupsManual backups which are known as snapshots. Q44) What is the difference between security groups and network access control list?Security GroupsNetwork access control listCan control the access at the instance levelCan control access at the subnet levelCan add rules for “allow” onlyCan add rules for both “allow” and “deny”Evaluates all rules before allowing the trafficRules are processed in order number when allowing traffic.Can assign unlimited number of security groupsCan assign upto 5 security groups.Statefull filteringStateless filtering Q45) What are the types of load balancers in EC2?

There are 3 types of load balancers,

Application load balancerNetwork load balancerClassic load balancer Q46) What is and ELB?

ELB stands for Elastic Load balancing. ELB automatically distributes the incoming application traffic or network traffic across multiple targets like EC2, containers, IP addresses.

 Q47) What are the two types of access that you can provide when you are creating users?

Following are the two types of access that you can create.

Programmatic accessConsole access Q48) What are the benefits of auto scaling?

Following are the benefits of auto scaling

Better fault toleranceBetter availabilityBetter cost management Q49) What are security groups?

Security groups acts as a firewall that contains the traffic for one or more instances. You can associate one or more security groups to your instances when you launch then. You can add rules to each security group that allow traffic to and from its associated instances. You can modify the rules of a security group at any time, the new rules are automatically  and immediately applied to all the instances that are associated with the security group

Q50) What are shared AMI’s?

Shared AMI’s are the AMI that are created by other developed and made available for other developed to use.

 Q51)What is the difference between the classic load balancer and application load balancer?

Answer: Dynamic port mapping, multiple port multiple listeners is used in Application Load Balancer, One port one listener is achieved via Classic Load Balancer

 Q52) By default how many Ip address does aws reserve in a subnet?

Answer: 5

 Q53) What is meant by subnet?

Answer: A large section of IP Address divided in to chunks are known as subnets

 Q54) How can you convert a public subnet to private subnet?

Answer: Remove IGW & add NAT Gateway, Associate subnet in Private route table

 Q55) Is it possible to reduce a ebs volume?

Answer: no it’s not possible, we can increase it but not reduce them

 Q56) What is the use of elastic ip are they charged by AWS?

Answer: These are ipv4 address which are used to connect the instance from internet, they are charged if the instances are not attached to it

 Q57) One of my s3 is bucket is deleted but i need to restore is there any possible way?

Answer: If versioning is enabled we can easily restore them

 Q58) When I try to launch an ec2 instance i am getting Service limit exceed, how to fix the issue?

Answer: By default AWS offer service limit of 20 running instances per region, to fix the issue we need to contact AWS support to increase the limit based on the requirement

 Q59) I need to modify the ebs volumes in Linux and windows is it possible

Answer: yes its possible from console use modify volumes in section give the size u need then for windows go to disk management for Linux mount it to achieve the modification

 Q60) Is it possible to stop a RDS instance, how can I do that?

Answer: Yes it’s possible to stop rds. Instance which are non-production and non multi AZ’s

 Q61) What is meant by parameter groups in rds. And what is the use of it?

Answer: Since RDS is a managed service AWS offers a wide set of parameter in RDS as parameter group which is modified as per requirement

 Q62) What is the use of tags and how they are useful?

Answer: Tags are used for identification and grouping AWS Resources

 Q63) I am viewing an AWS Console but unable to launch the instance, I receive an IAM Error how can I rectify it?

Answer: As AWS user I don’t have access to use it, I need to have permissions to use it further

 Q64) I don’t want my AWS Account id to be exposed to users how can I avoid it?

Answer: In IAM console there is option as sign in url where I can rename my own account name with AWS account

 Q65) By default how many Elastic Ip address does AWS Offer?

Answer: 5 elastic ip per region

 Q66) You are enabled sticky session with ELB. What does it do with your instance?

Answer: Binds the user session with a specific instance

 Q67) Which type of load balancer makes routing decisions at either the transport layer or theApplication layer and supports either EC2 or VPC.

Answer: Classic Load Balancer

 Q68) Which is virtual network interface that you can attach to an instance in a VPC?

Answer: Elastic Network Interface

 Q69) You have launched a Linux instance in AWS EC2. While configuring security group, youHave selected SSH, HTTP, HTTPS protocol. Why do we need to select SSH?

Answer: To verify that there is a rule that allows traffic from EC2 Instance to your computer

 Q70) You have chosen a windows instance with Classic and you want to make some change to theSecurity group. How will these changes be effective?

Answer: Changes are automatically applied to windows instances

 Q71) Load Balancer and DNS service comes under which type of cloud service?

Answer: IAAS-Storage

 Q72) You have an EC2 instance that has an unencrypted volume. You want to create another Encrypted volume from this unencrypted volume. Which of the following steps can achieve this?

Answer: Create a snapshot of the unencrypted volume (applying encryption parameters), copy the. Snapshot and create a volume from the copied snapshot

 Q73) Where does the user specify the maximum number of instances with the auto scaling Commands?

Answer: Auto scaling Launch Config

 Q74) Which are the types of AMI provided by AWS?

Answer: Instance Store backed, EBS Backed

 Q75) After configuring ELB, you need to ensure that the user requests are always attached to a Single instance. What setting can you use?

