ECS + Fargate quiz · Level 0 · Todo.io Learns AWS

Question 1What does a security group attach to?

A network interface (ENI): the one on an EC2 instance, a Fargate task or a VPC-attached Lambda function.Correct. Security groups filter traffic at the network card, not at the subnet.A subnet.Not this one. Subnets don't take security groups. (Network ACLs attach to subnets, in Level 1.)The whole VPC.Not this one. Each network interface has its own security groups.A route table.Not this one. Route tables decide where traffic goes. They hold no rules about who may connect.

Learn it: ENI (Elastic Network Interface) · Security group

Question 2In Amazon ECS, what is a running copy of a container (or a group of containers that run together) called?

A task.Correct. ECS starts and watches tasks. A service keeps a chosen number of them running.An instance.Not this one. Instances are EC2 servers.A function.Not this one. Functions are Lambda.A pod.Not this one. Pods are the Kubernetes (EKS) name. ECS calls them tasks.

Learn it: ECS and Fargate

Question 3Todo.io has packaged its app as a container. It wants to run it without managing any EC2 servers. What should it use?

Amazon ECS with the Fargate launch type.Correct. With Fargate, AWS runs the servers under your tasks; you only say how much CPU and memory each task needs.Amazon ECS with the EC2 launch type.Not this one. Then the containers run on EC2 instances you manage.One large EC2 instance with Docker installed.Not this one. That is a server to patch and a single point of failure.An SQS queue.Not this one. A queue passes messages; it doesn't run containers.

Learn it: ECS and Fargate

Question 4Code inside Todo.io's ECS task must send messages to SQS. Which role should be allowed sqs:SendMessage?

The task role.Correct. The task role is what your code may do. Its credentials are served inside the task.The task execution role.Not this one. That is what ECS itself needs to start the task: pull the image and ship logs.An instance profile on an EC2 host.Not this one. On Fargate there is no host of yours, and the task role keeps permissions per task.A service-linked role.Not this one. Those belong to AWS services, and you can't add permissions to them.

Learn it: ECS and Fargate · IAM role

Question 5A Fargate task fails to start because ECS can't pull the container image or create its log stream. Which role is missing permissions?

The task execution role.Correct. ECS uses the execution role to pull the image and send logs on your behalf, before your code runs.The task role.Not this one. The task role is only used by your code once the task is running.The root user.Not this one. Root is never involved in starting tasks.The developer's IAM Identity Center role.Not this one. The task starts long after the developer clicked deploy, using its own roles.

Learn it: ECS and Fargate

Question 6What does each Fargate task get in Todo.io's VPC?

Its own network interface, with a private IP address and its own security groups.Correct. So each task can be allowed or blocked on its own, like an EC2 instance.Nothing. Fargate tasks run outside the VPC.Not this one. Fargate tasks run inside your subnets.A share of the host server's IP address.Not this one. On Fargate there is no host of yours; each task has its own ENI.A public IP address, always.Not this one. A public IP is optional, and in a private subnet it would be useless.

Learn it: ECS and Fargate · ENI

Question 7Todo.io runs containers on ECS with Fargate. Who patches the operating system of the servers the tasks run on?

AWS.Correct. With Fargate the servers are AWS's. You still own what is inside your container image.Todo.io.Not this one. Todo.io never sees those servers.Nobody; they are never patched.Not this one. AWS patches them.The container, at start-up.Not this one. Containers don't patch the server they run on.

Learn it: ECS and Fargate

Question 8How does output from Todo.io's containers on Fargate reach CloudWatch Logs?

Through the awslogs log driver set in the task definition, using the task execution role.Correct. Each container's output goes to a log stream in a log group you choose.Through CloudTrail.Not this one. CloudTrail records AWS API calls, not container output.By installing the CloudWatch agent on the host.Not this one. With Fargate you have no host to install anything on.By connecting to each task and copying the files.Not this one. There is no need; the log driver ships output as it happens.

Learn it: ECS and Fargate · CloudWatch Logs

Question 9Todo.io's ECS service is set to keep two tasks running. One task crashes. What happens?

