AWS Certified Cloud Practitioner: Test 3 Flashcards
Which descriptions are correct regarding cloud deployment models? (Select TWO.)
A.With hybrid cloud, multiple private clouds are conected
B.With the private cloud the consumers organization typically incurs OPEX costs for usage
C.With the public cloud the consumers organization typically incurs OPEX costs for usage
D.With the public cloud the consumers organization typically owns and manages the infrastrucuture
E. With the private cloud the consumers organization typically owns and manages the infrastrucuture
C.With the public cloud the consumers organization typically incurs OPEX costs for usage
E. With the private cloud the consumers organization typically owns and manages the infrastrucuture
Explanation:
With public cloud the consumer organization typically incurs OPEX costs as they do not own the infrastructure and just pay usage costs.
CORRECT: “With the public cloud the consumer organization typically incurs OPEX costs for usage” is a correct answer.
CORRECT: “With the private cloud the consumer organization typically owns and manages the infrastructure” is also a correct answer.
INCORRECT: “With the public cloud the consumer organization typically owns and manages the infrastructure” is incorrect as that is the situation with private clouds.
INCORRECT: “With the private cloud the consumer organization typically incurs OPEX costs for usage” is incorrect. With the private cloud the consumer organization typically owns the infrastructure and will often manage it themselves or use a third-party organization to manage it for them. This model is largely CAPEX driven.
INCORRECT: “With the hybrid cloud, multiple private clouds are connected” is incorrect. Hybrid clouds are created when you connect private and public clouds together.
What tool provides real time guidance to help you provision your resources following best practices in the areas of cost optimization, performance, security and fault tolerance? A.AWS Personal health Dashboard B.AWS Trusted Advisor C.AWS Inspector D.AWS IAM
B.AWS Trusted Advisor
Explanation:
Trusted Advisor is an online resource that helps to reduce cost, increase performance and improve security by optimizing your AWS environment. Trusted Advisor provides real time guidance to help you provision your resources following best practices. Advisor will advise you on Cost Optimization, Performance, Security, and Fault Tolerance
CORRECT: “AWS Trusted Advisor” is the correct answer.
INCORRECT: “AWS Inspector” is incorrect. Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS.
INCORRECT: “AWS Personal Health Dashboard” is incorrect. AWS Personal Health Dashboard provides alerts and remediation guidance when AWS is experiencing events that may impact you.
INCORRECT: “AWS IAM” is incorrect. AWS Identity and Access Management is an identity service that provide authentication and authorization services.
Which AWS service is known as a "serverless" service and runs code as functions triggered by events? A.Amazon ECS B.Amazon CodeDeploy C.Amazon Cognito D.AWS Lambda
D.AWS Lambda
Explanation:
AWS Lambda lets you run code as functions without provisioning or managing servers. Lambda-based applications (also referred to as serverless applications) are composed of functions triggered by events. With serverless computing, your application still runs on servers, but all the server management is done by AWS.
CORRECT: “AWS Lambda” is the correct answer.
INCORRECT: “Amazon ECS” is incorrect. Amazon Elastic Container Service (ECS) is a highly scalable, high performance container management service that supports Docker containers and allows you to easily run applications on a managed cluster of Amazon EC2 instances.
INCORRECT: “Amazon CodeDeploy” is incorrect. AWS CodeDeploy is a fully managed deployment service that automates software deployments to a variety of compute services such as Amazon EC2, AWS Lambda, and your on-premises servers.
INCORRECT: “Amazon Cognito” is incorrect. Amazon Cognito lets you add user sign-up, sign-in, and access control to your web and mobile apps quickly and easily.
Which of the following represent economic advantages of moving to the AWS cloud? (Select TWO.)
A.Increase efficiencies through automation
B.Reduce the rate of change
C.Increase time to market for new applications
D.Reduce the need to manage applications
E.Reduce the need to manage infrastructure
A.Increase efficiencies through automation
E.Reduce the need to manage infrastructure
Explanation:
With the AWS Cloud you can increase efficiency through the use of automation and reduce the need to manage infrastructure, allowing you to concentrate on managing applications instead.
CORRECT: “Increase efficiencies through automation” is a correct answer.