Answer:  Sticky session

 Q76) When do I prefer to Provisioned IOPS over the Standard RDS storage?

Ans: If you have do batch-oriented is workloads.

Q77) If I am running on my DB Instance a Multi-AZ deployments, can I use to the stand by the DB Instance for read or write a operation along with to primary DB instance?

Ans: Primary db instance does not working.

Q78) Which the AWS services will you use to the collect and the process e-commerce data for the near by real-time analysis?

Ans:  Good of Amazon DynamoDB.

Q79) A company is deploying the new two-tier an web application in AWS. The company has to limited on staff and the requires high availability, and the application requires to complex queries and table joins. Which configuration provides to the solution for company’s requirements?

Ans: An web application provide on Amazon DynamoDB solution.

Q80) Which the statement use to cases are suitable for Amazon DynamoDB?

Ans: The storing metadata for the Amazon S3 objects& The Running of relational joins and complex an updates.

Q81) Your application has to the retrieve on data from your user’s mobile take every 5 minutes and then data is stored in the DynamoDB, later every day at the particular time the data is an extracted into S3 on a per user basis and then your application is later on used to visualize the data to user. You are the asked to the optimize the architecture of the backend system can to lower cost, what would you recommend do?

Ans: Introduce Amazon Elasticache to the cache reads from the Amazon DynamoDB table and to reduce the provisioned read throughput.

Q82) You are running to website on EC2 instances can deployed across multiple Availability Zones with an Multi-AZ RDS MySQL Extra Large DB Instance etc. Then site performs a high number of the small reads and the write per second and the relies on the eventual consistency model. After the comprehensive tests you discover to that there is read contention on RDS MySQL. Which is the best approaches to the meet these requirements?

Ans:The Deploy Elasti Cache in-memory cache is  running in each availability zone and Then Increase the RDS MySQL Instance size and the Implement provisioned IOPS.

Q83) An startup is running to a pilot deployment of around 100 sensors to the measure street noise and The air quality is urban areas for the 3 months. It was noted that every month to around the 4GB of sensor data are generated. The company uses to a load balanced take auto scaled layer of the EC2 instances and a RDS database with a 500 GB standard storage. The pilot was success and now they want to the deploy take atleast 100K sensors.let which to need the supported by backend. You need to the stored data for at least 2 years to an analyze it. Which setup of  following would you be prefer?

Ans: The Replace the RDS instance with an 6 node Redshift cluster with take 96TB of storage.

Q84) Let to Suppose you have an application where do you have to render images and also do some of general computing. which service will be best fit your need?

Ans: Used on Application Load Balancer.

Q85) How will change the instance give type for the instances, which are the running in your applications tier and Then using Auto Scaling. Where will you change it from areas?

Ans: Changed to Auto Scaling launch configuration areas.

Q86) You have an content management system running on the Amazon EC2 instance that is the approaching 100% CPU of utilization. Which option will be reduce load on the Amazon EC2 instance?

Ans: Let Create a load balancer, and Give register the Amazon EC2 instance with it.

Q87) What does the Connection of draining do?

Ans: The re-routes traffic from the instances which are to be updated (or) failed an health to check.

Q88) When the instance is an unhealthy, it is do terminated and replaced with an new ones, which of the services does that?

Ans: The survice make a fault tolerance.

Q89) What are the life cycle to hooks used for the AutoScaling?

Ans: They are used to the  put an additional taken wait time to the scale in or scale out events.

Q90) An user has to setup an Auto Scaling group. Due to some issue the group has to failed for launch a single instance for the more than 24 hours. What will be happen to the Auto Scaling in the condition?

Ans: The auto Scaling will be suspend to the scaling process.

Q91) You have an the EC2 Security Group with a several running to EC2 instances. You changed to the Security of Group rules to allow the inbound traffic on a new port and protocol, and then the launched a several new instances in the same of Security Group.Such the new rules apply?

Ans: The Immediately to all the instances in security groups.Q1) What is AWS?

AWS stands for Amazon Web Services. AWS is a platform that provides on-demand resources for hosting web services, storage, networking, databases and other resources over the internet with a pay-as-you-go pricing.

Q2)  What are the components of AWS?

EC2 – Elastic Compute Cloud, S3 – Simple Storage Service, Route53, EBS – Elastic Block Store, Cloudwatch, Key-Paris are few of the components of AWS.

Q3)  What are key-pairs?

Key-pairs are secure login information for your instances/virtual machines. To connect to the instances we use key-pairs that contain a public-key and private-key.

Q4)  What is S3?

S3 stands for Simple Storage Service. It is a storage service that provides an interface that you can use to store any amount of data, at any time, from anywhere in the world. With S3 you pay only for what you use and the payment model is pay-as-you-go.

Q5)  What are the pricing models for EC2instances?

The different pricing model for EC2 instances are as below,

On-demandReservedSpotScheduledDedicatedQ6) What are the types of volumes for EC2 instances?There are two types of volumes,Instance store volumesEBS – Elastic Block StoresQ7) What are EBS volumes?

EBS stands for Elastic Block Stores. They are persistent volumes that you can attach to the instances. With EBS volumes, your data will be preserved even when you stop your instances, unlike your instance store volumes where the data is deleted when you stop the instances.

