Are you looking to master the cloud architect technical interview?
Well, if so this video is for you.
Hi, my name is Michael Gibbs and I'm the founder and CEO of GoCloud Architects.
And we're an organization dedicated towards building high performance cloud computing careers.
I've been working in technology now for over 25 years and I've been coaching and mentoring others
for two decades. And today we're going to help you master the cloud architect interview. But anytime
we work on interview questions we want to make sure we weave in some Cloud Architect Training,
as well as some Cloud Architecture Training. So you can be sure, we're going to make
sure we provide some training along with our video on cloud architect interview questions.
The first interview question we're going to ask you is what is a DDoS attack and,
how do you prevent it? What we're trying to find out here is do you know what a DDoS attack is,
and can you figure out how to thwart it? So let's start with, what is a DDoS attack.
What we're looking to hear is that a DDoS attack is when a hacker
compromises multiple systems and then uses these systems to launch an attack on you. And what's
going on in a DDoS attack is basically what's happening is the attacker is trying to overwhelm
the service capabilities of your systems. So let's say for example, you have a web server that
can process 10,000 web requests per second. And a hacker sends you 100,000 web requests per second,
that 100,000 web request per second will easily overwhelm your web server that's capable of
handling only 10,000 web requests. So, it can completely take your services out of action.
So how do you block this? Well, when it comes to security, it's not any one thing that you use,
it's a combination of a lot of things. It's like dressing for cold weather. When you're dealing
with cloud security or any kind of security, you must use layers. So, typically speaking the way
this was going to work is you take the outside of your network or the perimeter of your network,
and you stick a firewall and the firewall blocks bad stuff from coming into your network.
Behind the firewall, you're going to put something called an IDS or an IPS system.
And an intrusion detection, intrusion prevention system sits there and it looks for attacks,
and when it sees an attack, it does things to stop the attack. Maybe it resets TCP connections, maybe
it modifies the configuration on your firewall, add additional ACL type rules, whatever the thing
that's going on, the IDS/IPS system sits behind it. Firewall? The firewall gives you a secure
perimeter and the IDS, IPS system comes in and takes care of things that get past your firewall.
You're also going to need to use some form of DDoS protection. And there's various forms
that are out there, AWS makes some in the form of shield, Cloudflare does some with
regards to their services, but there's a lot of different DDoS protections, and you should
definitely employ one on your applications, to protect your web facing applications.
Now, so if you got a firewall at the perimeter and you've got an IDS system and you've got some DDoS
protection, is that enough? Of course not. So then what you're going to do is you're going to
protect the subnets where your systems live by using an access control list, and if it's AWS,
we're going to call it a network ACL. And then what you're going to do is you're going
to make sure that you protect the servers with something called the security group,
which keeps things from getting in, let's look at this now. Now we've got a firewall at the edge,
we've got an IDS, IPS system, we've got some DDoS protection, we're protecting the subnets
with a network ACL, and we're protecting the host systems with a security group.
But you know what, that might not be enough. Meanwhile want to put some endpoint protection
on the host themselves. Maybe some antimalware things, such as maybe a secondary firewall. So
that's realistically speaking part of the process. And then after we get past that,
let's talk about other ways that are not security oriented that will still protect against the DDoS.
For example, let's bring an auto-scaling. Auto-scaling is one of the best things to happen
in DDoS protection ever. So let's go back to our web server example where our web server can handle
10,000 requests per second, and we have a hundred thousand requests coming in. With auto-scaling,
these servers can keep scaling up, we might be able to handle thousand requests per second,
and we can keep adding capacity while the attack is coming in. So we can temporarily thwart
the attack with auto-scaling, we can slow it down by adding capacity. Now, having said this,
you're going to pay for all these auto-scaling scales out, and you're going to be paying a
lot for it, but it might still be worth it to keep your systems up and running.
The last part that we're going to talk about with regards to DDoS protection is a content delivery
network. See, when you're dealing with a content delivery network and basically your servers are
here and you've got these CDNs, and the CDN has a private network throughout the world and
these connections are connected to say something like an edge location. Where the user comes in
and they hit the edge location, and if the data is stored there,
it'll immediately be provided by a cache. And if the data's not stored there,
the request will be forwarded to the web server, and then it'll be forwarded back to
the cache. And then future requests will go to the cache, at least until the cache time's out.
But when something else happens, when you're dealing with these types of
content delivery networks is they don't forward, typically speaking,
bad requests to the servers. So you can literally basically take out many of these bad requests
directly at the edge of your network with a content delivery network, shut down the attack
before it even gets to you. Now you know what is a DDoS attack and how to prevent it on the cloud.
The next question we're going to ask you is what is DHCP?
And here we want to know what your basic IP knowledge is. And what we're going to ask is DHCP,
or what we're hoping to hear is Dynamic Host Configuration Protocol. And DHCP
works to automatically assign an IP address to your computers. See if your systems don't
have an IP address, they can't communicate on an IP network. So they need an IP address and
they must have a unique IP address. So you really have a couple of options here. Option
one would be you manually go to every computer and manually configure their IP addresses. Well,
that's possible. What if you have 100,000 systems or 200,000 systems or 300,000 systems, do you
really want to go configure each one? Of course not. What you're going to use, you're going to use
DHCP. It's going to automatically assign an IP address to your users and it's going to be simple.
How does it work? The way DHCP works is when a new system comes up on a network,
it sends a broadcast called a DHCP Discover, "Hey, I'm on the network, I need an IP address." That's
what the DHCP Discover packet is basically doing. And then from there, what'll happen
is all the DHCP servers that are there will respond with something called a DHCP Offer.
I need an address, DHCP to Discover, all the servers respond DHCP Offer.
Now at this point, I have to pick which DHCP server that I choose to accept the request from.
Because we might be getting offered 10 addresses from 10 different DHCP servers. So in this state,
the client forms a DHCP request and it basically sends it directly to the server that it desires
to receive the IP address from. And then the server that provides the IP address then says,
"I've got it. I'm going to give you the address." DHCP acknowledge, you now have the address.
So what's the process? Ask for one via DHCP Discover, get one from multiple servers via DHCP
Offer, then send a DHCP request to the server of your choice. And then the sender receives a DHCP
acknowledgement message, which says basically, here's your IP address and the system can use it.
That is how Dynamic Host Configuration Protocol dynamically assigns IP addresses to systems.
The next question we're going to ask you as another networking question and it is what is
a VLAN? And we're going to ask what is the VLAN so we can get into the more complicated concepts,
which were very common in cloud computing, like VLAN Trunking.
So let's first and talk about what is a VLAN. So VLAN means just a virtual network.
That's all it really is. Let's say you have a switch with 100 ports in it.
By default, all 100 ports in the switch can talk to each other. So let's say you put 100 computers,
plug in 100 computers, via ethernet into the switch. All 100 computers can talk
to each other all on the same subnet. And in many cases, that is just absolutely perfect.
But what if you wanted to further segregate your network? What if you wanted to provide protection?
Maybe one that'll limit the users of finance to only access to things that they need,
and the users of accounting to only access the things they need, and the users from
HR to only access the things they need, and your operations team, your IT operations team,
might need access to everything. What you can do is you can take your switch and you can virtualize
your switch. We have virtualized servers, we have virtualized switches. So you could take your
switch and logically chop your switch to multiple switches, and that is what a Virtual LAN is.
A virtual LAN is basically taking a switch and chopping that switch
into multiple logical switches. So you can segregate your users to enhance your security.
That's why you would create something called a VLAN. Now, since we're talking about VLANs,
we also want to talk about the concept of what is a VLAN Trunk?
And why am I talking about what is a VLAN Trunk, after all, most of the networking is done for
you on the cloud. The reason we're talking about what is a VLAN Trunk is you will have
to use 802.1Q Trunking when you're dealing with AWS and creating a direct connection.
