AWS Sample Questions Flashcards
A company is storing an access key (access key ID and secret access key) in a text file on a custom AMI. The company uses the access key to access DynamoDB tables from instances created from the AMI. The security team has mandated a more secure solution.
Which solution will meet the security team’s mandate?
A. Put the access key in an S3 bucket, and retrieve the access key on boot from the instance.
B. Pass the access key to the instances through instance user data.
C. Obtain the access key from a key server launched in a private subnet.
D. Create an IAM role with permissions to access the table, and launch all instances with the new role.
D – IAM roles for EC2 instances allow applications running on the instance to access AWS resources
without having to create and store any access keys. Any solution involving the creation of an access key then introduces the complexity of managing that secret.
A company is developing a highly available web application using stateless web servers. Which
services are suitable for storing session state data? (Select TWO.)
A. CloudWatch B. DynamoDB C. Elastic Load Balancing D. ElastiCache E. Storage Gateway
B, D – Both DynamoDB and ElastiCache provide high performance storage of key-value pairs. CloudWatch and ELB are not storage services. Storage Gateway is a storage service, but it is a hybrid storage service that enables on-premises applications to use cloud storage.
Company salespeople upload their sales figures daily. A Solutions Architect needs a durable storage solution for these documents that also protects against users accidentally deleting important documents.
Which action will protect against unintended user actions?
A. Store data in an EBS volume and create snapshots once a week.
B. Store data in an S3 bucket and enable versioning.
C. Store data in two S3 buckets in different AWS regions.
D. Store data on EC2 instance storage.
B – If a versioned object is deleted, then it can still be recovered by retrieving the final version. Response
A would lose any changes committed since the previous snapshot. Storing the data in 2 S3 buckets would provide slightly more protection, but a user could still delete the object from both buckets. EC2 instance storage is ephemeral and should never be used for data requiring durability.
An application requires a highly available relational database with an initial storage capacity of 8 TB.
The database will grow by 8 GB every day. To support expected traffic, at least eight read replicas will be required to handle database reads.
Which option will meet these requirements?
A. DynamoDB
B. Amazon S3
C. Amazon Aurora
D. Amazon Redshift
C – Amazon Aurora is a relational database that will automatically scale to accommodate data growth. Amazon Redshift does not support read replicas and will not automatically scale. DynamoDB is a NoSQL service, not a relational database. Amazon S3 is object storage, not a relational database.
A Solutions Architect is designing a critical business application with a relational database that runs on an EC2 instance. It requires a single EBS volume that can support up to 16,000 IOPS.
Which Amazon EBS volume type can meet the performance requirements of this application?
A. EBS Provisioned IOPS SSD
B. EBS Throughput Optimized HDD
C. EBS General Purpose SSD
D. EBS Cold HDD
A – EBS Provisioned IOPS SSD provides sustained performance for mission-critical low-latency workloads. EBS General Purpose SSD can provide bursts of performance up to 3,000 IOPS and have a maximum baseline performance of 10,000 IOPS for volume sizes greater than 3.3 TB. The 2 HDD options are lower cost, high throughput volumes.
A web application allows customers to upload orders to an S3 bucket. The resulting Amazon S3 events trigger a Lambda function that inserts a message to an SQS queue. A single EC2 instance reads messages from the queue, processes them, and stores them in an DynamoDB table partitioned by unique order ID. Next month traffic is expected to increase by a factor of 10 and a Solutions Architect is reviewing the architecture for possible scaling problems.
Which component is MOST likely to need re-architecting to be able to scale to accommodate the new traffic?
A. Lambda function
B. SQS queue
C. EC2 instance
D. DynamoDB table
C – A single EC2 instance will not scale and is a single point of failure in the architecture. A much better solution would be to have EC2 instances in an Auto Scaling group across 2 availability zones read messages from the queue. The other responses are all managed services that can be configured to scale or will scale automatically.
An application saves the logs to an S3 bucket. A user wants to keep the logs for one month for troubleshooting purposes, and then purge the logs.
What feature will enable this?