Q8) What are the types of volumes in EBS?

Following are the types of volumes in EBS,

General purposeProvisioned IOPSMagneticCold HDDThroughput optimizedQ9) What are the different types of instances?

Following are the types of instances,

General purposeComputer OptimizedStorage OptimizedMemory OptimizedAccelerated ComputingQ10) What is an auto-scaling and what are the components?

Auto scaling allows you to automatically scale-up and scale-down the number of instances depending on the CPU utilization or memory utilization. There are 2 components in Auto scaling, they are Auto-scaling groups and Launch Configuration.

Q11) What are reserved instances?

Reserved instances are the instance that you can reserve a fixed capacity of EC2 instances. In reserved instances you will have to get into a contract of 1 year or 3 years.

Q12)What is an AMI?

AMI stands for Amazon Machine Image. AMI is a template that contains the software configurations, launch permission and a block device mapping that specifies the volume to attach to the instance when it is launched.

Q13) What is an EIP?

EIP stands for Elastic IP address. It is designed for dynamic cloud computing. When you want to have a static IP address for your instances when you stop and restart your instances, you will be using EIP address.

Q14) What is Cloudwatch?

Cloudwatch is a monitoring tool that you can use to monitor your various AWS resources. Like health check, network, Application, etc.

Q15) What are the types in cloudwatch?

There are 2 types in cloudwatch. Basic monitoring and detailed monitoring. Basic monitoring is free and detailed monitoring is chargeable.

Q16) What are the cloudwatch metrics that are available for EC2 instances?

Diskreads, Diskwrites, CPU utilization, networkpacketsIn, networkpacketsOut, networkIn, networkOut, CPUCreditUsage, CPUCreditBalance.

Q17) What is the minimum and maximum size of individual objects that you can store in S3

The minimum size of individual objects that you can store in S3 is 0 bytes and the maximum bytes that you can store for individual objects is 5TB.

Q18) What are the different storage classes in S3?

Following are the types of storage classes in S3,

Standard frequently accessedStandard infrequently accessedOne-zone infrequently accessed.GlacierRRS – reduced redundancy storage Q19) What is the default storage class in S3?

The default storage class in S3 in Standard frequently accessed.

 Q20) What is glacier?

Glacier is the back up or archival tool that you use to back up your data in S3.

 Q21) How can you secure the access to your S3 bucket?

There are two ways that you can control the access to your S3 buckets,

ACL – Access Control ListBucket polices Q22) How can you encrypt data in S3?

You can encrypt the data by using the below methods,

Server Side Encryption – S3 (AES 256 encryption)Server Side Encryption – KMS (Key management Service)Server Side Encryption – C (Client Side) Q23) What are the parameters for S3 pricing?

The pricing model for S3 is as below,

Storage usedNumber of requests you makeStorage managementData transferTransfer acceleration Q24) What is the pre-requisite to work with Cross region replication in S3?

You need to enable versioning on both source bucket and destination to work with cross region replication. Also both the source and destination bucket should be in different region.

 Q25) What are roles?

Roles are used to provide permissions to entities that you trust within your AWS account. Roles are users in another account. Roles are similar to users but with roles you do not need to create any username and password to work with the resources.

 Q26) What are policies and what are the types of policies?

Policies are permissions that you can attach to the users that you create. These policies will contain that access that you have provided to the users that you have created. There are 2 types of policies.

Managed policiesInline policies Q27) What is cloudfront?

Cloudfront is an AWS web service that provided businesses and application developers an easy and efficient way to distribute their content with low latency and high data transfer speeds. Cloudfront is content delivery network of AWS.

 Q28) What are edge locations?

Edge location is the place where the contents will be cached. When a user tries to access some content, the content will be searched in the edge location. If it is not available then the content will be made available from the origin location and a copy will be stored in the edge location.

Q29) What is the maximum individual archive that you can store in glacier?

You can store a maximum individual archive of upto 40 TB.

 Q30) What is VPC?

VPC stands for Virtual Private Cloud. VPC allows you to easily customize your networking configuration. VPC is a network that is logically isolated from other network in the cloud. It allows you to have your own IP address range, subnets, internet gateways, NAT gateways and security groups.

 Q31) What is VPC peering connection?

VPC peering connection allows you to connect 1 VPC with another VPC. Instances in these VPC behave as if they are in the same network.

 Q32) What are NAT gateways?

NAT stands for Network Address Translation. NAT gateways enables instances in a private subnet to connect to the internet but prevent the internet from initiating a connection with those instances.

 Q33) How can you control the security to your VPC?

You can use security groups and NACL (Network Access Control List) to control the security to your

VPC.

 Q34) What are the different types of storage gateway?

Following are the types of storage gateway.

File gatewayVolume gatewayTape gateway Q35) What is a snowball?

Snowball is a data transport solution that used source appliances to transfer large amounts of data into and out of AWS. Using snowball, you can move huge amount of data from one place to another which reduces your network costs, long transfer times and also provides better security.

 Q36) What are the database types in RDS?

Following are the types of databases in RDS,

AuroraOracleMYSQL serverPostgresqlMariaDBSQL server Q37) What is a redshift?

Amazon redshift is a data warehouse product. It is a fast and powerful, fully managed, petabyte scale data warehouse service in the cloud.

