Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Certifications > AWS Certified Developer Associate > Flashcards

AWS Certified Developer Associate Flashcards

1
Q

What is the proper definition of an IAM Role?

a. IAM Users in multiple User Groups
b. An IAM entity that defines a set of permissions for making requests to AWS services and will be used by an AWS service.
c. An IAM entity that defines a password policy for IAM Users
d. Permissions assigned to IAM Users to perform actions

A

b. An IAM entity that defines a set of permissions for making requests to AWS services and will be used by an AWS service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which of the following is an IAM Security Tool?

a. IAM Credentials Report
b. IAM Root Account Manager
c. IAM Services Report
d. IAM Security Advisor

A

a. IAM Credentials Report

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which answer is INCORRECT regarding IAM Users?

a. IAM Users can belong to multiple User Groups
b. IAM Users don’t have to belong to a User Group
c. IAM Policies can be attached directly to IAM Users
d. IAM Users access AWS services using root account credentials

A

d. IAM Users access AWS services using root account credentials

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which of the following is an IAM best practice?

a. create serveral IAM Users for on physical person
b. share your AWS account credentials with your colleague, so he can perform a task for you
c. don’t use the root user account
d. do not enable MFA for easier access

A

c. don’t use the root user account

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are IAM Policies?

a. a set of policies defines how AWS accounts interact with each other
b. JSON documents that define a set of permissions for making requests to AWS services, and can be used by IAM Users, User Groups, and IAM Roles
c. a set of policies that define a password for IAM Users
d. a set of policies defined by AWS that show how customers interact with AWS

A

b. JSON documents that define a set of permissions for making requests to AWS services, and can be used by IAM Users, User Groups, and IAM Roles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which principle should you apply regarding IAM Permissions?

a. grant least privilege
d. grant most privilege
c. grant more permissions if your employee asks you to
d. restrict root account permissions

A

a. grant least privilege

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What should you do to increase your root account security?

a. remove permissions from the root account
b. only access AWS services through AWS Command Line Interface (CLI)
c. enable Multi-factor Authentication (MFA)
d. don’t create IAM Users, only access your AWs account using the root account

A

c. enable Multi-factor Authentication (MFA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

True or False:

IAM User Groups can contain IAM Users and other User Groups

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

An IAM policy consists of one or more statements. A statement in an IAM Policy consists of the following EXCEPT:

a. effect
b. principal
c. version
d. action
e. resource

A

c. version

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

According to the AWS Shared Responsibility Model, which of the following is AWS responsibility?

a. rotate Access Key for IAM users
b. enable MFA for the root account and all IAM Users
c. IAM Users, User Groups, and IAM Policies
d. AWS Infrastructure

A

d. AWS Infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which EC2 Purchasing Option can provide you the biggest discount, but it is not suitable for critical jobs or databases?

a. convertible reserved instances
b. dedicated hosts
c. spot instances

A

c. spot instances

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What should you use to control traffic in and out of EC2 instances?

a. network access control list (NACL)
b. security groups
c. IAM policies

A

b. security groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How long can you reserve and EC2 Reserved Instance?

a. 1 or 3 years
b. 2 or 4 years
c. 6 months or 1 year
d. anytime between 1 and 3 years

A

a. 1 or 3 years

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

You would like to deploy a High-Performance Computing (HPC) application on EC2 instances. Which EC2 instance type should you choose?

a. storage optimized
b. memory optimized
c. compute optimized
d. general purpose

A

c. compute optimized

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which EC2 Purchasing option should you use for an application you plan to run on a sever continuously for 1 year?

a. on-demand instances
b. spot instances
c. reserved instances

A

c. reserved instances

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

You are preparing to launch an application that will be hosted on a set of EC2 instances. This application needs some software installation and some OS packages need to be updated during the first launch. What is the best way to achieve this when you launch the EC2 instance?

a. Connect to each EC2 instance using SSH, then install the required software and update your OS package manually.
b. Write a bash script that installs the required software and updates to your OS, then use this script in EC2 User Data when you launch your EC2 instances.
c. Write a bash script that installs the required software and updates to your OS, then contact AWS Support and provide them with the script. They will run it on your EC2 instances at launch.

A

b. Write a bash script that installs the required software and updates to your OS, then use this script in EC2 User Data when you launch your EC2 instances.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which EC2 instance type should you choose for a critical application that uses an in-memory database?

a. compute optimized
b. storage optimized
c. memory optimized
d. general purpose

A

c. memory optimized

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

You have an e-commerce application with an OLTP database hosted on-premises. This application has popularity which results in its database has thousands of requests per second. You want to migrate the database to an EC2 instance. Which EC2 instance type should you choose to handle this high-frequency OLTP database?

a. compute optimized
b. storage optimized
c. memory optimized
d. general purpose

A

b. storage optimized

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

True or False: Security Groups can be attached to only one EC2 instance.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

You are planning to migrate on-premises applications to AWS. Your company has strict compliance requirements that require your application to run on dedicated servers. You also need to use your own server-bound software license to reduce costs. Which EC2 purchasing options is suitable for you?

a. convertible reserved instances
b. dedicated hosts
c. spot instances

A

b. dedicated hosts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

You would like to deploy a database technology on an EC2 instance and the vendor license bills you based on the physical cores and underlying network socket visibility. Which EC2 purchasing option allows you to get visibility into them?

a. dedicated hosts
b. spot instances
c. on-demand
d. reserved instances

A

a. dedicated hosts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

You have just terminated an EC2 instance in us-east-1a, and its attached EBS volume is now available. Your teammate tries to attach it to an EC2 instance in us-east-1b but he can’t. What is a possible cause for this?

a. he’s missing IAM permissions
b. EBS volumes are locked to an AWS Region
c. EBS volumes are locked to an AZ

A

c. EBS volumes are locked to an AZ

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

You have launched an EC2 instance with two EBS volumes, the root volume type and the other EBS volume type to store the data. A month later you are planning to terminate the EC2 instance. What’s the default behavior that will happen to each EBS volume?

a. both the root volume type and the EBS volume type will be deleted
b. the root volume type will be deleted and the EBS volume type will not be deleted.
c. the root volume type will not be deleted and the EBS volume type will be deleted.
d. Both the root volume type and the EBS volume type will not be deleted.