A. Adding a bucket policy on the S3 bucket.
B. Configuring lifecycle configuration rules on the S3 bucket.
C. Creating an IAM policy for the S3 bucket.
D. Enabling CORS on the S3 bucket.
B – Lifecycle configuration allows lifecycle management of objects in a bucket. The configuration is a set of one or more rules, where each rule defines an action for Amazon S3 to apply to a group of objects. Bucket policies and IAM define access to objects in an S3 bucket. CORS enables clients in one domain to interact with resources in a different domain.
An application running on EC2 instances processes sensitive information stored on Amazon S3. The
information is accessed over the Internet. The security team is concerned that the Internet connectivity to Amazon S3 is a security risk.
Which solution will resolve the security concern?
A. Access the data through an Internet Gateway.
B. Access the data through a VPN connection.
C. Access the data through a NAT Gateway.
D. Access the data through a VPC endpoint for Amazon S3.
D – VPC endpoints for Amazon S3 provide secure connections to S3 buckets that do not require a
gateway or NAT instances. NAT Gateways and Internet Gateways still route traffic over the Internet to the public endpoint for Amazon S3. There is no way to connect to Amazon S3 via VPN.
An organization is building an Amazon Redshift cluster in their shared services VPC. The cluster will host sensitive data.
How can the organization control which networks can access the cluster?
A. Run the cluster in a different VPC and connect through VPC peering.
B. Create a database user inside the Amazon Redshift cluster only for users on the network.
C. Define a cluster security group for the cluster that allows access from the allowed networks.
D. Only allow access to networks that connect with the shared services network via VPN.
C – A security group can grant access to traffic from the allowed networks via the CIDR range for each network. VPC peering and VPN are connectivity services and cannot control traffic for security. Amazon Redshift user accounts address authentication and authorization at the user level and have no control over network traffic.
A Solutions Architect is designing an online shopping application running in a VPC on EC2 instances
behind an ELB Application Load Balancer. The instances run in an Auto Scaling group across multiple Availability Zones. The application tier must read and write data to a customer managed database cluster. There should be no access to the database from the Internet, but the cluster must be able to obtain software patches from the Internet.
Which VPC design meets these requirements?
A. Public subnets for both the application tier and the database cluster
B. Public subnets for the application tier, and private subnets for the database cluster
C. Public subnets for the application tier and NAT Gateway, and private subnets for the database cluster
D. Public subnets for the application tier, and private subnets for the database cluster and NAT Gateway
C – The online application must be in public subnets to allow access from clients’ browsers. The database
cluster must be in private subnets to meet the requirement that there be no access from the Internet. A NAT Gateway is required to give the database cluster the ability to download patches from the Internet. NAT Gateways must be deployed in public subnets.
You have five CloudFormation templates; each template is for a different application architecture. This architecture varies between your blog apps and your gaming apps. What determines the cost of using the CloudFormation templates?
A. The time it takes to build the architecture with Cloud Formation
B. Cloud Formation does not have any additional cost but you are charged for the underlying resources it builds.
C. 0.10$ per template per month
D. 0.1$ per template per month
B. Cloud Formation does not have any additional cost but you are charged for the underlying resources it builds.
Which of the following correctly applies to changing the DB subnet group of your DB instance?
A. An existing DB Subnet group can be updated to add more subnets for existing Availability Zones.
B. An existing DB group cannot be updated to add more subnets for new Availability Zones.
C. Removing subnets from an existing DB subnet group can cause unavailability.
D. Updating an existing DB subnet group of a deployed DB instance is not currently allowed.
E. Explicitly changing the DB Subnet group of a deployed DB instance is not currently allowed.
A. An existing DB Subnet group can be updated to add more subnets for existing Availability Zones.
C. Removing subnets from an existing DB subnet group can cause unavailability.
D. Updating an existing DB subnet group of a deployed DB instance is not currently allowed.
E. Explicitly changing the DB Subnet group of a deployed DB instance is not currently allowed.
An existing DB subnet group can be updated to add more subnets, either for existing Availability Zones, or for new Availability Zones added since the creation of the DB instance. Removing subnets from an existing DB subnet group can cause unavailability for instances.
If you want to use an SSL protocol but do not want to terminate the connection on your load balancer, you can use a __________ protocol for connection from the client to your load balancer.
A. HTTP
B. TSL
C. HTTPS
D. TCP
D. TCP
If you want to use an SSL protocol but do not want to terminate the connection on your load balancer, you can use a TCP protocol for connection from the client to your load balancer. Use the SSL protocol for connection from the load balancer to your back-end application, and install certificates on all the back-end instances handling requests.
You are building an automated transcription service in which “Amazon EC2 worker” instances process an uploaded audio file and generate a text file. You must store both of these files in the same durable storage until the text file is retrieved, but you do not know what the storage capacity requirements are. Which storage option is both cost-efficient and scalable?
A. Multiple Amazon EBS volume with snapshots
B. A single Amazon Glacier Vault
C. A single Amazon S3 bucket
D. Multiple instance stores
C. A single Amazon S3 bucket
Amazon S3 provides a cost effective, durable, and scalable storage option. It provides the developers the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of websites.
Which of the following should be referred to if you want to map Amazon Elastic Block Store to an Amazon EC2 instance for AWS CloudFormation resources?
A. The logical IDs of the instance
B. Reference the logical IDs of both the block stores and the instance
C. Reference the physical IDs of the instance
D. Reference the physical IDs of the both the block stores and the instance
B. Reference the logical IDs of both the block stores and the instance
As part of the CloudFormation template, you need to build the JSON with all the required attributes. You need to refer the logical IDs of both the block stores and the instances in the resource section and configure according to your requirement. Whatever information you had provided on the console, you will have to simulate and provide the same attributes in the resource section per JSON format.
In the event of a planned or an unplanned outage of your primary DB instance, Amazon RDS automatically switches to a standby replica in another Availability Zone if you have enabled_________.
A. More than one read replica
B. More than one write replica
C. Multiple Availability Zones
D. Multi Region Deployment
C. Multiple Availability Zones
In the event of a planned or unplanned outage of your primary DB instance, Amazon RDS automatically switches to a standby replica in another Availability Zone if you have enabled multi-Availability Zones.
Which of the following approaches provides the lowest cost for Amazon elastic block store snapshots while giving you the ability to fully restore data?
A. Maintain two snapshots: the original snapshot and the latest incremental snapshot.
B. Maintain a volume snapshot; subsequent snapshots will overwrite one another.
C. Maintain a single snapshot; the latest snapshot is both incremental and complete.
D. Maintain the most current snapshot; archive the original and increment to Amazon Glacier.
A. Maintain two snapshots: the original snapshot and the latest incremental snapshot.
After writing data to an EBS volume, you can periodically create a snapshot of the volume to use as a baseline for new volumes or for data backup. If you make periodic snapshots of a volume, the snapshots are incremental which means only the blocks on the device that have changed after your last snapshot are saved in the new snapshot. Even though snapshots are saved incrementally, the snapshot deletion process is designed such that you need to retain only the most recent snapshot in order to restore the volume.
You try to connect via SSH to a newly created Amazon EC2 instance and get one of the following error messages: ‘Network error: connection timed out” or “Error connecting to [instance], reason :-> Connection timed out: connect,’ you have confirmed that the network and security group rules are configured correctly and the instance is passing status checks. What steps should you take to identify the source of the behavior? (Select all that apply).
A. Verify that the private key file corresponds to the Amazon EC2 key pair assigned at launch.
B. Verify that your IAM user policy has permission to launch Amazon EC2 instances.
C. Verify that you are connecting with the appropriate username for your AMI.
D. Verify that the Amazon EC2 instance was launched with the proper IAM role.
E. Verify that your federation trust to AWS has been established.
A. Verify that the private key file corresponds to the Amazon EC2 key pair assigned at launch.
C. Verify that you are connecting with the appropriate username for your AMI.
D. Verify that the Amazon EC2 instance was launched with the proper IAM role.
For any EC2 instance, you need the correct key pair and the user account to log into the instance. Without these even AWS support team cannot access that instance.