 Q38) What is SNS?

SNS stands for Simple Notification Service. SNS is a web service that makes it easy to notifications from the cloud. You can set up SNS to receive email notification or message notification.

 Q39) What are the types of routing polices in route53?

Following are the types of routing policies in route53,

Simple routingLatency routingFailover routingGeolocation routingWeighted routingMultivalue answer Q40) What is the maximum size of messages in SQS?

The maximum size of messages in SQS is 256 KB.

Q41) What are the types of queues in SQS?

There are 2 types of queues in SQS.

Standard queueFIFO (First In First Out) Q42) What is multi-AZ RDS?

Multi-AZ (Availability Zone) RDS allows you to have a replica of your production database in another availability zone. Multi-AZ (Availability Zone) database is used for disaster recovery. You will have an exact copy of your database. So when your primary database goes down, your application will automatically failover to the standby database.

Q43) What are the types of backups in RDS database?

There are 2 types of backups in RDS database.

Automated backupsManual backups which are known as snapshots. Q44) What is the difference between security groups and network access control list?Security GroupsNetwork access control listCan control the access at the instance levelCan control access at the subnet levelCan add rules for “allow” onlyCan add rules for both “allow” and “deny”Evaluates all rules before allowing the trafficRules are processed in order number when allowing traffic.Can assign unlimited number of security groupsCan assign upto 5 security groups.Statefull filteringStateless filtering Q45) What are the types of load balancers in EC2?

There are 3 types of load balancers,

Application load balancerNetwork load balancerClassic load balancer Q46) What is and ELB?

ELB stands for Elastic Load balancing. ELB automatically distributes the incoming application traffic or network traffic across multiple targets like EC2, containers, IP addresses.

 Q47) What are the two types of access that you can provide when you are creating users?

Following are the two types of access that you can create.

Programmatic accessConsole access Q48) What are the benefits of auto scaling?

Following are the benefits of auto scaling

Better fault toleranceBetter availabilityBetter cost management Q49) What are security groups?

Security groups acts as a firewall that contains the traffic for one or more instances. You can associate one or more security groups to your instances when you launch then. You can add rules to each security group that allow traffic to and from its associated instances. You can modify the rules of a security group at any time, the new rules are automatically  and immediately applied to all the instances that are associated with the security group

Q50) What are shared AMI’s?

Shared AMI’s are the AMI that are created by other developed and made available for other developed to use.

 Q51)What is the difference between the classic load balancer and application load balancer?

Answer: Dynamic port mapping, multiple port multiple listeners is used in Application Load Balancer, One port one listener is achieved via Classic Load Balancer

 Q52) By default how many Ip address does aws reserve in a subnet?

Answer: 5

 Q53) What is meant by subnet?

Answer: A large section of IP Address divided in to chunks are known as subnets

 Q54) How can you convert a public subnet to private subnet?

Answer: Remove IGW & add NAT Gateway, Associate subnet in Private route table

 Q55) Is it possible to reduce a ebs volume?

Answer: no it’s not possible, we can increase it but not reduce them

 Q56) What is the use of elastic ip are they charged by AWS?

Answer: These are ipv4 address which are used to connect the instance from internet, they are charged if the instances are not attached to it

 Q57) One of my s3 is bucket is deleted but i need to restore is there any possible way?

Answer: If versioning is enabled we can easily restore them

 Q58) When I try to launch an ec2 instance i am getting Service limit exceed, how to fix the issue?

Answer: By default AWS offer service limit of 20 running instances per region, to fix the issue we need to contact AWS support to increase the limit based on the requirement

 Q59) I need to modify the ebs volumes in Linux and windows is it possible

Answer: yes its possible from console use modify volumes in section give the size u need then for windows go to disk management for Linux mount it to achieve the modification

 Q60) Is it possible to stop a RDS instance, how can I do that?

Answer: Yes it’s possible to stop rds. Instance which are non-production and non multi AZ’s

 Q61) What is meant by parameter groups in rds. And what is the use of it?

Answer: Since RDS is a managed service AWS offers a wide set of parameter in RDS as parameter group which is modified as per requirement

 Q62) What is the use of tags and how they are useful?

Answer: Tags are used for identification and grouping AWS Resources

 Q63) I am viewing an AWS Console but unable to launch the instance, I receive an IAM Error how can I rectify it?

Answer: As AWS user I don’t have access to use it, I need to have permissions to use it further

 Q64) I don’t want my AWS Account id to be exposed to users how can I avoid it?

Answer: In IAM console there is option as sign in url where I can rename my own account name with AWS account

 Q65) By default how many Elastic Ip address does AWS Offer?

Answer: 5 elastic ip per region

 Q66) You are enabled sticky session with ELB. What does it do with your instance?

Answer: Binds the user session with a specific instance

 Q67) Which type of load balancer makes routing decisions at either the transport layer or theApplication layer and supports either EC2 or VPC.

Answer: Classic Load Balancer

 Q68) Which is virtual network interface that you can attach to an instance in a VPC?

Answer: Elastic Network Interface

 Q69) You have launched a Linux instance in AWS EC2. While configuring security group, youHave selected SSH, HTTP, HTTPS protocol. Why do we need to select SSH?