A

b. the root volume type will be deleted an the EBS volume type will not be deleted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

True or False: You can use an AMI in N. Virginia Region us-east-1 to launch an EC2 instance in any AWS Region.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Which of the following EBS volume types can be used as boot volumes when you create EC2 instances?

a. gp2, gp3, io1, io2
b. gp2, gp3, st1, sc1
c. io1, io2, st1, sc1

A

a. gp2, gp3, io1, io2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is EBS Multi-Attach?

a. attach the same EBS volume to multiple EC2 instances in multiple AZs
b. attach multiple EBS volumes in the same AZ to the same EC2 instance.
c. attach the same EBS volume to multiple EC2 instances in the same AZ.
d. attach multiple EBS volumes in multiple AZs to the same EC2 instance

A

c. attach the same EBS volume to multiple EC2 instances in the same AZ

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

You have provisioned an 8TB gp2 EBS volume and you are running out of IOPS. What is NOT a way to increase performance?

a. mount EBS volumes in RAID 0
b. change to an io1 volume type
c. increase the EBS volume size

A

c. increase the EBS volume size

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

You have a fleet of EC2 instances distributed across AZs that process a large data set. What do you recommend to make the same data to be accessible as an NFS drive to all of your EC2 instances?

a. use an instance store
b. use EBS
c. use EFS

A

c. use EFS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

You would like to have a high-performance local cache for your application hosted on an EC2 instance. You don’t mind losing the cache upon the termination of your EC2 instance. Which storage mechanism do you recommend as a Solutions Architect?

a. instance store
b. EBS
c. EFS

A

a. instance store

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

You are running a high-performance database that requires and IPS of 310,000 for its underlying storage. What do you recommend?

a. use an EC2 Instance store
b. use an EBS gp2 drive
c. use an EBS io1 drive
d. use an EBS io2 Block Express drive

A

a. use an EC2 instance store

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Scaling an EC2 instance from r4.large to r4.4xlarge is called _____.

a. horizontal scalability
b. vertical scalability

A

b. vertical scalability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Running an application on an Auto Scaling Group that scales the number of EC2 instance in and out is called ____.

a. vertical scalability
b. horizontal scalability

A

b. horizontal scalability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Elastic Load Balancers provide a ____.

a. static IPv4 we can use in our application
b. static DNS name we can use in our application
c. static IPv6 we can use in our application

A

b. static DNS name we can use in our application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

You are running a website on 10 EC2 instances fronted by an Elastic Load Balancer. Your users are complaining about the fact that the website always asks them to re-authenticate when they are moving between website pages. You are puzzled because it’s working just fin on your machine and in the Dev environment with 1 EC2 instance. What could be the reason?

a. The elastic load balancer does not have Sticky Sessions enabled.
b. your website must have an issue when hosted on multiple EC2 instances.
c. The ec2 instances log out users as they cant see their IP addresses, instead, they receive ELB IP addresses.

A

a. The elastic load balancer does not have Sticky Sessions enabled.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

You are using an Application Load Balancer to distribute traffic to your website hosted on EC2 instances. It turns out that your website only sees traffic coming from private IPv4 addresses which are in fact your Application Load Balancer’s IP addresses. What should you do to get the IP address of clients connected to your website?

a. modify your website’s frontend so that users send their IP in every request.
b. modify your website’s backend to get the client IP address from X-Forwarded-For header
c. modify your website’s backend to get the client IP address from X-Forwarded-Port header
d. modify your website’s backend to get the client IP address from X-Forwarded-Proto header

A

b. modify your website’s backend to get the client IP address from X-Forwarded-For header

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

You hosted an application on a set of EC2 instances fronted by an Elastic load balancer. A week later, users begin complaining that sometimes the application just doesn’t work. You investigate the issue and found that some EC2 instances crash from time to time. What should you do to protect users from connecting to the EC2 instances that are crashing?

a. Enable ELB stickiness
b. enable SSL Termination
c. enable ELB health checks
d. enable Cross-Zone Load Balancing

A

c. enable ELB health checks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

You are working as a Solutions Architect for a company and you are required to design an architecture for a high-performance, low-latency application that will receive millions of requests per second. Which type of Elastic Load Balancer should you choose?

a. Application Load Balancer
b. Classic Load Balancer
c. Network Load Balancer

A

c. Network Load Balancer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Application Load Balancers support the following protocols, EXCEPT:

a. HTTP
b. HTTPS
c. WebSocket
d. TCP

A

d. TCP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Application Load Balancers can route traffic to different Target Groups based on the following EXCEPT:

a. hostname
b. client’s location (geography)
c. request URL path
d. source IP address

A

b. client’s location (geography)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Registered targets in a Target Group for an Application Load Balancer can be one of the following EXCEPT:

a. network load balancer
b. lambda functions
c. private IP addresses
d. EC2 instances

A

a. network load balancer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

For compliance purposes, you would like to expose a fixed static IP address to your end-users so that they can write firewall rules that will be stable and approved by regulators. What type of Elastic Load Balancer would you choose?

a. Application Load Balancer with an Elastic IP attached to it
b. Network Load Balancer
c. Classic Load Balancer

A

b. Network Load Balancer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

You want to create a customer applciaton-based cookie in your Application Load Balancer. Which of the following can you use as a cookie name?

a. AWSALBAPP
b. AWSALBTG
c. APPUSERC
d. AWSALB

A

c. APPUSERC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

You have a Network Load Balancer that distributes traffic across a set of EC2 instances in us-east-1. You have 2 EC2 instances in us-east-1b AZ and 5 EC2 instances in us-east-1e AZ. You have noticed that the CPU utilization is higher in the EC2 instances in us-east-1b AZ. After more investigation, you noticed that the traffic is equally distributed across the two AZs. How would you solve this problem?

a. enable Sticky Sessions
b. enable Cross-Zone Load Balancing
c. enable ELB Health Checks
d. enable SSL termination

A

b. enable Cross-Zone Load Balancing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Which feature in both Application Load Balancers and Network Load Balancers allows you to load multiple SSL certificates on one listener?

a. Server Name Indication (SNI)
b. TLS Termination
c. Host Headers
d. SSL Security Policies

A

a. Sever Name Indication (SNI)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

You have an Application Load Balancer that is configured to redirect traffic to 2 Target Groups based on the following hostnames: users.example.com, api.external.example.com, and checkout.example.com. You would like to configure HTTPS for each of these hostnames. How do you configure the ALB to make this work?

a. use an HTTP to HTTPS redirect rule
b. use a security group SSL certificate
c. use Server Name Indication (SNI)

A

c. user Server Name Indication (SNI)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

You have an application hosted on a set of EC2 instances managed by an Auto Scaling Group that you configured both desired and maximum capacity to 3. Also, you have created a CloudWatch Alarm that is configured to scale out your ASG when CPU Utilization reaches 60%. Your application suddenly received huge traffic and is now running at 80% CPU Utilization. What will happen?

a. the desired capacity will go up to 4 and the maximum capacity will stay at 3.
b. nothing
c. the desired capacity will go up to 4 and the maximum capacity will stay at 4

A

b. nothing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

You have an Auto Scaling Group frontend by an Application Load Balancer. You have configured the ASG to use ALB Health Checks, then one EC2 instance has just been reported unhealthy. What will happen to the EC2 instance?

a. the ASG will keep the instance running and re-start the applciaton.
b. the ASG will detach the EC2 instance and leave it running
c. the ASG will terminate the EC2 instance

A

c. the ASG will terminate the EC2 instance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Your boss asked you to scale your ASG based on the number of requests per minute your application makes to your database. What should you do?

a. You politely tell him it’s impossible
b. create a CloudWatch custom metric then create a CloudWatch Alarm on this metric to scale your ASG
c. enable Detailed Monitoring then create a CloudWatch Alarm to scale your ASG

A

b. create a CloudWatch custom metric then create a CloudWatch Alarm on this metric to scale your ASG