CORRECT: “Reduce the need to manage infrastructure” is also a correct answer.
INCORRECT: “Reduce the need to manage applications” is incorrect. You do not reduce the need to manage applications in most cases.
INCORRECT: “Reduce the rate of change” is incorrect. Reducing the rate of change is not something organization’s strive for in the cloud (usually faster development cycles are preferred) so it does not represent a valid economic advantage/
INCORRECT: “Increase time to market for new applications” is incorrect. You want to reduce not increase time to market for new applications
Which service can be used to cost-effectively move exabytes of data into AWS? A.AWS Snowmobile B.S3 Transfer Accerleration C.S3 Cross-Region Replication (CRR) D.AWS Snowball
A.AWS Snowmobile
Explanation:
Explanation
With AWS Snowmobile you can move 100PB per snowmobile. AWS call this an “Exabyte-scale data transfer service”.
CORRECT: “AWS Snowmobile” is the correct answer.
INCORRECT: “AWS Snowball” is incorrect. With AWS Snowball you can move up to 80TB per device. AWS call this a “petabyte-scale data transfer service”.
INCORRECT: “S3 Transfer Acceleration” is incorrect. S3 Transfer Acceleration is meant speed up uploads to Amazon S3 but would not be used for exabytes of data.
INCORRECT: “S3 Cross-Region Replication (CRR)” is incorrect. S3 Cross-Region Replication is used for copying data between regions, not into AWS. It is also unsuitable for moving such as huge amount of data.
Which authentication method is used to authenticate programmatic calls to AWS services? A.Key pair B.Server certififcate C.Console password D.Access keys
D.Access keys
Explanation:
Access keys are a combination of an access key ID and a secret access key. They are used to make programmatic calls to AWS using the API.
CORRECT: “Access keys” is the correct answer.
INCORRECT: “Console password” is incorrect. Console passwords are used for signing users into the AWS Management Console, not for making programmatic calls to AWS services.
INCORRECT: “Server certificate” is incorrect. Server certificates can be used to authenticate to some AWS services using HTTPS.
INCORRECT: “Key pair” is incorrect. Key pairs should not be confused with access keys. Key pairs are used for authenticating to Amazon EC2 instances.
When using Amazon IAM, what authentication methods are available to use? (Select TWO.) A.Server certificates B.Client certificates C.AES 256 D.Access Keys E.AWS KMS
A.Server certificates
D.Access Keys\
Explanation:
Supported authentication methods include console passwords, access keys and server certificates.
Access keys are a combination of an access key ID and a secret access key and can be used to make programmatic calls to AWS.
Server certificates are SSL/TLS certificates that you can use to authenticate with some AWS services.
CORRECT: “Access keys” is a correct answer.
CORRECT: “Server certificates” is also a correct answer.
INCORRECT: “Client certificates” is incorrect. Client certificates are not a valid IAM authentication method.
INCORRECT: “AWS KMS” is incorrect. AWS Key Management Service (KMS) is used for managing encryption keys and is not used for authentication..
INCORRECT: “AES 256” is incorrect. AES 256 is an encryption algorithm, not an authentication method.
Which service can an organization use to track API activity within their account? A.AWS CloudTrail B.Amazon CloudWatch C.AWS IAM D.AWS CloudHSM
A.AWS CloudTrail
Explanation:
AWS CloudTrail is a web service that records activity made on your account and delivers log files to an Amazon S3 bucket. CloudTrail is for auditing (CloudWatch is for performance monitoring).
CloudTrail is about logging and saves a history of API calls for your AWS account. Provides visibility into user activity by recording actions taken on your account. API history enables security analysis, resource change tracking, and compliance auditing
CORRECT: “AWS CloudTrail” is the correct answer.
INCORRECT: “Amazon CloudWatch” is incorrect. Amazon CloudWatch is a monitoring service for AWS cloud resources and the applications you run on AWS. CloudWatch is for performance monitoring (CloudTrail is for auditing). Used to collect and track metrics, collect and monitor log files, and set alarms.
INCORRECT: “AWS IAM” is incorrect. AWS Identity and Access Management is an identity service that provide authentication and authorization services
INCORRECT: “AWS CloudHSM” is incorrect. AWS CloudHSM is a cloud-based hardware security module (HSM) that enables you to easily generate and use your own encryption keys on the AWS Cloud.