Answer: To verify that there is a rule that allows traffic from EC2 Instance to your computer

 Q70) You have chosen a windows instance with Classic and you want to make some change to theSecurity group. How will these changes be effective?

Answer: Changes are automatically applied to windows instances

 Q71) Load Balancer and DNS service comes under which type of cloud service?

Answer: IAAS-Storage

 Q72) You have an EC2 instance that has an unencrypted volume. You want to create another Encrypted volume from this unencrypted volume. Which of the following steps can achieve this?

Answer: Create a snapshot of the unencrypted volume (applying encryption parameters), copy the. Snapshot and create a volume from the copied snapshot

 Q73) Where does the user specify the maximum number of instances with the auto scaling Commands?

Answer: Auto scaling Launch Config

 Q74) Which are the types of AMI provided by AWS?

Answer: Instance Store backed, EBS Backed

 Q75) After configuring ELB, you need to ensure that the user requests are always attached to a Single instance. What setting can you use?

Answer:  Sticky session

 Q76) When do I prefer to Provisioned IOPS over the Standard RDS storage?

Ans: If you have do batch-oriented is workloads.

Q77) If I am running on my DB Instance a Multi-AZ deployments, can I use to the stand by the DB Instance for read or write a operation along with to primary DB instance?

Ans: Primary db instance does not working.

Q78) Which the AWS services will you use to the collect and the process e-commerce data for the near by real-time analysis?

Ans:  Good of Amazon DynamoDB.

Q79) A company is deploying the new two-tier an web application in AWS. The company has to limited on staff and the requires high availability, and the application requires to complex queries and table joins. Which configuration provides to the solution for company’s requirements?

Ans: An web application provide on Amazon DynamoDB solution.

Q80) Which the statement use to cases are suitable for Amazon DynamoDB?

Ans: The storing metadata for the Amazon S3 objects& The Running of relational joins and complex an updates.

Q81) Your application has to the retrieve on data from your user’s mobile take every 5 minutes and then data is stored in the DynamoDB, later every day at the particular time the data is an extracted into S3 on a per user basis and then your application is later on used to visualize the data to user. You are the asked to the optimize the architecture of the backend system can to lower cost, what would you recommend do?

Ans: Introduce Amazon Elasticache to the cache reads from the Amazon DynamoDB table and to reduce the provisioned read throughput.

Q82) You are running to website on EC2 instances can deployed across multiple Availability Zones with an Multi-AZ RDS MySQL Extra Large DB Instance etc. Then site performs a high number of the small reads and the write per second and the relies on the eventual consistency model. After the comprehensive tests you discover to that there is read contention on RDS MySQL. Which is the best approaches to the meet these requirements?

Ans:The Deploy Elasti Cache in-memory cache is  running in each availability zone and Then Increase the RDS MySQL Instance size and the Implement provisioned IOPS.

Q83) An startup is running to a pilot deployment of around 100 sensors to the measure street noise and The air quality is urban areas for the 3 months. It was noted that every month to around the 4GB of sensor data are generated. The company uses to a load balanced take auto scaled layer of the EC2 instances and a RDS database with a 500 GB standard storage. The pilot was success and now they want to the deploy take atleast 100K sensors.let which to need the supported by backend. You need to the stored data for at least 2 years to an analyze it. Which setup of  following would you be prefer?

Ans: The Replace the RDS instance with an 6 node Redshift cluster with take 96TB of storage.

Q84) Let to Suppose you have an application where do you have to render images and also do some of general computing. which service will be best fit your need?

Ans: Used on Application Load Balancer.

Q85) How will change the instance give type for the instances, which are the running in your applications tier and Then using Auto Scaling. Where will you change it from areas?

Ans: Changed to Auto Scaling launch configuration areas.

Q86) You have an content management system running on the Amazon EC2 instance that is the approaching 100% CPU of utilization. Which option will be reduce load on the Amazon EC2 instance?

Ans: Let Create a load balancer, and Give register the Amazon EC2 instance with it.

Q87) What does the Connection of draining do?

Ans: The re-routes traffic from the instances which are to be updated (or) failed an health to check.

Q88) When the instance is an unhealthy, it is do terminated and replaced with an new ones, which of the services does that?

Ans: The survice make a fault tolerance.

Q89) What are the life cycle to hooks used for the AutoScaling?

Ans: They are used to the  put an additional taken wait time to the scale in or scale out events.

Q90) An user has to setup an Auto Scaling group. Due to some issue the group has to failed for launch a single instance for the more than 24 hours. What will be happen to the Auto Scaling in the condition?

Ans: The auto Scaling will be suspend to the scaling process.

Q91) You have an the EC2 Security Group with a several running to EC2 instances. You changed to the Security of Group rules to allow the inbound traffic on a new port and protocol, and then the launched a several new instances in the same of Security Group.Such the new rules apply?

Ans: The Immediately to all the instances in security groups.

Friday, 8 December 2017

Security Of Virtualization Solutions

vmware
Memory Isolation
Direction Execution of User Requests
OS Requests lure to VMM while not Binary Transformation or Paravirtualization
The supervisor American state nes the RAM allotted to a virtual machine by the VMM via the virtual machine’s settings. The VMkernel allocates memory once it American state nes the resources to be utilized by the virtual machine. A guest OS uses physical memory allotted thereto by the VMkernel and American state ned within the virtual machine’s con guration autoimmune disorder.