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

A web application hosted on a fleet of EC2 instances managed by an ASG. You are exposing the application through an ALB. Both the EC2 instances and the ALB are deployed on a VPC with the following CIDR 192.168.0.0/18. How do you configure the EC2 instances’ security group to ensure only the ALB can access them on port 80?

a. add an inbound rule with port 80 and 0.0.0.0/0 as the source
b. add an inbound rule with port 80 and 192.168.0.0/18 as the source
c. add an inbound rule with port 80 and the ALB’s Security Group as the source
d. load an SSL certificate on the ALB

A

c. add an inbound rule with port 80 and the ALB’s Security Group as the source

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

An application is deployed with an ALB and an ASG. Currently, you manually scale the ASG and you would like to define a Scaling Policy that will ensure the average number of connections to your EC2 instances is around 1000. Which Scaling Policy should you use?

a. simple scaling policy
b. step scaling policy
c. scheduled scaling policy
d. target tracking policy

A

d. target tracking policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Your application hosted on EC2 instances by and ASG suddenly receives a spike in traffic which triggers your ASG to scale out and a new EC2 instance has been launched. The traffic continuously increases but the ASG doesn’t launch any new EC2 instances immediately but after 5 minutes. What is a possible cause for this behavior?

a. cooldown period
b. lifecycle hooks
c. target tracking policy
d. launch template

A

a. cooldown period

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Amazon RDS supports the following databases, EXCEPT:

a. MongoDB
b. MySQL
c. MariaDB
d. Microsoft SQL Server

A

a. MongoDB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

You’re planning for a new solution that requires a MySQL database that must be available even in case of a disaster in one of the Availability Zones. What should you use?

a. Create Read Replicas
b. Enable Encryption
c. Enable Multi-AZ

A

c. Enable Multi-AZ

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

We have an RDS database that struggles to keep up with the demand of requests from our website. Our million users mostly read news, and we don’t post news very often. Which solution is NOT adapted to this problem?

a. an ElastiCache Cluster
b. RDS Multi-AZ
c. RDS Read Replicas

A

b. RDS Multi-AZ

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

You have set up read replicas on your RDS database, but users are complaining that upon updating their social media posts, they do not see their updated posts right away. What is a possible cause for this?

a. There must be a bug in your application
b. Read Replicas have Asynchronous Replication, therefore it’s likely your users will only read Eventual Consistency
c. You should have setup Multi-AZ instead.

A

b. Read Replicas have Asynchronous Replication, therefore it’s likely your users will only read Eventual Consistency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Which RDS (NOT Aurora) feature when used does not require you to change the SQL connection string?

a. Read Replicas
b. Multi-AZ

A

b. Multi-AZ

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Your application running on a fleet of EC2 instances managed by an ASG behind an ALB. Users have to constantly log back in and you don’t want to enable Sticky Sessions on your ALB as you fear it will overload some EC2 instances. What should you do?

a. Use your own custom Load Balancer on EC2 instances instead of using ALB
b. Store session data in RDS
c. Store session data in ElastiCache
d. Store session data in a shared EBS volume

A

c. Store Session data in ElastiCache

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

An analytics application is currently performing its queries against your main production RDS database. These queries run at any time of the day and slow down the RDS database which impacts your users’ experience. What should you do to improve the users’ experience?

a. setup a read replica
b. setup Multi-AZ
c. run the analytics queries at night

A

a. setup a read replica

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

You are running an ElastiCache Redis cluster which you want to ensure it is high available. What should you do?

a. add read replicas
b. enable mulit-az

A

a. add read replicas

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

How can you enhance the security of your ElastiCache Redis Cluster by forcing users to enter a password when they connect?

a. Use Redis Auth
b. Use IAM Auth
c. Use Security Groups

A

a. Use Redis Auth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Your company has a production Node.js application that is using RDS MySQL 5.6 as its database. A new application programmed in Java will perform some heavy analytics workload to create a dashboard on a regular hourly basis. What is the most cost-effective solution you can implement to minimize disruption for the main application?

a. Enable Multi-AZ for the RDS database and run the analytics workload on the standby database.
b. Create a Read Replica in a different AZ and run the analytics workload on the replica database
c. Create a Read Replica in a different AZ and run the analytics workload on the source database

A

b. Create a Read Replica in a different AZ and run the analytics workload on the replica database.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

You would like to create a disaster recovery strategy for your RDS PostgreSQL database so that in case of regional outage the database can be quickly made available for both read and write workloads in another AWS Region. The DR database must be highly available. what do you recommend?

a. create a read replica in the same region and enable multi-az on the main database.
b. create a read replica in the same region and enable multi-az on the read replica
c. create a read replica in a different region and enable multi-az and the read replica
d. enable multi-region option on the main database

A

c. create a read replica in a different region and enable multi-az and the read replica

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

You have migrated the MySQL database from on-premises to RDS. You have a lot of applications and developers interacting with your database. Each developer has an IAM user in the company’s AWS account. What is a suitable approach to give access to developers to the MySQL RDS DB instance instead of creating a DB user for each one?

a. enable IAM Database Authentication
b. user Amazon Cognito
c. by default IAM users have access to your RDS database

A

a. enable IAM Database Authenticaiton

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Which of the following statement is true regarding replication in both RDS Read Replica and Multi-AZ?

a. read replica uses Asynchronous Replication and Multi-AZ uses Asynchronous Replication
b. read replica uses synchronous replication and multi-az uses asynchronous replication
c. read replica uses synchronous replication and multi-az uses synchronous replication
d. read replica uses asynchronous replication and multi-az uses synchronous replication

A

d. read replica uses asynchronous replication and multi-az uses synchronous replication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

How do you encrypt an unencrypted RDS DB Instance?

a. do it straight from AWS Console, select RDS DB instance, choose Actions then Encrypt using KMS
b. create a snapshot of the unencrypted RDS DB instance, copy the snapshot and tick “Enable encryption”, then restore the RDS DB instance from the encrypted snapshot
c. Do it straight from AWS Console, after stopping the RDS DB instance

A

b. create a snapshot of the unencrypted RDS DB instance, copy the snapshot and tick “Enable encryption”, then restore the RDS DB instance from the encrypted snapshot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

For your RDS database, you can have up to ___ read replicas.

a. 3
b. 5
c. 7

A

b. 5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

Which RDS database technology does NOT support IAM Database Authentication?

a. Oracle
b. PostgreSQL
c. MySQL

A

a. Oracle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

Yes or No: You have an unencrypted RDS DB instance and you want to create read replicas. Can you configure the RDS read replicas to be encrypted?