Which service provides the ability to simply upload applications and have AWS handle the deployment details of capacity provisioning, load balancing, auto-scaling, and application health monitoring? A.Amazon EC2 B.AWS OpsWork C.AWS BeanStalk D.Amazon EC2 Auto Scaling
C.AWS BeanStalk
Explanation;
AWS Elastic Beanstalk can be used to quickly deploy and manage applications in the AWS Cloud. Developers upload applications and Elastic Beanstalk handles the deployment details of capacity provisioning, load balancing, auto-scaling, and application health monitoring. Considered a Platform as a Service (PaaS) solution. Supports Java, .NET, PHP, Node.js, Python, Ruby, Go, and Docker web applications.
CORRECT: “AWS Elastic Beanstalk” is the correct answer.
INCORRECT: “Amazon EC2” is incorrect. Amazon EC2 is an IaaS solution that provides unmanaged instances that you can deploy with a variety of operating systems.
INCORRECT: “Amazon EC2 Auto Scaling” is incorrect. Amazon EC2 Auto Scaling provides elasticity for your applications by automatically launching or terminating EC2 instances according to application load or schedules you define.
INCORRECT: “AWS OpsWorks” is incorrect. AWS OpsWorks provides a managed service for Chef and Puppet. This service is involved with automation and configuration management.
Which AWS service lets you use Chef and Puppet to automate how servers are configured, deployed, and managed across your Amazon EC2 instances or on-premises compute environments? A.AWS OpsWorks B.AWS Elastic Beanstalk C.AWS System Manager D.AWS CloudFormation
A.AWS OpsWorks
Explanation
AWS OpsWorks is a configuration management service that provides managed instances of Chef and Puppet. OpsWorks lets you use Chef and Puppet to automate how servers are configured, deployed, and managed across your Amazon EC2 instances or on-premises compute environments.
CORRECT: “AWS OpsWorks” is the correct answer.
INCORRECT: “AWS Elastic Beanstalk” is incorrect. This service does not use Chef or Puppet.
INCORRECT: “AWS CloudFormation” is incorrect. This service does not use Chef or Puppet.
INCORRECT: “AWS Systems Manager” is incorrect. This service does not use Chef or Puppet.
What are Edge locations used for?
A.They are the public-facing APIs for Amazon S3
B.They are used for CloudFront for caching content
C.They are used for terminating VPN connections
D.They are used by regions for inter-region connectivity
B.They are used for CloudFront for caching content
Explanation:
An edge location is used by CloudFront and is the location where content is cached (separate to AWS regions/AZs). Requests are automatically routed to the nearest edge location. Edge locations are not tied to Availability Zones or regions
CORRECT: “They are used by CloudFront for caching content” is the correct answer.
INCORRECT: “They are used for terminating VPN connections” is incorrect. They have nothing to do with VPN connections.
INCORRECT: “They are the public-facing APIs for Amazon S3” is incorrect. Amazon S3 does not run from Edge Locations.
INCORRECT: “They are used by regions for inter-region connectivity” is incorrect. They are not used for connectivity between regions.
Which feature enables fast, easy, and secure transfers of files over long distances between a client and an Amazon S3 bucket? A.Multipart Upload B.S3 Static Websites C.S3 Transfer Acceleration D.S3 Copy
C.S3 Transfer Acceleration
Explanation:
Amazon S3 Transfer Acceleration enables fast, easy, and secure transfers of files over long distances between your client and your Amazon S3 bucket. S3 Transfer Acceleration leverages Amazon CloudFront’s globally distributed AWS Edge Locations.
CORRECT: “S3 Transfer Acceleration” is the correct answer.
INCORRECT: “S3 Static Websites” is incorrect. S3 can also be used to host static websites but this does not assist with the performance of uploads to S3.
INCORRECT: “S3 Copy” is incorrect. With S3 copy you can create a copy of objects up to 5GB in size in a single atomic operation.
INCORRECT: “Multipart Upload” is incorrect. Multipart upload can be used to speed up uploads to S3.
