Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Cloud Professional > Exam > Flashcards

Exam Flashcards

1
Q

What is CloudWatch?

A
  • CloudWatch is used for monitoring performance.
  • CloudWatch can monitor most of AWS as well as your applications that run on AWS.
  • CloudWatch with EC2 will monitor events every 5 minutes by default.
  • You can have 1 minute intervals by turning on detailed monitoring.
  • You can create CloudWatch alarms which trigger notifications.
  • CloudWatch is all about performance.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Multiple EC2 instances is called what?

A

EC2 Fleet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is an AWS Systems Manager?

A
  • Systems Manager is a piece of software used to manage fleets of EC2 instances and virtual machines.
  • Can be both inside AWS and on premise.
  • Run Command is used to install, patch, uninstall software
  • Integrates with CloudWatch to give you a dashboard of your entire estate.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

List the 6 Advantages of Cloud.

A
  • Trade capital expense for variable expense
  • Benefit from massive economies of scale
  • Stop guessing about capacity
  • Increase speed and agility
  • Stop spending money running and maintaining data centers
  • Go global in minutes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

List the 3 Types of Cloud Computing.

A
  • Infrastructure as a Service (IaaS) (ex. EC2)
  • Platform as a Service (PaaS) (ex. Elastic Beanstalk)
  • Software as a Service (SaaS) (ex. Gmail)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

List the 3 Types of Cloud Computing Deployments

A
  • Public Cloud - AWS, Azure, GCP
  • Hybrid - Mixture of public and private
  • Private Cloud (or On Premise) - You manage it, in your datacenter (ex. Openstack or Vmware)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Explain the difference between a region, an Availability Zone (AZ) and an Edge Location.

A
  • A Region is a physical location in the world which consists of two or more Availability Zones (AZ’s)
  • An Availability Zone is one or more discrete data centers, each with redundant power, networking and connectivity, housed in separate facilities
  • Edge Locations are endpoints for AWS which are used for cashing content. Typically this consists of CloudFront, Amazon’s Content Delivery Network (CDN)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is Amazon CloudFront and how does it work?

A

CloudFront is Amazon’s Content Delivery Network (CDN)

The first time a user requests a file it queries an edge location. If that file is not on that edge location
it will download it from the origin (such as an S3 bucket). The next time a user requests the file, that file will be at the edge location and can be accessed right away.

  • Edge location - location where content will be cached (this is separate to an AWS Region or Availability Zone).
  • Origin - the origin of the files that Amazon’s Content Delivery Network (CDN) will distribute. This can either be an S3 Bucket, an EC2 instance, an Elastic Load Balancer or Route 53
  • Distribution - the name given to the CDN network and
    consists of a collection of Edge Locations. There are two different types: 1) Web Distribution (websites), and 2) RTMP (media streaming)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How do you choose the right AWS Region?

A
  • Data Sovereignty Laws (ex. regulatory restrictions on offshore data storage)
  • Latency to end users
  • AWS Services (not all services are available everywhere)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Explain the different AWS support packages available.

A
  • Basic - Free
  • Developer - $29 a month (scales based on usage)
  • Business - $100 a month (scales based on usage)
  • Enterprise - $15k a month (scales based on usage) - TAM, Technical Account Manager)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Exam Tip:

A

Billing Alerts or Billing Alarms will alert you automatically when a certain level of AWS spend has been reached. If you are learning AWS for the first time you should turn it on so that you don’t spend money without realizing it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How can you access the AWS platform?

A
  • Via the Console
  • Programmatically (using command line)
  • Using the Software Developers Kit (SDK)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

IAM

A

IAM stands for Identity Access Management.
You don’t specify a region when dealing with IAM,
it’s global and when you create a user or
a group these are created globally.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a root account?

A

Your root account is the email address that you used to set up your AWS account. The root account always has full administrator access. You should never give these account credentials away to anyone instead you should be creating a user for each individual, individually, within your organization and you should always secure this root account using multi-factor authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a user group?

A

A group is simply a place to store your users. Your users will always inherit the permissions that the group has, example groups might be Developers, System Administrators, Humans Resources, Finance, et cetera.
And then to set the permissions in a group you need to create or attach a policy to that group.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a user group policy?

A

To set the permissions in a group you need to create or attach a policy to that group. Policies consist of Java Script Object Notation (or JSON) and these are referred to as key value pairs, and you’ll always have your keys such as name and then the values

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is Amazon S3?

A
  • Object-based (i.e., allows you to upload files)
  • Files can be from 0 Bytes to 5 TB
  • There is unlimited storage
  • Files are stored in Buckets
  • S3 is a universal namespace, so names must be unique globally
  • Not suitable to install an operating system on
  • Successful uploads will generate a HTTP 200 status code

ex. https://selectedregion.amazonaws.com/bucket-name

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

List the Key Fundamentals of S3.

A
  • Key (This is simply the name of the object)
  • Value (This is simply the data and is made up of a sequence of bytes).
  • Read after Write consistency for PUTS of new Objects
  • Eventual Consistency for overwrite PUTS and DELETES (can take some time to propagate)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Explain the Consistency Model for Amazon S3.

A

If you put an object up in S3 immediately (new object), you’ll be able to read that new object straight away,
but if you update an object or delete an object it can take time to propagate, for example, if you update an object and you go to read it immediately you may get the old object or you may get the new object but if you wait a couple of seconds then you’ll get the newly uploaded object.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Amazon Buckets

A
  • When you view your buckets, you view them globally but you can have buckets in individual regions.
  • You can use bucket policies to make everything in S3 bucket public.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is Cross Region Replication?

A

When you replicate the contents of one bucket to another bucket in another region, this is called Cross region replication.

For example, say you’ve got a bucket in US East 1 and you want to have a backup bucket in Sydney, as soon as you write that file to S3 it will be replicated automatically over to Sydney.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is an S3 Transfer Acceleration?

A

Instead of uploading data directly to an S3 Bucket, data is uploaded to Edge Locations and then runs through Amazon’s dedicated cable network to the S3 Bucket

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

List the 6 different types of S3 storage classes.

A
  • S3 Standard: gives you 99.99% availability and eleven 9’s durability. It’s stored across multiple availability zones and is designed to sustain
    the loss of two facilities concurrently.
  • S3 - IA (Infrequently Accessed): this is for data that’s accessed less frequently but requires rapid access
    when you need it, it’s lower than S3, but you are still charged a retrieval fee.
  • S3 One Zone - IA (Infrequently Accessed): low cost for infrequently accessed data and only uses one availability zones.
  • S3 Intelligent Tiering: designed to optimize cost by using machine learning automatically moving your data to the most cost effective tier
  • S3 Glacier: secure, durable and low-cost storage class for data archival, your retrieval time is configurable from minutes up to hours.
  • S3 Glacier Deep Archive: lowest S3 cost storage class, retrieval time of 12 hours is acceptable.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What types of websites can you host in Amazon S3?

A

S3 can be used to host static websites such as .HTML.
However, websites that required database connections such as WordPress cannot be hosted with S3.

S3 scales automatically to meet our demand. Many enterprises will use static websites in S3 if they think there’s going to be a large number of requests (such as a movie preview for example).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Exam Tip:

A
  • Edge Locations are not just read only, you can also write to them and you can put an object to them, which is what we looked at when we, were looking at transfer acceleration.
  • Remember also that objects are cached for the
    life of the Time To Live (TTL) and is always in seconds. You can clear cached objects from your Edge Locations but you will still be charged for the service.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are the Case Severity / Response Times for each Support Plan level?