A

No

69
Q

How many Aurora Read Replicas can you have in a single Aurora DB Cluster?

a. 5
b. 10
c. 15

A

c. 15

70
Q

Amazon Aurora supports both ____ databases

a. MySQL and MariaDB
b. Oracle and MariaDB
c. MySQL and PostgreSQL
d. Oracle and MS SQL Server

A

c. MySQL and PostgreSQL

71
Q

What is the maximum number of read replicas you can add in an ElastiCache Redis Cluster with Cluster-Mode Disabled?

a. 3
b. 4
c. 5

A

c. 5

72
Q

You have an ElastiCache Redis Cluster that serves a popular application. You have noticed that there are a large number of requests that go to the database because a large number of items are removed from the cache before they expire. What is this called and how to solve it?

a. Cache Evictions, Scale up or out your ElastiCache Redis Cluster
b. Cache Invalidations, Scale up or out your ElastiCache Redis Cluster
c. Cache Evictions, Scale down or in your ElastiCache Cluster
d. Cache Invalidations, Scale down or in your ElastiCache Cluster

A

a. Cache Evictions, Scale up or out your ElastiCache Redis Cluster

73
Q

You have a MySQL RDS database instance on which you want to enforce SSL connections. What should you do?

a. modify your DB security group to only allow SSL traffic
b. download SSL certificates form your DB, then use these certificates in your application to connect over SSL
c. enable MySQL RDS Database Encryption
d. Execute a REQUIRE SSL SQL statement to all your DB users

A

d. Execute a REQUIRE SSL SQL statement to all your DB users

74
Q

You have an ElastiCache cluster with small cache size, so you want to ensure that only the data that’s requested will be loaded into the cluster. Which caching strategy should you use?

a. write through
b. lazy loading
c. time-to-live(TTL)

A

b. lazy loading

75
Q

You’re hosting a dynamic website fronted by an ElastiCache Cluster. You have been instructed to keep latency to a minimum for all read requests for every user. Also, writes can take longer to happen. Which caching strategy do you recommend?

a. Cache Aside
b. Time-To-Live (TTL)
c. Write Through

A

c. Write Through

76
Q

You have purchased mycoolcompany.com on Amazon Route 53 Registrar and would like the domain to point to your Elastic Load Balancer my-elb-1234567890.us-west-2.elb.amazonaws.com. Which Route 53 Record type must you use here?

a. CNAME
b. Alias

A

b. Alias

77
Q

You have deployed a new Elastic Beanstalk environment and would like to direct 5% of your production traffic to this new environment. This allows you to monitor for CloudWatch metrics and ensuring that no bugs exists with your new environment. Which Route 53 Record type allows you to do so?

a. simple
b. weighted
c. latency
d. failover

A

b. weighted

78
Q

You have updated a Route 53 Record’s myapp.mydomain.com value to point to a new Elastic Load Balancer, but it looks like users are still redirected to the old ELB. What is a possible cause for this behavior?

a. Because of the Alias Record
b. Because of the CNAME Record
c. Because of the TTL
d. Because of the Route 53 Health Checks

A

c. Because of the TTL

79
Q

You have an application that’s hosted in two different AWS Regions us-west-1 and eu-west-2. You want your users to get the best possible user experience by minimizing the response time from application servers to your users. Which Route 53 Routing Policy should you choose?

a. latency
b. multi value
c. weighted
d. geolocation

A

a. latency

80
Q

You have a legal requirement that people in any country but France should NOT be able to access your website. Which Route 53 Routing Policy helps you in achieving this?

a. latency
b. simple
c. multi value
d. geolocation

A

d. geolocation

81
Q

You have purchased a domain on GoDaddy and would like to use Route 53 as the DNS Service Provider. What should you do to make this work?

a. Request for a domain transfer
b. Create a Private Hosted Zone and update the 3rd party Registrar NS records
c. Create a Public Hosted Zone and update the 3rd party Registrar NS records
d. Create a Public Hosted Zone and update the Route 53 NS records

A

c. Create a Public Hosted Zone and update the 3rd party Registrar NS records

82
Q

Which of the following are NOT valid Route 53 Health Checks?

a. Health Check that monitor SQS Queue
b. Health Check that monitors an Endpoint
c. Health Check that monitors other Health Checks
d. Health Check that monitor CloudWatch Alarms

A

a. Heath Check that monitor SQS Queue

83
Q

Security Groups operate at the ____ level while NACLs operate at the ____ level.

a. EC2 instance, Subnet
b. Subnet, EC2 instance

A

a. EC2 instance, Subnet

84
Q

You have attached an Internet Gateway to your VPC, but your EC2 instances still don’t have access to the internet. What is NOT a possible issue?

a. Route Tables are missing entries
b. the EC2 instances don’t have public IP’s
c. the Security Group does not allow traffic in
d. the NACL does not allow network traffic out

A

c. the security group does not allow traffic in

85
Q

You would like to provide internet access to your EC2 instances in private subnets with IPv4 while making sure this solution requires the least amount of administration and scales seamlessly. What should you use?

a. NAT instances with source/destination check flag off
b. NAT Gateway
c. Egress only Internet Gateway

A

b. NAT Gateway

86
Q

When using VPC Endpoints, what are the only two AWS services that have a Gateway Endpoint available?

a. Amazon S3 & Amazon SQS
b. Amazon SQS & DynamoDB
c. Amazon S3 & DynamoDB

A

c. Amazon S3 & DynamoDB

87
Q

You have 3 VPCs A, B, and C. You want to establish a VPC Peering connection between all the 3 VPCs. What should you do?

a. Establish 3 VPC Peering connections (A-B, A-C, B-C)
b. As VPC Peering supports Transitive Peering, so you need to establish 2 VPC Peering connections (A-B, B-C)

A

a. Establish 3 VPC Peering connections (A-B, A-C, B-C)

88
Q

How can you capture information about IP traffic inside your VPCs?

a. enable VPC Traffic Monitoring
b. enable VPC Flow Logs
c. enable CloudWatch Traffic Logs

A

b. enable VPC Flow Logs

89
Q

You need to set up a dedicated connection between your on-premises corporate datacenter and AWS Cloud. This connection must be private, consistent, and traffic must not travel through the internet. Which AWS service should you use?

a. Site-to-Site VPN
b. AWS PrivateLink
c. Amazon EventBridge
d. AWS Direct Connect

A

d. AWS Direct Connect

90
Q

You have a 25 GB file that you’re trying to upload to S3 but you’re getting errors. What is a possible solution for this?

a. the file size limit on S3 is 5 GB
b. update your bucket policy to allow the larger file
c. use multi-part upload when uploading files larger than 5GB
d. encrypt the file

A

c. use multi-part upload when uploading files larger than 5GB

91
Q

You’re getting errors while trying to create a new S3 bucket named dev. You’re using a new AWS Account with no S3 buckets created before. What is a possible cause for this?

a. You’re missing IAM permissions to create an S3 bucket
b. S3 bucket names must be globally unique and dev is already taken

A

b. S3 bucket names must be globally unique and dev is already taken

92
Q

You have enabled versioning in your S3 bucket which already contains a lot of files. Which version will the existing files have?

a. 1
b. 0
c. -1
d. null

A

d. null

93
Q

Your client wants to make sure that file encryption is happening in S3, but he wants to fully manage the encryption keys and never store them in AWS. You recommend him to use ____.

a. SSE-S3
b. SSE-KMS
c. SSE-C
d. Client-Side Encryption

A

c. SSE-C

94
Q

A company you’re working for wants their data store in S3 to be encrypted. They don’t mind the encryption keys stored and managed by AWS, but they want to maintain control over the rotation policy of the encryption keys. You recommend them to use ____.

a. SSE-S3
b. SSE-KMS
c. SSE-C
d. Client-Side Encryption

A

b. SSE-KMS

95
Q

Your company does not trust AWS for the encryption process and wants it to happen on the application. You recommend them to use ____.