What is a VLAN Trunk? First and foremost, let's pretend you have a switch here, and a switch here,
and they're all on the same VLAN all you have to do is run a cable between them, and they'll talk.
Now, let's say you had four switches or four VLANS, you could plug in a cable
from VLAN one to VLAN two, I mean, VLAN one to VLAN one, VLAN two to VLAN two,
VLAN three to VLAN three and VLAN four to VLAN four and everything would work perfectly. You
could have four VLANs or four virtual lines in one switch. Four virtual line and another
switch and four cables between them and everything's going to work great. But
what if you didn't want to run four cables? What if you wanted to put in a secure manner
VLAN one, VLAN two, VLAN three, VLAN four on the same wire in between two switches.
How could you do that? Well, you can, and that's where we talk about VLAN Trunking.
So what VLAN Trunking is, is you've got four VLANs on one switch or four VLANs on another switch,
you run a single cable between them and somehow you miraculously make these VLANs communicate with
each other. And how do you do that in a private and secure manner? You do it with something called
a Trunk. And what a Trunk is, is it takes the wire and it puts something called a tag. And the
tag we're talking about is going to be an 802.1Q tag. And basically it's just a VLAN tag that will
separate VLAN traffic from other VLANs on the wire. So you've got a switch with four VLANs,
you have one cable between them, you add VLAN one with .1Q tag,
VLAN two with its own .1Q tag, VLAN three with its own .1Q tag and VLAN four with its own .1Q tag.
And in the process, you've now created an environment where four VLANs are
being transmitted over a single wire and their data is all logically, separated and secure.
Where does this come into play in a cloud computing environment? Well
on your data premises side, it's going to be everywhere, but also on the link between your
organization and the cloud. See, when you connect over a direct connection, you basically have to
send it on a VLAN over a Trunk. And the reason you're sending your information over a VLAN with a
.1Q tag over a Trunk is AWS is then going to take your information and your VLAN tag,
and then back haul it to the network. And that's how they're going to keep your traffic
separated from customer Bs traffic, separated from customer CS traffic,
separated from customer D's traffic, all on the same wire. They're going to use 802.1Q trunking.
So in today's video on mastering the cloud architect technical interview,
what do we cover? We talked about what is a DDoS attack and how do you prevent it?
We talked about what is DHCP and how does it work? We asked the question,
what is a VLAN? And we talked about what is a VLAN Trunk. Let me tell you about
some things that our organization does to assist the cloud architect community.
Every Monday and every Thursday, we have a free, how to get your first cloud architect job webinar.
On these webinars we teach you everything you need to do to get hired. We teach you what should be on
your resume, what the hiring manager desires in and employee, how to get caught architect
competent and what you need to do to get your first cloud architect job. We do it completely
free on Mondays and Thursdays. Now on Tuesdays, we have a cloud architect experience webinar,
and on these webinars, we teach you how to get the right kind of cloud architect experience,
so you can get hired. And we do this every Tuesday.
Not every Wednesday, but most Wednesdays we do a YouTube Live. And what we do is we
get on the YouTube Live and you can ask us any cloud architect career questions you may have.
Bring us your cloud architect career questions, and we will answer them real time. We want to
make sure that you optimize your training so you can get your goals and dreams as fast as possible.
And lastly, I'd like to let you know that if you're working on any AWS certifications,
we've got you covered. We have a completely free AWS Certified Solution Architect
Associate Ebook, I'll leave the link in the description below. And we have a free
AWS Certified Solution Architect Associate full course, and I'll leave the link in
the description below. Our team is working on creating new and completely free books
for the AWS advanced security on the AWS events networking. We aim to be a single source for all
your cloud architect career development needs. And when it comes to certification training, we
do everything we can to get you to either free or super low cost access to certification training.
Thank you so much for watching this video, I look forward to seeing you in another video, very soon.