Exam Questions Flashcards
Which AWS database service provides a fully managed data warehouse that can be analyzed using SQL tools and business intelligence tools?
Amazon Dynamo DB
Amazon ElastiCache
Amazon RDS
Amazon RedShift
Amazon RedShift is a fully managed data warehouse service designed to handle petabytes of data for analysis. Data can be analyzed with standard SQL tools and business intelligence tools. RedShift allows you to run complex analytic queries against petabytes of structured data.
CORRECT: “Amazon RedShift” is the correct answer.
INCORRECT: “Amazon RDS” is incorrect. RDS is Amazon’s transactional relational database.
INCORRECT: “Amazon DynamoDB” is incorrect. DynamoDB is Amazon’s non-relational database service.
INCORRECT: “Amazon ElastiCache” is incorrect. ElastiCache is a data caching service that is used to help improve the speed/performance of web applications running on AWS.
A security operations engineer needs to implement threat detection and monitoring for malicious or unauthorized behavior. Which service should be used?
AWS KMS
Amazon GuardDuty
AWS Shield
AWS CloudHSM
Amazon GuardDuty offers threat detection and continuous security monitoring for malicious or unauthorized behavior to help you protect your AWS accounts and workloads.
CORRECT: “AWS GuardDuty” is the correct answer.
INCORRECT: “AWS Shield” is incorrect. AWS Shield is a managed Distributed Denial of Service (DDoS) protection service.
INCORRECT: “AWS KMS” is incorrect. AWS Key Management Service gives you centralized control over the encryption keys used to protect your data.
INCORRECT: “AWS CloudHSM” is incorrect. AWS CloudHSM is a cloud-based hardware security module (HSM) that enables you to easily generate and use your own encryption keys on the AWS Cloud.
Which AWS services are associated with Edge Locations? (Select TWO.)
AWS Config AWS Shield AWS Direct Connect Amazon EBS Amazon CloudFront
Edge Locations are parts of the Amazon CloudFront content delivery network (CDN) that are all around the world and are used to get content closer to end-users for better performance.
AWS Shield which protects against Distributed Denial of Service (DDoS) attacks is available globally on Amazon CloudFront Edge Locations.
CORRECT: “Amazon CloudFront” is a correct answer.
CORRECT: “AWS Shield” is also a correct answer.
INCORRECT: “AWS Direct Connect” is incorrect. AWS Direct Connect is a networking service used for creating a hybrid cloud between on-premises and AWS Cloud using a private network connection
INCORRECT: “Amazon EBS” is incorrect. Amazon EBS is a storage service.
INCORRECT: “AWS Config” is incorrect. AWS Config is used for evaluating the configuration state of AWS resources.
What is a benefit of moving an on-premises database to Amazon Relational Database Service (RDS)?
- You can run any database engine
- You can scale vertically w/out downtime
- There is no database administration required
- There is no need to manage operating systems
With Amazon RDS, which is a managed service, you do not need to manage operating systems. This reduces operational costs.
CORRECT: “There is no need to manage operating systems” is the correct answer.
INCORRECT: “You can scale vertically without downtime” is incorrect. You cannot scale vertically without downtime. When scaling with RDS you must change the instance type, and this requires a short period of downtime while the instances’ operating system reboots.
INCORRECT: “There is no database administration required” is incorrect. There is still database administration required in the cloud. You don’t manage the underlying operating system but still need to manage your own tables and data within the DB.
INCORRECT: “You can run any database engine” is incorrect. You cannot run any database engine with RDS. The options are MySQL, Microsoft SQL, MariaDB, Oracle, PostgreSQL and Aurora.
Which service can an organization use to track API activity within their account?
AWS IAM
AWS CloudTrail
Amazon CloudWatch
AWS CloudHSM
AWS CloudTrail is a web service that records activity made on your account and delivers log files to an Amazon S3 bucket. CloudTrail is for auditing (CloudWatch is for performance monitoring).
CloudTrail is about logging and saves a history of API calls for your AWS account. Provides visibility into user activity by recording actions taken on your account. API history enables security analysis, resource change tracking, and compliance auditing
CORRECT: “AWS CloudTrail” is the correct answer.
INCORRECT: “Amazon CloudWatch” is incorrect. Amazon CloudWatch is a monitoring service for AWS cloud resources and the applications you run on AWS. CloudWatch is for performance monitoring (CloudTrail is for auditing). Used to collect and track metrics, collect and monitor log files, and set alarms.
INCORRECT: “AWS IAM” is incorrect. AWS Identity and Access Management is an identity service that provide authentication and authorization services
INCORRECT: “AWS CloudHSM” is incorrect. AWS CloudHSM is a cloud-based hardware security module (HSM) that enables you to easily generate and use your own encryption keys on the AWS Cloud.
How does Amazon EC2 Auto Scaling help with resiliency?
- By distributing connections to EC2 instances
- By changing instance types to increase capacity
- By launching and terminating instances as needed
- By automating the failover applications
Amazon EC2 Auto Scaling launches and terminates instances as demand changes. This helps with resiliency and high availability as it can also be set to ensure a minimum number of instances are always available.
CORRECT: “By launching and terminating instances as needed” is the correct answer.
INCORRECT: “By distributing connections to EC2 instances” is incorrect. Auto Scaling is not responsible for distributing connections to EC2 instances, that is a job for an Elastic Load Balancer (ELB).
INCORRECT: “By changing instance types to increase capacity” is incorrect. Auto Scaling does not change the instance type. You have to create a new launch configuration if you need to increase your instance size, this is not automatic.
INCORRECT: “By automating the failover of applications” is incorrect. Auto Scaling does not do application failover.
You have been running an on-demand Amazon EC2 instance running Linux for 4hrs, 5 minutes and 6 seconds. How much time will you be billed for?
4hrs, 5mins, and 6 seconds
5hrs
4hrs, 6mins
4hrs
On-demand, Reserved and Spot Amazon EC2 Linux instances are charged per second with a minimum charge of 1 minute. Therefore, as the minimum has been exceeded, exactly 4hrs, 5mins and 6 seconds will be charged.
CORRECT: “4hrs, 5mins, and 6 seconds” is the correct answer.
INCORRECT: “5hrs” is incorrect as explained above.
INCORRECT: “4hrs, 6mins” is incorrect as explained above.
INCORRECT: “4hrs” is incorrect as explained above.
Which of the options below are recommendations in the cost optimization pillar of the well-architected framework? (Select TWO.)
Start spending money on data center operations Adopt a capital expenditure model Analyze and attribute expenditure Manage your services independently Adopt a consumption model
The cost optimization pillar includes the ability to avoid or eliminate unneeded cost or suboptimal resource.
There are five design principles for cost optimization in the cloud:
– Adopt a consumption model.
– Measure overall efficiency.
– Stop spending money on data center operations.
– Analyze and attribute expenditure.
– Use managed services to reduce cost of ownership.
CORRECT: “Adopt a consumption model” is the correct answer.
CORRECT: “Analyze and attribute expenditure” is the correct answer.
INCORRECT: “Adopt a capital expenditure model” is incorrect. Please refer to the design principles above.
INCORRECT: “Start spending money on data center operations” is incorrect. Please refer to the design principles above.
INCORRECT: “Manage your services independently” is incorrect. Please refer to the design principles above.
Which AWS service can be used to track the activity of users on AWS?
Amazon CloudWatch
Amazon Inspector
AWS CloudTrail
AWS Directory Service
AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. With CloudTrail, you can log, continuously monitor, and retain account activity related to actions across your AWS infrastructure.
Think of CloudTrail is an auditing service (who did what and when), and CloudWatch as a performance monitoring service (how much resource was used).
CORRECT: “AWS CloudTrail” is the correct answer.
INCORRECT: “AWS Directory Service” is incorrect. This service provides several options for running directory services on AWS and connecting to directory services on-premises.
INCORRECT: “Amazon Inspector” is incorrect. Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS
INCORRECT: “Amazon CloudWatch” is incorrect. CloudWatch is used for performance monitoring, not auditing.
Which AWS service or feature can be used to restrict the individual API actions that users and roles in each member account can access?
Amazon Macie
AWS Organizations
AWS Shield
AWS IAM
AWS Organizations offers Service control policies (SCPs) which are a type of organization policy that you can use to manage permissions in your organization. SCPs offer central control over the maximum available permissions (API actions) for all accounts in your organization. SCPs help you to ensure your accounts stay within your organization’s access control guidelines. SCPs are available only in an organization that has all features enabled.
CORRECT: “AWS Organizations” is the correct answer.
INCORRECT: “Amazon Macie” is incorrect. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS
INCORRECT: “AWS Shield” is incorrect. AWS Shield a service that protects workloads against distributed denial of service (DDoS) attacks.
INCORRECT: “AWS IAM” is incorrect. AWS IAM is used for assigning permissions but SCPs in AWS Organizations are used to control which API actions are allowed in an account. You need to be granted permission in IAM and have the API allowed to be able to use the API successfully.
To ensure the security of your AWS account, what are two AWS best practices for managing access keys? (Select TWO.)
Where possible, use IAM roles with temporary security credentials
Don’t create any access keys, use IAM roles instead
Rotate access keys daily
Use MFA for access keys
Don’t generate an access key for the root account use
Best practices include:
– Don’t generate an access key for the root account user.
– Use Temporary Security Credentials (IAM Roles) Instead of Long-Term Access Keys.
– Manage IAM User Access Keys Properly.
CORRECT: “Don’t generate an access key for the root account user” is a correct answer.
CORRECT: “Where possible, use IAM roles with temporary security credentials” is also a correct answer.
INCORRECT: “Don’t create any access keys, use IAM roles instead” is incorrect. You should use IAM roles where possible, but AWS do not recommend that you don’t create any access keys as they also have a purpose
INCORRECT: “Rotate access keys daily” is incorrect. Rotating access keys is a recommended practice, but doing it daily would be excessive and hard to manage.
INCORRECT: “Use MFA for access keys” is incorrect. You can use MFA for securing accounts, but it does not secure access keys
Which IAM entity can be used for assigning permissions to multiple users?
IAM Group
IAM User
IAM Role
IAM password policy
Groups are collections of users and have policies attached to them. You can use groups to assign permissions to multiple users. To do this place the users in the group and then create an IAM policy with the correct permissions and attach it to the group.
You do not use an IAM User, Role, or password policy to assign permissions to multiple users.
CORRECT: “IAM Group” is the correct answer.
INCORRECT: “IAM User” is incorrect as explained above.
INCORRECT: “IAM Role” is incorrect as explained above.
INCORRECT: “IAM password policy” is incorrect as explained above.
A company needs to optimize costs and resource usage through monitoring of operational health for all resources running on AWS.
Which AWS service will meet these requirements?
AWS Control Tower
AWS CloudTrail
Amazon CloudWatch
AWS Config
Amazon CloudWatch is a performance monitoring tool that receives metrics from AWS services. This data can be used for monitoring the operational health of resources as well as being used to optimize costs through ensuring systems are right-sized and just enough capacity is provisioned.
CORRECT: “Amazon CloudWatch” is the correct answer.
INCORRECT: “AWS Control Tower” is incorrect. AWS Control Tower is a service that is intended for organizations with multiple accounts and teams who are looking for the easiest way to set up their new multi-account AWS environment and govern at scale
INCORRECT: “AWS CloudTrail” is incorrect. CloudTrail is used for auditing (who did what and when), it is not used for monitoring operational health.
INCORRECT: “AWS Config” is incorrect. Config is used for managing compliance for AWS services.
Which AWS service or component allows inbound traffic from the internet to access a VPC?
NAT Gateway
VPC Route Table
Internet gateway
Virtual Private Gateway
An Internet gateway is attached to a VPC and allows inbound traffic from the internet to access the VPC. It is also used as a target in route tables for outbound internet traffic.
CORRECT: “Internet gateway” is the correct answer.
INCORRECT: “NAT Gateway” is incorrect. A NAT gateway is used for outbound internet access for instances running in a private subnet.
INCORRECT: “VPC Route Table” is incorrect. The route table is used within a VPC for directing traffic.
INCORRECT: “Virtual Private Gateway” is incorrect. A VGW is used for IPSec VPN connections to access a VPC.
What are the benefits of using reserved instances? (Select TWO.)
More flexibility
Uses dedicated hardware
High availability
Reduced cost
With reserved instances you commit to a 1- or 3-year term and get a significant discount from the on-demand rate. You can also reserve capacity in an availability zone with reserved instances.
CORRECT: “Reduced cost” is a correct answer.
CORRECT: “Reserve capacity” is also a correct answer.
INCORRECT: “More flexibility” is incorrect. You don’t get more flexibility with reserved instances. If you need flexibility on-demand is better but more costly.
INCORRECT: “Uses dedicated hardware” is incorrect. Reserved instances are different to dedicated instances. Dedicates instances and dedicates hosts use dedicated hardware but reserved instances do not.
INCORRECT: “High availability” is incorrect. You do not get high availability with reserved instances; this is a pricing model.