A

Basic - N/A

Developer

  • General Guidance: < 24 business hours
  • System Impaired: < 12 business hours

Business

  • General Guidance: < 24 hours
  • System Impaired: < 12 hours
  • Production System Impaired: < 4 hours
  • Production System Down: < 1 hour

Enterprise

  • General Guidance: < 24 hours
  • System Impaired: < 12 hours
  • Production System Impaired: < 4 hours
  • Production System Down: < 1 hour
  • Business-Critical system Down: < 15 minutes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Explain the AWS Pricing Model.

A

On-Demand: pay by the hour
Reserved: contract terms of 1 or 3 years, the more you pay upfront the bigger the discount
Spot: allows you to bid whatever price that you want for instance capacity and if it hits your Spot price then it will provision the service for you, if the price goes up you lose instances but only pay for the minutes you use (but if you terminate the instance you pay for the full hour of usage)
Dedicated Hosts: physical servers dedicated just to you (really useful for server-bound software licenses)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

List all the EC2 instance classes (remember Fight Doctor McPixie or FIGHT DR MCPXZ)

A 
F is for FPGAs
I is for IOPS
G is for Graphics,
H is for High Disk Throughput,
T is for General Purpose, so that's what we've been using
throughout the course T2 Micros
D is for Density
R is for Ram
M is the main choice for general purpose apps,
C if for Compute,
P is for Graphics so think Pics,
X is for Extreme Memory
and Z is for Extreme Memory and CPU.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is EBS?

A

An EBS volume is best described as a virtual hard-disk in the cloud. EBS is split into SSD as well as Magnetic Storage. SSD consists of two, so we’ve got General Purpose SSD this is referred to as GP2. And we then have Provisioned IOPS SSD, this is for very high performance SSD volumes so its often referred to as IO1. Then on our Magnetic we have Throughput Optimized so we have ST1, this is low cost hard disk volume designed for frequently accessed throughput-intensive workloads. We then have Cold Hard Disk Drive, this is the lowest cost Hard Disk Drive volume that are designed for less frequently accessed workloads so think of File Servers and then we also have Magnetic which is previous generations and will probably be phased out at some point.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What are common ports used in AWS

A

Linux SSH/22
Microsoft RDP: 3389
HTTP: 80
HTTPS: 443

Basically, to let everything in, we open up 0.0.0.0/0. If we just want one IP address in, we’re going to do the individual IP address and the a /32. Security Groups are basically virtual firewalls in the cloud.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What does it mean to design for failure?

A

Things fail all the time and you should always have one EC2 instance in each availability zone, so if there is a failure you’re not going to have an outage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is EC2?

A

Amazon Elastic Compute Cloud (Amazon EC2). EC2 is a compute service and requires a private key to connect to EC2. Storing credentials on our EC2 instance is probably not a good idea because if that EC2 instance is hacked, basically, people could use that credentials to access our AWS environment anywhere in the world.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

List the three ways to interact with AWS

A
  1. Console
  2. Command Line Interface (CLI)
  3. Software Development Kit (SDK)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is the difference between user roles and access keys?

A

Roles are much more secure than using access key IDs and secret access keys, and they’re much easier to manage. And you can apply a role to an EC2 instance at any time. When you do this, the change takes place immediately. Roles are universal. You do not have to specify what regions they’re in. Similar to users, they are a product of IAM, which is a global service.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

List the three different flavors of load balancers.

A
  1. Layer 7 - make intelligent routing decisions, can see the traffic
  2. Network Load Balancers - static IP addresses, extreme performance
  3. Classic Load Balancers - low cost, test/dev
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

List the different types of AWS databases

A

RDS - (SQL/OLTP) or online transaction processing database. These consist of six different technologies
or database engines (Microsoft SQL Server, MySQL,
PostgreSQL, Oracle, Aurora, MariaDB).

DynamoDB - Amazon’s NoSQL database technology

Redshift (OLAP) - used for business intelligence or data warehousing, used for online analytics processing

ElastiCache - speed up performance of existing databases by caching very frequently used database queries, and it consists of two different types, Memcached and Redis.

Neptune - graph databases, highly scalable and highly available

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What are the two key features of RDS?

A

When we started provisioning out RDS instances we have Multiple Availability Zones. This is used solely for disaster recovery. If you need to increase your performance you wanna use Read Replicas. So Multi-AZs for DR, Read Replicas is for performance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is autoscaling?

A

Autoscaling allows you to provision multiple EC2 instances behind a load balancer, and basically, it will automatically scale depending on your demand.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is Amazon Route 53?

A

Amazon’s domain name system, or DNS service. It’s named that way after Route 66, the first interstate highway across America. The reason it’s called Route 53 is because DNS is on the port 53. Route 53 is global. It’s similar to IAM and S3. And you can use it to direct traffic all around the world, and you can even use it to register a domain name.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What is Elastic Beanstalk?

A

With Elastic Beanstalk you just, you basically upload your code. You don’t have to worry about the infrastructure that runs those applications. Basically, you upload your application. Elastic Beanstalk will automatically handle the details of capacity provisioning, load balancing, scaling, and application health monitoring. Essentially, developers use Elastic Beanstalk if they don’t know how to use AWS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

How does CloudFormation help you?

A

This helps you model and set up your AWS resources
so that you spend less time managing those resources
and more time focusing on your applications in AWS. And you just create a template. The template is a JSON template, and it describes all the AWS resources that you want, like your EC2 instances, RDS instances, et cetera, and then CloudFormation will take care of the provisioning and configuring of those resources.
You don’t need to individually go in and create and configure AWS resources yourself.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is the difference between Elastic Beanstalk

and CloudFormation?

A

Both of them are free services, however, the resources that they provision underneath, such as EC2, are not free. And the main difference is Elastic Beanstalk
is limited in what it can provision, it’s not programmable. CloudFormation is, by far, the most flexible product, and it can provision almost any AWS service, and it’s completely programmable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Which AWS services are global?

A 
IAM - When you create a user, or a group, or a role, that is created globally.
Route 53 
CloudFront
SNS 
SES
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Which AWS services can be installed on premise?

A 
Snowball
Snowball Edge
Storage Gateway
CodeDeploy 
OpsWorks
IoT Greengrass
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What is CloudWatch

A

CloudWatch is used to monitor performance. CloudWatch can monitor most of AWS as well as your applications that run on AWS. CloudWatch with EC2 will monitor events every five minutes, by default, and you can have one-minute intervals by turning on detailed monitoring. And you can create CloudWatch alarms which trigger notifications. And CloudWatch is all about performance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What is AWS Systems Manager?

A

Systems Manager can be used to manage fleets of EC2 instances and virtual machines. A piece of software is installed on each VM. This is sometimes referred to as an agent. And it can be both inside AWS as well as on premise. And then you can use the run command to install, patch, and uninstall software. And it integrates with CloudWatch to give you a dashboard of your entire estate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What is AWS’ philosophy on billing and pricing?

A

You pay as you go, pay for what you use, pay less as you use more, and pay even less when you reserve capacity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What is CapEx vs OpEx?

A

CapEx stands for capital expenditure, which is where you pay up front, and it’s fix sunk costs. So it’s like buying a server up front, or buying a whole bunch of servers, or buying network, switches or firewalls, or load balancers, et cetera.

OpEx stands for operational expenditure, which is where you pay for what you use (utility bills, electricity, gas, etc.)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What are the five basic pricing policies?

A
  1. Pay as you go:
  2. Pay less when you reserve
  3. Pay even less when using more per unit
  4. Pay less as AWS grows
  5. Custom Pricing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

List the key pricing principles and best practices that are broadly applicable.

A
  1. Understand the fundamentals of pricing
  2. Start early with cost optimization (it’s easiest to put cost visibility and control mechanisms in place before the environment grows large and complex)
  3. Maximize the power of flexibility (cost savings by not paying for services that are not running)
  4. Use the right pricing model for the job
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What are the three drivers of pricing/cost?