Which of the below AWS services supports automated backups as a default configuration? A.Amazon S3 B.Amazon RDS C.Amazon EBS D.Amazon EC2
B.Amazon RDS
Explanation:
Amazon RDS automated backups allow point in time recovery to any point within the retention period down to a second. When automated backups are turned on for your DB Instance, Amazon RDS automatically performs a full daily snapshot of your data (during your preferred backup window) and captures transaction logs (as updates to your DB Instance are made). Automated backups are enabled by default and data is stored on S3 and is equal to the size of the DB
CORRECT: “Amazon RDS” is the correct answer.
INCORRECT: “Amazon S3” is incorrect. Amazon S3 objects are replicated across multiple facilities. You can also archive data onto Amazon Glacier and use versioning to maintain copies of older versions of objects
INCORRECT: “Amazon EC2” is incorrect. EC2 instances using EBS volumes can be backed up by creating a snapshot of the EBS volume.
INCORRECT: “Amazon EBS” is incorrect. EC2 instances using EBS volumes can be backed up by creating a snapshot of the EBS volume.
Your CTO wants to move to cloud. What cost advantages are there to moving to cloud?
A.You can reduce your marketing costs
B.You get free data transfer into and out of the cloud
C.You don’t need to pay for application licensing
D.You provision only what you need and adjust to peak load
D.You provision only what you need and adjust to peak load
Explanation:
One of the best benefits of cloud is that you can launch what you need to and automatically adjust your resources as demand changes. This means you only ever pay for what you’re using.
CORRECT: “You provision only what you need and adjust to peak load” is the correct answer.
INCORRECT: “You can reduce your marketing costs” is incorrect. You don’t reduce marketing costs when moving to the cloud, your organization still needs to do the same amount of marketing.
INCORRECT: “You don’t need to pay for application licensing” is incorrect. It is not true that you don’t need to pay for application licensing in the cloud. You still pay for your application licenses when running on Amazon EC2.
INCORRECT: “You get free data transfer into and out of the cloud” is incorrect. You do not get free bi-directional data transfer into and out of the cloud. AWS charge for outbound data transfer.
What is a specific benefit of an Enterprise Support plan? A.Included Cloud Support Associate B.Included AWS Solutions Architect C.Included Technical Account Manager D.Included technical support manager
C.Included Technical Account Manager
Explanation:
Only the Enterprise Support plan gets a Technical Account Manager (TAM).
You do not get an AWS Solutions Architect with any plan.
Cloud Support Associates are provided in the Developer plan.
There’s no such thing as a Technical Support Manager in the AWS support plans.
CORRECT: “Included Technical Account Manager” is the correct answer.
INCORRECT: “Included Technical Support Manager” is incorrect as explained above.
INCORRECT: “Included AWS Solutions Architect” is incorrect as explained above.
INCORRECT: “Included Cloud Support Associate” is incorrect as explained above.
Which AWS services are associated with Edge Locations? (Select TWO.) A.AWS Direct Connect B.Amazon CloudFront C.AWS Config D.AWS Shield E.Amazon EBS
B.Amazon CloudFront
D.AWS Shield
Explanation:
Edge Locations are parts of the Amazon CloudFront content delivery network (CDN) that are all around the world and are used to get content closer to end-users for better performance.
AWS Shield which protects against Distributed Denial of Service (DDoS) attacks is available globally on Amazon CloudFront Edge Locations.
CORRECT: “Amazon CloudFront” is a correct answer.
CORRECT: “AWS Shield” is also a correct answer.
INCORRECT: “AWS Direct Connect” is incorrect. AWS Direct Connect is a networking service used for creating a hybrid cloud between on-premises and AWS Cloud using a private network connection
INCORRECT: “Amazon EBS” is incorrect. Amazon EBS is a storage service.
INCORRECT: “AWS Config” is incorrect. AWS Config is used for evaluating the configuration state of AWS resources.
Which AWS support plan comes with a Technical Account Manager (TAM)? A.Basic B.Developer C.Business D.Enterprise
D.Enterprise
Explanation:
Only the Enterprise plan comes with a TAM.
CORRECT: “Enterprise” is the correct answer.
INCORRECT: “Basic” is incorrect as this plan does not come with a TAM.
INCORRECT: “Developer” is incorrect as this plan does not come with a TAM.
