1 Flashcards
When you define a CIDR block with a IP address range, you can’t use all the IP addresses. AWS reserves a few IP addresses for its own networking purpose. How many IP addresses does AWS reserves?
A.
5
B.
2
C.
3
D.
4
A is correct. AWS reserves the first four and the last IP address of every subnet for internal purpose (4+1=5).
You are reviewing Change Control requests and note a change designed to reduce wasted CPU cycles by increasing the value of the VisibilityTimeout attribute. What does this mean?
A.
When the consumer instance polls for new work, the SQS service will allow it to wait a certain amount of time for a message to be available before closing the connection.
B.
While processing a message, a consumer instance can reset the message visibility by restarting the preset timeout counter.
C.
When a consumer instance retrieves a message, that message will be hidden from other consumer instances for a fixed period of time.
D.
While processing a message, a consumer instance can amend the message visibility counter by a fixed amount.
E.
When a new message is added to the SQS queue, it will be hidden from consumer instances for a fixed period of time.
F.
When the consumer instance polls for new work, the consumer instance will wait a certain amount of time until it has a full workload before closing the connection.
C is correct. When a consumer instance retrieves a message, that message will be hidden from other consumer instances for a fixed period of time. You have the ability to control this timeout period.
A, B, D, E, and F are incorrect because all these options have irrelevant information.
You receive a ProvisionedThroughputExceededException error. However, the DynamoDB metrics show that your table or index has not been operating at maximum provisioned throughput. What could this error be caused by?
A.
It is only a warning. DynamoDB’s burst capacity will handle the extra traffic.
B.
The throughput is not balanced across your partitions. One partition is being subjected to a disproportionate amount of the traffic and is therefore exceeding the limits.
C.
The error is caused by excess traffic generated by your local secondary indexes. You should provision units specifically to the local secondary indexes.
D.
It is a transitory error. AWS will adjust the table to accommodate it and reprocess the transaction.
B is correct. In DynamoDB, it is possible that one of the partitions of the table get more traffic whereas others get less traffic. If one partition is getting massive traffic, you will get a ProvisionedThroughputExceededException error. Since the other partitions are not getting a lot of traffic, when you do the average of IO across the partitions for a table, it will not show you are operating at maximum provisioned throughput.
A is incorrect because the question is about an error, not a warning. C is incorrect because the error is about throughput and not excess traffic. D is incorrect because this is not a transitory error.
You have been asked by your employer to create an identical copy of your production environment in another region for disaster recovery purposes. Which of the following AWS resources would you NOT need to re-create because they are available universally across the console? (Choose two.)
A.
Elastic Load Balancers
B.
Route 53
C.
Security groups
D.
EC2 key pairs
E.
Identity Access Management roles
B and E are correct. Route 53 and IAM are global services, so it does not matter which region you choose because you can leverage them globally. Conversely, ELB, security groups, and EC2 key pairs are tied to a particular region.
A is incorrect because ELB is a regional service. C is incorrect because security groups are tied to a particular region. D is incorrect because EC2 key pairs are tied to a particular region.
Your company provides an online image recognition service and uses SQS to decouple system components. Your EC2 instances poll the image queue as often as possible to keep end-to-end throughput as high as possible, but you realize that all this polling is resulting in both a large number of CPU cycles and skyrocketing costs. How can you reduce cost without compromising service?
A.
Enable short polling by setting ReceiveMessageWaitTimeMinutes to a number greater than 0.
B.
Enable long polling by setting ReceiveMessageWaitTimeSeconds to a number greater than 0.
C.
Enable long polling by setting ReceiveMessageWaitTimeMinutes to a number greater than 0.
D.
Enable short polling by setting ReceiveMessageWaitTimeSeconds to a number greater than 0.
B is correct. SQS long polling doesn’t return a response until a message arrives in the queue, thus reducing your overall cost over time. Short polling WILL return empty responses. In this case, you need to enable long polling since the key is cost control. At the same time, you need to keep the high throughput, so you have to set the wait time in seconds to a number greater than zero. Also, because the max wait time is 20 seconds, the options with “ReceiveMessageWaitTimeMinutes” automatically become invalid.
A, C, and D are incorrect because you need to enable long polling, and ReceiveMessageWaitTimeSeconds should be set to a number greater than zero. All these options have a different value.
You are creating a data lake, and one of the criteria you are looking for is faster performance. You want the ability to transform the data directly during the ingestion process to save time and cost. Which AWS service should you choose for this?
A.
Use Kinesis Analytics for transforming the data.
B.
Ingest the data in S3 and then load it in Redshift to transform.
C.
Ingest the data in S3 and then use EMR to transform.
D.
Use Kinesis Firehose.
A is correct. Kinesis Analytics has the ability to transform the data during ingestion.
B, C, and D are incorrect. Loading the data in S3 and then using EMR to transform it is going to take lot of time. You are looking for faster performance. Redshift is a data warehouse solution. Kinesis Firehose can ingest the data, but it does not have any ability to transform the data.