A
  1. Compute
  2. Storage
  3. Data Outbound (leaving AWS environment)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What services in AWS are free?

A
  • Amazon VPC (Virtual Datacenter)
  • Elastic Beanstalk (only services, not resources)
  • CloudFormation (not resources it provisions)
  • IAM
  • AutoScaling(not resources it provisions)
  • Opsworks (not resources it provisions)
  • Consolidated Billing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What determines price?

A
  • Clock hours of server time
  • Instance Type
  • Pricing Model
  • Number of Instances
  • Load Balancing Level
  • Detailed Monitoring
  • Auto Scaling (more EC2 instances you have the more you pay)
  • Elastic IP Addresses
  • Operating Systems and Software Packages
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

EC2 Pricing Models

A

On Demand - allows you to pay a fixed rate
by the hour or by the second with no commitment

Reserved - provides you with a capacity reservation and offers significant discount on the hourly charge for an instance, and your contract terms of one or three years

Spot - enables you to bid whatever price you want, for Instance capacity, which gives you a great amount of savings, but only if your application has a flexible start and end time. If your application always needs to be on always running, then you don’t want spots. So it’s where you might be doing things like batch processing or you can have the application run in the middle of the night when the prices of the cheapest. But then as soon as it comes 9 a.m. on a Monday morning, it’s stops.

Dedicated - a physical EC2 server that’s dedicated for your use. And dedicated host can help you reduce costs by allowing you to use your existing server bound software licenses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Exam Tip:

A

You can use EC2 reserved instances to reserve capacity and receive discounts on your instance usage,
compared to running on demand instances. And the more you pay up front, and the longer the contract term, the more you’re going to save.

The longer the contract term that you sign, and the more money you pay up front to AWS, the more you’re going to save versus on demand

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What determines price for Lambda (Amazon Alexa)?

A

Request Pricing

  • Free Tier: 1 million requests per month and $0.20 per 1 million requests thereafter
  • Duration Pricing: 400,000 GB-seconds per month free, up to 3.2 million seconds of compute time
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What is a tag in AWS Systems Manager?

A

A tag is metadata (data about data). It consists of a case-sensitive key-value pair. For example, you could define a tag with ‘key = Name’ and ‘value = Webserver.’ A copy of a tag can be applied to volumes, instances or both. Tags will be applied to all instances and volumes. Tags can be inherited.Tag Editor is a global services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What is the difference between tags and groups?

A

Tags are global, groups are per region

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What is a resource group?

A

Resource groups make it easy to group your resources using the tags that are assigned to them. You can group resources that share one or more tags.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What is CloudTrail?

A

CloudTrail monitors AWS Management Console actions and API calls in the AWS platform. Is a tool for auditing. CloudTrail works on a per AWS account basis and is enabled per region. And essentially, you can consolidate your logs using an S3 bucket. To do this, you need to turn CloudTrail on in the paying account, create a bucket and a bucket policy that allows cross account access, and then you turn CloudTrail on in the other accounts and you use the bucket in the paying accounts to log all your data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Exam Tip:

A

You’re paying account should be used for billing purposes only, do not deploy resources into the paying account,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

What is the default number of linked accounts you can have with consolidated billing?

A

You can actually only have 20 linked accounts only. It’s a soft limit so you can get them to increase it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Exam Tip:

A

When monitoring is enabled on the paying account, the billing data for all linked accounts is included. That’s really, really important. And you can still create billing alerts on a per individual account basis. So again, if you have a billing alert turned on for the main paying account, then the billing data for all linked accounts is going to be included in that. But then if you have a, let’s say you’ve got a Test and Dev account, and you create a billing account on that you can also still receive individual billing alerts.

64
Q

What is AWS Organizations?

A

AWS Organizations enables you to centrally apply policy-based controls across multiple accounts in the AWS Cloud. You can consolidate all your AWS accounts into an organization, and arrange all AWS accounts into distinct organizational units.

65
Q

What is the difference between AWS CloudWatch and AWS Config?

A

CloudWatch is used for monitoring performance. AWS Config is used to monitor configurations of your AWS Resources (i.e., global group changes).

66
Q

What is Athena?

A

Athena is an interactive query service which enables you to analyse and query data located in S3 using standards SQL.

  • Serverless, nothing to provision, pay per query / per TB scanned
  • No need to set up complex Extract/Transform/Load (ETL) processes
  • Works directly with data stored in S3
  • Can be used to query log files stored in S3
  • Generate business reports on data stored in S3
  • Analyse AWS cost and Usage reports
  • Run queries on click-stream data
67
Q

What is Macie?

A

Macie is a security service which uses Machine Learning and Natural Language Processing (NLP) to discover, classify, and protect sensitive data stored in S3
- Uses AI to recognize if your S3 objects contain sensitive data such as PII
- Dashboards, reporting and alerts
0 Works directly with data stored in S3
- Can also analyze CloudTrail logs
- Great for PCI-DSS and preventing ID theft

68
Q

What is AWS Artifact?

A

Used to retrieve compliance reports globally

69
Q

What is the shared responsibility model?

A

AWS is responsible for security of the cloud. Users are responsible for security in the cloud.

70
Q

What is the difference between AWS WAF and AWS Shield?

A

AWS WAF is a Web Application Firewall, designed to stop hackers. WAF operates down to Layer 7. AWS Shield is a DDOS mitigation service designed to stop DDOS attacks. Only AWS Shield Advanced offers automated application layer monitoring.

71
Q

What is the difference between AWS Inspector and AWS Trusted Advisor?

A

AWS Inspector is used for inspecting EC2 instances for vulnerabilities. AWS Inspector assesses the security and compliance of your EC2 instances. AWS Trusted Advisor inspects your AWS account as a whole (not just EC2). It does more than just security checks. It also does Cost Optimization, Performance, & Fault Tolerance.

72
Q

What is AWS Trusted Advisor?

A

Trusted Advisor helps you optimize your entire AWS environment in real time following AWS best practices. It helps you optimize cost, fault-tolerance, and more. AWS Trusted Advisor can help you assess the fault-tolerance of your AWS environment.

73
Q

Which of the following Route 53 policies allow you to a) route data to a second resource if the first is unhealthy, and b) route data to resources that have better performance?

A

Failover Routing and Latency-based Routing are the only two correct options, as they consider routing data based on whether the resource is healthy or whether one set of resources is more performant than another. Any answer containing location based routing (Geoproximity and Geolocation) cannot be correct in this case, as these types only consider where the client or resources are located before routing the data. They do not take into account whether a resource is online or slow. Simple Routing can also be discounted as it does not take into account the state of the resources.

74
Q

True or False: A CloudFront Origin can be an S3 bucket, an EC2 instance, an Elastic Load Balancer, or Route 53.

A

A CloudFront Origin can be an S3 bucket, an EC2 instance, an Elastic Load Balancer, or Route 53.

75
Q

S3 can be used to host a dynamic website, like one that runs on a LAMP stack.

A

S3 can be used to host static websites.

76
Q

What is consolidated billing?

A

Consolidated Billing is a feature of AWS organizations. Once enabled and configured, you will receive a bill containing the costs and charges for all of the AWS accounts within the organization. Although each of the individual AWS accounts are combined into a single bill, they can still be tracked individually and the cost data can be downloaded in a separate file. Using Consolidated Billing may ultimately reduce the amount you pay, as you may qualify for Volume Discounts. There is no charge for using Consolidated Billing.

77
Q

What is Amazon Lightsaile?

A

Lightsail is AWS’ Platform-as-a-Service offering.