Fig:Memory Isolation in vmware.



An OS booting on real hardware is given a zero-based physical address house; AN OS corporal punishment on virtual hardware is given a zero-based address space. The VMM offers every virtual machine the illusion that it's victimization such AN address house, virtualizing physical memory by adding an additional level of address translation. A machine address refers to actual hardware memory; a physical address may be a software package abstraction wont to give the illusion of hardware memory to a virtual machine. This paper uses “physical” in quotation marks to tell apart this deviation from the standard which means of the term.

Memory Protection
To protect privileged parts, like the VMM and VMkernel, vSphere uses sure well-known techniques. Address house layout organisation (ASLR) randomizes wherever core kernel modules square measure loaded into memory. The NX/XD C.P.U. options change the VMkernel to mark writeable areas of memory as nonexecutable. each ways shield the system from bu er over ow attacks in running code. NX/XD C.P.U. options are also exposed to guest virtual machines by default.

Device Isolation
Each virtual machine is isolated from different virtual machines running on an equivalent hardware. Virtual machines share physical resources like C.P.U., memory, and I/O devices; a guest OS in a private virtual machine cannot observe any device aside from the virtual devices created offered thereto.
To any clarify, a virtual machine will observe solely the virtual (or physical) devices assigned thereto by the systems administrator, like the subsequent examples:
• A virtual SCSI disk mapped to a autoimmune disorder on a disk
• AN actual disk or LUN connected to a physical host or array
• A virtual network controller connected to a virtual switch
• AN actual network controller connected to a physical network

Device Access to Hardware
At the hardware level, all direct access (DMA) transfers and device-generated interrupts square measure virtualized and isolated from different virtual machines. This prevents one virtual machine from accessing the memory house controlled by another virtual machine. If such an endeavor is formed by a virtual machine, the guest OS can receive a fault from the C.P.U..
Because the VMkernel and VMM mediate access to the physical resources, and every one physical hardware access takes place through the VMkernel, virtual machines cannot circumvent this level of isolation.

I/O Remapping
Modern processors feature AN I/O memory management unit that remaps I/O DMA transfers and device interrupts. this allows virtual machines to possess direct access to hardware I/O devices, like network cards, storage controllers (HBAs), and GPUs. In AMD processors, this feature is termed AMD I/O Virtualization (AMD-Vi) or I/O memory management unit (IOMMU); in Intel processors, the feature is termed Intel Virtualization Technology for Directed I/O (VT-d). among ESXi, use of this capability is termed DirectPath I/O. DirectPath I/O doesn't impact the protection properties in any approach. as an example, a virtual machine con gured to use VT-d or AMD-Vi to directly access a tool cannot in uence or access the I/O of another virtual machine.

      1. Resource Provisioning, Shares, and Limits

      2. Security of the VMware vSphere Hypervisor

DirectPath I/O
In a virtualized surroundings, resources square measure shared among all virtual machines. however as a result of system resources will be managed, it permits use limits on virtual machines. There square measure variety of ways to deal with this.

Provisioning
In a physical system, the OS will use all the hardware resources. If the system has 128GB of memory, and also the OS will address it, all of that memory will be used. an equivalent applies to C.P.U. resources. However, as antecedently noted, all resources square measure shared in an exceedingly virtual surroundings. AN OS victimization too several resources, C.P.U. as an example, probably will deprive another OS of the resources it wants. Provisioning is that the rst step in managing virtual machine resources. A virtual machine ought to be provisioned with solely the resources it needs to try and do employment. as a result of virtual machines ne'er will use additional C.P.U. or memory resources than provisioned, users will limit the impact on different virtual machines.

Shares
Users will any isolate and shield neighboring virtual machines from “noisy neighbors” through the employment of shares. Grouping “like” virtual machines into resource pools, and departure shares set to default, ensures that every one virtual machines within the pool receive about an equivalent resource priority. A “noisy neighbor” won't be ready to use quite the other virtual machine within the pool.

Limits
Previous recommendations prompt the employment of limits to manage resource usage. However, supported additional operational expertise, it's been found that virtual machine–level limits will have prejudicious operational e ects if used improperly.
For example, a virtual machine is provisioned with 4GB and also the limit is ready to 4GB

      1. Network Isolation

      2. ESXi Networks

There square measure variety of networks to think about on AN ESXi server:
1. vSphere infrastructure networks, used for options like VMware vSphere vMotion®, VMware vSphere Fault Tolerance, and storage. These networks square measure thought of to be isolated for his or her speci c functions and sometimes aren't routed outside one physical set of server racks.
2. A management network that isolates shopper, command-line interface (CLI) or API, and third-party software package tra c from traditional tra c. This network ought to be accessible solely by system, network, and security directors. Use of “jump box” or virtual personal network (VPN) to secure access to the management network is suggested. Access among this network to sources of malware ought to be strictly controlled.
3. Virtual machine networks will be one or several networks over that virtual machine tra c ows. Isolation of virtual machines among this network will be increased with the employment of virtual rewall solutions that set rewall rules at the virtual network controller. These settings travel with the virtual machine because it migrates from host to host among a vSphere cluster.