A client is concerned that someone other than approved administrators is trying to gain access to the Linux web app instances in their VPC. The client asks what sort of network access logging can be added. Which of the following might you recommend? (Choose two.)
A. Use Event Log filters to trigger alerts that are forwarded to CloudWatch.
B.Set up a Flow Log for the group of instances and forward them to S3.
C.Make use of an OS-level logging tool such as iptables and log events to CloudWatch or S3.
D.Set up a traffic-logging rule on the VPC firewall appliance and direct the log to CloudWatch or S3.
E.Set up a Flow Log for the group of instances and forward them to CloudWatch.
C and E are correct. Since someone is trying to get into the web tier and the app tier, you have to analyze the logs from the operating system, and the Flow Log is going to give you all the information you are looking for.
A is incorrect because the Event Log won’t provide you the required information. B is incorrect because if you forward instances to S3, how do you use the information? D is incorrect because this option is purposely misleading.
At the monthly product meeting, one of the product owners proposes an idea to address an immediate shortcoming of the product system: storing a copy of the customer price schedule in the customer record in the database. You know that you can store large text or binary objects in DynamoDB. You give a tentative OK to do a minimum viable product (MVP) test, but you stipulate that it must comply with the size limitation on the attribute name and value. Which is the correct limitation?
A. The name must not exceed 64KB, and the value must not exceed 1024KB.
B.
The name must not exceed 128KB, and the value must not exceed 400KB.
C.
The value and name combined must not exceed 1024KB.
D.
The value and name combined must not exceed 400KB.
E.
The value and name combined must not exceed 500KB.
F.
The name must not exceed 64KB, and the value must not exceed 500KB.
D is correct. The combined size for the name and value can’t exceed 400KB.
A, B, C, E, and F are incorrect because the combined name and value size is more than 400KB.
Your application is hosted in EC2 instances, and all the data is stored in EBS volumes. The EBS volumes must be durable and backed up across multiple AZs. What is the most resilient way to back up the EBS volumes?
A.
Encrypt the EBS volumes.
B.
Take regular EBS snapshots.
C.
Mirror data across two EBS volumes by using RAID.
D.
Write a Lambda function to copy all the data from EBS to S3 regularly.
B is correct. By using snapshots, you can back up the EBS volume and you can create the snapshot in a different AZ.
A is incorrect because encrypting the volumes is different from backing up the volumes. Even if you encrypt the volumes, you still need to back them up. C is incorrect because if you mirror the data across two EBS volumes by using RAID, you will have high availability of the data but still you won’t have a backup. Remember, the backup has to be across AZs. If you use RAID and provide high availability to your EBS volumes, that will be still be under the same AZ since EBS volumes can’t be mounted across AZs. D is incorrect because although you can back up all the data to S3 from an EBS volume, that is not backing up the EBS volume. Backing up the volume means that if your primary volume goes down or is bad, you should be able to quickly mount the volume from backup. If you have a snapshot of an EBS volume, you can quickly mount it and have all the data in it. If you back up the data to S3, you need to create a new volume and then copy all the data from S3 to the EBS volume.
When editing permissions (policies and ACLs), creating S3 buckets, and performing activities with EC2 instances, to whom does “Owner” generally refer in the context of AWS?
A.
Owner is the IAM role used to create the object via the GUI, CLI, or API.
B.
There is no special concept of “Owner” in AWS.
C.
Owner is the IAM user who created the object via the GUI, CLI, or API.
D.
Owner refers to the root account.
D is correct. Owner in AWS refers to the root account.
A, B, and C are incorrect. In AWS context, the owner of the account is the root account, which needs to be logged in using the username/password combination. When you first create an Amazon Web Services (AWS) account, you begin with a single sign-on identity that has complete access to all AWS services and resources in the account. This identity is called the AWS account root user and is accessed by signing in with the e-mail address and password that you used to create the account.
You work for a large media organization that has traditionally stored all its media on large SAN arrays. After evaluating AWS, the company has decided to move its storage to the cloud. Staff will store their personal data on S3 and will have to use their Active Directory credentials in order to authenticate. These items will be stored in a single S3 bucket, and each staff member will have their own folder within that bucket named after their employee ID. Which of the following steps should you take in order to help set this up? (Choose three.)
A.
Use the AWS security token service to create temporary tokens.
B.
Create an IAM role.
C.
Tag each folder with the appropriate staff member’s ID.
D.
Create either a federation proxy or identity provider.
E.
Create an IAM user for each member of staff and use their existing Active Directory password for the account.
A, B, and D are correct. You should create either a federation proxy or identity provider and then use the AWS security token service to create temporary tokens. You will then need to create the appropriate IAM role for the users to assume when writing to the S3 bucket.
C is incorrect because you cannot tag individual folders within an S3 bucket. E is incorrect because if you create an individual user for each staff member, there will be no way to keep their Active Directory credentials synched when they change their password.
You are in the process of designing a document archive solution for your company. The solution must be cost-effective; therefore, you have selected Glacier. The business wants to have the capability to get a document within 15 minutes of requesting it. Which feature of Amazon Glacier will you choose?
A.
Expedited retrieval
B.
Standard retrieval
C.
Glacier is not the correct solution. You need Amazon S3.
D.
Bulk retrieval
A is correct. Since you are looking for a cost-effective archival solution, Amazon Glacier is the right choice. By using the expedited retrieval option, you should be able to get the file within 5 minutes, which meets your business objective.
B is incorrect because standard retrieval won’t be able to meet the 15-minute SLA. C is incorrect because you are developing an archival solution. If you choose S3, cost will go up. D is incorrect because bulk retrieval won’t be able to meet the 15-minute SLA.
You are running a couple of social media websites in AWS, and they use databases hosted in multiple AZs via RDS MySQL. With expansion of number of users, your users have started seeing degraded performance mainly with database reads. What can you do to make sure you get the required performance? (Choose two.)
A.
Use ElastiCache in-memory cache in each AZ hosting the database.
B.
Create read replicas of RDS MySQL to offload read-only traffic.
C.
Migrate the database to the largest box available in RDS.
D.
Migrate the RDS MySQL to an EC2 server.
A and B are correct. The contention is with read-only traffic; therefore, adding a read replica or adding in-memory cache will solve the problem.
C and D are incorrect. Since the contention is with read-only traffic, adding a read replica or an in-memory cache is going to solve the problem. Suppose you have migrated the database to the largest possible box available in RDS, but again the problem occurs. What do you do? In that case, again, you are going to add a read replica or in-memory cache. If you are running a database in RDS, you should not move it to EC2 since you get a lot of operational benefits simply by hosting your database in RDS.
You have been engaged by a company to design and lead a migration to an AWS environment. The team is concerned about the capabilities of the new environment, especially when it comes to avoiding all bottlenecks. The design calls for about 20 instances (C3.2xLarge) pulling jobs/messages from SQS. Network traffic per instance is estimated to be around 500Mbps at the beginning and end of each job. Which network configuration should you plan on deploying?
A.
Choose a different instance type that better matched the traffic demand.
B.
Use a second network interface to separate the SQS traffic from the storage traffic.
C.
Deploy as a placement group, as the aggregated burst traffic could be around 10Gbps.
D.
Activate EBS-Optimization on the instance to maximize network throughput.
E.
Spread the instances over multiple AZs to minimize the traffic concentration and maximize the fault tolerance.
E is correct. When considering network traffic, you need to understand the difference between storage traffic and general network traffic, and the ways to address each. The 10Gbps is a red herring, in that the 500Mbps only occurs for short intervals, and therefore your sustained throughput is not 10Gbps. Wherever possible, use simple solutions such as spreading the load out rather than expensive high-tech solutions.
A is incorrect because even if you choose a different instance type, you still won’t be distributing your network traffic. B is incorrect because you can just separate the SQS traffic with a second network card. C is incorrect because the placement group will bring the instance within proximity. D is incorrect because an EBS-optimized instance will not distribute the network traffic.
You have an application for which you are thinking of using EC2 to host an Oracle database. The size of the database is 100GB. Since the application needs operating system access in the database tier, you can’t use RDS. The application will be used infrequently; sometimes it will be used during the morning and sometimes during the evening. What is a cost-effective way of designing the storage layer?
A.
Amazon S3
B.
Amazon EBS General Purpose SSD
C.
Amazon EBS Provisioned IOPS SSD
D.
Amazon EBS Throughput Optimized HDD
D is correct. Since the application will be used infrequently and the goal is to use cost-optimized storage, Throughput Optimized HDD is the best choice.
A, B, and C are incorrect. Amazon S3 is an object store, so it can’t be used to host a database. General Purpose SSD and Provisioned IOPS SSD are going to cost lot more than Throughput Optimized HDD.
Following advice from your consultant, you have configured your VPC to use Dedicated hosting tenancy. A subsequent change to your application has rendered the performance gains from Dedicated tenancy superfluous, and you would now like to recoup some of these greater costs. How do you revert to Default hosting tenancy? (Choose two.)
A.
Stop each instance, change the hosting attribute, and restart.
B.
Create AMIs of all your instances and use them to create new instances using Default hosting.
C.
Change the hosting attribute and then restart the instance.
D.
Create AMIs of all your instances. Create a new VPC with Default as the hosting tenancy attribute and then use them to create new instances using Default tenancy.
E.
Change tenancy using CLI/SDK.
D and E are correct. Once the VPC is created, the ways to change the tenancy are either create a new VPC with different tenancy and migrate all the instance or use CLI/SDK to change the tenancy.
A, B, and C are incorrect. If you create a VPC with a dedicated hosting type of tenancy, you can’t change it. You can either create a new VPC or drop and re-create the existing one.
You are leading a design team to implement an urgently needed collection and analysis project. You will be collecting data for an array of 50,000 anonymous data collectors. This data will be summarized each day and then rarely used again. The data will be pulled from collectors approximately once an hour. The developer responsible for the DynamoDB design is concerned about how to design the partition and local keys to ensure efficient use of the DynamoDB tables. What advice would you provide? (Choose two.)
A.
Use a time-based partition key so that it is easy to query and analyze.
B.
Don’t worry about it; AWS will optimize the table and partitions to meet your needs.
C.
Use a date-based partition key to avoid having to hop from partition to partition.
D.
Create a new table each day and reconfigure the old table for infrequent use after the summation is complete.
E.
Insert a calculated hash in front of the date/time value in the partition key to force DynamoDB to hop from partition to partition.
D and E are correct. There are two issues here: how to handle stale data to avoid paying for high-provisioned throughput for infrequently used data, and how to design a partition key that will distribute IO from sequential data across partitions evenly to avoid performance bottlenecks.
A is incorrect because just creating a partition key is not enough. B is incorrect because you have to design your application. AWS is not going to do it for you. C is incorrect because just creating the partition key won’t solve the problem.
You are reviewing Change Control requests and note a proposed change designed to reduce errors due to S3 Eventual Consistency by updating the DelaySeconds attribute. What does this mean?
A.
When a new message is added to the SQS queue, it will be hidden from consumer instances for a fixed period of time.
B.
When a consumer instance retrieves a message, that message will be hidden in the queue for a fixed period of time.
C.
When the consumer instance polls for new work, the SQS service will allow it to wait a certain amount of time for a message to be available before closing the connection.
D.
When the consumer instance polls for new work, the consumer instance will wait a certain amount of time until it has a full workload before closing the connection.
E.
While processing a message, a consumer instance can reset the message visibility by restarting the preset timeout counter.
F.
While processing a message, a consumer instance can amend the message visibility counter by a fixed amount.
A is correct. When a new message is added to the SQS queue, it will be hidden from consumer instances for a fixed period of time. Delay queues are a mechanism that lets you postpone delivery of messages if you need to.
B, C, D, E, and F are incorrect because all these options have irrelevant information.
You have created a non-default VPC that contains two web servers. These web servers must be publicly accessible via the Internet and should also be highly resilient. Which of the following configurations should you consider? (Choose two.)
A.
Set up an Elastic Load Balancer and place your two web servers behind it in different Availability Zones. Configure a Route 53 “A” record to point to the IP address of the Elastic Load Balancer.
B.
Set up an Elastic Load Balancer and place your two web servers behind it in different Availability Zones. Configure a Route 53 CNAME to use the public DNS address of the Elastic Load Balancer.
C.
Assign each EC2 instance with an Elastic IP address. Configure Route 53 with both EIPs and set up health checks with DNS failover.
D.
Configure a NAT instance within your VPC. Create a route via the NAT and associate it with all private subnets within your VPC. Create a Route 53 “A” record to point to the public IP address of the NAT.
B and C are correct. You have the option of either using an Elastic Load Balancer or multiple Elastic IP addresses and configuring DNS failover with health checks using Route 53.
A is incorrect because you cannot configure a Route 53 “A” record that points to an ELB. D is incorrect because you can’t use a NAT as a makeshift load balancer.
You are designing a media streaming application and need to store over 100,000 videos. Each video will have multiple files associated with it for storing the different resolutions (480p, 720p, 1080p, 4K, and so on). The videos need to be kept in durable storage, but the cost should be kept at a minimum. What storage option should you choose?
A.
Store the main videos in S3 and the different resolution files in Glacier.
B.
Store the main videos in EBS and the different resolution files in S3.
C.
Store the main videos in EFS and the different resolution files in S3.
D.
Store the main videos in S3 and the different resolution files in S3-IA.
D is correct. S3 provides 99.9999999% durability, so that is the best choice for both the main videos and the resolution files.
A, B, and C are incorrect. If you store the files in EBS or EFS, the cost is going to be very high. You can’t store these files in Glacier because it is an archival solution.
You have created an S3 bucket for your application and immediately receive over 10,000 PUT requests per second. What should you do to ensure optimal performance?
A.
No need to do anything. S3 will automatically handle this.
B.
Create each file in a separate folder.
C.
Use S3 Infrequent Access.
D.
Add a random prefix to the key names.
D is correct. Also, when you are putting a large number of files, the process should be optimized with multipart uploads, where on the sending side the original file is split into multiple parts and uploaded in parallel, and on the receiving side the file is composed back into a single object.
A, B, and C are incorrect. When doing some optimizations, if you can get better performance, then why not go it? If you create a separate folder for each file, you will create a management nightmare. S3 IA won’t give you better performance.