INCORRECT: “Business” is incorrect as this plan does not come with a TAM.
Which of the options below are recommendations in the security pillar of the well-architected framework? (Select TWO.) A.Protect data when it is at rest only B.Enable traceability C.Apply security at the application D.Automate security best practices E.Expect to be secure
B.Enable traceability
D.Automate security best practices
Explanation:
The security pillar includes the ability to protect information, systems, and assets while delivering business value through risk assessments and mitigation strategies
There are six design principles for security in the cloud:
– Implement a strong identity foundation.
– Enable traceability.
– Apply security at all layers.
– Automate security best practices.
– Protect data in transit and at rest.
– Prepare for security events.
CORRECT: “Enable traceability” is the correct answer.
CORRECT: “Automate security best practices” is the correct answer.
INCORRECT: “Apply security at the application layer” is incorrect. Please refer to the design principles above.
INCORRECT: “Protect data when it is at rest only” is incorrect. Please refer to the design principles above.
INCORRECT: “Expect to be secure” is incorrect. Please refer to the design principles above.
To ensure the security of your AWS account, what are two AWS best practices for managing access keys? (Select TWO.)
A.Dont create any access keys, use IAM roles instead
B.Dont generate an access key for the root account user
C.Use MFA for access keys
D.Where possible, use IAM roles with temporary security credentials
E.Rotate access keys daily
B.Dont generate an access key for the root account user
D.Where possible, use IAM roles with temporary security credentials
Explanation:
Best practices include:
– Don’t generate an access key for the root account user.
– Use Temporary Security Credentials (IAM Roles) Instead of Long-Term Access Keys.
– Manage IAM User Access Keys Properly.
CORRECT: “Don’t generate an access key for the root account user” is a correct answer.
CORRECT: “Where possible, use IAM roles with temporary security credentials” is also a correct answer.
INCORRECT: “Don’t create any access keys, use IAM roles instead” is incorrect. You should use IAM roles where possible, but AWS do not recommend that you don’t create any access keys as they also have a purpose
INCORRECT: “Rotate access keys daily” is incorrect. Rotating access keys is a recommended practice, but doing it daily would be excessive and hard to manage.
INCORRECT: “Use MFA for access keys” is incorrect. You can use MFA for securing accounts, but it does not secure access keys
Which IAM entity can be used for assigning permissions to multiple users? A.IAM password policy B.IAM Role C.IAM user D.IAM Group
D.IAM Group
Explanation:
Explanation
Groups are collections of users and have policies attached to them. You can use groups to assign permissions to multiple users. To do this place the users in the group and then create an IAM policy with the correct permissions and attach it to the group.
You do not use an IAM User, Role, or password policy to assign permissions to multiple users.
CORRECT: “IAM Group” is the correct answer.
INCORRECT: “IAM User” is incorrect as explained above.
INCORRECT: “IAM Role” is incorrect as explained above.
INCORRECT: “IAM password policy” is incorrect as explained above.
What are the charges for using Amazon Glacier? (Select TWO.) A.Retrieval requests B.Data storage C.Data transferred into Glacier D.Number of availability zones E.Enhanced networking
A.Retrieval requests
B.Data storage
Explanation:
With Amazon Glacier you pay for storage on a per GB / month basis, retrieval requests and quantity (based on expedited, standard, or bulk), and data transfer out of Glacier.
CORRECT: “Retrieval requests” is the correct answer.
CORRECT: “Data storage” is the correct answer.
INCORRECT: “Data transferred into Glacier” is incorrect. You do not pay for data transferred in and there are no minimum storage fees.
INCORRECT: “Enhanced networking” is incorrect. Enhanced networking is a feature of EC2.
INCORRECT: “Number of Availability Zones” is incorrect. You do not pay for the number of AZs.
Which IAM entity is associated with an access key ID and secret access key? A.IAM Policy B.IAM user C.IAM Group D.IAM Role
B.IAM user
Explanation:
An access key ID and secret access key are used to sign programmatic requests to AWS. They are associated with an IAM user.
You cannot associate an access key ID and secret access key with an IAM Group, Role or Policy.
CORRECT: “IAM User” is the correct answer.
INCORRECT: “IAM Group” is incorrect as explained above.
INCORRECT: “IAM Role” is incorrect as explained above.
INCORRECT: “IAM Policy” is incorrect as explained above.
What is the best way for an organization to transfer hundreds of terabytes of data from their on-premise data center into Amazon S3 with limited bandwidth available? A.Use Amazon CloudFront B.Use AWS Snowball C.Use S3 Transfer Acceleration D.Apply Compression before uploading
B.Use AWS Snowball
Explanation:
Snowball is a petabyte-scale data transport solution that uses devices designed to be secure to transfer large amounts of data into and out of the AWS Cloud. Using Snowball addresses common challenges with large-scale data transfers including high network costs, long transfer times, and security concerns
CORRECT: “Use AWS Snowball” is the correct answer.
INCORRECT: “Use S3 Transfer Acceleration” is incorrect. Amazon S3 Transfer Acceleration enables fast, easy, and secure transfers of files over long distances between your client and an S3 bucket. Transfer Acceleration takes advantage of Amazon CloudFront’s globally distributed edge locations. However, for these volumes of data Snowball is a better choice.
INCORRECT: “Apply compression before uploading” is incorrect as for this volume of data Snowball should be used.
INCORRECT: “Use Amazon CloudFront” is incorrect as this cannot be used for uploading large quantities of data to Amazon S3.
Which AWS service does API Gateway integrate with to enable users from around the world to achieve the lowest possible latency for API requests and responses? A.AWS Lambda B.Amazon S3 Transfer Accerleration C.AWS Direct Connect D.Amazon Cloudfront
D.Amazon Cloudfront
Explanation:
Amazon CloudFront is used as the public endpoint for API Gateway. Provides reduced latency and distributed denial of service protection through the use of CloudFront.
CORRECT: “Amazon CloudFront” is the correct answer.
INCORRECT: “AWS Direct Connect” is incorrect. AWS Direct Connect is a cloud service solution that makes it easy to establish a dedicated network connection from your premises to AWS.
INCORRECT: “Amazon S3 Transfer Acceleration” is incorrect. Amazon S3 Transfer Acceleration is a bucket-level feature that enables faster data transfers to and from Amazon S3.
INCORRECT: “AWS Lambda” is incorrect. AWS Lambda lets you run code without provisioning or managing servers.
Which AWS database service provides a fully managed data warehouse that can be analyzed using SQL tools and business intelligence tools? A.Amazon RDS B.Amazon DynamoDB C.Amazon RedShift D.Amazon ElastiCache
C.Amazon RedShift
Explanation:
Amazon RedShift is a fully managed data warehouse service designed to handle petabytes of data for analysis. Data can be analyzed with standard SQL tools and business intelligence tools. RedShift allows you to run complex analytic queries against petabytes of structured data.
CORRECT: “Amazon RedShift” is the correct answer.
INCORRECT: “Amazon RDS” is incorrect. RDS is Amazon’s transactional relational database.
INCORRECT: “Amazon DynamoDB” is incorrect. DynamoDB is Amazon’s non-relational database service.
INCORRECT: “Amazon ElastiCache” is incorrect. ElastiCache is a data caching service that is used to help improve the speed/performance of web applications running on AWS.
Which of the options below are recommendations in the performance efficiency pillar of the well-architected framework? (Select TWO.) A.Democratie advanced technologies B.Mechanical complexity C.User serverless architectures D.Go global in days E.Rarely experiment
A.Democratie advanced technologies
C.User serverless architectures
Explanation:
The performance efficiency pillar includes the ability to use computing resources efficiently to meet system requirements and to maintain that efficiency as demand changes and technologies evolve.
There are five design principles for performance efficiency in the cloud:
– Democratize advanced technologies.
– Go global in minutes.
– Use serverless architectures.
– Experiment more often.
– Mechanical sympathy.
CORRECT: “Democratize advanced technologies” is a correct answer.
CORRECT: “Use serverless architectures” is also a correct answer.
INCORRECT: “Go global in days” is incorrect. Please refer to the design principles above.
INCORRECT: “Rarely experiment” is incorrect. Please refer to the design principles above.
INCORRECT: “Mechanical complexity” is incorrect. Please refer to the design principles above.