In a VPC network, access control lists (ACLs) act as a firewall for associated subnets, controlling both inbound and outbound traffic at the __________ level.
A. Full VPC
B. Customer Gateway
C. EC2 instance
D. Subnet
D. Subnet
Amazon VPC provides two features that you can use to increase security for your VPC: security groups and ACL. Security groups act as a firewall for associated Amazon EC2 instances, controlling both inbound and outbound traffic at the subnet level.
You try to enable lifecycle policies on one of the S3 buckets created by you, but you are not able to do so on that particular bucket. What could be the reason?
A. Bucket is corrupted.
B. Versioning is not enabled on that bucket.
C. Bucket type is not correct.
D. Versioning is enabled on the bucket.
B. Versioning is not enabled on that bucket.
You can manage an object’s lifecycle by enabling lifecycle policies, which define how Amazon S3 manages objects during their lifetime. You need to enable bucket versioning to manage S3 lifecycle policies.
For Dynamodb, which of the following statements are correct? (Select all that apply).
A. By using proxy, it is not possible for a developer to achieve item level access control.
B. By using FGAC, it is possible for a developer to achieve item level access control.
C. By using Per-Client Embedded Token, it is possible for a developer to achieve item level access control.
D. By using secret key, it is possible for a developer to achieve item level access control.
A. By using proxy, it is not possible for a developer to achieve item level access control.
B. By using FGAC, it is possible for a developer to achieve item level access control.
C. By using Per-Client Embedded Token, it is possible for a developer to achieve item level access control.
Fine Grained Access Control (FGAC) gives a DynamoDB table owner a high degree of control over data in the table. Specifically, the table owner can indicate who (caller) can access which items or attributes of the table and perform what actions.
Each EC2 instance has a default network interface that is assigned a primary private IP address on your Amazon VPC network. What is the name given to the additional network interfaces that can be created and attached to any Amazon EC2 instance in your VPC?
A. Elastic IP
B. Elastic Network Interface
C. AWS Elastic Interface
D. AWS Network ACL
B. Elastic Network Interface
An Elastic Network Interface (ENI) is a virtual network interface that you can attach to an instance in a VPC. An ENI can include a primary private IP address.
___________ is a task coordinator and state management service for cloud applications.
A. Amazon SWF
B. Amazon SNS
C. Amazon SQS
D. Amazon SES
A. Amazon SWF
Amazon Simple Workflow (Amazon SWF) is a task coordinator and state management service for cloud applications. With Amazon SWF, you can stop writing complex codes or invest in state machinery and business logic that makes your applications unique.
Which of the following IP address mechanisms are supported by ELB?
A. IPv4
B. IPv5
C. IPv6
D. IPv3
A. IPv4
C. IPv6
ELB supports both IPv4 and IPv6. IPv4 is the most widely used form of address. But with the boom of the Internet and connected devices IPv4 is running out of IP addresses; IPv6 is slowly replacing it as it has more IP addresses available.
A ___________ is a physical device or software application on your side of the VPN connection.
A. Customer gateway
B. Gateway level
C. Gateway table
D. Virtual private gateway
A. Customer gateway
When you create a VPN connection, the VPN tunnel comes up when traffic is generated from your side of the VPN connection. The virtual private gateway is not the initiator; your customer gateway initiates the tunnels.
You are currently hosting multiple applications in a VPC and have logged numerous port scans coming in from a specific IP address block. Your security team has requested that all access to the offending IP address block be denied for the next 24 hours. Which of the following is the best method to quickly and temporarily deny access to the specified IP address block?
A. Create an AD policy to modify Windows Firewall settings on all hosts in the VPC to deny access to the IP address block.
B. Modify the Network ACLs (NACLs) associated with all public subnets in the VPC to deny access from the IP address block.
C. Modify the Windows Firewall settings on all Amazon Machine Images (AMIs) which your organization uses in that VPC to deny access from the IP address block.
B. Modify the Network ACLs (NACLs) associated with all public subnets in the VPC to deny access from the IP address block.