You manage a Ruby on Rails application that lives on a cluster of EC2 instances. Your website occasionally experiences brief, strong, and entirely unpredictable spikes in traffic that overwhelm your EC2 instances’ resources and freeze the application. As a result, you’re losing recently submitted requests from end users. You use Auto Scaling to deploy additional resources to handle the load during spikes, but the new instances don’t spin up fast enough to prevent the existing application servers from freezing. Which of the following actions will provide the most cost-effective solution in preventing the loss of recently submitted requests?
A.
Increase the size of your existing EC2 instances.
B.
Ask AWS support to pre-warm the Elastic Load Balancer.
C.
Keep a large EC2 instance on standby.
D.
Use Amazon SQS to decouple the application components and keep the requests in queue until the extra Auto Scaling instances are available.
D is correct. The cost-effective solution to the unpredictable spike in traffic is to use SQS to decouple the application components.
A is incorrect because increasing the size of EC2 will increase the cost. B is incorrect because pre-warming of the ELB can be done only when the traffic is predictable. C is incorrect because keeping large EC2 servers on standby is going to spike the cost.
How is the public IP address managed in an instance session via the instance GUI/RDP or Terminal/SSH session?
A.
The public IP address can be managed via the instance MetaData at http://169.254.169.254/latest/meta-data/local-ipv4.
B.
The public IP address can be managed via the instance MetaData at http://169.254.169.254/latest/meta-data/public-ipv4.
C.
For security reasons, the public IP address is a hidden value.
D.
The public IP address is not managed on the instance; instead, it is an alias applied as a network address translation of the private IP address.
D is correct. When you manage the public IP address in an instance session via the instance GUI/RDP or Terminal/SSH session, it is not managed on the instance. In this case, an alias is applied as a network address translator of the private IP address.
A, B, and C are incorrect. The details are provided in the explanation for answer D.
Your server logs are full of what appear to be application-layer attacks, so you deploy AWS Web Application Firewall. Which of the following conditions can you set when configuring AWS WAF? (Choose three.)
A.
URL match conditions
B.
String match conditions
C.
Termination conditions
D.
SQL rejection match conditions
E.
Size constraint conditions
F.
IP match conditions
B, E, and F are correct. In AWS WAF, you can set string match, IP match, and size constraint conditions.
A, C, and D are incorrect because these conditions are not options in WAF.
Route 53, the AWS implementation of DNS, supports a number of routing policies. Which of the following are valid policy types? (Choose five.)
A.
Load-Balanced
B.
Weighted
C.
Failover
D.
Simple
E.
Default
F.
Geolocation
G.
Latency
B, C, D, F, and G are correct. The valid routing policies are Weighted, Failover, Simple, Geolocation, and Latency.
A is incorrect because there is no Load-Balanced routing policy. E is incorrect because there is no Default routing policy.
Which of the following statements are true regarding SAML-enabled single sign-on? (Choose two.)
A.
After the client browser posts the SAML assertion, AWS sends the sign-in URL as a redirect and then the client browser is redirected to the Console.
B.
The client browser is immediately directed to the AWS Console.
C.
The portal acknowledges a SAML authentication response and then verifies the user’s identity in the organization.
D.
The portal first verifies the user’s identity in the organization and then generates a SAML authentication response.
A and D are correct. With SAML, after the client browser posts the SAML assertion, AWS sends the sign-in URL as a redirect and then the client browser is redirected to the Console. The portal first verifies the user’s identity in the organization and then generates a SAML authentication response.
B and C are incorrect. The true statements regarding SAML-enabled single sign-on are provided in answers A and D.
You work for a large software company in Seattle. The company has its production environment provisioned on AWS inside a custom VPC. The VPC contains both a public subnet and a private subnet. The company tests its applications on custom EC2 instances inside a private subnet. There are approximately 500 instances, and they communicate to the outside world via a proxy server. At 3 A.M. every night, the EC2 instances pull down OS updates, which are usually 150MB or so. They then apply these updates and reboot; however, if the software has not downloaded within half an hour, the update will attempt to download the following day. You notice that a number of EC2 instances are continually failing to download the updates in the allotted time. Which of the following answers might explain this failure? (Choose two.)
A.
Your proxy server is blacklisting the address from which the updates are being downloaded, resulting in failed downloads.
B.
The proxy server has only one Elastic IP address added to it. To increase network throughput, you should add additional Elastic IP addresses.
C.
The proxy server is on an inadequately sized EC2 instance and does not have sufficient network throughput to handle all updates simultaneously. You should increase the instance size of the EC2 instance for the proxy server.
D.
The proxy server is in a private subnet and uses a NAT gateway instance to connect to the Internet. However, this instance is too small to handle the required network traffic. You should re-provision the NAT gateway instance so that it’s able to handle the throughput.
E.
The proxy server has an inadequately sized EBS volume attached to it. The network buffer is stored on the EBS volume, and it is running out of disk space when trying to buffer the 500 simultaneous connections. You should provision an EBS volume with provisioned IOPS.
C and D are correct. Network throughput is the obvious bottleneck. You are not told in this question whether the proxy server is in a public or private subnet, so if it is in a public subnet, the proxy server instance size itself is not large enough to cope with the current network throughput. If the proxy server is in a private subnet, then it must be using a NAT gateway in order to communicate out to the Internet. This NAT gateway may also be inadequately provisioned in terms of size. You should therefore increase the size of both the proxy server and the NAT gateway.
A is incorrect because there is no data point stating that the proxy server is blacklisting. B is incorrect because adding elastic IP does not increase network throughput. E is incorrect because there is no data point stating that the EBS volume is running out of space.
Your company has a policy of encrypting all data at rest. You host your production environment on EC2 in a non-default VPC. Attached to your EC2 instances are multiple EBS volumes, and you must ensure this data is encrypted. Which of the following options will allow you to do this? (Choose three.)
A.
Use third-party volume encryption tools.
B.
Install SSL certificates on the servers so as to encrypt your data.
C.
EBS volumes are encrypted by default. You do not need to do anything.
D.
Encrypt the data using native encryption tools available in the operating system.
E.
Encrypt the data inside your application, before storing it on EBS.
A, D, and E are correct. These answers cover all the options required to encrypt all the data at rest.
B is incorrect because SSL certificates will only be useful to encrypt data in transit, not data at rest. C is incorrect because EBS volumes are not encrypted by default.
You are reviewing Change Control requests and note a change designed to reduce costs by updating the WaitTimeSeconds attribute. What does this mean?
A.
When the consumer instance polls for new work, the SQS service will allow it to wait a certain amount of time for one or more messages to be available before closing the connection.
B.
When a new message is added to the SQS queue, it will be hidden from consumer instances for a fixed period of time.
C.
While processing a message, a consumer instance can reset the message visibility by restarting the preset timeout counter.
D.
While processing a message, a consumer instance can amend the message visibility counter by a fixed amount.
E.
When a consumer instance retrieves a message, that message will be hidden in the queue for a fixed period of time.
F.
When the consumer instance polls for new work, the consumer instance will wait a certain amount of time until it has a full workload before closing the connection.
A is correct. WaitTimeSeconds means when the consumer instance polls for new work, the SQS service will allow it to wait a certain amount of time for one or more messages to be available before closing the connection.
You have created a VPC using the VPC Wizard with the CIDR block 100.0.0.0/16. You have selected a private subnet and VPN connection using the VPC Wizard. You have launched an EC2 instance in the private subnet. Now you need to connect to the EC2 instance via SSH. What do you need to do in order to connect to the EC2 instance?
A.
Allow inbound traffic on port 22 on your network.
B.
Allow inbound traffic on ports 80 and 22 to the private subnet.
C.
Connect to the instance on the private subnet using a NAT instance.
D.
Create a public subnet and from there connect to the EC2 instance.
A is correct. The port where SSH runs is 22; therefore, you need to provide access to port 22.
B, C, and D are incorrect. You have already created a VPN while creating the VPC; therefore, via VPN, the VPC is already connected with your network, so you can reach the private subnet directly from your network.
Your company has hired a young and enthusiastic accountant. After reviewing the AWS documentation and usage graphs, he announces that you are wasting vast amounts of the company’s money running servers for a full hour instead of spinning them up only when they are needed and down again as soon as they are idle for 1 minute. He cites the AWS claim that you only pay for what you use, and that as a senior engineer, you should be more conscious of wasting company money. How do you respond?
A.
You thank him for his concern and then implement EC2’s pay-per-minute billing to get the maximum benefit for the company.
B.
You leap across the meeting table and slap him for insulting you in front of your peers.
C.
You grudgingly acknowledge his point and change your scheduling and tuning settings.
D.
You acknowledge the problem and propose that you could downsize the instances so that the workload consumes the full instance capacity for the full hour. You also propose closer monitoring and automation so that you can upsize and/or downsize the instance each hour during the day to match the instance performance to the anticipated workload.
A is correct. AWS has launched a new feature called pay-per-minute, where the billing occurs in increments of 60 seconds for certain types of instances. If cost control is one of your main objectives, it makes sense to stop the instance whenever it is not in use.
B is incorrect because in real life you would never do this. C is incorrect because changing the scheduling won’t help in reducing the cost. D is incorrect because changing the instance size won’t help to reduce the bill if the server is idle for more than a minute.
You successfully configure VPC peering between VPC-A and VPC-B. You then establish an IGW and a Direct-Connect connection in VPC-B. Can instances in VPC-A connect to your corporate office via the Direct-Connect service as well as connect to the Internet via the IGW?
A.
Instances in VPC-A will be able to access the corporate office but not the Internet.
B.
Yes, VPC peering is designed to route traffic between the VPCs.
C.
No, VPC peering does not support edge-to-edge routing.
D.
Instances in VPC-A will be able to access the Internet, but not the corporate office.
C is correct. The answer is no because VPC peering does not support edge-to-edge routing. Say, for example, that VPC-A is peered to VPC-B, and VPC-B is peered to VPC-C. In this case, VPC-A and VPC-C won’t be able to talk unless there is a peering between them.
A, B, and D are incorrect. These options are purposefully misleading.
Your server logs are full of what appear to be application-layer attacks, so you deploy AWS Web Application Firewall. Which of the following conditions can you set when configuring AWS WAF? (Choose three.)
A.
URL match conditions
B.
String match conditions
C.
Termination conditions
D.
SQL rejection match conditions
E.
Size constraint conditions
F.
IP match conditions
B, E, and F are correct. In AWS WAF, you can set string match, IP match, and size constraint conditions.
A, C, and D are incorrect because these conditions are not options in WAF.
You’ve been commissioned to develop a high-availability application with a stateless web tier. Identify the most cost-effective means of reaching this goal.
A.
Use an Elastic Load Balancer, a multi-AZ deployment of an Auto Scaling group of EC2 On-Demand instances (primary) running in tandem with an Auto Scaling group of EC2 Spot instances (secondary), and a multi-AZ deployment of RDS.
B.
Use an Elastic Load Balancer, a multi-AZ deployment of an Auto Scaling group of EC2 Spot instances (primary) running in tandem with an Auto Scaling group of EC2 On-Demand instances (secondary), and a multi-AZ deployment of RDS.
C.
Use an Elastic Load Balancer, a multi-AZ deployment of an Auto Scaling group of EC2 Spot instances (primary) running in tandem with an Auto Scaling group of EC2 On-Demand instances (secondary), and a multi-AZ deployment of DynamoDB.
D.
Use an Elastic Load Balancer, a multi-AZ deployment of an Auto Scaling group of EC2 Spot instances (primary) running in tandem with an Auto Scaling group of EC2 On-Demand instances (secondary), and DynamoDB.
D is correct. With proper scripting and scaling policies, the On-Demand instances behind the Spot instances will deliver the most cost-effective solution because the On-Demand instances will only spin up if the Spot instances are not available. DynamoDB is a regional service; there is no need to explicitly create a multi-AZ deployment. RDS could be used, but DynamoDB lends itself better to supporting stateless web/app installations.
A is incorrect because it uses EC2 On-Demand instances as the primary, which is going to spike the cost. B is incorrect because it uses RDS, which is going to increase the cost. C is incorrect because it uses a multi-AZ deployment of DynamoDB, which is going to increase the cost. DynamoDB comes with built-in HA since it is a managed service.
When making use of EC2 instances on dedicated hosting, you are able to transition between which of the following modes of tenacity by stopping an instance and starting it again? (Choose two.)
A.
Default and Dedicated
B.
Host and Default
C.
Dedicated and Host
D.
Host and Dedicated
E.
Dedicated and Default
C and D are correct. If you choose the Dedicated and Host or the Host and Dedicated instance, you can do the transition between by start and the stop of the instance. When you choose the Dedicated tenancy, you own the full physical machine. Therefore, whatever VMs you deploy in this machine, you have to take care of them all.
A, B, and E are incorrect. None of these is the correct choice.
You work for a genomics company that is developing a cure for motor neuron disease by using advanced gene therapies. As a part of its research, the company takes extremely large data sets (usually in the terabytes) and analyzes them using Elastic Map Reduce (EMR). In order to keep costs low, the company runs the analysis for only a few hours in the early hours of the morning, using spot instances for the task nodes. The core nodes are on-demand instances. Lately, however, the EMR jobs have been failing. This is due to spot instances being unexpectedly terminated. Which of the following remedies would both keep costs manageable and mitigate the issues caused by terminated spot instances? (Choose two.)
A.
Increase the bid price for the core nodes.
B.
Increase the bid price for the task nodes so that you have a greater threshold before the task nodes are terminated.
C.
Change the task nodes to on-demand instances.
D.
Change the core nodes to spot instances and lower the spot price.
B and C are correct. Task nodes perform the jobs, whereas core nodes provide the pure core for performing the jobs. Even if a core node goes down, the jobs won’t fail.
A is incorrect because it is the task nodes that do all the work; the issue is with the task nodes. D is incorrect because the problem is with the task nodes.
You have been engaged as a consultant by a company that generates utility bills and publishes them online. PDF images are generated and then stored on a high-performance RDS instance. Generally, invoices are viewed by customers once per month. Recently, however, the number of customers has increased threefold, and the wait-time necessary to view invoices has increased unacceptably. The CTO is unwilling to alter the codebase more than necessary this quarter, but needs to return performance to an acceptable level before the end-of-the-month print run. Which of the following solutions would you feel comfortable proposing to the CTO and GM? (Choose two.)
A.
Use CloudFront to accelerate the presentation of the PDF images.
