AWS Certified Cloud Practitioner: Test 5 Flashcards
What is the name of the online, self-service portal that AWS provides to enable customers to view reports and, such as PCI reports, and accept agreements? A. AWS Documentation Portal B.AWS DocuFact C.AWS Compliance Portal D.AWS Artifact
D.AWS Artifact
Explanation
AWS Artifact is your go-to, central resource for compliance-related information that matters to you. It provides on-demand access to AWS’ security and compliance reports and select online agreements.
Reports available in AWS Artifact include our Service Organization Control (SOC) reports, Payment Card Industry (PCI) reports, and certifications from accreditation bodies across geographies and compliance verticals that validate the implementation and operating effectiveness of AWS security controls.
Agreements available in AWS Artifact include the Business Associate Addendum (BAA) and the Nondisclosure Agreement (NDA).
CORRECT: “AWS Artifact” is the correct answer.
INCORRECT: “AWS Compliance Portal” is incorrect as this is not a real service.
INCORRECT: “AWS Documentation Portal” is incorrect as this is not a real service.
INCORRECT: AWS DocuFact”” is incorrect as this is not a real service.
Which service provides alerts and remediation guidance when AWS is experiencing events that may impact you? A.AWS Trusted Advisory B.AWS Inspector C.AWS Personal Health Dashboard D.AWS Shield
C.AWS Personal Health Dashboard
Explanation:
AWS Personal Health Dashboard provides alerts and remediation guidance when AWS is experiencing events that may impact you.
CORRECT: “AWS Personal Health Dashboard” is the correct answer.
INCORRECT: “AWS Trusted Advisor” is incorrect. Trusted Advisor is an online resource that helps to reduce cost, increase performance and improve security by optimizing your AWS environment.
INCORRECT: “AWS Inspector” is incorrect. Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS.
INCORRECT: “AWS Shield” is incorrect. AWS Shield is a managed Distributed Denial of Service (DDoS) protection service.
Which AWS program can help an organization to design, build, and manage their workloads on AWS? A.AWS Consulting Partners B.AWS Business Development Manager C.APN Technology Consultants D.AWS Technical Account Manager
A.AWS Consulting Partners
Explanation:
APN Consulting Partners are professional services firms that help customers of all sizes design, architect, build, migrate, and manage their workloads and applications on AWS. Consulting Partners include System Integrators (SIs), Strategic Consultancies, Agencies, Managed Service Providers (MSPs), and Value-Added Resellers (VARs).
None of the other options are AWS Programs that can assist a customer with the design, build and management of their workloads.
CORRECT: “APN Consulting Partners” is the correct answer.
INCORRECT: “APN Technology Consultants” is incorrect as explained above.
INCORRECT: “AWS Business Development Manager” is incorrect as explained above.
INCORRECT: “AWS Technical Account Manager” is incorrect as explained above.
Assuming you have configured them correctly, which AWS services can scale automatically without intervention? (Select TWO.) A.Amazon EC2 B.Amazon EBS C.Amazon S3 D.Amazon RDS E.Amazon DynamoDB
C.Amazon S3
Explanation:
Both S3 and DynamoDB automatically scale as demand dictates. In the case of DynamoDB you can either configure the on-demand or provisioned capacity mode. With on-demand capacity mode DynamoDB automatically adjusts the read and write throughput for you.
EBS and RDS do not scale automatically. You must intervene to adjust volume sizes and database instance types to scale these resources
CORRECT: “Amazon S3” is a correct answer.
CORRECT: “Amazon DynamoDB” is also a correct answer.
INCORRECT: “Amazon RDS” is incorrect as explained above.
INCORRECT: “Amazon EC2” is incorrect. EC2 cannot scale automatically. You need to use Auto Scaling to scale the number of EC2 instances deployed.
INCORRECT: “Amazon EBS” is incorrect as explained above.
What is an Edge location? A.A public endpoint for Amazon S3 B.A content delivery network (CDN) endpoint for CloudFront C.A virtual private gateway for VPN D.A VPC peering connection endpoint
B.A content delivery network (CDN) endpoint for CloudFront
Explanation:
Edge locations are Content Delivery Network (CDN) endpoints for CloudFront. There are many more edge locations than regions.