      1. Virtual Machine Networks

Just as a physical machine will communicate with different machines in an exceedingly network solely through a network adapter, a virtual machine will communicate with different virtual machines running on an equivalent ESXi host solely through a virtual switch. Further, a virtual machine communicates with the physical network, as well as virtual machines on different ESXi hosts, solely through a physical network adapter, unless it uses DirectPath I/O.

In considering virtual machine isolation in an exceedingly network context, users will apply these rules supported Figure 5:
• If a virtual machine doesn't share a virtual switch with the other virtual machine, it's fully isolated from different virtual networks among the host. this is often virtual machine one.
• If no physical network adapter is con gured for a virtual machine, the virtual machine is totally isolated from any physical networks. this is often virtual machine two. during this example, the sole access to a physical network is that if virtual machine three acts as a router between virtual switch two and virtual switch three.
• A virtual machine will span 2 or additional virtual switches provided that con gured by the administrator. this is often virtual machine three.


      1. Virtual Networking Layer

The virtual networking layer consists of the virtual network devices through that virtual machines interface with the remainder of the network. ESXi depends on the virtual networking layer to support communication between virtual machines and their users. additionally, ESXi hosts use the virtual networking layer to speak with iSCSI SANs, NAS storage, and so on. The virtual networking layer includes virtual network adapters and also the virtual switches.
Virtual Switches
The networking stack uses a standard style for optimum exibility. A virtual switch is “built to order” at runtime from a group of tiny useful units, like the following:
• The core layer two forwarding engine
• VLAN tagging, stripping, and ltering units
• Virtual port capabilities speci c to a specific adapter or a specific port on a virtual switch • Level security, checksum, and segmentation o oad units
When the virtual switch is constructed at runtime, ESXi installs and runs solely those parts that square measure needed to support the speci c physical and virtual LAN adapter sorts employed in the con guration. Therefore, the system pays the bottom doable price in quality and helps guarantee a secure design.







Virtual Switch VLANs
ESXi supports IEEE 802.1q VLANs, which might be wont to any shield the virtual machine network, management networks, and storage con guration. VMware software package engineers wrote this driver in accordance with the IEEE speci ion. VLANs change segmentation of a physical network thus 2 machines on an equivalent physical network cannot send packets to or receive packets from one another unless they're on an equivalent VLAN.

Virtual Ports
The virtual ports in ESXi give a fashionable management channel for communication with the virtual LAN adapters connected to them. ESXi virtual ports magisterially observe that square measure the con gured receive lters for virtual LAN adapters connected to them, thus no learning is needed to populate forwarding tables.
They conjointly magisterially observe the “hard” con guration of the virtual LAN adapters connected to them. This capability makes it doable to line such policies as forbidding macintosh address changes by the guest and rejecting solid macintosh address transmission, as a result of the virtual switch port will basically magisterially observe what's “burned into ROM”—actually, keep within the con guration autoimmune disorder, outside the management of the guest OS.
The policies offered in virtual ports square measure far more di cult—if not impossible—to implement with physical switches. Either ACLs should manually be programmed into the switch port, or weak conjecture like “ rst macintosh seen is assumed to be correct” should be relied on.

Virtual Network Adapters
vSphere provides many varieties of virtual network adapters that guest OSs will use. the selection of adapter depends upon factors like support by the guest OS and performance, however all the adapters share the subsequent characteristics:
• they need their own macintosh addresses and unicast/multicast/broadcast lters. • they're strictly stratified LAN adapter devices.
• They act with the low-level VMkernel layer stack via a standard API.


KVM

    1. Executive outline

You've most likely been reading regarding the economic science of cloud computing. the guarantees of economical, virtualized computing platforms square measure attractive: low entry price, dynamic filler to accommodate varied workloads, machine-controlled management, and more. the worth proposition appearance equally compelling for each rising and well-established organizations. Moving your mission-critical workloads to a cloud might save your organization a considerable fraction of its current IT expense. However, there's AN obstacle important enough to forestall you from ever taking advantage of the advantages cloud computing offers. That obstacle may be a very important question of security. What virtualization technology are you able to trust for the protection of your cloud? UN agency will give it? The answer: you'll trust the corporate that has the foremost virtualization expertise. you'll trust the open supply technology that powers its clouds. That company is IBM®, which technology is KVM.


KVM meets all the factors cartoonist outlined for a sort one hypervisor. First, the virtual machine monitor (VMM) runs in privileged mode and directly uses hardware directions to virtualize the guest. Guest code executes most of the time directly on hardware at full speed. most significantly, the virtual-to-physical resource translation happens just one occasion. In meeting these criteria, KVM is adequate VMWare, Xen, z/VM, and different vacant metal hypervisors. the actual fact that KVM will co-reside with AN enterprise UNIX system OS doesn't amendment any of its sort one characteristics.

In fact, KVM is prepackaged nowadays each with and while not a full UNIX system surroundings. Red Hat offers a locked- down, hypervisor-only KVM product that omits the Enterprise UNIX system OS and restricts administrator access to atiny low set of controlled interfaces. This implementation demonstrates the pliability of KVM's bare- metal style.
Regardless, the plain truth is that the hypervisor sort may be a false indicator of security. whereas style and implementation square measure vital issues to hypervisor security, hypervisor structure isn't. A badly designed sort one hypervisor will be abundant less secure than a literary sort two hypervisor, and also the reverse is additionally true. KVM's hypervisor style provides isolation properties that square measure almost like VMware ESX. The sure code base of KVM is mostly an equivalent as for different x86 hypervisors.


      1. Key advantages of KVM

The kernel-based virtual machine (KVM) hypervisor provides a full virtualization answer supported the UNIX system software package. the subsequent key advantages of KVM square measure delineated in additional detail later during this paper.
• KVM has sturdy guest isolation with an additional layer of protection against guest breakouts. necessary access management adds grade of isolation on the far side basic method separation.
• KVM's vacant metal style (Type one design) is comparable to different x86 hypervisors.
• KVM is strictly enforced and tested. With open supply, developers square measure unceasingly
inspecting KVM for flaws.
• KVM has the advantage over different x86 hypervisors in terms of lower total price of possession and bigger flexibility than competitive hypervisors.


      1. Strong guest isolation

One of the primary things that involves mind relating to hypervisor security, notably in an exceedingly cloud surroundings wherever multiple purchasers square measure served by one software package instance, is guest isolation. within the cloud, purchasers place their trust within the hypervisor. Unquestionably, the hypervisor should be protected against security breaches involving guests in operation on prime of the hypervisor. These security problems include:
• Guests bypassing security controls to access either the host or different guests in ways in which violate the host security policy
• Guests intercepting shopper information or host resources to that they're not approved
• Guests trying or changing into the victim of security attacks, that might probably take down the
entire cloud.








In addition, shopper information should be protected against spare access from the hypervisor itself. Finally, guests would like the aptitude to make controlled shared storage for collaboration functions.
Because KVM is constructed into UNIX system, KVM guest methodes square measure subject to any or all the standard user house process separation that's integral to the UNIX system kernel's operation. UNIX system method separation continues to evolve over time. However, the foremost basic protection mechanisms have existed since early within the development of the UNIX system kernel, and square measure well tested and authorized. On x86 systems, the kernel, at the bottom level, uses the central process unit (CPU) chip set hardware to realize separation between user house mode and kernel (privileged or supervisor) mode. within the kernel, discretionary access management (DAC) prevents user house processes from unauthorized access of resources or different processes. DAC is that the ancient set of access controls during which users own their own resources and may manage access to those resources at their discretion.

      1. Mandatory access management

KVM goes even any than basic DAC separation by incorporating necessary access management (MAC) through Security-Enhanced UNIX system (SELinux). With MAC, it's the administrator, not the method owner, UN agency determines the access a method should resources. macintosh implements sturdy guest isolation and controls resources offered to guests. The sVirt API, that integrates macintosh and UNIX system virtualization among SELinux, is enabled by default in RHEL six. As of the writing of this document, no different all-purpose x86 hypervisor implements macintosh by default, providing KVM with a layer of defense on the far side that of different hypervisors.

    1. Rigorous implementation and testing

Open supply may be a methodology of engineering that distributes style and development effort globally. Participants contribute labor whereas making the most of the work of others to resolve totally different issues. most work takes place on web mailing lists within the kind of patch submissions to open supply communities. Anyone will browse, comment on, and contribute to the mailing lists. Communities put together decide individual submissions, and meritocracies kind organically. Maintainers intumesce from the communities UN agency square measure specialists in their fields and lead the communities. Open supply communities attract consultants worldwide in specific downside domains that will preferably be troublesome or not possible to assemble.
All KVM development takes place in open supply communities. the event methodology brings nice advantages to KVM security. Maintainers and community members perform continuous examination and testing to seek out bugs. Weaknesses square measure known and patched quickly. Relentless analysis of the ASCII text file by multiple consultants is especially vital to reduce the likelihood of unknown vulnerabilities stepping into the code base and resulting in zero-day exploits. This development approach may be a explicit advantage that open supply has over proprietary development. Proprietary development is opaque; it's troublesome or not possible to get info regarding proprietary hypervisor internals. square measure guests extremely separated? square measure communications methods adequately controlled? square measure the privileged management arthropod genus coded correctly? while not security certification results offered, you have got very little selection however to trust proprietary vender security claims. However, there's zero mystery relating to the contents of KVM and its broader ecosystem; all its ASCII text file is accessible for viewing.








Conclusion
KVM may be a sure answer for implementing virtualized environments, like clouds that contain multiple tenants. KVM security stacks up well against different all-purpose x86 hypervisors. It implements layers of controls, as well as necessary access management and hardware-based isolation, to realize deep defense against attacks. KVM's direct access to hardware provides an equivalent level of protection as different vacant metal hypervisors.



Fig comparing both virtualisation technology as we can clearly see KVM is the clear winner.

Based on UNIX system, KVM advantages from the open supply development community, as well as constant examination for potential security flaws. moreover, KVM can presently succeed Common Criteria certification at AN EAL4+ level3.


Proper way to install nvidia 390 fix error

Proper way to install nvidia 390 if you see any error in the process look below; command  sudo apt purge --autoremove '*nvidia*...