78
Q

What steps should you take in securing your AWS account?

A

The Root account should have MFA enabled; you should always create individual users (the Root account should never be used for actual work); and groups should be used to grant permissions to the users you create.

79
Q

What are the Support Levels offered by AWS?

A

The AWS Support levels are Basic, Developer, Business, and Enterprise.

80
Q

Which of the following is the document used to grant permissions to users, groups, and roles?

A

A Policy is the document used to grant permissions to users, groups, and roles.

81
Q

Where is CloudFront content cached?

A

CloudFront content is cached in Edge Locations.

82
Q

IAM policies are written using ____.

A

JSON

83
Q

Which of the following are not valid CloudFormation template sections?

  • Parameters
  • Options
  • Outputs
  • Resources
A

In total there are 9 valid sections allowed within a CloudFormation template. In the answers above, only “Parameters”, “Resources” and “Outputs” are considered valid. “Options” is not a template section.

84
Q

True or False: To restrict access to an entire bucket, you use bucket control lists; and to restrict access to an individual object, you use object policies.

A

False. To restrict access to an entire bucket, you use bucket policies; and to restrict access to an individual object, you use access control lists.

85
Q

True or False: A Distribution is what we call a series of Edge Locations that make up CDN.

A

True. The collection of a CDN’s Edge Locations is called a Distribution.

86
Q

True or False: Access Control Lists are used to make entire buckets (like one hosting an S3 website) public.

A

False. Bucket Policies are used to make entire buckets (like one hosting an S3 website) public.

87
Q

True or False: Objects stored in S3 are stored in a single, central location within AWS.

A

False. Objects stored in S3 are stored in multiple servers in multiple facilities across AWS.

88
Q

True or False: S3 is object storage suitable for the storage of ‘flat’ files like Word documents, photos, etc.

A

True. S3 is object storage suitable for the storage of ‘flat’ files like Word documents, photos, etc.

89
Q

Which of the following AWS Support levels offers 24x7 support via phone or chat?

  • Individual
  • Basic
  • Developer
  • Business
A

Business. The Business and Enterprise support plans offer 24 X 7 technical support via phone or chat.

90
Q

There are at least ___ Availability Zones per AWS Region.

A

2

91
Q

Which of the following are AWS compute services?

  • EBS
  • SNS
  • EC2
  • Lambda
A

EC2 and Lambda are AWS Compute Services.

92
Q

Which native AWS service will act as a file system mounted on an S3 bucket?

  • Amazon S3
  • Amazon Elastic Block Store
  • AWS Storage Gateway
  • Amazon Elastic File System
A

The AWS Storage Gateway service is primarily used for attaching infrastructure located in a Data centre to the AWS Storage infrastructure. The AWS documentation states that; “You can think of a file gateway as a file system mount on S3.” Amazon Elastic File System (EFS) is a mountable file storage service for EC2, but has no connection to S3 which is an object storage service. Amazon Elastic Block Store (EBS) is a block level storage service for use with Amazon EC2 and again has no connection to S3.

93
Q

You have a mission-critical application which must be globally available at all times. Which deployment strategy should you follow?

  • Deploy to all Availability Zones in your home region.
  • Multi-VPC in two AWS Regions
  • Multi-Region
  • Multi-Availability Zone
A

A Multi-Region deployment will best ensure global availability.

94
Q

You need to host a file in a location that’s publicly accessible from anywhere in the world. Which AWS service would best meet that need?

  • EC2
  • RDS
  • EBS
  • S3
A

With S3, objects can be accessed from anywhere in the world via a dedicated URL.

95
Q

Which of the following AWS services should you use if you’d like to be notified when you have crossed a billing threshold?

  • AWS Budgets
  • CloudWatch
  • Trusted Advisor
  • AWS Cost Allocation
A

In both AWS-Budget & CloudWatch alarms can be set to monitor spending on your AWS Account.

96
Q

What is EMR?

A

Amazon EMR is a web service that makes it easy to process large amounts of data efficiently.

97
Q

What is Lambda?

A

Lambda is the AWS Function-as-a-Service (FaaS) offering that lets you run code without provisioning or managing servers.

98
Q

What is Aurora?

A

Aurora is AWS’ managed database service that is up to 5X faster than a traditional MySQL database.

99
Q

What is DMS?

A

The AWS Database Migrations Service is the best choice for conventional data migrations.

100
Q

What is Redshift?

A

Redshift is AWS’ data warehousing service.

101
Q

A developer is trying to programmatically retrieve information from an EC2 instance such as public keys, ip address, and instance id. From where can this information be retrieved?

  • Instance metadata
  • Instance Snapshot
  • Instance userdata
  • Systems Parameter Store
A

Instance metadata

Although you can create a snapshot of an EBS volume attached to an instance, this snapshot will not contain the data described in the scenario. This type of data is stored in Instance metadata.

102
Q

Your company would like to begin using auto-scaling to add servers when CPU utilization reaches a certain threshold (say 70%). What can you use to signal when CPU utilization crosses the threshold?

  • Elastic Load Balancers
  • EC2 Logs
  • CloudWatch Alarms
  • Simple Notification Service
A

CloudWatch Alarms

Elastic Load Balancer are used to balance traffic between EC2 instances, typically in an Auto Scaling Group,

A CloudWatch alarm can be set up to monitor CPU utilization and trigger further action. Further action could be an Auto Scaling Group adding another EC2 instance and/or using SNS to notify team members of the occurrence.

103
Q

A financial company needs to migrate large amounts of data, at a peta-byte scale, to AWS. Which AWS service can perform this type of migration?

  • AWS Data Pipeline
  • API Gateway
  • Database Migration Service
  • AWS Snowball
A

AWS Snowball

Amazon API Gateway is a fully managed service that makes it easy for developers to create, publish, maintain, monitor, and secure APIs at any scale. APIs act as the “front door” for applications to access data, business logic, or functionality from your backend services. Using API Gateway, you can create RESTful APIs and WebSocket APIs that enable real-time two-way communication applications. API Gateway supports containerized and serverless workloads, as well as web applications. https://aws.amazon.com/api-gateway/

Snowball is a petabyte-scale data transport solution that uses secure appliances to transfer large amounts of data into and out of the AWS cloud. Using Snowball addresses common challenges with large-scale data transfers including high network costs, long transfer times, and security concerns. https://aws.amazon.com/getting-started/projects/migrate-petabyte-scale-data/services-costs/#:~:text=Description%3A%20Snowball%20is%20a%20petabyte,transfer%20times%2C%20and%20security%20concerns.

104
Q

You would like to set up a loosely coupled architecture. Which service would allow you to send and receive messages, but most importantly, store messages if they are not consumed immediately?

  • AWS SES
  • AWS CloudSearch
  • AWS SQS
  • AWS S3
A

AWS SQS

SES is an email service, not a message queueing service. Amazon Simple Email Service (SES) is a cost-effective, flexible, and scalable email service that enables developers to send mail from within any application. You can configure Amazon SES quickly to support several email use cases, including transactional, marketing, or mass email communications.

Amazon Simple Queue Service (SQS) is a fully managed message queuing service that enables you to decouple and scale microservices, distributed systems, and serverless applications. SQS eliminates the complexity and overhead associated with managing and operating message-oriented middleware and empowers developers to focus on differentiating work. Using SQS, you can send, store, and receive messages between software components at any volume, without losing messages or requiring other services to be available. https://aws.amazon.com/sqs/

105
Q

Your company has entered into a 3-year contract with a government agency. Your best option for EC2 is reserved instances. Which AWS service would you use to track your reserved instance usage?