a. SSE-S3
b. SSE-KMS
c. SSE-C
d. Client-Side Encryption

A

d. Client-Side Encryption

96
Q

You have updated an S3 bucket policy to allow IAM users to read/write files in the S3 bucket, but one of the users complain that he can’t perform a PutObject API call. What is a possible cause for this?

a. The S3 bucket policy must be wrong
b. The user is lacking permissions
c. The IAM user must have an explicit DENY in the attached IAM Policy
d. You need to contact AWS Support to lift this limit

A

c. The IAM user must have an explicit DENY in the attached IAM Policy

97
Q

You have a website that loads files from an S3 bucket. When you try the URL of the files directly in your Chrome browser it works, but when the website you’re visiting tries to load these files it doesn’t. What’s the problem?

a. the bucket policy is wrong
b. the IAM policy is wrong
c. Encryption is wrong
d. CORS is wrong

A

d. CORS is wrong

98
Q

Which S3 encryption method mandates that you use HTTPS while uploading/download objects?

a. SSE-C
b. SSE-S3
c. SSE -KMS
d. Client-Side Encryption

A

a. SSE-C

99
Q

An application hosted on an EC2 instance wants to upload objects to an S3 bucket using the PutObject API call, but it lacks the required permissions. What should you do?

a. From inside the EC2 instance, run “aws configure” and insert your personal IAM Credentials, because you have access to do the required API call.
b. Ask an administrator to attach an IAM Policy to the IAM Role on your EC2 instance that authorizes it to do the required API call.
c. Export the environment variables with your IAM credentials on the EC2 instance.
d. use the EC2 Metadata API call

A

b. Ask an administrator to attach an IAM Policy to the IAM Role on your EC2 instance that authorizes it to do the required API call.

100
Q

You and your colleague are working on an application that’s interacting with some AWs services through making API calls. Your colleague can run the application on his machine without issues, while you get API Authorization Exceptions What should you do?

a. send him your AWS Access Key and Secret Access Key so he can replicate the issue on his machine
b. ask him to send you his IAM credentials so you can work without issues.
c. Compare both your IAM Policy and his IAM Policy in AWS Policy Simulator to understand the differences
d. Ask him to create an EC2 Instance and insert his IAM credentials inside it, so you can run the application from the EC2 instance.

A

c. Compare both your IAM Policy and his IAM Policy in AWS Policy Simulator to understand the differences

101
Q

Your administrator launched a Linux EC2 instance ang gives you the EC2 Key Pair so you can SSH into it. After getting into the EC2 instance, you want to get the EC2 instance ID. What is the best way to do this?

a. create an IAM Role and attach it to your EC2 instance so you can perform a “describe-instances” API call
b. Query the user data at http://169.254.169.254/latest/user-data
c. Query the metadata at http://254.169.254.169/latest/meta-data
d. Query the metadata at http://169.254.169.254/latest/meta-data

A

d. Query the metadata at http://169.254.169.254/latest/meta-data

102
Q

AWS CLI requires _____ as its runtime.

a. Java
b. Golang
c. Python
d. C#

A

c. Python

103
Q

You’re running an application on an on-premises server. The application needs to perform API calls to an S3 bucket. How can you achieve this in the most secure manner?

a. create an IAM user to be used by the application, then generate IAM credentials and put the credentials into environment variables
b. from inside your on-premises server, run “aws configure” and insert your personal IAM Credentials
c. Create an IAM user to be used by the application, then generate IAM credentials and use the credentials in the application’s code
d. attach an IAM role to your on-premises server

A

a. create an IAM user to be used by the application, then generate IAM credentials and put the credentials into environment variables

104
Q

When you have an IAM role attached to your EC2 instance and you run AWS CLI commands from inside this instance, AWS CLI uses the ______ to get _____ credentials.

a. instance user data, temporary
b. instance metadata, temporary
c. instance user data, permanent
d. instance metadata, permanent

A

b. instance metadata, temporary

105
Q

You have created an IAM role with the required IAM permissions to make API calls to get sensitive files stored in an S3 bucket. You have attached the newly created IAM role to an EC2 instance an you want to test whether you can download these files from inside the EC2 instance. What should you do to make your tests without changing the parameters’ values as they’re critical?

a. use IAM Policy simulator or the Instance metadata
b. use “–dry-run” AWS CLI option or the Instance metadata
c. use IAM Policy simulator or the “–dry-run” AWS CLI option

A

c. use IAM Policy simulator or the “–dry-run” AWS CLI option

106
Q

True or False: When an IAM role is attached to your EC2 instance, you can retrieve both the IAM role name and the IAM policies attached to the role.

A

False

107
Q

While performing EC2 API calls from inside your EC2 instance, you received the following authorization exception: vbguZQ1pz421h4rtSaXnEfDAZPii8X…..
How can you decode this encrypted error message?

a. contact AWS Support as they’re the only ones who can decode these messages.
b. use the EC2 decode-authorization-message API call
c. use the IAM decode-authorization-message API call
d. use the STS decode-authorization-message API call

A

d. use the STS decode-authorization-message API call

108
Q

The last AP calls you made to AWS KMS begin to throttle, as you have reached the max allowed API calls per second. What should you do?

a. make API calls every 10 ms
b. use exponential Backoff Strategy
c. use-linear backoff strategy

A

b. use exponential backoff strategy

109
Q

Before making API calls against MFA-protected API, you should use ____ to get temporary credentials.

a. STS GetSessionToken
b. STS GetFederationToken
c. IAM GetMFAToken

A

a. STS GetSessionToken

110
Q

AWS CLI uses credentials located in multiple locations and certain locations take precedence over others. Which of the following is the correct order for locations AWS CLI uses to find credentials?

a. environment variables -> command line options -> ec2 Instance Profile
b. command line options -> environment variables -> ec2 instance profile
c. ec2 instance profile -> command line options -> environment variables
d. ec2 instance profile -> environment variables -> command line options

A

b. command line options -> environment variables -> ec2 instance profile

111
Q

AWS CLI and AWS SDKs sign API requests for you using your AWS access key. If you’re writing your custom code, you must sign AWS API requests using ______.

a. signature version 1 (SigV1)
b. signature version 2 (SigV2)
c. signature version 3 (SigV3)
d. signature version 4 (SigV4)

A

d. signature version 4 (SigV4)

112
Q

You have enabled versioning and want to be extra careful when it comes to deleting files on an S3 bucket. What should you enable to prevent accidental permanent deletions?

a. use a bucket policy
b. encrypt the files
c. enable mfa delete
d. disable versioning

A

c. enable mfa delete

113
Q

You would like all your files in an S3 bucket to be encrypted by default. What is the optimal way of achieving this?

a. use a bucket policy that forces HTTPS connections
b. enable default encryption
c. enable versioning

A

b. enable default encryption

114
Q

You suspect that some of your employees try to access files in an S3 bucket that they don’t have access to. How can you verify this is indeed the case without them noticing?

a. restrict their IAM policies and look at CloudTrail logs
b. use a bucket policy
c. enable S3 Access Logs and analyze them using Athena

A

c. enable S3 Access Logs and analyze them using Athena

115
Q

You want the content of an S3 bucket to be fully available in different AWS Regions. That will help your team perform data analysis at the lowest latency and cost possible. What S3 feature should you use?

a. Amazon CloudFront Distributions
b. S3 Replication
c. S3 versioning
d. S3 Static Website hosting

A

b. S3 Replication

116
Q

You have 2 S3 buckets. One source bucket A, and two destination buckets B and C in different AWS Regions. You want to replicate objects from bucket A to both bucket B and C. How would you achieve this?

a. configure replication from bucket A to bucket B, then from bucket A to bucket C.
b. Configure replication from bucket A to bucket B, then from bucket B to bucket C.
c. configure replication from bucket A to bucket C, then from bucket C to bucket B.