AWS has implemented security layers at every level. As per OSI layers, you can restrict access at network level using NACL rules at VPC and below subnet levels. You can configure NACL rules to allow and deny the traffic. After crossing the network layer, if you still want to configure at the instance or resource level, you can configure it using security groups. Per the above context, you need to do it at the network level for a specific period and roll back the changes. You can do this at the network layer by altering allow/deny NACL rules.
Which ELB component is responsible for monitoring the Load Balancers?
A. Controller service
B. Load Balancer
C. Auto Scaling
D. Load Manager
A. Controller service
Elastic Load Balancing (ELB) consists of two components: the load balancers and the controller service. The load balancers monitor the traffic and handle requests that come in through the Internet. The controller service monitors the load balancers, adding and removing load balancers as needed and verifying that the load balancers are functioning properly.
An application hosted at the EC2 instances receives HTTP requests through the ELB. Each request has an X-Forwarded-For request header, having three IP addresses. Which of the following IP address will be a part of this header?
A. IP address of ELB
B. IP address of Forward Request
C. IP address of client
D. IP address of CloudWatch
C. IP address of client
The X-Forwarded-For request header helps you identify the IP address of a client when you use HTTP/HTTPS load balancer. Because load balancers intercept traffic between clients and servers, your server access logs contain only the IP address of the load balancer. Elastic Load Balancing stores the IP address of the client in the X-Forwarded-For request header and passes the header along to your server.
You have launched an instance in EC2-Classic and you want to make some change to the security group rule. How will these changes be effective?
A. Security group rules cannot be changed.
B. Changes are automatically applied to all instances that are associated with the security group.
C. Changes will be effective after rebooting the instances in that security group.
D. Changes will be effective after 24-hours.
B. Changes are automatically applied to all instances that are associated with the security group.
If you’re using EC2-Classic, you must use security groups created specifically for EC2-Classic. When you launch an instance in EC2-Classic, you must specify a security group in the same region as the instance. If you make any changes, they will be automatically applied to all instances that are associated with the security group.
You have an application running on Amazon Web Services. The application has 4 EC2 instances in Availability Zone us-east-1c. You’re using Elastic Load Balancer to load balance traffic across your four instances. What changes would you make to create a fault tolerant architecture?
A. Create EBS backups to ensure data is not lost.
B. Move all four instances to a different Availability Zone.
C. Move two instances to another Availability Zone.
D. Use CloudWatch to distribute the load evenly.
C. Move two instances to another Availability Zone.
Elastic Load Balancer automatically distributes incoming application traffic across multiple Amazon Elastic Compute Cloud (Amazon EC2) instances. You can set up an elastic load balancer to load balance incoming application traffic across Amazon EC2 instances in a single Availability Zone or multiple Availability Zones. Elastic Load Balancing enables you to achieve greater fault tolerance in your applications and it also seamlessly provides the amount of load balancing capacity that is needed in response to incoming application traffic.
The load balancer does not distribute traffic across ________.
A. One Availability Zone
B. Domains
C. Availability Zones within a region
D. Regions
D. Regions
You can set up your Elastic Load Balancing to distribute incoming requests across EC2 instances in a single Availability Zone or multiple Availability Zones within a region. Your load balancer does not distribute traffic across regions.
In context of CloudFormation, which of the following information do you get from the AWS CloudFormation list-stacks Command?
A. A list of any of the stacks you have created.
B. A list of any of the stacks you have created or have deleted up to 90 days ago.
C. A list of any of the stacks that have been created or deleted up to 60 days ago.
D. A 90 days history list of all your activity on stacks.
B. A list of any of the stacks you have created or have deleted up to 90 days ago.
The AWS CloudFormation list-stacks command enables you to get a list of any of the stacks you have created (even those which have been deleted up to 90 days). You can use an option to filter results by stack status, such as CREATE_COMPLETE and DELETE_COMPLETE. The AWS CloudFormation list-stacks command returns summary information about any of the running or deleted stacks, including the name, stack identifier, template, and status.
