Examples 1 Flashcards
You are planning to build a fleet of EBS-optimized EC2 instances for your new application. Due to security compliance, your organization wants you to encrypt root volume which is used to boot the instances. How can this be achieved?
A. Select Encryption option for the root EBS volume while launching EC2 instance.
B. Once the EC2 instances are launched, encrypt the root volume using AWS KMS Master Key.
C. Root volumes cannot be encrypted. Add another EBS volume with encryption option selected during launch. Once EC2 instances are launched, make encrypted EBS volume as root volume through the console.
D. Launch an unencrypted EC2 instance and create a snapshot of the root volume. Make a copy of the snapshot with the encryption option selected and CreateImage using encrypted snapshot. Use this image to launch EC2 instances.
Answer: D
When launching an EC2 instance, the EBS volume for root cannot be encrypted.
AWS EC2You can launch the instance with unencrypted root volume and create a snapshot of the root volume. Once the snapshot is created, you can copy the snapshot where you can make the new snapshot encrypted.
Organization XYZ is planning to build an online chat application for their enterprise level collaboration for their employees across the world. They are looking for a single digit latency fully managed database to store and retrieve conversations. What would AWS Database service you recommend?
A. AWS DynamoDB
B. AWS RDS
C. AWS Redshift
D. AWS Aurora
Answer: A
When creating an AWS CloudFront distribution, which of the following is not an origin?
A. Elastic Load Balancer
B. AWS S3 bucket
C. AWS MediaPackage channel endpoint
D. AWS Lambda
Answer: D
Explanation: AWS Lambda is not supported directly as the CloudFront origin. However, Lambda can be invoked through API Gateway which can be set as the origin for AWS CloudFront.
Which of the following statements are true with respect to VPC? (choose multiple)
A. A subnet can have multiple route tables associated with it.
B. A network ACL can be associated with multiple subnets.
C. A route with target “local” on the route table can be edited to restrict traffic within VPC.
D. Subnet’s IP CIDR block can be same as the VPC CIDR block.
Answer: B, D
Option A is not correct. A subnet can have only one route table associated with it.
Organization ABC has a customer base in US and Australia that would be downloading 10s of GBs files from your application. For them to have a better download experience, they decided to use AWS S3 bucket with cross-region replication with the US as source and Australia as the destination. They are using existing unused S3 buckets and had setup cross-region replication successfully. However, when files uploaded to US bucket, they are not being replicated to Australia bucket. What could be the reason?
A. Versioning is not enabled on the source and destination buckets.
B. Encryption is not enabled on the source and destination buckets.
C. Source bucket has a policy with DENY and role used for replication is not excluded from DENY.
D. Destination bucket’s default CORS policy does not have source bucket added as the origin.
Answer: C
When you have a bucket policy which has explicit DENY, you must exclude all IAM resources which need to access the bucket.
For option A, Cross region replication cannot be enabled without enabling versioning. The question states that cross-region replication has been successfully enabled. So this option is not correct
Which of the following is not a category in AWS Trusted Advisor service checks?
A. Cost Optimization
B. Fault Tolerance
C. Service Limits
D. Network Optimization
Answer: D
Your organization is building a collaboration platform for which they chose AWS EC2 for web and application servers and MySQL RDS instance as the database. Due to the nature of the traffic to the application, they would like to increase the number of connections to RDS instance. How can this be achieved?
A. Login to RDS instance and modify database config file under /etc/mysql/my.cnf
B. Create a new parameter group, attach it to DB instance and change the setting.
C. Create a new option group, attach it to DB instance and change the setting.
D. Modify setting in default options group attached to DB instance.
Answer: B
You will be launching and terminating EC2 instances on need basis for your workloads. You need to run some shell scripts and perform certain checks connecting to AWS S3 bucket when the instance is getting launched. Which of the following options will allow performing any tasks during launch? (choose multiple)
A. Use Instance user data for shell scripts.
B. Use Instance metadata for shell scripts.
C. Use AutoScaling Group lifecycle hooks and trigger AWS Lambda function through CloudWatch events.
D. Use Placement Groups and set “InstanceLaunch” state to trigger AWS Lambda functions.
Answer: A, C
Your organization has an AWS setup and planning to build Single Sign-On for users to authenticate with on-premise Microsoft Active Directory Federation Services (ADFS) and let users log in to AWS console using AWS STS Enterprise Identity Federation. Which of the following service do you need to call from AWS STS service after you authenticate with your on-premise?
A. AssumeRoleWithSAML
B. GetFederationToken
C. AssumeRoleWithWebIdentity
D. GetCallerIdentity
Answer: A
How many VPCs can an Internet Gateway be attached to at any given time?
A. 2
B. 5
C. 1
D. By default 1. But it can be attached to any VPC peered with its belonging VPC
Answer: C
AWS VPC
https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/amazon-vpc-limits.html#vpc-limits-gateways
At any given time, an Internet Gateway can be attached to only one VPC. It can be detached from the VPC and be used for another VPC.
Your organization was planning to develop a web application on AWS EC2. Application admin was tasked to perform AWS setup required to spin EC2 instance inside an existing private VPC. He/she has created a subnet and wants to ensure no other subnets in the VPC can communicate with your subnet except for the specific IP address. So he/she created a new route table and associated with the new subnet. When he/she was trying to delete the route with the target as local, there is no option to delete the route. What could have caused this behavior?
A. Policy attached to IAM user does not have access to remove routes.
B. A route with the target as local cannot be deleted.
C. You cannot add/delete routes when associated with the subnet. Remove associated, add/delete routes and associate again with the subnet.
D. There must be at least one route on the route table. Add a new route to enable delete option on existing routes.
Answer: B
Which of the following are not backup and restore solutions provided by AWS? (choose multiple)
A. AWS Elastic Block Store
B. AWS Storage Gateway
C. AWS Elastic Beanstalk
D. AWS Database Migration Hub
E. AWS CloudFormation
Answer: C, E
Option A is snapshot based data backup solution.
AWS Backup and Recovery
Option B, AWS Storage Gateway provides multiple solutions for backup & recovery.
AWS Backup and Recovery
Option D can be used as a Database backup solution.
Organization ABC has a requirement to send emails to multiple users from their application deployed on EC2 instance in a private VPC. Email receivers will not be IAM users. You have decided to use AWS Simple Email Service and configured from email address. You are using AWS SES API to send emails from your EC2 instance to multiple users. However, email sending getting failed. Which of the following options could be the reason?
A. You have not created VPC endpoint for SES service and configured in the route table.
B. AWS SES is in sandbox mode by default which can send emails only to verified email addresses.
C. IAM user of configured from email address does not have access AWS SES to send emails.
D. AWS SES cannot send emails to addresses which are not configured as IAM users. You have to use the SMTP service provided by AWS.
Answer: B
Amazon SES is an email platform that provides an easy, cost-effective way for you to send and receive email using your own email addresses and domains.
For example, you can send marketing emails such as special offers, transactional emails such as order confirmations, and other types of correspondence such as newsletters. When you use Amazon SES to receive mail, you can develop software solutions such as email autoresponders, email unsubscribe systems and applications that generate customer support tickets from incoming emails.
You have configured AWS S3 event notification to send a message to AWS Simple Queue Service whenever an object is deleted. You are performing ReceiveMessage API operation on the AWS SQS queue to receive the S3 delete object message onto AWS EC2 instance. For any successful message operations, you are deleting them from the queue. For failed operations, you are not deleting the messages. You have developed a retry mechanism which reruns the application every 5 minutes for failed RecieveMessage operations. However, you are not receiving the messages again during the rerun. What could have caused this?
A. AWS SQS deletes the message after it has been read through ReceiveMessage API
B. You are using Long Polling which does not guarantee message delivery.
C. Failed RecieveMessage queue messages are automatically sent to Dead Letter Queues. You need to RecieveMessage from Dead Letter Queue for failed retries.
D. Visibility Timeout on the SQS queue is set to 10 minutes.
Answer: D When a consumer receives and processes a message from a queue, the message remains in the queue. Amazon SQS doesn’t automatically delete the message. Because Amazon SQS is a distributed system, there’s no guarantee that the consumer actually receives the message (for example, due to a connectivity issue, or due to an issue in the consumer application). Thus, the consumer must delete the message from the queue after receiving and processing it.
You had set up an internal HTTP(S) Elastic Load Balancer to route requests to two EC2 instances inside a private VPC. However, one of the target EC2 instance is showing Unhealthy status. Which of the following options could not be a reason for this?
A. Port 80/443 is not allowed on EC2 instance’s Security Group from the load balancer.
B. An EC2 instance is in different availability zones than load balancer.
C. The ping path does not exist on the EC2 instance.
D. The target did not return a successful response code
Answer: B
If a target is taking longer than expected to enter the InService state, it might be failing health checks. Your target is not in service until it passes one health check.