A

a. configure replication from bucket A to bucket B, then from bucket A to bucket C.

117
Q

Which of the following is NOT a Glacier Deep Archive retrieval mode?

a. Standard (12 hrs)
b. Expedited (1-5 minutes)
c. Bulk (48 hrs)

A

b. Expedited (1-5 minutes)

118
Q

How can you be notified when there’s an object uploaded to your S3 bucket?

a. S3 Select
b. S3 Access Logs
c. S3 Event Notifications
d. S3 Analytics

A

c. S3 Event Notifications

119
Q

You are looking to provide temporary URLs to a growing list of federated users to allow them to perform a file upload on your S3 bucket to a specific location. What should you use?

a. S3 CORS
b. S3 Pre-signed URL
c. S3 Bucket Policies
d. IAM Users

A

b. S3 Pre-signed URL

120
Q

You have an S3 bucket that has S3 Versioning enabled. This S3 bucket has a lot of objects, and you would like to remove old object versions to reduce costs. What’s the best approach to automate the deletion of these old object version?

a. S3 Lifecycle Rules - Expiration Actions
b. S3 Lifecycle Rules - Transition Actions
c. S3 Access Logs

A

a. S3 Lifecycle Rules - Expiration Actions

121
Q

How can you automate the transition of S3 objects between their different tiers?

a. AWS Lambda
b. CloudWatch Events
c. S3 Lifecycle Rules

A

c. S3 Lifecycle Rules

122
Q

Which of the following is NOT a Glacier Flexible retrieval mode?

a. Expedited (1-5 min)
b. Standard (3-5 hrs)
c. Bulk (5-12 hrs)
d. Instant (10 secs)

A

d. Instant (10 secs)

123
Q

While you’re uploading large files to an S3 bucket using Multi-part Upload, there are a lot of unfinished parts stored in the S3 bucket due to network issues. You are not using these unfinished parts and they cost you money. What is the best approach to remove these unfinished parts?

a. Use AWS Lambda to loop on each old/unfinished part and delete them
b. Use and S3 Lifecycle Policy to automate old/unfinished parts deletion
c. Request AWS Support to help you delete old/unfinished parts

A

b. Use and S3 Lifecycle Policy to automate old/unfinished parts deletion

124
Q

Which of the following is a Serverless data analysis service allowing you to query data in S3?

a. S3 Analytics
b. Redshift
c. Athena
d. RDS

A

c. Athena

125
Q

You are looking to build an index of your files in S3, using Amazon RDS PostgreSQL. To build this index, tit is necessary to read the first 250 bytes of each object in S3, which contains some metadata about the content of the file itself. There are over 100,000 files in your S3 bucket, amounting to 50 TB of data, how can you build this index efficiently?

a. use the RDS import feature to load the data from S3 to PostgreSQL, and run a SQL query to build the index
b. Create an application that will traverse the S3 bucket, issue a Byte Range Fetch for the first 250 bytes, and store that information in RDS.
c. Create an application that will traverse the S3 bucket, read all the files one by one, extract the first 250 bytes, and store that information in RDS.
d. Create an application that will traverse the S3 bucket, use S3 Select to get the first 250 bytes, and store that information in RDS.

A

b. Create an application that will traverse the S3 bucket, issue a Byte Range Fetch for the first 250 bytes, and store that information in RDS.

126
Q

You have a large dataset stored on-premises that you want to upload to the S3 bucket. The dataset is divided into 10GB files. You have good bandwidth but your internet connection isn’t stable. What is the best way to upload this dataset to s3 and ensure that the process is fast and avoid any problems with the internet connection?

a. use S3 multi-part upload & S3 Transfer Acceleration
b. Use S3 Select & use S3 Transfer Acceleration
c. use multi-part upload only

A

a. use S3 multi-part upload & S3 Transfer Acceleration

127
Q

You would like to retrieve a subset of your dataset store in S3 with the CSV format. You would like to retrieve a month of data and only 3 columns out of 10, to minimize compute and network costs. What should you use?

a. S3 Inventory
b. S3 Select
c. S3 Analytics
d. S3 Access Logs

A

b. S3 Select

128
Q

You have a paid content that is stored in the S3 bucket. You want to distribute the content globally, so you have set up a CloudFront Distribution and configured the S3 bucket to only exchange data with your CloudFront Distribution. Which CloudFront feature allows you to securely distribute this paid content?

a. Origin Access Identity
b. S3 Pre-Signed URL
c. CloudFront Signed URL
d. CloudFront Invalidation

A

c. CloudFront Signed URL

129
Q

You have a CloudFront Distribution that serves your website hosted on a fleet of EC2 instances behind an Application Load Balancer. All your clients are from the United States, but you found that some malicious requests are coming from other countries. What should you do to only allow users from the US and block other countries?

a. User Origin Access Identity
b. Use CloudFront Geo Restriction
c. set up a security group and attach it to your CloudFront Distribution
d. Use a Route 53 Latency record and attach it to CloudFront

A

b. Use CloudFront Geo Restriction

130
Q

You have a static website hosted on an S3 bucket. You have created a CloudFront Distribution that points to your S3 bucket to better serve your requests and improve performance. After a while, you noticed that users can still access your website directly from the S3 bucket. You want to enforce users to access the website only through CloudFront. How do you achieve that?

a. Configure your CloudFront Distribution and create an Origin Access Identity, then update your S3 Bucket Policy to only accept requests from your CloudFront Distribution OAI user.
b. Send an email to your clients and tell them to not use the S3 endpoint
c. Use S3 Access Points to redirect clients to CloudFront

A

a. Configure your CloudFront Distribution and create an Origin Access Identity, then update your S3 Bucket Policy to only accept requests from your CloudFront Distribution OAI user.

131
Q

A website is hosted on a set of EC2 instance fronted by an Application Load Balancer. You have created a CloudFront Distribution and set up its origin to point to your ALB. What should you use to provide access to hundreds of private files served by your CloudFront distribution?

a. CloudFront Signed URLs
b. CloudFront Origin Access Identity
c. CloudFront HTTPS Encryption
d. CloudFront Signed Cookies

A

d. CloudFront Signed Cookies

132
Q 
What does this S3 bucket policy do?
{
    "Version": "2012-10-17",
    "Id": "Mystery Policy",
    "Statement": [ {
          "Sid": "What could it be?",
          "Effect": "Allow",
          "Principal": { "CanonicalUser": "CloudFront Origin Identity Canonical User ID" },
          "Action": "s3:GetObject",
          "Resource": "arn:aws:s3:::examplebucket/*"
    }]
}

a. Forces GetObject request to be encrypted if coming from CloudFront
b. Only allows the S3 bucket content to be accessed from your CloudFront Distribution Origin Access Identity
c. Only allows GetObject type of request on the S3 bucket from anybody

A

b. Only allows the S3 bucket content to be accessed from your CloudFront Distribution Origin Access Identity

133
Q

You have a React Single Page Application hosted on an S3 Bucket and served through CloudFront Distribution. You have made an update to your React application an pushed it to S3, but the old version is still cached at CloudFront, and clients still see the old version. You want the new update to be propagated immediately. What would you do?

a. use CloudFront Invalidation
b. delete and create a new CloudFront Distribution
c. tell your clients to remove cache from their browsers or use Incognito Mode

A

a. use CloudFront Invalidation

134
Q

You are hosting highly dynamic content in an S3 bucket in the us-east-1 region. You want to make this data to be available with low latency in Singapore’s ap-southeast-1 region. What do you recommend?

a. Amazon CloudFront
b. S3 Cross-Region Replication
c. S3 Pre-Signed URLs

A

b. S3 Cross-Region Replication

135
Q

Using a CloudFront Distribution, you can cache based on the following, except ______.

a. HTTP Headers
b. HTTP Cookies
c. Query String Parameters
d. HTTP Methods

A

d. HTTP Methods

136
Q

When you’re configuring a CloudFront distribution to use Signed URLs/Cookies, it is recommended to use ______ signer instead of ______ signer.

a. trusted key group, CloudFront key pair
b. CloudFront key pair, Trusted key group

A

a. trusted key group, CloudFront key pair

137
Q

You have multiple Docker-based applications hosted on-premises that you want to migrate to AWS. You don’t want to provision or manage any infrastructure, you just want to run your containers on AWS. Which AWS Service should you choose?

a. Elastic Container Service (ECS)
b. Elastic Container Registry (ECR)
c. AWS Fargate
d. Elastic Kubernetes Service (EKS)

A

c. AWS Fargate

138
Q

Two of the launch types of ECS are:

a. Amazon EC2 Launch Type and Fargate Launch Type
b. Amazon EC2 Launch Type and EKS Launch Type
c. Fargate Launch Type and EKS Launch Type

A

a. Amazon EC2 Launch Type and Fargate Launch Type

139
Q

You have an application hosted on an ECS Cluster (EC2 Launch Type) where you want your ECS tasks to upload files to an S3 bucket. Which IAM Role for your ECS Tasks should you modify?

a. EC2 Instance Profile
b. ECS Task Role

A

b. ECS Task Role

140
Q

You’re planning to migrate a Word Press website running on Docker containers from on-premises to AWS. You have decided to run the application in an ECS Cluster, but you want your Docker containers to access the same WordPress website content such as website files, images, videos, etc. What do you recommend to achieve this?

a. Mount an EFS volume
b. Mound and EBS volume
c. Use and EC2 Instance Store

A

a. Mount and EFS volume

141
Q

You are deploying an application on an ECS Cluster made of EC2 instances. Currently, the cluster is hosting one application that is issuing API calls to DynamoDB successfully. Upon adding a second application, which issues API calls to S3, you are getting authorization issues. What should you do to resolve the problem and ensure proper security?

a. Edit the EC2 instance role to add permission to S3
b. Create and IAM task role for the new application
c. Enable the Fargate mode
d. Edit the S3 bucket policy to allow the ECS task

A

b. Create an IAM task role for the new application

142
Q

Which feature allows an Application Load Balancer to redirect traffic to multiple ECS Tasks running on the same ECS Container instance?

a. Automatic Port Mapping
b. ECS Task Definition
c. ECS Service
d. Dynamic Port Mapping

A

d. Dynamic Port Mapping

143
Q

You are migrating your on-premises Docker-based application to Amazon ECS. You were using Docker Hub Container Image Library as your container image repository. Which is an alternative AWS service which is fully integrated with Amazon ECS?

a. AWS Fargate
b. Elastic Kubernetes Service (EKS)
c. Elastic Container Registry (ECR)
d. Amazon EC2

A

c. Elastic Container Registry (ECR)

144
Q

You have a Classic ECS cluster that you want to enable IAM roles for your ECS tasks so that they can make API requests to AWS Services. Which ECS configuration options should you enable in /etc/ecs/ecs.config?

a. ECS_CLUSTER
b. ECS_ENGINE_AUTH_DATA
c. ECS_AVAILABLE_LOGGING_DRIVERS
d. ECS_ENABLE_TASK_IAM_ROLES

A

d. ECS_ENABLE_TASK_IAM_ROLES

145
Q

You have a CodePipeline pipeline, which contains a build state that uses AWS CodeBuild. This build stage builds your Docker images and pushes them to Amazon ECR. The build stage fails with an authorization issues. What is the issue?

a. Open an AWS Support ticket?
b. Delete and re-create your ECR repositories
c. Double-check your IAM role and permissions for the AWS CodeBuild service
d. You must have an up and running EC2 container instance

A

c. Double-check your IAM role and permissions for the AWS CodeBuild service

146
Q

You are looking to run multiple copies of the same application on the same EC2 instance and expose it with an load balancer. The application is available as a Docker image. You should use _____.

a. Application Load Balancer + ECS
b. Classic Load Balancer + Beanstalk
c. Application Load Balancer + Beanstalk
d. Classic Load Balancer + ECS

A

a. Application Load Balancer + ECS

147
Q

You have a containerized application stored as Docker images in an ECR repository, that you want to run on an ECS cluster. You’re trying to launch two copies of the same Docker container to the same EC2 container instance. The first container successfully starts, but the second container doesn’t. You have checked that there’s enough CPU and RAM on the EC2 container instance. What is the problem here?

a. The EC2 container instance doesn’t have the required IAM permissions to fetch Docker images from the ECR repository.
b. The host port defined in the task definition
c. The container port defined in the task definition
d. EC2 container instances can only run one container instance for each Docker image.

A

b. The host port defined in the task definition

*** To enable random host port, set host port=0 (or empty), which allows multiple containers of the same type to launch on the same EC2 container instance.

148
Q

A newly launched EC2 container instance can’t be registered with your ECS cluster. What is NOT a reason for this issue?

a. the ECS agent is not running
b. the AMI used isn’t the Amazon ECS-optimized AMI
c. the EC2 container instance is missing IAM permissions
d. the security group on the EC2 instance does not allow inbound traffic.

A

d. the security group on the EC2 instance does not allow inbound traffic.