CORRECT: “A content delivery network (CDN) endpoint for CloudFront” is the correct answer.
INCORRECT: “A public endpoint for Amazon S3” is incorrect as it is not related to S3.
INCORRECT: “A virtual private gateway for VPN” is incorrect as it is not related to VPN.
INCORRECT: “A VPC peering connection endpoint” is incorrect as it is not related to VPC.
What information must be entered into the AWS TCO Calculator?
A.The number of applications in your company
B.The number of storage systems in your company
C.The number of servers in your company
D.The number of end users in your company
C.The number of servers in your company
Explanation:
The TCO calculator asks for the number of servers (Physical or VMs) you are running on-premises. You also need to supply the resource information (CPU, RAM) and specify whether the server is a DB or non-DB.
CORRECT: “The number of servers in your company” is the correct answer.
INCORRECT: “The number of end users in your company” is incorrect. You do not need to supply the number of end users.
INCORRECT: “The number of applications in your company” is incorrect. You do not need to supply the number of applications.
INCORRECT: “The number of storage systems in your company” is incorrect. You don’t need to specify the number of storage systems, you just need to specify the raw capacity.
Use this new calculator to compare the cost of your applications in an on-premises or traditional hosting environment to AWS. Describe your on-premises or hosting environment configuration to produce a detailed cost comparison with AWS.
Which service runs your application code only when needed without needing to run servers? A.Amazon EC2 B.Amazon ECS C.AWS LightSail D.AWS Lambda
D.AWS Lambda
Explanation:
AWS Lambda is a serverless service that runs code as “functions”. That means that your code is run when needed but there are no servers running (at least not servers that you see or manage). This reduces cost and operational overhead.
CORRECT: “AWS Lambda” is the correct answer.
INCORRECT: “Amazon EC2” is incorrect. Amazon EC2 is used for running server instances so this is an incorrect answer.
INCORRECT: “Amazon ECS” is incorrect. Amazon ECS is used for running Docker containers which do need to run waiting for requests.
INCORRECT: “AWS LightSail” is incorrect. AWS LightSail is a service that is used for running virtual instances and databases using a simplified user interface for users who are less experienced with AWS (also at a much lower cost than EC2).
Which of the following are advantages of using the AWS cloud computing over legacy IT? (Select TWO.)
A. You do not need to worry about over provisioning as youcan elastically scale
B.You are able to pass responsibility for the availability of your applications to AWS
C.You can bring services closer to your end users
D.You can bring new applications to market faster
E.You do not need to patch your operating systems
A. You do not need to worry about over provisioning as youcan elastically scale
D.You can bring new applications to market faster
Explanation:
With cloud computing you no longer need to guess about capacity as you can elastically scale. This means you don’t end up overprovisioning but instead react to the load on your servers. You can also be faster and more agile with development and release of applications.
CORRECT: “You don’t need to worry about over provisioning as you can elastically scale” is a correct answer.
CORRECT: “You can bring new applications to market faster” is also a correct answer.
INCORRECT: “You are able to pass responsibility for the availability of your application to AWS” is incorrect. You do not pass responsibility for your application to AWS. AWS runs the infrastructure but you still manage the application
INCORRECT: “You don’t need to patch your operating systems” is incorrect. You still need to patch your own operating systems.
INCORRECT: “You can bring services closer to your end users” is incorrect. The cloud is centralized so you won’t necessarily bring services closer to your end users.
A company wants to utilize a pay as you go cloud model for all of their applications without CAPEX costs and which is highly elastic. Which cloud delivery model will suit them best? A.Private B.On-premise C.Public D.Hybrid
C.Public
Explanation;
The public cloud is offered under a purely pay as you go model (unless you choose to reserve), and allows companies to completely avoid CAPEX costs. The public cloud is also highly elastic so companies can grow and shrink the applications as demand changes.
Private and on-premise clouds are essentially the same, though both could be managed by a third party and even could be delivered under an OPEX model by some vendors. However, they are typically more CAPEX heavy and the elasticity is limited.