  • Trusted Advisor
  • AWS CloudTrail
  • AWS Cost and Usage Report
  • AWS Organizations
A

AWS Organizations helps you centrally govern your environment as you grow and scale your workloads on AWS. Whether you are a growing startup or a large enterprise, Organizations helps you to centrally manage billing; control access, compliance, and security; and share resources across your AWS accounts. https://aws.amazon.com/organizations/

The AWS Cost & Usage Report contains the most comprehensive set of AWS cost and usage data available, including additional metadata about AWS services, pricing, and reservations (e.g., Amazon EC2 Reserved Instances (RIs)). https://aws.amazon.com/aws-cost-management/aws-cost-and-usage-reporting/

106
Q

Your design team has recommended the need to distribute incoming traffic across multiple EC2 instances and also across multiple availability zones. Which AWS service can accomplish this?

  • CloudFormation
  • Auto Scaling Group
  • Elastic Load Balancer
  • CloudFront
A

Elastic Load Balancer

AWS CloudFormation provides a common language for you to model and provision AWS and third-party application resources in your cloud environment. AWS CloudFormation allows you to use programming languages or a simple text file to model and provision, in an automated and secure manner, all the resources needed for your applications across all regions and accounts. This gives you a single source of truth for your AWS and third-party resources, but it is not what your design team is looking for.

Elastic Load Balancing automatically distributes incoming application traffic across multiple targets, such as Amazon EC2 instances, containers, IP addresses, and Lambda functions. It can handle the varying load of your application traffic in a single Availability Zone or across multiple Availability Zones. Elastic Load Balancing offers three types of load balancers that all feature the high availability, automatic scaling, and robust security necessary to make your applications fault-tolerant. https://aws.amazon.com/elasticloadbalancing/

107
Q

You need to visualize, understand, and manage your AWS costs and usage over time. Which AWS tool would you use?

  • CloudWatch
  • Trusted Advisor
  • Cost Explorer
  • AWS Cost and Usage Report
A

Cost Explorer

AWS Cost Explorer lets you visualize, understand, and manage your AWS costs and usage over time. You can analyze your cost and usage data at a high level (e.g., total costs and usage across all accounts in your organization) or for highly specific requests. https://docs.aws.amazon.com/whitepapers/latest/cost-optimization-reservation-models/aws-cost-explorer.html

108
Q

A company wants to deploy applications entirely on a serverless platform. Which AWS service can they upload their applications to and not have to worry about managing servers?

  • EC2
  • Elasticache
  • AWS Lambda
  • CloudFormation
A

AWS Lambda

AWS CloudFormation allows you to use programming languages or a simple text file to model and provision, in an automated and secure manner, all the resources needed for your applications across all regions and accounts. It is not what your team is looking for in this instance.

AWS Lambda lets you run code without provisioning or managing servers. You pay only for the compute time you consume. https://aws.amazon.com/lambda/

109
Q

You are storing sensitive employee information in an S3 Bucket. What can you use to give bucket access only to authorized personnel?

  • Network Access Control List
  • Access Keys
  • Bucket Policy
  • Login and password
A

Bucket Policy

S3 bucket policies specify what actions are allowed or denied for which principals on the bucket that the bucket policy is attached to (e.g., allow user Alice to PUT but not DELETE objects in the bucket). https://aws.amazon.com/blogs/security/iam-policies-and-bucket-policies-and-acls-oh-my-controlling-access-to-s3-resources/#:~:text=In%20other%20words%2C%20IAM%20policies,do%20in%20your%20AWS%20environment.&text=S3%20bucket%20policies%20specify%20what,DELETE%20objects%20in%20the%20bucket).

110
Q

A fantasy sports company needs to run an application for the length of a football season (5 months). They will run the application on an EC2 instance and there can be no interruption. Which purchasing option best suits this use case?

  • On-Demand
  • Reserved
  • Dedicated
  • Spot
A

On-Demand.

This is not a long enough term to make reserved instances the better option. Plus, the application can’t be interrupted, which rules out spot instances.

111
Q

Which policy will provide information on performing penetration testing on your EC2 instances?

  • AWS Acceptable use policy
  • IAM Policy
  • JSON Policy
  • AWS Terms and Conditions Policy
A

AWS Acceptable use policy

This AWS Customer Agreement (this “Agreement”) contains the terms and conditions that govern your access to and use of the Service Offerings.

The policy states that penetration testing may be performed by customers on their own instances with prior approval from AWS.

112
Q

You need to purchase reserved instances for a 3-year project. But a company initiative may change all the company compute operating systems from Windows to Linux midway through this project. What type of reserved instance should you purchase?

  • Automatic
  • Standard
  • Convertible
  • Zonal
A

Convertible

Can be exchanged during the term for another Convertible Reserved Instance with new attributes including instance family, instance type, platform, scope, or tenancy. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/reserved-instances-types.html

113
Q

You have joined a small company and inherited an AWS application built within the EC2 Classic network. Which Load Balancer will work with this application?

  • Application Load Balancer
  • Network Load Balancer
  • Classic Load Balancer
  • None, the application needs to be upgraded.
A

Classic Load Balancer

Classic Load Balancer provides basic load balancing across multiple Amazon EC2 instances and operates at both the request level and connection level. Classic Load Balancer is intended for applications that were built within the EC2-Classic network. https://aws.amazon.com/elasticloadbalancing/

114
Q

You are creating a few IAM policies. This is the first time you have worked with IAM policies. Which tool can you use to test IAM policies?

  • CloudWatch
  • IAM Policy Simulator
  • Amazon GuardDuty
  • Amazon Inspector
A

IAM Policy Simulator

AWS Inspector actually examines your applications and looks for security vulnerabilities, but it can not examine individual policies. Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS. Amazon Inspector automatically assesses applications for exposure, vulnerabilities, and deviations from best practices. After performing an assessment, Amazon Inspector produces a detailed list of security findings prioritized by levels of severity. These findings can be reviewed directly or as part of detailed assessment reports which are available via the Amazon Inspector console or API. https://aws.amazon.com/inspector/

With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies, and resource-based policies. https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html

115
Q

A gaming company is using the AWS Developer Tool Suite to develop, build, and deploy their applications. Which AWS service can be used to trace user requests from end-to-end through the application?\

  • AWS X-Ray
  • CloudWatch
  • AWS Inspector
  • CloudTrail
A

AWS X-Ray

AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. With CloudTrail, you can log, continuously monitor, and retain account activity related to actions across your AWS infrastructure. CloudTrail provides event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services. https://aws.amazon.com/cloudtrail/

AWS X-Ray helps developers analyze and debug production, distributed applications, such as those built using a microservices architecture. With X-Ray, you can understand how your application and its underlying services are performing to identify and troubleshoot the root cause of performance issues and errors. X-Ray provides an end-to-end view of requests as they travel through your application, and shows a map of your application’s underlying components. https://aws.amazon.com/xray/

116
Q

You need to launch an EC2 instance in AWS and control access to it. Which AWS service can help with this?

  • Amazon RDS
  • Elastic Network Interface
  • Amazon Virtual Private Cloud
  • Amazon Route 53
A

Amazon Virtual Private Cloud

RDS (Relational Database Service) enables the creation and management of relational databases in AWS.

Amazon Virtual Private Cloud (Amazon VPC) lets you provision a logically isolated section of the AWS Cloud where you can launch AWS resources in a virtual network that you define. You have complete control over your virtual networking environment, including the selection of your own IP address range, creation of subnets, and configuration of route tables and network gateways. You can use both IPv4 and IPv6 in your VPC for secure and easy access to resources and applications. https://aws.amazon.com/vpc/

117
Q

Your company hosts gaming applications online and would like to deliver these apps to a worldwide audience. Which AWS Service would enable delivery to users worldwide and greatly improve response times?

