EBS Flashcards by Certification Exams

CLF-C02 — Cloud Practitioner

1. Q: What is Amazon EBS?
   A: A persistent, high-availability block storage service for EC2 instances. Volumes behave like virtual disks attached to one instance at a time within the same Availability Zone.

2. Q: How is EBS different from S3, EFS, and Instance Store?
   A: EBS is block storage for low-latency, single-instance disks; S3 is object storage; EFS is shared POSIX file storage; Instance Store is ephemeral local NVMe that is lost on stop/terminate.

3. Q: Which EBS volume types exist and when to use them?
   A: gp3/gp2 (general purpose), io2/io1 (provisioned IOPS for critical databases), st1 (throughput-optimized HDD for big sequential I/O), sc1 (cold HDD for infrequent access).

4. Q: Which EBS types can be used as boot volumes?
   A: SSD types (gp3/gp2/io2/io1). HDD types (st1/sc1) cannot be used as root/boot volumes.

5. Q: What is an EBS snapshot?
   A: An incremental, point-in-time backup of a volume stored in S3 (managed by EBS). You can restore volumes and create AMIs from snapshots.

6. Q: Is EBS regional or AZ-scoped?
   A: Volumes are AZ-scoped and must be attached in the same AZ as the EC2 instance. Use snapshots to recreate volumes in other AZs or regions.

7. Q: What is EBS encryption?
   A: Transparent at-rest encryption using AWS KMS. You can enable default encryption per region and choose AWS-managed or customer-managed KMS keys.

8. Q: Typical EBS use cases?
   A: Boot volumes, application data disks, single-instance relational/NoSQL databases, and low-latency transactional workloads.

9. Q: What are the main cost drivers for EBS?
   A: Provisioned GB-month (and provisioned IOPS/throughput for gp3/io1/io2), plus snapshot storage for changed blocks.

10. Q: How durable is EBS?
    A: Data is replicated within the AZ for durability. Use snapshots (and cross-region copy) for disaster recovery.

SAA-C03 — Solutions Architect Associate

• Q: When do you choose EBS vs EFS vs FSx?
  A: Choose EBS for block storage to a single instance; EFS for shared, elastic NFS across instances; FSx for managed, higher-performance file systems (Windows/ONTAP/Lustre/OpenZFS).

• Q: gp3 vs gp2: what are the differences?
  A: gp3 decouples performance from size and lets you provision up to roughly 16,000 IOPS and 1,000 MB/s; gp2 performance scales with size (3 IOPS/GB with burst), max ~16,000 IOPS.

• Q: When should you use io2/io1?
  A: For consistent, high IOPS and low latency (mission-critical OLTP databases). io2 offers higher durability than io1; io2 Block Express supports very high IOPS/throughput and up to 64 TiB.

• Q: When to use st1 vs sc1?
  A: st1 for large, sequential, frequently accessed data (big data, logs); sc1 for infrequent, cold sequential workloads. Neither supports boot volumes.

• Q: What is EBS Multi-Attach?
  A: io1/io2 volumes can attach to up to 16 Nitro-based Linux instances in the same AZ for cluster-aware file systems. Not for standard file systems or boot volumes.

• Q: How do you change EBS size/type/IOPS with minimal downtime?
  A: Use Elastic Volumes to modify online, then expand the partition/LVM/filesystem at the OS layer.

• Q: How do you improve restore performance from snapshots?
  A: Enable Fast Snapshot Restore (FSR) in chosen AZs to get full performance immediately after volume creation.

• Q: How do you move an EBS volume across AZs or regions?
  A: Create a snapshot → (optional) copy to target region with a KMS key → create a new volume in the target AZ.

• Q: What are common mappings from workload to EBS type?
  A: Web/app servers → gp3; latency-sensitive DBs → io2; analytics/log processing → st1; archival on EC2 → sc1.

• Q: How do you ensure at-rest encryption on every new volume?
  A: Enable EBS default encryption in each active region and select the default KMS key.

SOA-C02 — SysOps Administrator Associate

• Q: Which CloudWatch metrics are key for EBS performance?
  A: VolumeRead/WriteOps, VolumeRead/WriteBytes, VolumeQueueLength, VolumeThroughputPercentage, VolumeConsumedRead/WriteOps, and BurstBalance (gp2/st1/sc1).

• Q: What does a low BurstBalance indicate on gp2/st1/sc1?
  A: Credit depletion leading to throttled performance; consider gp3 or resizing/changing type.

• Q: Can you resize EBS volumes without downtime?
  A: Yes, with Elastic Volumes you can increase size, change type, and adjust IOPS online; then extend partitions/LVM/filesystems (e.g., growpart, resize2fs, xfs_growfs).

• Q: How do you operationalize backups?
  A: Use EBS Snapshot Lifecycle Manager for policy-based snapshots or AWS Backup for centralized, cross-account, cross-region backups with retention and vaulting.

• Q: How to verify encryption and the KMS key quickly?
  A: Use describe-volumes/describe-snapshots with queries for Encrypted and KmsKeyId; enforce with AWS Config rules (encrypted-volumes, ebs-encryption-by-default).

• Q: What are safe attach/detach practices?
  A: Stop or quiesce the application, unmount the filesystem, detach the volume, attach to the target, mount, and verify. For root volumes, stop the instance to swap.

• Q: How to reduce “slow first read” after restore?
  A: Use FSR or pre-warm by reading the entire volume once. Without FSR, lazy loading can cause initial latency.

• Q: What are options to scale beyond a single volume’s limits?
  A: Stripe (RAID 0/LVM) across multiple volumes to aggregate IOPS/throughput; understand the higher failure domain and protect with snapshots/replication.

• Q: How to guarantee capacity availability?
  A: Use Capacity Reservations for instances; for storage, plan quotas and monitor EBS API limits/KMS request rates during mass operations.

• Q: What is EBS-optimized networking?
  A: On Nitro-based instances, EBS-optimized is standard, providing dedicated bandwidth and consistent performance.

DVA-C02 — Developer Associate

• Q: How do you create an encrypted volume programmatically?
  A: Use CreateVolume with Encrypted=true and KmsKeyId, or specify block device mappings in RunInstances with encrypted=true and a KMS key.

• Q: How do you convert an unencrypted snapshot to encrypted?
  A: CopySnapshot with Encrypted=true and KmsKeyId, then create volumes from the encrypted copy.

• Q: How do you tag EBS resources at creation?
  A: Provide TagSpecifications in RunInstances/CreateVolume or call CreateTags immediately after creation.

• Q: How do you wait for snapshot completion in code?
  A: Use SDK waiters (e.g., EC2 waiter for snapshotCompleted) or poll DescribeSnapshots until state=completed.

• Q: How do you choose gp3 performance settings?
  A: Provision IOPS and throughput independently for your workload. Balance cost with required latency and throughput targets.

• Q: How do you share an encrypted AMI across accounts for a CI/CD pipeline?
  A: Share the AMI and underlying snapshots, and grant the consumer account access to the KMS key (key policy or grant). Automate with IaC.

• Q: What are safe patterns for multi-writer access to a single dataset?
  A: Use EBS Multi-Attach with a cluster-aware filesystem, or prefer shared file systems (EFS/FSx). Do not mount standard filesystems (ext4/XFS) read-write from multiple instances.

• Q: How do you handle restore-time performance in automation?
  A: Enable FSR for critical snapshots in target AZs before restore, or pre-warm volumes after creation to avoid cold-read penalties.

• Q: Which IAM permissions are commonly required for EBS automation?
  A: ec2:CreateVolume, ec2:DeleteVolume, ec2:AttachVolume, ec2:CreateSnapshot, ec2:CopySnapshot, ec2:CreateTags, and kms:Encrypt/Decrypt/CreateGrant when using CMKs.

• Q: How do you move data across regions programmatically?
  A: Copy the snapshot to the destination region specifying a regional KMS key, then create a volume and attach to instances there.

SCS-C02 — Security Specialty

• Q: How do you enforce encryption for all new volumes?
  A: Enable default EBS encryption and use IAM/SCPs to deny ec2:CreateVolume/RunInstances when ec2:Encrypted is false or when kms:KeyId is not in an allowed set.

• Q: How do you restrict CMK usage to EBS in specific regions?
  A: In the KMS key policy or IAM, use kms:ViaService conditions with ec2..amazonaws.com and optionally limit to specific account/ARNs.

• Q: How do you share encrypted snapshots/AMIs across accounts securely?
  A: Share the resource and grant the target account access to the CMK (policy or grant). Encrypted snapshots cannot be made public.

• Q: What are the implications of disabling or deleting a KMS key?
  A: Operations that need the key fail (create/attach/restore). After key deletion, data becomes unrecoverable.

• Q: How do you detect public snapshot exposure?
  A: Use AWS Config rule ebs-snapshot-public-restorable-check and alert/remediate if any unencrypted snapshots are public.

• Q: What does key rotation affect?
  A: CMK rotation does not re-encrypt existing data; EBS keeps using existing data keys. Applications remain unaffected.

• Q: How is data protected in transit between EC2 and EBS?
  A: EBS provides transparent encryption in transit for encrypted volumes; Nitro-based instances offload crypto with minimal overhead.

• Q: What logs help audit EBS encryption usage?
  A: CloudTrail for EC2 and KMS API calls; AWS Config for configuration state; CloudWatch/KMS metrics for usage and throttling.

• Q: How do you satisfy separation of duties or BYOK?
  A: Use customer managed CMKs with imported keys (BYOK) or CloudHSM custom key stores; restrict administrators via key policies and grants.

• Q: How do you prevent data exfiltration via snapshot sharing?
  A: Use SCPs and Config rules to disallow public snapshots and restrict cross-account sharing; monitor for CreateSnapshot/ModifySnapshotAttribute in CloudTrail.

SAP-C02 — Solutions Architect Professional

• Q: How do you design multi-account, multi-region encryption at scale?
  A: Standardize on customer managed (possibly multi-Region) KMS keys with replicas; enable default encryption everywhere; automate key policy/grant management and snapshot copy policies.

• Q: How do you distribute golden AMIs securely across an organization?
  A: Use EC2 Image Builder or pipelines to bake encrypted AMIs; distribute per OU/account; share AMI+snapshots and grant CMK access; pin KMS ARNs in Launch Templates.

• Q: When do you select gp3 vs io2 (or io2 Block Express)?
  A: gp3 for cost-effective general workloads with tunable IOPS/throughput; io2 for consistent, high IOPS/latency-sensitive databases; io2 Block Express for ultra performance and 64 TiB volumes.

• Q: How to scale performance beyond per-volume limits?
  A: Stripe multiple volumes (RAID 0/LVM) and/or use io2 Block Express. Confirm per-instance EBS bandwidth and watch queue depths.

• Q: How do you minimize RTO/RPO for EBS-backed apps?
  A: Scheduled, cross-region snapshot copies with destination CMKs, enable FSR in target AZs, pre-provision Launch Templates, and practice failover runbooks.

• Q: How do you govern encryption and sharing org-wide?
  A: SCPs to require encryption and approved CMKs/regions, Config conformance packs, and auto-remediation (SSM) for non-compliant volumes/snapshots.

• Q: How do you budget FSR effectively?
  A: Enable FSR only for high-priority snapshots and AZs; monitor FSR usage and disable when not needed to control costs.

• Q: What are best practices for replacing unencrypted roots at scale?
  A: Snapshot → copy with encryption → image/volume replacement via automation (SSM/Automation/EC2 Image Builder); schedule rolling maintenance windows.

• Q: How do you handle KMS throughput at scale?
  A: Stagger large rollouts, reuse data keys efficiently (service-managed), monitor KMS API throttling, and tune concurrency with exponential backoff.

• Q: What storage choice trade-offs appear in complex designs?
  A: For shared access, prefer EFS/FSx over EBS Multi-Attach unless a cluster-aware, block-level design is required; for ephemeral high IOPS, consider Instance Store with application-level replication.