Cloud Practitioner - PRACTICE 6 Flashcards
The AWS Cost Management tools give users the ability to do which of the following? (Select TWO.)
- Terminate all AWS resources automatically if budget thresholds are exceeded
- Break down AWS costs by day, service, and linked AWS account
- Create budgets and receive notifications if current or forecasted usage exceeds the budgets
- Switch automatically to Reserved Instances or Spot Instances, whichever is most cost- effective
- Move data stored in Amazon S3 to a more cost-effective storage class
Break down AWS costs by day, service, and linked AWS account & Create budgets and receive notifications if current or forecasted
Which AWS service or feature helps restrict the AWS service, resources, and individual API actions the users and roles in each member account can access?
- Amazon Cognito
- AWS Organizations
- AWS Shield
- AWS Firewall Manager
AWS Organizations
Under the shared responsibility model, which of the following tasks are the responsibility of the AWS customer? (Select TWO.)
- Ensuring that application data is encrypted at rest
- Ensuring that AWS NIP servers are set to the correct time
- Ensuring that users have received security training in the use of AWS services
- Ensuring that access to data centers is restricted
- Ensuring that hardware is disposed of properly
Ensuring that application data is encrypted at rest & Ensuring that users have received security training in the use of AWS services
As a customer on AWS you take responsibility for encrypting data. This includes encrypting data at rest and data in transit. It’s also a customer’s responsibility to properly train their staff in security best practices and procedures for the AWS services they use.
Under the AWS shared responsibility model, which of the following are customer responsibilities? (Select TWO.)
- Setting up server-side encryption on an Amazon S3 bucket
- Amazon RDS instance patching
- Network and firewall configurations
- Physical security of data center facilities
- Compute capacity availability
Setting up server-side encryption on an Amazon S3 bucket & Network and firewall configurations
As a customer on AWS you take responsibility for encrypting data. This includes encrypting data at rest and data in transit. Another security responsibility the customer owns is setting network and firewall configurations. For instance, you must configure Network ACLs and Security Groups, and any operating
system-level firewalls on your EC2 instances.
A web application running on AWS has been received malicious requests from the same set of IP addresses. Which AWS service can help secure the application and block the malicious traffic?
- AWS IAM
- Amazon GuardDuty
- Amazon SNS
- AWS WAF
AWS WAF
The AWS Web Application Firewall (WAF) is used to protect web applications or APIs against common web exploits. Rules can be created that block traffic based on source IP address.
Which AWS service provides the ability to detect inadvertent data leaks of personally identifiable information (PII) and user credential data?
- Amazon GuardDuty
- Amazon Inspector
- Amazon Macie
- AWS Shield
Amazon Macie
Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in Amazon S3.
According to the AWS Well-Architected Framework, what change management steps should be taken to achieve reliability in the AWS Cloud? (Select TWO.)
- Use AWS Config to generate an inventory of AWS resources
- Use service limits to prevent users from creating or making changes to AWS resources
- Use AWS CloudTrail to record AWS API calls into an auditable log file
- Use AWS Certificate Manager to create a catalog of approved services
- Use Amazon GuardDuty to record API
activity to an S3 bucket
Use AWS Config to generate an inventory of AWS resources & Use AWS CloudTrail to record AWS API calls into an auditable log file
AWS Config can be used to track the configuration state of your resources and how the state has changed over time. With CloudTrail you can audit who made what API
calls on what resources at what time. This can help with identifying changes that cause reliability issues.
Which of the following acts as a virtual firewall at the Amazon EC2 instance level to control traffic for one or more instances?
- Route table
- Virtual private gateways (VPG)
- Security groups
- Network Access Control Lists (ACL)
Security Groups
A security group is an instance-level firewall that can be used to control traffic the that reaches (ingress/inbound) and is sent out from (egress/outbound) your EC2 instances. Rules are created for inbound or outbound traffic.
Which AWS Cloud design principles can help increase reliability? (Select TWO.)
- Using monolithic architecture
- Measuring overall efficiency
- Testing recovery procedures
- Adopting a consumption model
- Automatically recovering from failure
Testing recovery procedures
& Automatically recovering from failure
Which pricing model will interrupt a running Amazon EC2 instance if capacity becomes temporarily unavailable?
- On-Demand Instances
- Standard Reserved Instances
- Spot Instances
- Convertible Reserved Instances
Spot Instances
Amazon EC2 Spot Instances let you take advantage of unused EC2 capacity in the AWS cloud. Spot Instances are available at up to a 90% discount compared to On-Demand prices. When AWS need to reclaim the capacity you get a 2 minute warning and then your instances are terminated.
Which of the following statements about AWS’s pay-as-you-go pricing model is correct?
- It results in reduced capital expenditures
- It requires payment up front for AWS services
- It is relevant only for Amazon EC2, Amazon S3, and Amazon DynamoDB
- It reduces operational expenditures
It results in reduced capital expenditures
The pay-as-you-go pricing model means you only pay for the services and consumption you actually use. You are charged for compute, storage and outbound data transfer. This model reduces capital expenditure as you pay a monthly bill (operational expenditure).
Which AWS service can serve a static website?
- Amazon S3
- Amazon Route 53
- Amazon QuickSight
- AWS X-Ray
Amazon S3
A startup eCommerce company needs to quickly deliver new website features in an iterative manner, minimizing
the time to market. Which AWS Cloud feature allows this?
- Elasticity
- High availability
- Agility
- Reliability
Agility
What is the most efficient way to establish network connectivity from on-premises to multiple VPCs in different AWS Regions?
- Use AWS Direct Connect
- Use AWS VPN
- Use AWS Client VPN
- Use an AWS Transit Gateway
AWS Transit Gateway
AWS Transit Gateway is a service that enables customers to connect their Amazon Virtual Private Clouds (VPCs)
and their on-premises networks to a single gateway.
A company is using the AWS CLI and programmatic access of AWS resources from its on-premises network. What is a mandatory requirement in this scenario?
- Using an AWS Direct Connect connection
- Using an AWS access key and a secret key
- Using Amazon API Gateway
- Using an Amazon EC2 key pair
Using an AWS access key and a secret key
Access keys are long-term credentials for an IAM user or the AWS account root user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK). Access keys consist of two parts: an access key ID (for example, AKIAIOSFODNN7EXAMPLE) and a secret
access key (for example, walrXUtnFEMI/K7MDENG/
bPxRfiCYEXAMPLEKEY). Like a username and password, you must use both the access key ID and secret access key together to authenticate your requests.
Which AWS service is suitable for an event-driven workload?
- Amazon EC2
- AWS Elastic Beanstalk
- AWS Lambda
- Amazon Lumberyard
AWS Lambda
AWS Lambda is an event-driven service. For example you can configure an Amazon S3 bucket with event notifications that trigger an AWS Lambda function when data is uploaded to an S3 bucket.
Based on the shared responsibility model, which of the following security and compliance tasks is AWS responsible for?
- Granting access to individuals and services
- Encrypting data in transit
- Updating Amazon EC2 host firmware
- Updating operating systems
Updating Amazon EC2 host firmware
AWS are responsible for updating Amazon EC2 host firmware. This is considered “security of the cloud”. All other tasks are the responsibility of the customer.
Which AWS service can be used to run Docker containers?
- AWS Lambda
- Amazon ECR
- AWS Fargate
- Amazon AMI
AWS Fargate
AWS Fargate is a serverless compute engine for containers that works with both Amazon Elastic Container Service (ECS) and Amazon Elastic Kubernetes Service (EKS).
Which type of Elastic Load Balancer operates at the TCP connection level?
- Application Load Balancer (ALB)
- Network Load Balancer (NLB)
- Classic Load Balancer (CLB)
- Amazon Route 53 Load Balancer
Network Load Balancer (NLB)
A Network Load Balancer functions at the
fourth layer of the Open Systems Interconnection (OSI) model. NLBs direct connections based on information at the TCP connection level.
Which AWS technology can be referred to as a “virtual hard disk in the cloud”?
- Amazon EFS Filesystem
- Amazon S3 Bucket
- Amazon EBS volume
- Amazon ENI
Amazon EBS Volume
An Amazon Elastic Block Store (EBS) volume is often described as a “virtual hard disk in the cloud”. EBS volumes are block-level storage volumes that are attached to EC2 instances much as you would attach a virtual hard disk to a virtual machine in a virtual
infrastructure.
In which ways does AWS’ pricing model benefit organizations?
- Eliminates licensing costs
- Focus spend on capital expenditure, rather than operational expenditure
- Reduce the cost of maintaining idle resources
- Reduces the people cost of application development
Reduce the cost of maintaining idle resources
Using AWS you can provision only what you need and adjust resources automatically and elastically. This reduces the amount of resources that are sitting idle which reduces cost.
Which service allows you to monitor and troubleshoot systems using system and application log files generated by those systems?
- CloudTrail Logs
- Cloud Watch Metrics
- CloudWatch Logs
- CloudTrail Metrics
CloudWatch Logs
Amazon CloudWatch Logs lets you monitor and troubleshoot your systems and applications using your existing system, application and custom log files. Cloud Watch Logs can be used for real time application and system monitoring as well as long term log retention.
According to the AWS Shared Responsibility Model,
which of the following is a shared control?
- Operating system patching
- Awareness and training
- Protection of infrastructure
- Client-side data encryption
Awareness and training
Shared Controls are controls which apply to both the infrastructure layer and customer layers, but in completely separate contexts or perspectives. In a shared control, AWS provides the requirements for the infrastructure and the customer must provide their own control implementation within their use of AWS services. Examples include patch management, configuration management, and awareness and training.
Where do Amazon Identity and Access Management (IAM) accounts need to be created for a global organization?
- In each region where the users are located
- Just create them once, as IAM is a global service
- Create them globally, and then replicate them regionally
- In each geographical area where the users are located
Just create them once, as IAM is a global service
IAM is a global service so you only need to create your users once and can then use those user accounts anywhere globally. The other options are all incorrect. as you do not create IAM accounts regionally, replicate them regionally, or create them within geographical areas.
What is the name for the top-level container used to hold objects within Amazon S3?
- Folder
- Directory
- Instance Store
- Bucket
Bucket
Amazon S3 is an object-based storage system. You upload your objects into buckets.
Which of the following are examples of horizontal scaling? (Select TWO.)
- Add more CPU/RAM to existing instances as demand increases
- Add more instances as demand increases
- Requires a restart to scale up or down
- Automatic scaling using services such as AWS Auto Scaling
- Scalability is limited by maximum instance size
Add more instances as demand increases & Automatic scaling using services such as AWS Auto Scaling
With horizontal scaling you add more instances to a fleet of instances to service demand as it increases.
This can be achieved automatically by using AWS Auto Scaling to add instances in response to CloudWatch performance metrics.
Which resource should you use to access AWS security and compliance reports?
- AWS Artifact
- AWS Business Associate Addendum (BAA)
- AWS IAM
- AWS Organizations
AWS Artifact
AWS Artifact, available in the console, is a self-service audit artifact retrieval portal that provides our customers with on-demand access to AWS’ compliance documentation and AWS agreements.
What methods are available for scaling an Amazon RDS database? (Select TWO.)
- You can scale up by moving to a larger instance size
- You can scale out automatically with EC2 Auto Scaling
- You can scale up by increasing storage capacity
- You can scale out by implementing Elastic Load Balancing
- You can scale up automatically using AWS Auto Scaling
You can scale up by moving to a larger instance size & You can scale up by increasing storage capacity
To handle a higher load in your database, you can vertically scale up your master database with a simple push of a button. There are currently over 18 instance sizes that you can choose from when resizing your RDS, MySQL, PostgreSQL, MariaDB, Oracle, or Microsoft SQL Server instance.
Which type of scaling does Amazon EC2 Auto Scaling provide?
- Vertical
- Linear
- Horizontal
- Incremental
Horizontal
Amazon EC2 Auto Scaling scales horizontally by adding launching and terminating EC2 instances based on
actual demand for your application.
Which feature of Amazon S3 enables you to create rules to control the transfer of objects between different
storage classes?
- Object sharing
- Versioning
- Lifecycle management
- Bucket policies
Lifecycle management
To manage your objects so that they are stored cost effectively throughout their lifecycle, configure their Amazon S3 Lifecycle. An S3 Lifecycle configuration is a set of rules that define actions that Amazon S3 applies to a group of objects.
How can a database administrator reduce operational overhead for a MySQL database?
- Migrate the database onto an EC2 instance
- Migrate the database onto AWS Lambda
- Use AWS CloudFormation to manage operations
- Migrate the database onto an Amazon RDS instance
Migrate the database onto an Amazon RDS instance
Amazon RDS is a managed database service that supports MySQL. The DBA can reduce operational overhead by moving to RDS and having less work to do to manage the database.
Which AWS database service is schema-less and can be scaled dynamically without incurring downtime?
- Amazon RDS
- Amazon Aurora
- Amazon RedShift
- Amazon DynamoDB
Amazon DynamoDB
Amazon DynamoDB is a fully managed NoSQL database service that provides fast and predictable performance with seamless scalability. Push button scaling means that you can scale the DB at any time without incurring downtime. DynamoDB is schema-less.
Which type of AWS database is ideally suited to analytics using SQL queries?
- Amazon DynamoDB
- Amazon RedShift
- Amazon RDS
- Amazon S3
Amazon Redshift
Amazon Redshift is a fast, fully managed data warehouse that makes it simple and cost-effective to analyze all your data using standard SQL and existing Business Intelligence (BI) tools. RedShift is a SQL based data warehouse used for analytics applications.
Which AWS service is designed to be used for operational analytics?
- Amazon EMR
- Amazon Athena
- Amazon QuickSight
- Amazon Elasticsearch Service
Amazon Elasticsearch Service
Amazon Elasticsearch Service is involved with operational analytics such as application monitoring, log analytics and clickstream analytics. Amazon Elasticsearch Service allows you to search, explore, filter, aggregate, and visualize your data in near real-time.
You need to connect your company’s on-premise network into AWS and would like to establish an AWS managed VPN service. Which of the following configuration items needs to be setup on the Amazon VPC side of the connection?
- A Virtual Private Gateway
- A Customer Gateway
- A Network Address Translation device
- A Firewall
A Virtual Private Gateway
A Virtual Private Gateway is the VPN concentrator on the Amazon side of the VPN connection. You create a virtual
private gateway and attach it to the VPC from which you want to create the VPN connection.
Where are Amazon EBS snapshots stored?
- On an Amazon EBS instance store
- On an Amazon EFS filesystem
- Within the EBS block store
- On Amazon S3
On Amazon S3
You can back up the data on your Amazon EBS volumes to Amazon S3 by taking point-in-time snapshots. Snapshots are incremental backups, which means that only the blocks on the device that have changed after your most recent snapshot are saved.
Which AWS service makes it easy to coordinate the components of distributed applications as a series of steps in a visual workflow?
- Amazon SWF
- AWS Step Functions
- Amazon SNS
- Amazon SES
AWS Step Functions
AWS Step Functions lets you coordinate multiple AWS services into serverless workflows so you can build and update apps quickly. AWS Step Functions lets you build visual workflows that enable fast translation of business requirements into technical requirements.
A Cloud Practitioner is creating the business process workflows associated with an order fulfilment system. Which AWS service can assist with coordinating tasks across distributed application components?
- AWS STS
- Amazon SQS
- Amazon SWF
- Amazon SNS
Amazon SWF
Amazon Simple Workflow Service (SWF) is a web service that makes it easy to coordinate work across distributed application components. SWF enables applications for a range of use cases, including media processing, web application back-ends, business process workflows, and analytics pipelines, to be designed as a coordination of tasks.
Your manager has asked you to explain some of the security features available in the AWS cloud. How can you describe the function of Amazon CloudHSM?
- It provides server-side encryption for S3 obiects
- It is a Public Key Infrastructure (PKI)
- It can be used to generate, use and manage encryption keys in the cloud
- It is a firewall for use with web applications
It can be used to generate, use and manage encryption keys in the cloud
AWS CloudHSM is a cloud-based hardware security module (HSM) that allows you to easily add secure key storage and high-performance crypto operations to your AWS applications.