  • DynamoDB
  • Elasticache
  • CloudFront
  • CloudFormation
A

CloudFront

Amazon ElastiCache allows you to seamlessly set up, run, and scale popular open-Source compatible in-memory data stores in the cloud. Build data-intensive apps or boost the performance of your existing databases by retrieving data from high throughput and low latency in-memory data stores. It is not for delivery. https://aws.amazon.com/elasticache/

Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds, all within a developer-friendly environment.

118
Q

You need to stream data in real-time for a dashboard application. Which AWS service would you use?

  • AWS Kinesis
  • AWS CloudWatch
  • AWS CloudTrail
  • Amazon RedShift
A

AWS Kinesis

Amazon Kinesis makes it easy to collect, process, and analyze real-time, streaming data so you can get timely insights and react quickly to new information. https://aws.amazon.com/kinesis/

119
Q

You have a web application that needs to run for a short period of time (a couple days). It is alright if there are interruptions in the application. Which EC2 instance type would be best for this use case?

  • On_Demand
  • Reserved
  • Dedicated Instance
  • Spot
A

Spot

Spot Instances are a great choice for this use case. Amazon EC2 Spot Instances let you take advantage of unused EC2 capacity in the AWS cloud. Spot Instances are available at up to a 90% discount compared to On-Demand prices. You can use Spot Instances for various stateless, fault-tolerant, or flexible applications such as big data, containerized workloads, CI/CD, web servers, high-performance computing (HPC), and other test & development workloads. The key phrase in this question is, “It is alright if there are interruptions in the application”. If the application could not accept interruptions, then the best option would be on-demand.

120
Q

Which S3 storage class is the best value for long-term storage?

  • S3 Standard Infrequent-Access
  • Glacier
  • S3 Standard
  • S3 Intelligent-Tiering
A

Glacier is a low-cost storage option for Data Archiving. It can take several hours to retrieve the data, but if this is acceptable, it is the best value for long-term storage of data. https://aws.amazon.com/s3/storage-classes/

121
Q

You are trying out AWS on a trial basis and need to deploy an application without having to configure servers. Which AWS service can you use?

  • ECS
  • CloudFormation
  • Auto Scaling
  • Elastic Beanstalk
A

Elastic Beanstalk

You will have to configure servers, using CloudFormation Templates, to host applications. AWS CloudFormation provides a common language for you to model and provision AWS and third-party application resources in your cloud environment. https://aws.amazon.com/cloudformation/

AWS Elastic Beanstalk is an easy-to-use service for deploying and scaling web applications and services developed with Java, .NET, PHP, Node.js, Python, Ruby, Go, and Docker on familiar servers such as Apache, Nginx, Passenger, and IIS. https://aws.amazon.com/elasticbeanstalk/

122
Q

Your company has recently migrated large amounts of data to the AWS cloud in S3 buckets. But it is necessary to discover and protect the sensitive data in these buckets. Which AWS service can do that?

  • GuardDuty
  • Amazon Macie
  • CloudTrail
  • AWS Inspector
A

Amazon Macie

Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS. https://aws.amazon.com/macie/

123
Q

A new web application is getting much more traffic than expected. You decide to add another EC2 instance to share the load. Which AWS principle does this represent?

  • Durability
  • Vertical Scaling
  • Elasticity
  • Horizontal Scaling
A

Horizontal Scaling

Elasticity is the ability to acquire resources as you need them and release resources when you no longer need them. Think of auto-scaling and adding and removing instances as needed.

Horizontal Scaling is the act of changing the number of nodes in a computing system without changing the size of any individual node. So, with horizontal scaling, we would add instances.

124
Q

A company needs to use a Load Balancer which can serve traffic at the TCP, and UDP layers. Additionally, it needs to handle millions of requests per second at very low latencies. Which Load Balancer should they use?

  • TCP Load Balancer
  • Application Load Balancer
  • Classic Load Balancer
  • Network Load Balancer
A

Network Load Balancer

Network Load Balancer is best suited for load balancing of Transmission Control Protocol (TCP), User Datagram Protocol (UDP) and Transport Layer Security (TLS) traffic where extreme performance is required. Operating at the connection level (Layer 4), Network Load Balancer routes traffic to targets within Amazon Virtual Private Cloud (Amazon VPC) and is capable of handling millions of requests per second while maintaining ultra-low latencies. https://aws.amazon.com/elasticloadbalancing/

125
Q

After experiencing unusual behavior in your AWS account, you need to determine if there are any issues with AWS that may be affecting your account?

  • AWS Service Health Dashboard
  • AWS SNS
  • AWS Personal Health Dashboard
  • AWS CloudWatch
A

AWS Personal Health Dashboard

The Service Health Dashboard provides a general overview of all of the AWS services, but it does not detail problems that may directly affect your AWS account.

AWS Personal Health Dashboard provides alerts and remediation guidance when AWS is experiencing events that may impact you. While the Service Health Dashboard displays the general status of AWS services, Personal Health Dashboard gives you a personalized view into the performance and availability of the AWS services underlying your AWS resources. https://aws.amazon.com/premiumsupport/technology/personal-health-dashboard/

126
Q

You are about to migrate a MySQL database to the AWS Cloud. Which AWS service can help with this?

  • AWS VPN
  • AWS Database Migration Service
  • AWS SnowBall
  • AWS Direct Connect
A

AWS Database Migration Service

AWS Database Migration Service helps you migrate databases to AWS quickly and securely. The source database remains fully operational during the migration, minimizing downtime to applications that rely on the database. The AWS Database Migration Service can migrate your data both to and from most of the widely used commercial and open-source databases. https://aws.amazon.com/dms/

127
Q

A colleague tells you about a service that uses machine learning to discover and protect sensitive data stored in S3 Buckets. Which AWS service does this?

  • Cognito
  • Macie
  • Rekognition
  • Inspector
A

Macie

Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS. https://aws.amazon.com/macie/

128
Q

During Disaster Recovery exercises, you need to re-route traffic from EC2 instances to instances in another region. With which service can you do this?

  • Route 53
  • AWS Auto Scaling
  • VPC Peering
  • CloudFront
A

Route 53

Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds, all within a developer-friendly environment. CloudFront is integrated with AWS – both physical locations that are directly connected to the AWS global infrastructure, as well as other AWS services.

Route 53 can be used for Disaster Recovery by simply shifting traffic to the new region. Amazon Route 53 is a highly available and scalable cloud Domain Name System (DNS) web service. It is designed to give developers and businesses an extremely reliable and cost-effective way to route end users to Internet applications by translating names like www.example.com into the numeric IP addresses like 192.0.2.1 that computers use to connect to each other. Amazon Route 53 is fully compliant with IPv6 as well.

129
Q

A company is configuring IAM for its new AWS account. There are 5 departments with between 5 to 10 users in each department. How can they efficiently apply access permissions for each of these departments?

  • Create a policy defining the permissions needed. Create an IAM Group and attach the policy to the group. Add the department’s members to the group.
  • Create a policy defining the permissions needed. Attach the policy to all users in the department.
  • Create a role defining the permissions needed. Create an IAM Group and attach the policy to the group. Add the department’s members to the group.
  • Create an IAM group for each department. Add the department’s members to the group.
A

Create a policy defining the permissions needed. Create an IAM Group and attach the policy to the group. Add the department’s members to the group.

By creating a group, all like users can be managed all at one time.

130
Q

Which of the following can you use as a web-based interface to view processes in AWS?

  • AWS CLI
  • AWS SDK
  • AWS Management Console
  • AWS API
A

AWS Management Console

AWS Management Console is a web application for managing Amazon Web Services.

131
Q

A retail company has EC2 On-Demand instances running to serve customer transactions. There is a set pattern of traffic where demand is high at two points in the day, but the instances sit idle for much of the day. What is a good way to optimize these resources?

  • Use reserved instances instead of on-demand instances.
  • Write a script to stop instances when demand is low.
  • Use an Elastic Load Balancer to scale out and in based on demand.
  • Use an Auto Scaling Group to scale out and in based on demand.
A

Use an Auto Scaling Group to scale out and in based on demand.

The Auto Scaling Group can be used to scale out and scale in the instances as the demand dictates. This will save money and avoid having instances sitting idle for long periods of time.

AWS Auto Scaling monitors your applications and automatically adjusts your capacity to maintain steady, predictable performance at the lowest possible cost. Using AWS Auto Scaling, it’s easy to set up application scaling for multiple resources across multiple services in minutes. https://aws.amazon.com/autoscaling/

132
Q

In AWS Global Infrastructure, which component has one or more discrete data centers with redundant power, networking, and connectivity?

  • Route 53
  • Placement Group
  • VPC
  • Availability Zone
A

Availability Zone

An Availability Zone (AZ) is one or more discrete data centers with redundant power, networking, and connectivity in an AWS Region. Availability Zones allow you to operate production applications and databases that are more highly available, fault-tolerant, and scalable than would be possible from a single data center. All Availability Zones in an AWS Region are interconnected with high-bandwidth, low-latency networking, over fully redundant, dedicated metro fiber providing high-throughput, low-latency networking between Availability Zones. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html

133
Q

Which AWS service provides central governance and management across multiple AWS accounts?

  • CloudFormation
  • Identity and Access Management
  • AWS Systems Manager
  • AWS Organizations
A

AWS Organizations

AWS Organizations helps you centrally govern your environment as you grow and scale your workloads on AWS. Whether you are a growing startup or a large enterprise, AWS Organizations helps you to centrally manage billing, control access, compliance, and security, and share resources across your AWS accounts.

Using AWS Organizations, you can automate account creation, create groups of accounts to reflect your business needs, and apply policies for these groups for governance. You can also simplify billing by setting up a single payment method for all of your AWS accounts. Through integrations with other AWS services, you can use Organizations to define central configurations and resource sharing across accounts in your organization. AWS Organizations is available to all AWS customers at no additional charge. https://aws.amazon.com/organizations/

134
Q

A travel company has an application that serves customers worldwide. Which AWS service can speed up delivery of content to this widespread customer base?

  • OpsWorks
  • S3
  • CloudFront
  • CodeDeploy
A

CloudFront

Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds, all within a developer-friendly environment. CloudFront is integrated with AWS – both physical locations that are directly connected to the AWS global infrastructure, as well as other AWS services. https://aws.amazon.com/cloudfront/

135
Q

After creating an EC2 instance to host an application, the traffic to the site far exceeds what was expected. You decide to move to a larger instance type. What AWS principal does this represent?

  • Durability
  • Horizontal Scaling
  • Elasticity
  • Vertical Scaling
A

Vertical Scaling

Horizontal Scaling is the act of changing the number of nodes in a computing system without changing the size of any individual node. So, with horizontal scaling, we would add instances, not increase the size of an instance.

Vertical Scaling is increasing the size and computing power of a single instance or node without increasing the number of nodes or instances.

136
Q

Which of the following is an AWS Global Service?

  • VPC
  • RDS
  • EC2
  • CloudFront
A

CloudFront

Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds, all within a developer-friendly environment. https://aws.amazon.com/cloudfront/

137
Q

Upon venturing into using the AWS Cloud, your company decides to follow the 5 pillars of the AWS Well Architected Framework. Which items are pillars of the Well Architected Framework? (Choose 2)

  • Reliability
  • Scalability
  • Elasticity
  • Operational Excellence
  • Ease of Use
A

Reliability and Operational Excellence

Scalability is certainly a concept that can be achieved with AWS resources, but it is not one of the 5 pillars of a well architected framework: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization.

The 5 pillars of a Well Architected Framework - Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization.

The reliability pillar includes the ability of a system to recover from infrastructure or service disruptions, dynamically acquire computing resources to meet demand, and mitigate disruptions such as misconfigurations or transient network issues. https://aws.amazon.com/blogs/apn/the-5-pillars-of-the-aws-well-architected-framework/

The operational excellence pillar includes the ability to run and monitor systems to deliver business value and to improve supporting processes and procedures continually. https://aws.amazon.com/blogs/apn/the-5-pillars-of-the-aws-well-architected-framework/

138
Q

After creating an EC2 instance to host an application, the traffic to the site far exceeds what was expected. You decide to move to a larger instance type. What AWS principal does this represent?

  • Durability
  • Horizontal Scaling
  • Elasticity
  • Vertical Scaling
A

Vertical Scaling

Horizontal Scaling is the act of changing the number of nodes in a computing system without changing the size of any individual node. So, with horizontal scaling, we would add instances, not increase the size of an instance.

Vertical Scaling is increasing the size and computing power of a single instance or node without increasing the number of nodes or instances.

139
Q

Your company hosts gaming applications online and would like to deliver these apps to a worldwide audience. Which AWS Service would enable delivery to users worldwide and greatly improve response times?

  • DynamoDB
  • Elasticache
  • CloudFront
  • CloudFormation
A

CloudFront

Amazon ElastiCache allows you to seamlessly set up, run, and scale popular open-Source compatible in-memory data stores in the cloud. Build data-intensive apps or boost the performance of your existing databases by retrieving data from high throughput and low latency in-memory data stores. It is not for delivery. https://aws.amazon.com/elasticache/

Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds, all within a developer-friendly environment.

140
Q

The CFO of a software company had requested an Executive Summary detailing the advantages of a potential move to the AWS Cloud. What can you say is an advantage of an RDS database over a traditional database?

  • It is much easier to convert to a NoSQL database.
  • AWS maintains the underlying OS and performs software patching on the database.
  • It is 5 times faster than traditional databases.
  • There is much greater access for DBAs.
A

AWS maintains the underlying OS and performs software patching on the database.

This is not true as a general statement. Amazon Aurora is up to 5 times faster than MySQL RDS.

Amazon Relational Database Service (Amazon RDS) makes it easy to set up, operate, and scale a relational database in the cloud. It provides cost-efficient and resizable capacity while automating time-consuming administration tasks such as hardware provisioning, database setup, patching, and backups. It frees you to focus on your applications so you can give them the fast performance, high availability, security, and the compatibility they need. https://aws.amazon.com/rds/

141
Q

You are trying out AWS on a trial basis and need to deploy an application without having to configure servers. Which AWS service can you use?

  • ECS
  • CloudFormation
  • Auto Scaling
  • Elastic Beanstalk
A

Elastic Beanstalk

You will have to configure servers, using CloudFormation Templates, to host applications. AWS CloudFormation provides a common language for you to model and provision AWS and third-party application resources in your cloud environment. https://aws.amazon.com/cloudformation/

AWS Elastic Beanstalk is an easy-to-use service for deploying and scaling web applications and services developed with Java, .NET, PHP, Node.js, Python, Ruby, Go, and Docker on familiar servers such as Apache, Nginx, Passenger, and IIS. https://aws.amazon.com/elasticbeanstalk/

142
Q

Upon venturing into using the AWS Cloud, your company decides to follow the 5 pillars of the AWS Well Architected Framework. Which items are pillars of the Well Architected Framework? (Choose 2)

  • Reliability
  • Scalability
  • Elasticity
  • Operational Excellence
  • Ease of Use
A

Reliability and Operational Excellence

Scalability is certainly a concept that can be achieved with AWS resources, but it is not one of the 5 pillars of a well architected framework: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization.