149
Q

You want to pull Docker images from a private ECR repository. Which AWS CLI command can you use?

a. docker login -u $AWS_ACCESS_KEY_ID -p $AWS_SECRET_ACCESS_KEY $ECR_URL
docker pull $ECR_IMAGE_URL

b. docker login -u $AWS_USERNAME -p $AWS_PASSWORD $ECR_URL
docker pull $ECR_IMAGE_URL

c. $(aws ecr get-login –no-include-email)
docker pull $ECR_IMAGE_URL

d. docker build -t $ECR_URL
docker pull $ECR_IMAGE_URL

A

c. $(aws ecr get-login –no-include-email)

docker pull $ECR_IMAGE_URL

150
Q

You have an ECS cluster where you want to run 4 ECS services. Each ECS service needs to interact with various AWS services. Which of the following is the best practice while giving permission to these ECS services?

a. Create an IAM role with 4 IAM policies and attach it to the EC2 instances in the ECS cluster.
b. Create 4 IAM roles and attach them to the EC2 instances in the ECS cluster.
c. Create 1 ECS Task role with 4 policies and attach it to each ECS Task definition.
d. Create 4 ECS Task roles and attach them to the relevant ECS Task definition.

A

d. Create 4 ECS Task roles and attach them to the relevant ECS Task definition.

151
Q

Which ECS Task Placement strategy is the most cost-efficient?

a. spread
b. binpack
c. random

A

b. binpack

152
Q

Which ECS Task Placement constraint allows you to place each ECS Task on a different EC2 container instance?

a. distintInstance
b. memberOf

A

a. distintInstance

153
Q

You’re developing an application and would like to deploy it to Elastic Beanstalk with minimal cost. you should run it in ___.

a. single instance mode
b. high availability mode

A

a. single instance mode

154
Q

Elastic Beanstalk application versions can be deployed to ____.

a. one environment
b. many environments

A

b. many environments

155
Q

You have been tasked to run an application developed using Rust language on Elastic Beanstalk. After checking you found that Rust runtime is not currently supported on Elastic Beanstalk. Which of the following is NOT a solution?

a. Create a custom platform.
b. Install scripts and security software using an EC2 User Data script
c. Use a Docker image with all scripts and security software installed.
d. use a Custom AMI

A

b. Install scripts and security software using an EC2 User Data script

156
Q

True or False: Environments in Elastic Beanstalk must have the following names: dev, test, and prod.

A

False

157
Q

You are developing a new application that’s hosted on Elastic Beanstalk. As you are in the development process you don’t mind downtime so you want your application to be deployed as soon as a new version is available. Which Elastic Beanstalk deployment option should you use?

a. all at once
b. rolling
c. rolling with additional batches
d. immutable

A

a. all at once

158
Q

A company hosting their websites on AWS Elastic Beanstalk. They want a methodology to continuously release new application versions with the ability to roll back very quickly in case if there’s any issues. Also, the application must be running at full capacity while releasing new versions. Which Elastic Beanstalk deployment option do you recommend?

a. all at once
b. rolling
c. rolling with additional batches
d. immutable

A

d. immutable

159
Q

You’re a DevOps engineer working for a startup company hosting their application on Elastic Beanstalk. The application is in its early phases and it has a lot of new updates every week while being used by a number of users. You want to continuously release new features without application downtime and without incurring extra costs. It’s acceptable to temporarily decrease the number of running instances serving users. Which Elastic Beanstalk deployment option should you choose?

a. all at once
b. rolling
c. rolling with additional batches
d. immutable

A

b. rolling

160
Q

Which Elastic Beanstalk deployment option allows you to release new version of your application with minimal added cost while maintaining the full capacity to serve the current users?

a. all at once
b. rolling
c. rolling with additional batches
d. immutable

A

c. rolling with additional batches

161
Q

To improve you application performance, you want to add an ElastiCache cluster to your application hosted on Elastic Beanstalk. What should you do?

a. Manually create an ElastiCache cluster outside of your Elastic Beanstalk and connect to it through using environment variables.
b. Create an elasticache.extensions file at the root of the code zip files and provide appropriate configuration.
c. Create a config.elasticache file in the .ebextensions folder which is at the root of the code zip file and provide appropriate configuration.
d. Create and elasticache.config file in the .ebextensions folder which is at the root of the code zip file and provides appropriate configuration.

A

d. Create and elasticache.config file in the .ebextensions folder which is at the root of the code zip file and provides appropriate configuration.

162
Q

Your deployment on Elastic Beanstalk have been painfully slow. After checking the logs, you realize that this is due to the fact that your application dependencies are resolved on each instance each time you deploy. What can you do to speed up to the deployment process with minimal impact?

a. Resolve the dependencies beforehand and package them in the zip file uploaded to Elastic Beanstalk
b. Remove some dependencies in your code
c. Place the dependencies in an S3 Bucket

A

a. Resolve the dependencies beforehand and package them in the zip file uploaded to Elastic Beanstalk

163
Q

Which AWS service does Elastic Beanstalk use under the hood?

a. AWS OpsWorks
b. AWS CloudFormation
c. AWS Lambda
d. Amazon EC2

A

b. AWS CloudFormation

164
Q

Due to compliance regulations, you have been tasked to enable HTTPS for your application hosted on Elastic Beanstalk. This allows in-flight encryption between your clients and web servers. What must be done to set up HTTPS on Elastic Beanstalk?

a. Use a separate CloudFormation template to load the SSL certificate onto the Application Load Balancer
b. Modify Security Groups to allows inbound traffic on port 80.
c. Create an .ebextension/securelistner-alb.config file to configure the Applicaiton Load Balancer
d. Configure Health Checks

A

c. Create an .ebextension/securelistner-alb.config file to configure the Applicaiton Load Balancer

165
Q

Which feature in Elastic Beanstalk allows you to automate deletions of old application versions so that new application versions can be created?

a. setup an .ebextensions file
b. use a lifecycle policy
c. define a Lambda function
d. use Worker environments

A

b. use a lifecycle policy

166
Q

You’re using Elastic Beanstalk and you would like to schedule tasks to run periodically and asynchronously. These tasks typically take more than 1 hour to complete. Which Elastic Beanstalk environment should you choose?

a. web server environment and a .ebextension file
b. web server environment and a cron.yaml file
c. worker environment and a .ebextension file
d. work environment and a cron.yaml file

A

d. work environment and a cron.yaml file

167
Q

You have created a test environment in Elastic Beanstalk and as part of the environment, you have created an RDS DB instance. How can you make sure the database can be used after you delete the environment

a. Make a selective delete in Elastic Beanstalk
b. Make a snapshot of the RDS DB instance before it gets deleted
c. Change the Elastic Beanstalk environment variables

A

b. Make a snapshot of the RDS DB instance before it gets deleted

168
Q

You’re running an application on Elastic Beanstalk. You have just finished a major update to your application. You want to deploy the new version then direct a small percentage of traffic to the new version so you can test and fall back if there’re any issues. Which Elastic Beanstalk deployment option should you choose?

a. Traffic Splitting
b. Rolling
c. Rolling with Additional Batches
d. Immutable

A

a. Traffic Splitting

169
Q

You have been hired by a company to run some tests on their application hosted on Elastic Beanstalk. You can’t run these tests on the current environment as this is the production environment, so you have to create another environment similar to the one already running. Which Elastic Beanstalk feature allows you to do this?

a. Download the current Elastic Beanstalk environment CloudFormation template, then use it to create another environment.
b. Manually create another environment with the same configuration
c. Elastic Beanstalk Cloning
d. Use Worker Environment

A

c. Elastic Beanstalk Cloning

AWS Certifications (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions