CloudAcademy Knowledge Check: Management (SAA-C03) 1 of 2

Question 1

Where does AWS Config record resource change information and relevant metadata related to the change?

A. In a Configuration Item
B. In an AWS Config rule
C. In a CloudTrail log
D. In a Conformance Pack

Answer 1

A. In a Configuration Item

Explanation:
AWS Config can capture resource changes. So any change to a resource supported by Config can be recorded, which will record what change along with other useful metadata all held within a file known as a configuration item, a CI.

It can act as a resource inventory. AWS Config can discover supported resources running within your environment, allowing you to see data about that resource type.

Question 2

Which of the following tasks can AWS Config help you accomplish?

A. Manage and maintain compliance
B. Track resource metrics
C. Automatically delete non-compliant resources
D. Log all API calls to your resources

Answer 2

A. Manage and maintain compliance

Explanation:
AWS Config can:

Enforce rules that check the compliance of your resource against specific controls: Predefined and custom rules can be configured within AWS Config, allowing you to check resources compliance against these rules

Act as a resource inventory: AWS Config can discover supported resources running within your environment allowing you to see data about that resource type

The other choices include services offered by AmazonCloudWatch and Amazon CloudTrail.

Store configuration history for individual resources: The service will record and hold all existing changes that have happened against the resource, providing a useful historical record of changes

Question 3

An IAM user is part of an IAM groupthat is allowed permissionto create Amazon EC2 instances. This user is also part of an organizational unit (OU) assigned a service control policy (SCP) that denies all access to Amazon EC2. If this user tries to create and launch an EC2 instance, what will happen?

A. The user will be denied access to Amazon EC2 because denies in SCPs assigned in AWS Organizations can overrule allows identity-based permissions granted through IAM.
B. The user will be grantedaccess to Amazon EC2 becauseidentity-based permissions allowedthrough IAMoverrule denies in SCPs assigned throughAWS Organizations.
C. The user’s request will be reviewed for approval by the AWS Organizations master account.
D. The user’s request will be reviewed for approval by both the owner of the related AWS account and the AWS Organizations master account.

Answer 3

A. The user will be denied access to Amazon EC2 because denies in SCPs assigned in AWS Organizations can overrule allows identity-based permissions granted through IAM.

Explanation:
Here is how AWS Organizations’ SCPs and IAM policies work together:

Users and roles must still be granted permissions with appropriate IAM permission policies. A user without any IAM permission policies has no access, even if the applicable SCPs allow all services and all actions.

If a user or role has an IAM permission policy that grants access to an action that is also allowed by the applicable SCPs, the user or role can perform that action.

If a user or role has an IAM permission policy that grants access to an action that is either not allowed or explicitly denied by the applicable SCPs, the user or role can’t perform that action.

Question 4

_____________ in AWS Control Tower help to keep all of your users’ accounts and make sure everything is in compliance with basic security regulations.

A.Guardrails
B. Registries
C. Service control policies
D. Rule groups

Answer 4

A.Guardrails

Explanation:
Guardrails is an appropriately named service that helps to keep all of your users’ accounts and everything under AWS Control Tower and compliance with basic security regulations.

Question 5

Which Amazon CloudWatch feature allows CloudWatch to implement machine learning algorithms against your metric data to help detect any activity that sits outside of the normal baseline parameters?

A. alarms
B. anomaly detection
C. EventBridge
D. logs

Answer 5

B. anomaly detection

Explanation:
CloudWatch metrics also allow you to enable a feature known as anomaly detection. This allows CloudWatch to implement machine learning algorithms against your metric data to help detect any activity that sits outside of the normal baseline parameters that are generally expected.

Question 6

What is the general workflow of AWS Systems Manager?

A. Group your AWS resources, examine your AWS resources’ relevant operational data via dashboards, and take action to mitigate any issues reported.
B. View your resources via dashboards and take action to mitigate any issues reported.
C. Take action to mitigate any issues reported, group your AWS resources, and examine your AWS resources’ relevant operational data via dashboards.
D. Examine your AWS resources’ relevant operational data via dashboards, group your AWS resources, and take action to mitigate any issues reported.

Answer 6

A. Group your AWS resources, examine your AWS resources’ relevant operational data via dashboards, and take action to mitigate any issues reported.

Explanation:
In general, using Systems Manager entails grouping your AWS resources, examining their relevant operational data via dashboards, and, finally, taking action to mitigate any issues reported.

Question 7

What is a service control policy (SCP) within the AWS Organizations service?

A. A hierarchical, visual representationofyourcompany’sentire AWS account structure
B. A method of categorizing acompany’s multiple AWS accounts
C. A method of controlling which AWS services are accessible forspecific AWS accounts within your AWS account structure
D. A container at the top of a company’s AWS accounts structure

Answer 7

C. A method of controlling which AWS services are accessible forspecific AWS accounts within your AWS account structure

Explanation:
An Organization is an element that serves to form a hierarchical structure of multiple AWS accounts. You could think of an organization as a family tree which provides a graphical view of your entire AWS account structure. At the very top of this Organization, there will be a Root container.

The Root object is simply a container that resides at the top of your Organization. All of your AWS accounts and Organizational units will then sit underneath this Root. Within any Organization, there will only be one single Root object.

Organizational Units (OUs) provide a means of categorizing your AWS Accounts. Again, like the Root, these are simply containers that allow you to group together specific AWS accounts. An organizational unit (or OU) can connect directly below the Root or even below another OU (which can be nested up to 5 times). This allows you to create a hierarchical structure as I mentioned previously.

Accounts. These are your AWS accounts that you use and create to be able to configure and provision AWS resources. Each of your AWS accounts has a 12 digit account number.

Service control policies, or SCPs, allow you to control what services and features are accessible from within an AWS account. These SCPs can either be associated with the Root, Organizational Units, or individual accounts. When an SCP is applied to any of these objects, its associated controls are fed down to all child objects. Think of it as a permission boundary that sets the maximum permission level for the objects that it is applied to.

Question 8

Amazon CloudWatch _____ allow you to implement automatic actions based on specific thresholds that you can configure related to each metric.

A. anomaly detections
B. rules
C. alarms
D. events

Answer 8

C. alarms

Explanation:
Amazon CloudWatch alarms tightly integrate with the metrics that I just discussed and they allow you to implement automatic actions based on specific thresholds that you can configure related to each metric.

Question 9

What is the primary function of AmazonCloudWatch?

A. To notify you regardingconfiguration changes toyour AWS resources
B. To monitor your AWS resources’ performance against specific metrics and thresholds
C. To track and record API requests made in AWS
D. To provide feedback on your AWS cloud environment’s configuration based on best practices

Answer 9

B. To monitor your AWS resources’ performance against specific metrics and thresholds

Explanation:
The primary function of Amazon CloudWatch is to provide a means of monitoring theresources that you’re running within AWS via a series of metrics, which are individual to each service that you are using. This allows you to quickly react to events, and diagnose, and dynamically adjust any availability or scalability issue that you might be experiencing.

Question 10

In Amazon CloudWatch EventBridge, a(n) _____ acts as a filter for incoming streams of event traffic and then routes these events to the appropriate target.

A. log
B. event bus
C. rule
D. alarm

Answer 10

C. rule

Explanation:
A rule acts as a filter for incoming streams of event traffic and then routes these events to the appropriate target defined within the rule.

Question 11

In AWS Service Catalog, which type of constraint lets you configure where you want your products to launch?

A. tag update
B. template
C. launch
D. stack set

Answer 11

D. stack set

Explanation:
Stack set constraint: This constraint gives you the option to configure where you want your products to launch.

Question 12

AWS Control Tower is a service that offers a larger and more controlled method of _____.

A. searching, visualizing, and analyzing up to petabytes of text and unstructured data
B. creating, distributing, managing, and auditing multiple accounts
C. provisioning, managing, and deploying SSL/TLS certificates
D. centrally managing firewall rules

Answer 12

B. creating, distributing, managing, and auditing multiple accounts

Explanation:
AWS Control Tower is a service that offers a larger and more controlled method of creating, distributing, managing, and auditing multiple accounts.

Question 13

Which three AWS Config components use configuration items? (Choose 3 answers)

A. Configuration history
B. Configuration snapshots
C. Configuration streams
D. Config rules

Answer 13

A. Configuration history
B. Configuration snapshots
C. Configuration streams

Explanation:
Configuration items are used by other features and components of AWS Config, such as:

Configuration History - Configuration items are used to look up all changes that have been made to a resource

Configuration Streams - Configuration items are sent to an SNS Topic to enable analysis of the data

Configuration Snapshots - Configuration items are used to create a point in time snapshot of all supported resources

Question 14

What is AWS Systems Manager?

A. a service that continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations
B. a service that monitors your applications and automatically adjusts capacity to maintain steady, predictable performance at the lowest possible cost
C. a set of fully managed AWS services that enable automated configuration and ongoing management of systems at scale in a secure and reliable way across all your Linux and Windows instances running on Amazon EC2, your own data center, or other cloud platforms
D. a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account

Answer 14

C. a set of fully managed AWS services that enable automated configuration and ongoing management of systems at scale in a secure and reliable way across all your Linux and Windows instances running on Amazon EC2, your own data center, or other cloud platforms

Explanation:
Systems Manager is a set of fully managed AWS services that enable automated configuration and ongoing management of systems at scale in a secure and reliable way across all your Linux and Windows instances running on Amazon EC2, your own data center, or other cloud platforms.

Question 15

The _____ feature of AWS Systems Manager is a fully-managed capability that lets you connect to any managed instance using an interactive browser shell login for Linux, Windows, and MacOS instances.

A. Session Manager
B. Fleet Manager
C. Patch Manager
D. State Manager

Answer 15

A. Session Manager

Explanation:
The Session Manager feature of Systems Manager is a fully-managed capability that lets you connect to any managed instance using an interactive browser shell login for Linux, Windows, and MacOS instances.

Question 16

To determine whether a log file was modified, deleted, or unchanged after CloudTrail delivered it, you can use ____.

A. trusted signers
B. optimistic locking
C. root credentialing
D. integrity validation

Answer 16

D. integrity validation

Explanation:
The AWS CloudTrail uses log file integrity validation to determine whether the log files were changed or modified since CloudTrail delivered them to an Amazon S3 bucket.

Question 17

hat is the primary function of AWS CloudTrail?

A. To track and record API requests made in AWS
B. To notify you regardingconfiguration changes toyour AWS resources
C. To monitor resource performance against specific service thresholds
D. To provide feedback on your AWS cloud environment’s configuration based on best practices

Answer 17

A. To track and record API requests made in AWS

Explanation:
CloudTrail is a service that has a primary function to record and track all AWS API requests made. These API calls can be programmatic requests initiated from a user using an SDK, the AWS Command Line Interface, from within the AWS management console, or even from a request made by another AWS service.

Question 18

In AWS Control Tower, a _____ is a multi-account architecture that follows the well-architected framework and is based around the ideas of security and compliance best practices.

A. drift
B. guardrail
C. landing zone
D. blueprint

Answer 18

C. landing zone

Explanation:
A landing zone is a multi-account architecture that follows the well-architected framework and is based around the ideas of security and compliance best practices.

Question 19

What allows you to add a level of customization to the type of API requests you want the corresponding trail to capture?

A. Event selectors
B. CloudTrail Logs
C. Events
D. CloudWatch Logs

Answer 19

A. Event selectors

Explanation:
Event selectors allow you to add a level of customization to the type of API requests you want the corresponding trail to capture.

Question 20

Non-compliant resources identified through the use of AWS Config Rules are automatically removed from operational service.

A. True
B. False
C. It depends on the rule configuration
D. Only if it remains non-compliant for more than six hours

Answer 20

B. False

Explanation:
Each time a change is made to one of your supported resources, AWS config will check its compliance against any Config Rules that you have in place. If there is a violation against these rules, then AWS Config will send a message to the Configuration Stream via SNS and the resource will be marked as ‘noncompliant.’

It’s important to note that this does not mean the resource will be taken out of service or it will stop working. It will continue to operate exactly as it is with its new configuration. AWS Config simply alerts you that there is a violation and it’s up to you to take the appropriate action.

Question 21

When creating metric filters in CloudWatch for your CloudTrail logs, you must create a ______ that determines what exactly you want CloudWatch to monitor and extract from your CloudTrail log files.

A. filter pattern
B. search pattern
C. filter string
D. search string

Answer 21

A. filter pattern

Explanation:
When creating these metric filters, you must create a filter pattern which determines what exactly you want CloudWatch to monitor and extract from your files. These filter patterns are fully customizable strings, but as a result, a very specific pattern syntax is required. So if you are creating these for the first time, you must understand the correct syntax

Question 22

What is AWS Organizations?

A. a service that provides a means of centrally managing and categorizing multiple AWS accounts that you own, bringing them together into a single organization
B. a service that enables you to assess, audit, and evaluate the configurations of your AWS resources
C. a service that makes it easier to manage your software licenses from vendors such as Microsoft, SAP, Oracle, and IBM across AWS and on-premises environments
D. a service that enables you to launch and manage virtual private servers

Answer 22

A. a service that provides a means of centrally managing and categorizing multiple AWS accounts that you own, bringing them together into a single organization

Explanation:
For those not familiar with AWS Organizations, it’s a service that provides a means of centrally managing and categorizing multiple AWS accounts that you own, bringing them together into a single organization.

Question 23

What is the purpose of AWS Service Catalog?

A. to allow you to meet, chat, and place business calls inside and outside your organization, all using a single application
B. to provide a way to model a collection of related AWS and third-party resources, provision them quickly and consistently, and manage them throughout their life cycles
C. to provide secure, resizable compute capacity in the cloud
D. to make provisioning and creating IT stacks easier for both the end user and IT admins

Answer 23

D. to make provisioning and creating IT stacks easier for both the end user and IT admins

Explanation:
AWS Service Catalog is an organizational tool developed with the purpose of making provisioning and creation of IT stacks easier for both the end user as well as your IT admins.

Question 24

In AWS Service Catalog, a(n) _____ is a collection of products with configuration information that helps in determining who can use the products.

A. portfolio
B. tag
C. stack
D. array

Answer 24

A. portfolio

Explanation:
A portfolio is a collection of products with configuration information, which helps in determining who can use the products within.

Question 25

An IAM user is part of an IAM group that has read-only access to Amazon RDS databases within a company’s production environment. This user is also part of an organizational unit (OU) which is granted full access to Amazon RDS databases in the company’s production environment. If the IAM user attempts to modify the failover settings for a database in the company’s production environment, what will happen?

A. The user’s request willbe deniedbecause permissions can only be grantedby AWS IAM, not AWS Organizations.
B. The user’s request willbe grantedbecause permissions can be granted by eitherAWS IAM orAWS Organizations.
C. The user’s request will be reviewed for approval by the owner of the related AWS account.
D. The user’s request will be reviewed for approval by the master accountof the related AWS Organization.

Answer 25

A. The user’s request willbe deniedbecause permissions can only be grantedby AWS IAM, not AWS Organizations.

Explanation:
Here is how AWS Organizations’ SCPs and IAM policies work together:

Users and roles must still be granted permissions with appropriate IAM permission policies. A user without any IAM permission policies has no access, even if the applicable SCPs allow all services and all actions.

If a user or role has an IAM permission policy that grants access to an action that is also allowed by the applicable SCPs, the user or role can perform that action.

If a user or role has an IAM permission policy that grants access to an action that is either not allowed or explicitly denied by the applicable SCPs, the user or role can’t perform that action.

Here is how AWS Organizations’ SCPs and IAM policies work together:

Users and roles must still be granted permissions with appropriate IAM permission policies. A user without any IAM permission policies has no access, even if the applicable SCPs allow all services and all actions.

If a user or role has an IAM permission policy that grants access to an action that is also allowed by the applicable SCPs, the user or role can perform that action.

If a user or role has an IAM permission policy that grants access to an action that is either not allowed or explicitly denied by the applicable SCPs, the user or role can’t perform that action.