The 5 pillars of a Well Architected Framework - Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization.

The reliability pillar includes the ability of a system to recover from infrastructure or service disruptions, dynamically acquire computing resources to meet demand, and mitigate disruptions such as misconfigurations or transient network issues. https://aws.amazon.com/blogs/apn/the-5-pillars-of-the-aws-well-architected-framework/

The operational excellence pillar includes the ability to run and monitor systems to deliver business value and to improve supporting processes and procedures continually. https://aws.amazon.com/blogs/apn/the-5-pillars-of-the-aws-well-architected-framework/

143
Q

After configuring your VPC and all of the resources within it, you want to add an extra layer of security at the subnet level. Which will you use to add this security?

  • Security Group
  • Network ACL
  • Private IP Address
  • IAM
A

Network ACL

A network access control list (ACL) is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets. You might set up network ACLs with rules similar to your security groups to add an additional layer of security to your VPC. https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html

144
Q

A network security team has noticed some malicious activity on the company AWS account. Which AWS service can be used to detect malicious activity and help protect the account?

  • AWS Shield
  • AWS Inspector
  • Amazon Macie
  • Amazon GuardDuty
A

Amazon GuardDuty

Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads. With the cloud, the collection and aggregation of account and network activities is simplified, but it can be time-consuming for security teams to continuously analyze event log data for potential threats. With GuardDuty, you now have an intelligent and cost-effective option for continuous threat detection in the AWS Cloud. https://aws.amazon.com/guardduty/

145
Q

Which is a core design principle for deploying resources in AWS?

  • Use a tight coupling of your resources and applications.
  • Plan ahead for hardware capacity.
  • Deploy in Multiple Availability Zones.
  • Estimate your S3 storage needs up front.
A

Deploy in Multiple Availability Zones

Deploying in Multiple Availability zones will protect against downtime should an Availability Zone be lost.

146
Q

Your company is migrating its services to the AWS cloud. The DevOps team has heard about infrastructure as code, and wants to investigate this concept. Which AWS service would they investigate?

  • AWS CloudFormation
  • AWS Lambda
  • CodeCommit
  • Elastic Beanstalk
A

AWS CloudFormation

AWS CloudFormation is a service that helps you model and set up your Amazon Web Services resources so that you can spend less time managing those resources and more time focusing on your applications that run in AWS. https://aws.amazon.com/cloudformation/

147
Q

As an AWS account administrator, you are in charge of creating AWS accounts and securing those accounts. What steps can you take? (Choose 2)

  • Create multi-factor authentication for the root account.
  • Add IP restrictions for all accounts
  • Store the root account credentials in sharepoint.
  • Grant admin access to all users.
  • Create functional groups for each department and use a common password for each group.
A

Create multi-factor authentication for the root account and Add IP restrictions for all accounts

This will add an additional layer of security to the root account.

This would greatly limit who can access your environment and from where.

148
Q

A small startup is configuring its AWS cloud environment. Which AWS service will allow grouping these users together and applying permissions to them as a group?

  • Resource Groups
  • AWS Organizations
  • Tagging
  • AWS IAM
A

AWS IAM

You can not assign permissions with tagging. Amazon Web Services allows customers to assign metadata to their AWS resources in the form of tags. Each tag is a simple label consisting of a customer-defined key and an optional value that can make it easier to manage, search for, and filter resources by purpose, owner, environment, or other criteria.

AWS Identity and Access Management (IAM) enables you to manage access to AWS services and resources securely. Using IAM, you can create and manage AWS users and groups, and use permissions to allow and deny their access to AWS resources. https://aws.amazon.com/iam/

149
Q

With which AWS service, coupled with EC2, can you implement elasticity by adding and removing instances as needed?

  • CloudFormation
  • Auto Scaling
  • AWS Systems Manager
  • Elastic Beanstalk
A

Auto Scaling

Elastic Beanstalk can create EC2 instances automatically, and it can also create Auto Scaling Groups, but it does not interact with EC2 in adding and removing instances elastically.

AWS Auto Scaling monitors your applications and automatically adjusts capacity to maintain steady, predictable performance at the lowest possible cost. In this way, the necessary EC2 instances will expand and contract based on the current demands placed on the application.

150
Q

What is the most cost effective AWS Support Plan if you want the full set of Trusted Advisor checks?

  • Basic
  • Developer
  • Business
  • Enterprise
A

Business

The Business Plan is the cheapest plan that will still provide the full set of Trusted Advisor checks. https://aws.amazon.com/premiumsupport/plans/

151
Q

When configuring an Application Load Balancer, what step will you take to ensure a highly available architecture?

  • Configure the Load Balancer to serve traffic to multiple Availability Zones.
  • Set up cross-region Load Balancing.
  • Set up multiple Edge Locations for your load balancer.
  • Set up more than one ALB.
A

Configure the Load Balancer to serve traffic to multiple Availability Zones.

Load Balancing can be set up to serve traffic across multiple availability zones (not multi-region).

You would set up the load balancer to deliver traffic across multiple availability zones. https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/enable-disable-az.html

152
Q

Which is a core design principle for deploying resources in AWS?

  • Use a tight coupling of your resources and applications.
  • Plan ahead for hardware capacity.
  • Deploy in Multiple Availability Zones.
  • Estimate your S3 storage needs up front.
A

Deploy in Multiple Availability Zones

Deploying in Multiple Availability zones will protect against downtime should an Availability Zone be lost.

153
Q

Your company is migrating its services to the AWS cloud. The DevOps team has heard about infrastructure as code, and wants to investigate this concept. Which AWS service would they investigate?

  • AWS CloudFormation
  • AWS Lambda
  • CodeCommit
  • Elastic Beanstalk
A

AWS CloudFormation

AWS CloudFormation is a service that helps you model and set up your Amazon Web Services resources so that you can spend less time managing those resources and more time focusing on your applications that run in AWS. https://aws.amazon.com/cloudformation/

154
Q

A small startup is configuring its AWS cloud environment. Which AWS service will allow grouping these users together and applying permissions to them as a group?

  • Resource Groups
  • AWS Organizations
  • Tagging
  • AWS IAM
A

AWS IAM

You can not assign permissions with tagging. Amazon Web Services allows customers to assign metadata to their AWS resources in the form of tags. Each tag is a simple label consisting of a customer-defined key and an optional value that can make it easier to manage, search for, and filter resources by purpose, owner, environment, or other criteria.

AWS Identity and Access Management (IAM) enables you to manage access to AWS services and resources securely. Using IAM, you can create and manage AWS users and groups, and use permissions to allow and deny their access to AWS resources. https://aws.amazon.com/iam/

155
Q

Which AWS service can help you optimize your AWS environment by giving recommendations to reduce cost, increase security, and improve performance?

  • AWS Optimizations
  • AWS Trusted Advisor
  • AWS Inspector
  • AWS CloudWatch
A

AWS Trusted Advisor

AWS Trusted Advisor is an online tool that provides you real-time guidance to help you provision your resources following AWS best practices. Trusted Advisor checks help optimize your AWS infrastructure, increase security and performance, reduce your overall costs, and monitor service limits. Whether establishing new workflows, developing applications, or as part of ongoing improvement, take advantage of the recommendations provided by Trusted Advisor on a regular basis to help keep your solutions provisioned optimally. https://aws.amazon.com/premiumsupport/technology/trusted-advisor/

156
Q

A software development team has requested IAM access to be able to work with AWS from the CLI. What will you provide these developers?

  • Access Keys
  • Security Token
  • Username and password
  • Root user credentials
A

Access Keys

Access keys are long-term credentials for an IAM user or the AWS account root user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html

AWS Cloud Professional (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions