AWS Developer Associate(DVA-C01)- Quiz 4

Q1.
An application reads data from Amazon S3 and makes 55,000 read requests per second. A Developer must design the storage solution to ensure the performance requirements are met cost-effectively.
How can the storage be optimized to meet these requirements?

Move the files to Amazon DynamoDB. Index files with S3 metadata.

Create at least 10 S3 buckets and split the files across buckets.

Move the files to Amazon EFS. Index the files with S3 metadata.

Create at least 10 prefixes and split the files across the prefixes.

WHY A IS False?	CONCEPT: Move the files to Amazon DynamoDB. Index files with S3 metadata.	This is not cost-effective.
WHY B IS False?	CONCEPT: Create at least 10 S3 buckets and split the files across the buckets	To avoid throttling in Amazon S3 you must ensure you do not exceed certain limits on a per-prefix basis. You can send 3,500 PUT/COPY/POST/DELETE or 5,500 GET/HEAD requests per second per prefix in an Amazon S3 bucket. There are no limits to the number of prefixes that you can have in your bucket. Performance is improved based on splitting reads across prefixes, not buckets.
WHY C IS False?	CONCEPT: Move the files to Amazon EFS. Index the files with S3 metadata.	This is not cost-effective.
WHY D IS True?	CONCEPT: Create at least 10 prefixes and split the files across the prefixes.	To avoid throttling in Amazon S3 you must ensure you do not exceed certain limits on a per-prefix basis. You can send 3,500 PUT/COPY/POST/DELETE or 5,500 GET/HEAD requests per second per prefix in an Amazon S3 bucket. There are no limits to the number of prefixes that you can have in your bucket. In this case, the Developer would need to split the files across at least 10 prefixes in a single Amazon S3 bucket. The application should then read the files across the prefixes in parallel.
Short Trick	1. "performance requirements are met cost-effectively" - which we need a cost-effective method & creating at least 10 prefixes and split the files across the prefixes.
References:	REFERNCED DOCS

aws sts assume-role

aws sts get-session-token

aws dynamodb describe-endpoints

aws iam get-role-policy

WHY A IS True?	CONCEPT: aws sts assume-role	The AWS CLI “aws sts assume role” command will enable the Developer to assume the role and gain temporary security credentials. The Developer can then use those security credentials to troubleshoot access issues that are affecting the application.
WHY B IS False?	CONCEPT: aws sts get-session-token	This is used to get temporary credentials for an AWS account or IAM user. It can subsequently be used to call the assume-role API.
WHY C IS False?	CONCEPT: aws dynamodb describe-endpoints	This command returns the regional endpoint information.
WHY D IS False?	CONCEPT: aws iam get-role-policy	This command retrieves the specified inline policy document that is embedded with the specified IAM role.
Short Trick	1." test the role permissions using the AWS CLI" - clearly suggest that first, we have used assume role command to test the role permissions.
References:	REFERNCED DOCS

Use AWS Certificate Manager (ACM) to create one certificate for each DynamoDB table.

Use the UpdateTable operation to switch to an AWS managed customer master key (CMK).

Use the UpdateTable operation to switch to a customer managed customer master key (CMK).

Use the DynamoDB Encryption Client to enable end-to-end protection using client-side encryption.

WHY A IS False?	CONCEPT: AWS Certificate Manager (ACM)	AWS Certificate Manager (ACM) is used to Create, manage & deploy public & private SSL/TLS certificates.
WHY B IS False?	CONCEPT: AWS managed customer master key (CMK)	AWS managed customer master key (CMK) AWS generated on the customer’s behalf Rotated Once every three years automatically Can’t be deleted Scope limited to a specific AWS service User Access Policy - IAM policy
WHY C IS False?	CONCEPT: Customer managed customer master key (CMK)	Customer managed customer master key (CMK) Customer-generated Rotated Once a year automatically through opt-in or on-demand manually Can be deleted Scope Controlled via KMS/IAM policy User Access Policy - IAM policy
WHY D IS True?	CONCEPT: DynamoDB Encryption Client & client-side encryption	In addition to encryption at rest, which is a server-side encryption feature, AWS provides the Amazon DynamoDB Encryption Client. This client-side encryption library enables you to protect your table data before submitting it to DynamoDB. With server-side encryption, your data is encrypted in transit over an HTTPS connection, decrypted at the DynamoDB endpoint, and then re-encrypted before being stored in DynamoDB. Client-side encryption provides end-to-end protection for your data from its source to storage in DynamoDB.
Short Trick	1." data must be encrypted before it is submitted to DynamoDB" indicates client-side encryption should be done.
References:	REFERNCED DOCS