A hybrid model combines public and private and this company wants to go all in on a single model.
CORRECT: “Public” is the correct answer.
INCORRECT: “Private” is incorrect as explained above.
INCORRECT: “Hybrid” is incorrect as explained above.
INCORRECT: “On-premise” is incorrect as explained above.
What are the primary benefits of using AWS Elastic Load Balancing? (Select TWO.) A.Automation B.Elasticity C.Caching D.Regional resilience E.high availability
B.Elasticity
E.high availability
High availability – ELB automatically distributes traffic across multiple EC2 instances in different AZs within a region.
Elasticity – ELB is capable of handling rapid changes in network traffic patterns.
CORRECT: “High availability” is a correct answer.
CORRECT: “Elasticity” is also a correct answer.
INCORRECT: “Automation” is incorrect. Automation is not a primary benefit of ELB.
INCORRECT: “Caching” is incorrect. Caching is not a benefit of ELB
INCORRECT: “Regional resilience” is incorrect. An ELB can distribute incoming traffic across your Amazon EC2 instances in a single Availability Zone or multiple Availability Zones, but not across regions (for regional resilience).
Which of the following constitute the five pillars for the AWS Well-Architected Framework? (Select TWO.)
A.Operational excellence, elasticity and scalability
B.Operational excellence, security and reliability
C.Performance efficiency and cost optimization
D.Data consistency and cost optimization
E.Cost prioritization and cost optimization
B.Operational excellence, security and reliability
C.Performance efficiency and cost optimization
Explanation:
The five pillars of the AWS Well-Architected Framework are operational excellence, security, reliability, performance efficiency, and cost optimization
CORRECT: “Operational excellence, security, and reliability” is the correct answer.
CORRECT: “Performance efficiency, and cost optimization” is the correct answer.
INCORRECT: “Operational excellence, elasticity and scalability” is incorrect as elasticity and scalability are not included.
INCORRECT: “Cost prioritization, and cost optimization” is incorrect as cost prioritization is not included.
INCORRECT: “Data consistency, and cost optimization” is incorrect as data consistency is not included.
Which service can you use to monitor, store and access log files generated by EC2 instances and on-premises servers? A.Amazon CloudWatch Logs B.AWS OpsWorks C.AWS CloudTrail D.Amazon kenesis
A.Amazon CloudWatch Logs
Explanation:
You can use Amazon CloudWatch Logs to monitor, store, and access your log files from Amazon Elastic Compute Cloud (Amazon EC2) instances, AWS CloudTrail, Route 53, and other sources. You can then retrieve the associated log data from CloudWatch Logs.
CORRECT: “Amazon CloudWatch Logs” is the correct answer.
INCORRECT: “AWS CloudTrail” is incorrect. AWS CloudTrail is used for recording a history of API actions taken on your account.
INCORRECT: “AWS OpsWorks” is incorrect. OpsWorks is a configuration management service.
INCORRECT: “Amazon Kinesis” is incorrect. Amazon Kinesis is a set of services used for collecting, processing and analyzing streaming data.
A company needs protection from distributed denial of service (DDoS) attacks on its website and assistance from AWS experts during such events.
Which AWS managed service will meet these requirements? A.AWS Firewall manager B.AWS Shield Advanced C.AWS Web Application Firewall D.Amazon GuardDuty
B.AWS Shield Advanced
Explanation:
AWS Shield Advanced provides enhanced detection and includes a specialized support team for customers on Enterprise or Business support plans. The AWS DDoS Response Team (DRT) are available 24/7 and can be engaged before, during, or after a DDoS attack.
CORRECT: “AWS Shield Advanced” is the correct answer.
INCORRECT: “AWS Firewall Manager” is incorrect. This service is used to simplify management of AWS WAF, AWS Shield Advanced, and Amazon VPC security groups.
INCORRECT: “AWS Web Application Firewall” is incorrect. AWS WAF is used for protecting web applications and APIs against malicious attacks. This is not a DDoS prevention service.