B.
Move the images to S3 to reduce database IO.
C.
Install an ElastiCache cluster in front of the RDS installation.
D.
Create RDS read replicas and additional web/app instances across all the available AZs.
E.
Move the metadata to a DynamoDB solution, permitting real-time scaling of read IOPS to match demand.
C and D are correct. In this case, the customer can’t change the architecture immediately so they have to keep the PDFs in RDS. Thus, in order to provide faster read-only performance, you need to create read replicas. ElastiCache in front of RDS is going to provide an additional performance boost.
A is incorrect because, as per the CTO, you can’t change the code. B is incorrect because, as per the CTO, you can’t change the code. E is incorrect because, as per the CTO, you can’t change the code.
Your security manager has hired a security contractor to audit your firewall implementation. When the consultant asks for the login details for the firewall appliance, which of the following might you do? (Choose two.)
A.
Tell him the details of the web application firewall.
B.
Create an IAM role with a policy that can read Security Group and Route settings.
C.
Explain that AWS is a cloud service and that AWS manages the network appliances.
D.
Create an IAM role with a policy that can read Security Group and NACL settings.
E.
Explain that AWS implements network security differently and that there is no such thing as a firewall appliance. Create an IAM user with a policy that can read Security Group and Route settings.
A and E are correct. AWS has removed the firewall appliance from the hub of the network and implemented the firewall functionality as stateful Security Groups and stateless subnet NACLs. This is not a new concept in networking.
B is incorrect because you need to create a user with a policy and not a role with a policy. C is incorrect because, although AWS manages the network appliance, you can still give the requested info to the security consultant. D is incorrect because the answer is incomplete.
You are reviewing Change Control requests and note a proposed change designed to reduce errors due to S3 Eventual Consistency by updating the DelaySeconds attribute. What does this mean?
A.
When a new message is added to the SQS queue, it will be hidden from consumer instances for a fixed period of time.
B.
When a consumer instance retrieves a message, that message will be hidden in the queue for a fixed period of time.
C.
When the consumer instance polls for new work, the SQS service will allow it to wait a certain amount of time for a message to be available before closing the connection.
D.
When the consumer instance polls for new work, the consumer instance will wait a certain amount of time until it has a full workload before closing the connection.
E.
While processing a message, a consumer instance can reset the message visibility by restarting the preset timeout counter.
F.
While processing a message, a consumer instance can amend the message visibility counter by a fixed amount.
A is correct. When a new message is added to the SQS queue, it will be hidden from consumer instances for a fixed period of time. Delay queues are a mechanism that lets you postpone delivery of messages if you need to.
B, C, D, E, and F are incorrect because all these options have irrelevant information.
Your company does business in North America, and all your customers are based out of the United States and Canada. You are using us-east as the primary region and using the us-west region for DR. You have a VPC in both the regions for hosting all the applications supporting the business. On weekends, you are seeing a sudden spike in traffic from China. While going through the log files, you find that some users from China are scanning open ports to gain entry to your server. How do you restrict the users from China from connecting to your VPC?
A.
Use a VPC endpoint.
B.
Use CloudTrail.
C.
Use security groups.
D.
Use a network access control list.
D is correct. You can explicitly deny the traffic from a particular IP address or from a CIDR block via an NACL.
A is incorrect because a VPC endpoint is used to communicate privately between a VPC and services like S3 and DynamoDB. B is incorrect because, using CloudTrail, you can find the trail of API activities, but you can’t block any traffic. C is incorrect because, using security group, you can’t explicitly deny traffic.
Your company likes the idea of storing files on AWS. However, low-latency service of the majority of files is important to customer service. Which Storage Gateway configuration would you use to achieve both these ends?
A.
Gateway-Cached
B.
Gateway-Stored
C.
Gateway-VTL
D.
Gateway-Snapshot
B is correct. In this case, they key is low latency, and you have to choose the solution based on that. Since you want a low-latency solution, Gateway-Stored is the right way to go.
A is incorrect because Gateway-Cached won’t provide the lowest latency. C is incorrect because Gateway-VTL won’t provide the lowest latency. D is incorrect because Gateway-Snapshot won’t provide the lowest latency.
You are running a highly available application in AWS. The business indicates that it needs a very performant file system that can be shared across EC2 servers (web servers). Which AWS service can solve this problem?
A.
Amazon EFS
B.
Amazon EBS
C.
Amazon EC2 Instance Store
D.
Amazon S3
A is correct. Only EFS can be mounted across several EC2 instances at same time. It provides the shared file system capability.
B is incorrect because EBS can be mounted with one EC2 instance at any point in time, but it can’t be mounted across multiple EC2 instances. C is incorrect because the EC2 Instance Store is the local storage within the EC2 server and is also known as ephemeral storage. This can’t be mounted to any other EC2 server. D is incorrect because Amazon S3 is an object store, not a file system, and can’t be mounted to an EC2 server as a file system.
