AMI Flashcard For AWS Exams

CLF‑C02 (AWS Cloud Practitioner) – AMI Flashcards

Q: What is an AMI?
A: A template containing an operating system, software, configuration, and block device mapping used to launch EC2 instances.
Q: Name three types of AMIs.
A: AWS‑provided AMIs, AWS Marketplace AMIs, and custom user‑created AMIs.
Q: What is meant by a Golden AMI?
A: A pre‑approved, hardened, security‑patched AMI used for standardized, compliant deployments.
Q: What does an AMI include?
A: One or more snapshots (root + data volumes), launch permissions, and block device mappings.
Q: Where are snapshots that make up an AMI stored?
A: In Amazon S3 (managed by AWS).

Q: What is the difference between EBS‑backed and Instance Store‑backed AMIs?
A: EBS‑backed AMIs support stop/start; Instance Store‑backed AMIs use ephemeral storage and lose data when stopped/terminated.
Q: Can AMIs be copied across regions?
A: Yes, you can copy an AMI to another region for DR or global deployments.
Q: What must you configure to share an encrypted AMI with another account?
A: Share both the snapshots and the KMS key used for encryption.
Q: Why use custom AMIs?
A: To standardize deployments, improve launch speed, and embed pre‑installed software or patches.
Q: Best practice for secure scaling?
A: Use a Golden AMI in Auto Scaling Groups with user data for last‑mile config.

Q: How do you create an AMI from an existing instance?
A: EC2 Console → Instance → Actions → Create Image, or useaws ec2 create-image.
Q: What happens when you deregister an AMI?
A: The AMI is deleted, but the underlying snapshots still exist and must be deleted manually if not needed.
Q: What tool automates AMI lifecycle management in AWS?
A:EC2 Image Builderor third‑party tools likePacker.
Q: How do you ensure AMIs are up to date?
A: Regularly patch instances, create new AMIs, and deprecate old ones.
Q: Where do you check AMI launch permissions?
A: In the AMI’s metadata (private, public, or shared with accounts).

Q: How do AMIs interact with Launch Templates?
A: Launch Templates can reference AMI IDs to ensure consistent EC2 instance baselines.
Q: Best practice for CI/CD pipelines using AMIs?
A: Automate “AMI baking” with EC2 Image Builder or Packer integrated into pipeline.
Q: How do you configure dependencies at launch beyond the AMI itself?
A: UseUser Data scriptsor Automation documents to bootstrap additional configs.
Q: How do you roll out new app versions via AMIs?
A: Bake a new AMI with updated software and deploy via Auto Scaling or Blue/Green strategy.
Q: How do you query AMIs via CLI/SDK?
A: Usedescribe-imageswith filters such as owner, name, or tag.

Q: Can encrypted AMIs be made public?
A: No, encrypted AMIs cannot be made public.
Q: What is required to share an encrypted AMI securely between accounts?
A: Permission on both the snapshot(s) and associated KMS key.
Q: Why are Golden AMIs critical for security?
A: They enforce a hardened, patched baseline for all workloads.
Q: How can you enforce using only approved AMIs in an organization?
A: Use AWS Config conformance packs and IAM/SCP restrictions on AMI IDs.
Q: How do you verify that an AMI meets compliance requirements?
A: Scan AMI contents through image pipelines (Inspector, custom tools) before use.

Q: How to design multi‑region AMI distribution?
A: Copy AMIs across regions, ensure corresponding CMKs exist, and leverage automation pipelines like Image Builder with Organizations.
Q: How are Golden AMIs managed at scale in enterprises?
A: Automated AMI pipelines with patching, approval workflows, organizational sharing, and deprecation of older images.
Q: How do snapshots and AMIs relate in DR strategies?
A: AMIs bundle snapshots; copying encrypted snapshots across regions enables secure global AMI replication.
Q: How to integrate AMIs with governance?
A: Centralize AMI builds, enforce compliance via Config rules, distribute via Service Catalog or Launch Templates.
Q: What is a scenario where you’d combine AMI + User Data effectively?
A: Deploy a Golden AMI with OS and agents baked-in, then use User Data for environment‑specific configs at launch (e.g., app configs, secrets retrieval).