INCORRECT: “Amazon GuardDuty” is incorrect. This service is used for continuously monitoring AWS resources for threats. It is not a DDoS prevention service, it uses machine learning and anomaly detection to identify security vulnerabilities in resources.
Which type of EBS volumes can be encrypted?
A.Both non-root and root volumes
B.Only non-root volumes created from snapshots
C.Only root volumes can have encryption applied at launch time
D.Non-root volumes only
A.Both non-root and root volumes
Amazon EBS encryption offers a straight-forward encryption solution for your EBS resources that doesn’t require you to build, maintain, and secure your own key management infrastructure. It uses AWS Key Management Service (AWS KMS) customer master keys (CMK) when creating encrypted volumes and snapshots.
Encryption operations occur on the servers that host EC2 instances, ensuring the security of both data-at-rest and data-in-transit between an instance and its attached EBS storage.
All volumes can now be encrypted at launch time and it’s possible to set this as the default setting.
CORRECT: “Both non-root and root volumes” is the correct answer.
INCORRECT: “Non-root volumes only” is incorrect as this is not true.
INCORRECT: “Only non-root volumes created from snapshots” is incorrect as you can encrypt all EBS volumes whether created from snapshots or not.
INCORRECT: “Only root volumes can have encryption applied at launch time” is incorrect as all volumes can have encryption applied at launch time.
Under the AWS Shared Responsibility Model, which of the following is the customer NOT responsible for?
A.Applying encryption to data stored on an EBS volume
B.Adding firewall rules to security groups and network ACLs
C.Installing firmware updates on host servers
D.Applying bucket policies to share Amazon S3 data
C.Installing firmware updates on host servers
Explanation:
AWS customers are not responsible for installing firmware updates on the underlying infrastructure. AWS customers must protect their AWS services through policies, encryption, and firewall rules.
CORRECT: “Installing firmware updates on host servers” is the correct answer.
INCORRECT: “Adding firewall rules to security groups and network ACLs” is incorrect as this is a customer responsibility.
INCORRECT: “Applying encryption to data stored on an EBS volume” is incorrect as this is a customer responsibility.
INCORRECT: “Applying bucket policies to share Amazon S3 data” is incorrect as this is a customer responsibility.
Which AWS security service provides a firewall at the subnet level within a VPC? A.Bucket Policy B.Network Access Control List C.IAM Policy D.Security Policy
B.Network Access Control List
Explanation:
A Network ACL is a firewall that is associated with a subnet within your VPC. It is used to filter the network traffic that enters and exits the subnet.
CORRECT: “Network Access Control List” is the correct answer.
INCORRECT: “Security Group” is incorrect. A Security Group is a firewall that is associated with an EC2 instances (not the subnet). Security Groups control the traffic the inbound and outbound network traffic from/to the instance.
INCORRECT: “IAM Policy” is incorrect. An IAM Policy is used to assign permissions to users and roles.
INCORRECT: “Bucket Policy” is incorrect. A Bucket Policy is used with Amazon S3 buckets to control access.
Which AWS support plan provides email only support by Cloud Support Associates? A.Eneterpsie B.Developer C.Basic D.Business
B.Developer
Explanation:
Developer provides email support by the Cloud Support Associates team whereas Business and Enterprise provide email, 24×7 phone and chat access to Cloud Support Engineers. Basic does not provide email support at all.
CORRECT: “Developer” is the correct answer.
INCORRECT: “Basic” is incorrect as explained above.
INCORRECT: “Business” is incorrect as explained above.
INCORRECT: “Enterprise” is incorrect as explained above.
A user deploys an Amazon Aurora database instance in multiple Availability Zones.
This strategy involves which pillar of the AWS Well-Architected Framework? A.Cost optimization B.Reliability C.Performance efficiency D.Security
B.Reliability
Explanation:
The reliability pillar includes the ability of a system to recover from infrastructure or service disruptions, dynamically acquire computing resources to meet demand, and mitigate disruptions such as misconfigurations or transient network issues.
There are five design principles for reliability in the cloud:
- Test recovery procedures
- Automatically recover from failure
- Scale horizontally to increase aggregate system availability
- Stop guessing capacity
- Manage change in automation
The example given in the question is related to “Automatically recover from failure”.
CORRECT: “Reliability” is the correct answer.
INCORRECT: “Performance efficiency” is incorrect as this is an example of reliability.
INCORRECT: “Cost optimization” is incorrect as this is an example of reliability.
INCORRECT: “Security” is incorrect as this is an example of reliability.
With which service can a developer upload code using a ZIP or WAR file and have the service handle the end-to-end deployment of the resources? A.Amazon ECS B.AWS CodeDeploy C.AWS CodeCommit D,AWS Elastic Beanstalk
D,AWS Elastic Beanstalk
Explanation
AWS Elastic Beanstalk can be used to quickly deploy and manage applications in the AWS Cloud. Developers upload applications and Elastic Beanstalk handles the deployment details of capacity provisioning, load balancing, auto-scaling, and application health monitoring.
You can upload code directly using a ZIP or WAR file. You can also use a Git archive.
CORRECT: “AWS Elastic Beanstalk” is the correct answer.
INCORRECT: “AWS CodeDeploy” is incorrect. AWS CodeDeploy is a fully managed deployment service that automates software deployments to a variety of compute services such as Amazon EC2, AWS Lambda, and on-premises servers.
INCORRECT: “Amazon ECS” is incorrect. Amazon Elastic Container Service is a managed service for running Docker containers.
INCORRECT: “AWS CodeCommit” is incorrect. AWS CodeCommit is a fully-managed source control service that hosts secure Git-based repositories. It does not actually automate the build of the code or infrastructure on which it runs.
Which type of storage stores objects comprised of key, value pairs? A.Amazon DynamoDB B.Amazon EBS C.Amazon EFS D.Amazon S3
D.Amazon S3
Explanation:
Amazon Simple Storage Service is storage for the Internet. It is designed to make web-scale computing easier for developers. Amazon S3 is an object-based storage system that stores objects that are comprised of key, value pairs.
CORRECT: “Amazon S3” is the correct answer.
INCORRECT: “Amazon DynamoDB” is incorrect. Amazon DynamoDB stores items, not objects, based on key, value pairs.
INCORRECT: “Amazon EBS” is incorrect. Amazon EBS is a block-based storage system.
INCORRECT: “Amazon EFS” is incorrect. Amazon EFS is a file-based storage system.
Which of the following statements is correct about Amazon S3 cross-region replication?
A.The source S3 bucket owner must have the source and destination AWS Regions disabled for their account
B.The source and destination S3 buckets cannot be in different AWS regions
C.S3 buckets configured for cross-region replication can be owned by a single AWS account or by different accounts
D.Both source and destination S3 buckets must have versioning disabled
C.S3 buckets configured for cross-region replication can be owned by a single AWS account or by different accounts
Explanation:
Replication enables automatic, asynchronous copying of objects across Amazon S3 buckets. Buckets that are configured for object replication can be owned by the same AWS account or by different accounts. You can copy objects between different AWS Regions or within the same Region.
Both source and destination buckets must have versioning enabled. The source bucket owner must have the source and destination AWS Regions enabled for their account. The destination bucket owner must have the destination Region-enabled for their account.
CORRECT: “S3 buckets configured for cross-region replication can be owned by a single AWS account or by different accounts” is the correct answer.
INCORRECT: “Both source and destination S3 buckets must have versioning disabled” is incorrect as explained above.
INCORRECT: “The source and destination S3 buckets cannot be in different AWS Regions” is incorrect as explained above.
INCORRECT: “The source S3 bucket owner must have the source and destination AWS Regions disabled for their account” is incorrect as explained above.
Which of the following Amazon EC2 pricing models allows customers to use existing server-bound software licenses? A.On-Demand Instances B.Reserved Instances C.Spot Instances D.Dedicated Hosts
D.Dedicated Hosts
Explanation:
Amazon EC2 Dedicated Hosts allow you to use your eligible software licenses from vendors such as Microsoft and Oracle on Amazon EC2, so that you get the flexibility and cost effectiveness of using your own licenses, but with the resiliency, simplicity and elasticity of AWS. An Amazon EC2 Dedicated Host is a physical server fully dedicated for your use, so you can help address corporate compliance requirements.
CORRECT: “Dedicated Hosts” is the correct answer.
INCORRECT: “On-Demand Instances” is incorrect. This is a standard pricing model and does not offer the advantages requested.
INCORRECT: “Spot Instances” is incorrect. This is used to obtain discounted pricing for short-term requirements that can be interrupted.
INCORRECT: “Reserved Instances” is incorrect. This is used to lower cost by reserving usage of an instance for a term of 1 or 3 years.
How can a company connect from their on-premises network to VPCs in multiple regions using private connections? A.Amazon CloudFront B.AWS managed VPN C.Inter-Region VPC Peering D.AWS Direct Connect Gateway
D.AWS Direct Connect Gateway
Explanation;
You can use an AWS Direct Connect gateway to connect your AWS Direct Connect connection over a private virtual interface to one or more VPCs in your account that are located in the same or different Regions
CORRECT: “AWS Direct Connect Gateway” is the correct answer.
INCORRECT: “AWS Managed VPN” is incorrect. AWS Managed VPN uses the public Internet and is therefore not a private connection.
INCORRECT: “Amazon CloudFront” is incorrect. Amazon CloudFront is a content delivery network used for caching data.
INCORRECT: “Inter-Region VPC Peering” is incorrect. Inter-Region VPC peering does not help you to connect from an on-premise network.
What is the name of the AWS managed Docker registry service used by the Amazon Elastic Container Service (ECS)? A.ECS Container Registry B.Docker Container Registry C.Elastic Container Registry D.Docker Image Repository
C.Elastic Container Registry
Explanation:
Amazon Elastic Container Registry (ECR) is a fully-managed Docker container registry that makes it easy for developers to store, manage, and deploy Docker container images.
Amazon ECR is integrated with Amazon Elastic Container Service (ECS). Amazon ECR eliminates the need to operate your own container repositories or worry about scaling the underlying infrastructure.
CORRECT: “Elastic Container Registry” is the correct answer.
INCORRECT: “ECS Container Registry” is incorrect as this is the wrong name.
INCORRECT: “Docker Container Registry” is incorrect as this is not an AWS registry.
INCORRECT: “Docker Image Repository” is incorrect as this is not an AWS registry.
An Elastic IP Address can be remapped between EC2 instances across which boundaries? A.Regions B.Edge Locations C.DB Subnets D.Availability Zones
D.Availability Zones
Explanation:
Elastic IP addresses are for use in a specific region only and can therefore only be remapped between instances within that region. You can use Elastic IP addresses to mask the failure of an instance in one Availability Zone by rapidly remapping the address to an instance in another Availability Zone.
CORRECT: “Availability Zones” is the correct answer.
INCORRECT: “Regions” is incorrect as you cannot remap across regions.
INCORRECT: “Edge Locations” is incorrect. Edge Locations are used by CloudFront and are not places where you can run EC2 instances.
INCORRECT: “DB Subnets” is incorrect. DB subnets (groups) are used by the RDS relational database service and are not used for running EC2 instances.
A Cloud Practitioner is developing a disaster recovery plan and intends to replicate data between multiple geographic areas.
Which of the following meets these requirements? A.Availability Zones B.AWS Accounts C.AWS Regions D.Edge Locations
C.AWS Regions
Explanation:
AWS has the concept of a Region, which is a physical location around the world where we cluster data centers. We call each group of logical data centers an Availability Zone. Each AWS Region consists of multiple, isolated, and physically separate AZ’s within a geographic area.
Therefore, the Cloud Practitioner should replicate data between multiple Regions as these are separate geographical areas.
CORRECT: “AWS Regions” is the correct answer.
INCORRECT: “AWS Accounts” is incorrect. An account is not a geographic area.
INCORRECT: “Availability Zones” is incorrect. AZs are within a Region, not across geographical areas.
INCORRECT: “Edge locations” is incorrect. These are not locations to which you can replicate your data. They are used primarily by Amazon CloudFront for caching content, not for disaster recovery.