ECS notices and starts a replacement, so two tasks are running again.Correct. An ECS service keeps the number of tasks you asked for, replacing any that stop.Nothing, until someone starts a new task by hand.Not this one. Keeping the desired count is what an ECS service is for.ECS restarts the server under every task.Not this one. It only replaces the task that stopped.ECS emails the team and waits.Not this one. It replaces the task by itself. (You can still set up alarms.)

Learn it: ECS and Fargate

Question 10Todo.io's monthly export takes about 40 minutes. Which compute choice can run it in one go without managing servers?

A task on ECS with Fargate.Correct. Tasks run as long as they need to. Lambda stops at 15 minutes.A Lambda function with a 40-minute timeout.Not this one. The longest a Lambda function can run is 15 minutes.API Gateway.Not this one. It passes requests to backends; it doesn't run jobs.An SQS queue.Not this one. A queue holds the job; something else still has to run it.

Learn it: Lambda · ECS and Fargate

Question 11Todo.io's Fargate tasks run in private subnets. Their IAM permissions are correct, but every call they make to SQS times out. What fixes it?

A NAT gateway in a public subnet, with the private subnets routing 0.0.0.0/0 to it.Correct. SQS is a public AWS service. From a private subnet, traffic needs a way out. (VPC endpoints are another fix, in a later level.)An outbound rule in the task's security group.Not this one. Security groups allow outbound traffic by default; the problem is the missing route.A public IP on each task, left in the private subnet.Not this one. A public IP is useless without a route to the internet gateway.More permissions on the task role.Not this one. A permission problem returns AccessDenied, not a timeout.

Learn it: NAT gateway · IAM policy

Question 12Todo.io's Lambda function processes large uploads and always stops at exactly 15 minutes, unfinished. What is the right fix?

Split the work into smaller pieces, or run it on a service without that limit, such as ECS on Fargate.Correct. 15 minutes is the most a Lambda function can ever run.Raise the function's timeout to 30 minutes.Not this one. The timeout can't go above 15 minutes.Give the function more memory, which extends the limit.Not this one. More memory makes it faster, but the 15-minute limit stays.Attach the function to a VPC.Not this one. Being in a VPC changes what it can reach, not how long it can run.

Learn it: Lambda

Question 13What does "ECS and Fargate" mean?

Run containers on AWS. With Fargate, AWS also runs the servers underneath.Correct. Think of it as: Handing over a packed lunchbox and letting someone else heat it up.Rent a virtual server by the second.Not this one. That describes EC2 (Elastic Compute Cloud).Upload a function; AWS runs it only when something calls it.Not this one. That describes Lambda.A managed HTTPS front door that passes requests to your code.Not this one. That describes API Gateway.

Learn it: ECS and Fargate

Question 14Which term is this? "Run containers on AWS. Pick the serverless option and AWS also runs the servers underneath."

ECS and FargateCorrect. Yes. Think of it as: Handing over a packed lunchbox and letting someone else heat it up.EC2 (Elastic Compute Cloud)Not this one. EC2 (Elastic Compute Cloud) is: Rent a virtual server by the second.LambdaNot this one. Lambda is: Upload a function; AWS runs it only when something calls it.API GatewayNot this one. API Gateway is: A managed HTTPS front door that passes requests to your code.

Learn it: ECS and Fargate

Question 15Which AWS term is described by this analogy? "Handing over a packed lunchbox and letting someone else heat it up."

ECS and FargateCorrect. Yes: Run containers on AWS. With Fargate, AWS also runs the servers underneath.EC2 (Elastic Compute Cloud)Not this one. EC2 (Elastic Compute Cloud) is: Rent a virtual server by the second. Its analogy: Renting a computer you have to look after yourself.LambdaNot this one. Lambda is: Upload a function; AWS runs it only when something calls it. Its analogy: A taxi. You pay for the ride, not for owning the car.API GatewayNot this one. API Gateway is: A managed HTTPS front door that passes requests to your code. Its analogy: A receptionist who takes every visitor's request and phones the right person.

Learn it: ECS and Fargate

ECS + Fargate

Worth another look

Your weak spots

Services

Concepts