Performant Architectures Flashcards
1
Q
When replicating data from a primary RDS instance to a secondary one, how much will you be charged, in relation to the standard data transfer charge?
A) Your data will be transferred at the standard data transfer charge.
B) Your data will be transferred at half of the standard data transfer charge.
C) Your data will be transferred at half of the standard data transfer charge up to 1 GB of transfer per day and then additional data at the standard data transfer charge.
D) There is no charge for primary-to-secondary data replication.
A
D. There is no way to reason through this; it is a matter of memorization. There is no charge associated with data replication in this scenario.
2
Q
Which of the following are valid options for where an RDS read replica is set up in relation to the primary instance? (Choose two.)
A) In the same region as the primary instance
B) In a separate region from the primary instance
C) In an instance running on premises
D) Both A and B
A
C, D. All of these are valid options. Although it’s not particularly common, you can set up a read replica in an on-premises instance. Additionally, read replicas are often created in separate regions from the primary instance, to improve performance for clients closer to different regions than the primary instance.
3
Q
What is the primary purpose of a read replica RDS configuration?
A) Disaster recovery
B) Fault tolerance
C) Performance
D) Security
A
C. A read replica configuration is aimed squarely at increasing database performance, specifically the performance of reading data from an RDS instance.
4
Q
Which of the following databases support read replicas?
A) MariaDB
B) MySQL
C) PostgreSQL
D) All of the above
A
D. All three of these databases support read replicas. Most other databases supported by RDS (Oracle, for example, or Aurora) offer other approaches to gain similar functionality to read replicas but do not support the AWS read replica functionality.
5
Q
Which of the following databases support read replicas?
A) Oracle
B) MySQL
C) DynamoDB
D) All of the above
A
B. Currently, read replicas in RDS are only supported by MariaDB, MySQL, and PostgreSQL.
6
Q
Which of the following is true about a read replica? (Choose two.)
A) It is a read-only instance of a primary database.
B) It can only exist in the same region as the primary database, although it can be in a different availability zone.
C) It is updated via asynchronous replication from the primary instance.
D) It is updated via synchronous replication from the primary instance.
A
A, C. A read replica is a read-only instance of a database created from a snapshot of the primary instance (A). Read replicas can be in the same instance, or a different one, as the primary instance (so B is false). Read replicas are updated via asynchronous replication—the most performant approach—from the primary database.
7
Q
Which of the following is true about an RDS read replica configuration? (Choose two.)
A) Only three read replicas can be set up for a single primary database instance.
B) Only MariaDB, MySQL, and Aurora are supported.
C) A read replica replicates all databases in the primary instance.
D) A read replica can exist in a different region than the primary instance.
A
C, D. Read replicas can be in a different region than the primary instance (D), and they replicate all the databases in the primary instance (C). You can have up to five read replicas at a time for a single instance (so A is false). While MySQL and MariaDB are supported (B), Aurora is not.
8
Q
You have a primary database set up to use read replicas running on an instance in US East 1. You have three read replicas also in US East 1 and two additional replicas in US West 2. You are trying to create a new replica in EU West 1 and are getting an error. What do you need to do to resolve this error and successfully create a new read replica in EU West 1?
A) Turn on the Multi-AZ option for your primary instance.
B) You can’t create the replica in EU West 1. Instead, create the replica in another US region to avoid regulations about read replicas in the EU.
C) Contact AWS about raising the number of read replicas allowed from 5 to 8.
D) Turn off one of the read replicas in US East 1 and then you can create the instance in EU West 1.
A
D. The root issue here is that a read replica setup only allows for five read replicas. This is not a limit that can be raised by AWS either (so C is out). Option A won’t address the issue, and option B isn’t accurate; there are no EU limitations affecting the issue here. The only answer that would result in being able to create the instance is D: By turning off an existing instance, you can create a new fifth replica in the desired region.
9
Q
Which of the following are true about a read replica setup? (Choose two.)
A) Backups are configured by default when you set up read replicas.
B) They provide a highly scalable solution for your on-premises databases.
C) They can exist within a single AZ, cross-AZ, or cross-region.
D) A read replica can be promoted to a stand-alone database instance.
A
C, D. Read replicas are focused on performance, so you can generally eliminate any answers related to disaster recovery—in this case, A. Read replicas work with RDS databases, as well, so B is out; on-premises databases aren’t supported. This leaves C and D, which are both valid.
10
Q
Which of the following are true about a read replica setup? (Choose two.)
A) Automated backups are taken from the read replicas rather than the primary instance.
B) The database engine on all instances is active.
C) Each read replica instance can upgrade its database engine separate from the primary instance.
D) Replication is synchronous.
A
B, C. No backups are taken from any instance automatically, including the primary instance, so A is false. Since each read replica has its own database instance running, both B and C are valid. Replication is asynchronous rather than synchronous (so D is false).
11
Q
Which of the following statements are false? (Choose two.)
A) Both read replicas and Multi-AZ configurations ensure that you have database instances in multiple availability zones.
B) Both read replicas and Multi-AZ configurations provide disaster recovery options for your primary instance.
C) A single database can both have a read replica and be part of a Multi-AZ setup.
D) A read replica can be promoted to be a stand-alone database instance.
A
A, B. A is false because you can create read replicas in the same AZ as the primary instance. There is no requirement to use multiple AZs, as there is with a Multi-AZ setup. B is also false; read replicas provide no disaster recovery options. Both C and D are true.
12
Q
Which of the following statements is true?
A) A Multi-AZ setup is aimed at fault tolerance, while a read replica setup is aimed at scalability.
B) Both read replicas and Multi-AZ configurations are aimed at fault tolerance.
C) A Multi-AZ setup is aimed at scalability, while a read replica setup is aimed at fault tolerance.
D) Both read replicas and Multi-AZ configurations are aimed at scalability.
A
A. Only A is correct. A Multi-AZ setup is focused on disaster recovery and fault tolerance, while read replicas provide performance and scalability.
13
Q
How do applications communicate with read replica instances?
A) Through the read replica REST API provided by RDS
B) ELBs and ALBs will automatically translate requests to a read replica to use the read replica REST API provided by RDS.
C) Each read replica provides a read replica key that allows applications to communicate with the instance as if it were a normal database instance.
D) Applications communicate with a read replica exactly as they would with a non-read replica.
A
D. There is no difference in how applications communicate with read replicas as compared to the communication with non-replica instances. In fact, applications don’t “know” that they’re communicating with a read replica other than an inability to make writes.
14
Q
Which of the following are valid reasons to use read replication? (Choose two.)
A) You have a read-heavy database that is peaking in traffic.
B) You have a large number of errors reported by applications trying to update user entries in your current database and want to reduce these errors.
C) You want an automated disaster recovery solution in case you lose an AZ.
D) You have a large number of business reporting queries that are currently interfering with customer application performance.
A
A, D. A and D are both solutions that would be aided by additional read-only instances. B is not a valid answer because updating records would still only be possible with the primary instance; read replicas don’t support writes. C is incorrect because read replicas do not provide automated fault recovery.
15
Q
Does a read replica provide any assistance at all in creating a fault-tolerant database setup?
A) Yes, it provides automated backups to the read replicas.
B) Yes, if the primary instance fails, one of the replicas can be manually promoted to a stand-alone database instance.
C) Yes, if the primary instance fails, one of the replicas will be automatically promoted to a stand-alone database instance.
D) No
A
B. You need to be careful here. While read replicas are not advertised or even suggested as solutions for disaster recovery, option B does provide a somewhat manual process to use them in that manner. While you get no automated backups or failover (A or C), you can manually promote a read replica instance to a stand-alone instance if you have to. Still, a Multi-AZ setup is almost always a more robust solution for fault tolerance.
16
Q
Which of the following are valid reasons to use read replication? (Choose two.)
A) You have customers in a region geographically distant from your primary instance and want to improve their read performance when they access your applications hosted in regions closer to them.
B) Your current database instance is showing memory saturation with current traffic loads.
C) Your boss has asked for an automated backup solution that takes advantage of AWS managed services.
D) You need to perform additional OLTP queries and want to improve the performance of those queries.
A
A, B. Both A and B are ideal situations for read replicas. C is the usual incorrect answer: read replicas don’t provide automated backups. And D is not accurate; the actual database processing doesn’t improve; you are merely adding more sources for reading data for clients.
17
Q
Can you configure a database instance to be both a read replica and a primary database instance for the original instance?
A) Yes, as long as the instances are all in the same availability zone.
B) Yes, if you turn on circular replication in both primary database instances.
C) Yes, as long as the instances are not in the same availability zone.
D) No, AWS does not support circular replication.
A
D. AWS does not support circular replication through RDS. While some of the databases supported by RDS do, RDS itself does not provide access to this functionality.
18
Q
In which of the following ways can you create a read replica? (Choose two.)
A) Through the AWS console
B) Through the AWS online support system
C) Through the AWS API
D) Through Elastic Beanstalk
A
A, C. You can create a read replica through the AWS console (A), the AWS API (C), and the AWS CLI (not mentioned, but still true).
19
Q
How are automated backups related to read replicas?
A) They are not; read replicas and automated backups have no relationship at all.
B) Read replicas do not create automatic backups, but the primary database instance must have automatic backups enabled to create read replicas.
C) Read replicas cause the primary database instance to automatically begin backing up.
D) Each read replica is automatically backed up after an initial read from the primary database instance.
A
B. As has been said numerous times, read replicas are not a backup strategy, nor do they cause automatic backups to be set up. However, you must turn on automatic backups for the primary database instance to enable read replicas.
20
Q
Can a database instance be a read replica of one database and the source instance for another read replica?
A) Yes, as long as the source and replicant database are not the same instance.
B) No, a database cannot be both a read replica and a source database.
C) Yes, as long as the source and replicant database are in the same availability zone.
D) Yes, as long as you enable circular replication on both databases.
A
A. This bears careful reading. Amazon RDS does not support circular replication, which means one database reads from a second database but then is replicated back by that second database. However, it is absolutely permissible for one database to replicate another database and then be the source for a third database. This makes option A correct.
21
Q
How quickly can you make changes to the backup window used by your RDS instance?
A) Changes to the window via the console take place within 1 hour; changes made via the API take place immediately.
B) Changes to the window take place after the next complete backup occurs.
C) Changes to the window via the API take place within 1 hour; changes made via the console take place immediately.
D) Changes to the window take place immediately.
A
D. There is no difference in response to a change in the backup window based on how that window is changed (API, console, etc.). All changes take place immediately.
22
Q
What is the longest backup retention window that Amazon RDS allows?
A) 30 days
B) 35 days
C) 45 days
D) 365 days
A
B. This is another straight memorization question: Amazon RDS backups can be retained for up to 35 days, and no longer.
23
Q
You have an Oracle installation using a custom geospatial plug-in. You also want to ensure the maximum throughput for database operations once those operations are begun by the plug-in. How would you set up Oracle to meet these requirements?
A) Set up Oracle using RDS with provisioned IOPS.
B) Set up Oracle using RDS with magnetic storage.
C) Install Oracle on an EC2 instance with a provisioned IOPS EBS volume.
D) Install Oracle on an EC2 instance with a magnetic EBS volume.
A
C. There are two components to this question: using RDS or EC2 for Oracle hosting and the class of storage to select. While RDS is a better option in the general case, it is likely not possible to use RDS in this scenario due to the custom plug-in required. This eliminates A and B. Given an installation on EC2, then, the question becomes which storage class is faster: provisioned IOPS or magnetic. The answer here is always provisioned IOPS.
24
Q
In what scenarios would you install an Oracle database on an EC2 instance rather than using RDS? (Choose two.)
A) You want to use an ALB to support multiple instances and round-robin request distributions.
B) Your database size is greater than 80% of the maximum database size in RDS.
C) You have custom plug-ins that will not run in RDS.
D) You want to ensure that your database is only accessible through your private subnet in a VPC.
A
B, C. Option C should be the immediately obvious first choice. Anytime you have custom plug-ins, you will likely need to install your database on an EC2 instance rather than using RDS. Options A and D are really both about network routes and services around your database, and both can be accomplished without affecting your EC2 vs. RDS decision. This leaves B, which also logically makes sense: If you have a very large database, and it will grow (as almost all databases do), then sizing restraints on RDS can be a limiting factor.
25
Which of the following are SQL-based options in RDS? (Choose two.)
A) Aurora
B) DynamoDB
C) MariaDB
D) Redshift
A, C. This should be an easy question if you’re prepared. While it’s easy to forget if Aurora and MariaDB are RDS options—they are!—you should know that DynamoDB is AWS’s NoSQL database, and Redshift is a data-warehousing solution.
26
You are a new architect at a company building out a large-scale database deployment for web applications that receive thousands of requests per minute. The previous architect suggested a Multi-AZ deployment in RDS to ensure maximum responsiveness to the web tier. Is this a good approach for high performance?
A) No, because a Multi-AZ deployment is no faster in responding to requests than a standard RDS deployment.
B) Yes, because the additional databases in a Multi-AZ deployment will share the request load from the web tier.
C) Yes, because a Multi-AZ deployment will ensure that if the primary database goes down, a secondary database will be current and available.
D) No, because a Multi-AZ deployment can only field requests from the availability zone in which each database resides.
A. This is not particularly difficult as long as you understand that a Multi-AZ deployment is concerned with failover, not performance. Option A is correct: There is no particular performance increase in a Multi-AZ deployment, unless read replicas are also turned on (which isn’t specified). B is false because only the primary database responds to requests in a Multi-AZ deployment. C is actually a true statement but does not have a bearing on the subject of the question: performance. And D doesn’t actually make sense in the context of the question at all!
27
You launch an EC2 instance that has two volumes attached: a root and an additional volume, both created with default settings. What happens to each volume when you terminate the instance?
A) The root volume is deleted and the additional volume is preserved.
B) Both volumes are deleted.
C) Both volumes are preserved.
D) The instance is unable to terminate until the root volume is deleted.
A. This one is a little tricky as it requires understanding what default options AWS puts in place. By default, root volumes are terminated on instance deletion, and by default, additional EBS volumes attached to an instance are not. This makes option A true. However, note that these settings can be changed! Also note that option D is not true in any configuration.
28
How many S3 buckets can you add to an account?
A) 100
B) 100 by default, but this can be increased by contacting AWS.
C) It depends on the default set for the new account by AWS.
D) It depends on how the account is configured at account creation.
B. The default for all new accounts is 100 allowed S3 buckets; this is consistent across AWS and does not change via configuration (meaning that C and D are not correct). However, this value can be raised through asking AWS for an exception and providing a reasonable justification, making B the correct answer.
29
What type of replication occurs in a Multi-AZ RDS setup?
A) Sequential replication
B) Synchronous replication
C) Asynchronous replication
D) Synchronous replication for full backups and asynchronous replication for incremental backups
B. Replication occurs synchronously from a primary instance to a secondary instance in a Multi-AZ setup. Asynchronous replication only occurs in a read replica setup (which can be enabled in addition to a Multi-AZ setup).
30
What type of replication occurs in a read replica RDS setup?
A) Sequential replication
B) Synchronous replication
C) Asynchronous replication
D) Synchronous replication for full backups and asynchronous replication for incremental backups
C. Replication occurs asynchronously from a primary instance to the various read replicas in a read replica setup. As a result, updates are not guaranteed to be instant on the read replicas. Synchronous replication occurs in a Multi-AZ setup.
31
Which of the following protocols and routing approaches does a classic load balancer support? (Choose two.)
A) IPv4
B) IPv6
C) HTTP/2
D) Registering targets in target groups and routing traffic to those groups
A, B. Classic load balancers support both IPv4 and IPv6. They support HTTP/1 and HTTP/1.1, but only application load balancers support HTTP/2. Further, you must register individual instances, rather than target groups, with classic load balancers; registering target groups is a functionality only available with application load balancers.
32
How many elastic IP addresses can you create per region by default in a new AWS account?
A) 5
B) 10
C) 20
D) There is no preset limit.
A. AWS accounts allow you five elastic IP addresses per region by default. As with most AWS defaults, this can be raised by contacting AWS and providing a reasonable justification.
33
To how many EBS volumes can a single EC2 instance attach?
A) 1
B) 2
C) 27
D) Unlimited
C. Officially, instances can have up to 28 attachments. One of those attachments is the network interface attachment, leaving 27 attachments available for EBS volumes. However, the better approach is to remember that an instance can attach to a root volume and several more volumes (more than two); this eliminates options A and B. Additionally, instances cannot have unlimited attachments. This leaves the correct answer, C.
34
How many EC2 instances can be attached to a single EBS volume at one time?
A) 1
B) 2
C) 27
D) Unlimited
A. Be careful with the wording, to ensure that you do not misread this as asking how many EBS volumes can be attached to an EC2 instance (a different question altogether). A single EBS volume can only be attached to one instance at a time.
35
Which of the following protocols are supported by an application load balancer? (Choose two.)
A) SSH
B) HTTP
C) HTTPS
D) FTP
B, C. This should be an easy answer: Application load balancers, as well as classic load balancers, only support HTTP and HTTPS.
36
Which of the following provide ways to automate the backup of your RDS database? (Choose two.)
A) Automated snapshots
B) S3 lifecycle management policies
C) Automated backups
D) Data pipeline
A, C. RDS provides two (and only two) methods for backing up RDS databases at this point: automated backups and automated snapshots. S3 lifecycle management policies are not applicable to RDS databases, and data pipeline is not relevant in this context.
37
You have an EC2 instance running a heavy compute process that is constantly writing data to and from a cache on disk. How and when should you take a snapshot of the instance to ensure the most complete snapshot?
A) Take a snapshot of the instance from the AWS console.
B) Shut down the instance and take a snapshot of the instance.
C) Take a snapshot of the instance from the AWS CLI.
D) Detach the EBS volume attached to the instance and take a snapshot of both the EC2 and EBS instance.
B. Data written to and from cache is ephemeral, and if your instance is reading and writing that data frequently, the only way to ensure that your snapshot isn’t missing data is to stop the instance from running altogether and to then take a snapshot (B). Both A and C will take snapshots but will likely miss any cached data. With option D, you cannot detach a root volume from an instance (it’s unclear from the question if the cached data is being written to EBS, EFS, or another storage mechanism in any case), and so it is not a safe choice.
38
Your web-based application uses a large RDS data store to write and read user profile information. The latest marketing campaign has increased traffic to the application by an order of magnitude. Users are reporting long delays when logging in after having signed up. Which solutions are valid approaches to addressing this lag? (Choose two.)
A) Set up a Multi-AZ configuration for your RDS and round-robin requests between the two RDS instances to spread out traffic.
B) Employ ElastiCache to cache users’ credentials after their initial visit to reduce trips to the database from the web application.
C) Set up a read replica configuration for your RDS and round-robin requests between all the replicas to spread out traffic.
D) Increase the number of EC2 instances allocated to your Auto Scaling group to spread out traffic on the web application tier.
B, C. Option A is invalid because Multi-AZ is a disaster recovery solution; the primary database is the only instance that can respond to traffic in normal operation (unless read replicas are also set up). Option B is valid; caching user data would reduce round trips to the database and should reduce lag for users. Option C also makes sense, as having additional databases from which to read should decrease network latency to a single RDS instance. Option D is not helpful as the problem appears to be in retrieving credentials, not in the web tier itself.
39
Your users are now storing all of their photos in your cloud-based application. CloudWatch metrics suggests that photos are written an average of 5 times per user per day and read 100 times per user per day. If photos are lost, user surveys indicate that users are not typically upset and simply re-upload the missing photo or ignore the missing photo altogether. What is the most cost-effective recommendation for the S3 storage class to use?
A) Standard S3
B) S3-IA
C) S3 One Zone-IA
D) S3 RRS
C. Standard S3 (A) is not a bad choice, but is the most expensive, and both it and S3-IA (B) are more expensive than S3 One Zone-IA because of their increased availability and resilience. The key here is that photos can be lost without an issue, making S3 One Zone-IA the better option. S3 RRS is no longer recommended by AWS.
40
You are consulting for a company that wants to migrate its 85TB data store into S3. It is willing to upload the data into S3 every night in small batches but is concerned that overseas customers using its other applications might experience network latency as they are transferring files into S3. What solution should you recommend to move the company’s data?
A) Enable Transfer Acceleration on S3.
B) Direct Connect
C) Snowball
D) Set up a VPN that uses a virtual private gateway for transferring the data.
C. This should be automatic: Anytime a large data transfer is involved (especially on an AWS exam!), the answer should be Snowball. This comes up a lot and should be an easy correct answer.
41
Which of the following are valid reasons for using Multipart Upload for uploading objects to S3? (Choose two.)
A) You need a solution that recovers from network issues.
B) You need a solution to upload files larger than 10 GB.
C) You need a solution for increasing the security around uploaded objects.
D) You need a solution to decrease the time required to upload large files.
A, D. The only tricky answer here is B. While Multipart Upload absolutely would improve the experience of uploading large files (larger than 10 GB, for example), it is not required; therefore, option B is not the best option to choose. Options A and D both are only possible with Multipart Upload enabled. Option C is false, as security is not related to Multipart Upload.
42
In which of the following situations would you recommend using a placement group?
A) Your fleet of EC2 instances requires high disk IO.
B) Your fleet of EC2 instances requires high network throughput across two availability zones.
C) Your fleet of EC2 instances requires high network throughput within a single availability zone.
D) Your fleet of EC2 instances requires high network throughput to S3 buckets.
C. A placement group is concerned primarily with network throughput and reducing latency among EC2 instances within a single availability zone. AWS does support a placement group spanning multiple AZs via spread placement groups, but unless “spread” is specifically mentioned, you should assume the question references a “normal” (or “cluster”) placement group.
43
Which of the following statements are true about cluster placement groups? (Choose two.)
A) All instances in the group must be in the same availability zone.
B) Instances in the group will see lowered network latency in communicating with each other.
C) Instances in the group will see improved disk write performance when communicating with S3.
D) Instances in the group must all be of the same instance class.
A, B. Cluster placement groups (the default type of placement group) must be made up of instances that exist within a single availability zone (A). This results in increased throughput for network activity (B) but does not affect actual disk performance when writing to S3 (C). Instances can also be of different types, so D is also false.
44
Which of the following statements are true about spread placement groups? (Choose two.)
A) All instances in the group must be in the same availability zone.
B) Instances in the group will see lowered network latency in communicating with each other.
C) You can have up to seven instances in multiple availability zones in the group.
D) AWS provisions the hardware rather than having you specify the distinct hardware for the group.
B, C. Spread placement groups can span availability zones and support up to seven instances per zone (C). Like cluster groups, this results in increased throughput for network activity (B). You must specify the distinct underlying hardware for spread placement groups, which means that D is false.
45
Which of the following storage classes has the lowest durability?
A) S3 standard
B) S3-IA
C) Glacier
D) They all have equal durability.
D. This is a question where the answer is nonintuitive. All the S3 storage classes have the same durability. Even S3 One Zone-IA has 11 9s of durability in the single availability zone in which it resides.
46
Which of the following storage classes has the highest availability?
A) S3 standard
B) S3-IA
C) Glacier
D) They all have equal availability.
A. Availability starts at 99.99% for S3 and then decreases to 99.9% for S3-IA, 99.5% for S3 One Zone-IA, and finally N/A for Glacier.
47
Which of the following storage classes support automated lifecycle transitions?
A) S3 standard
B) S3-IA
C) Glacier
D) They all support lifecycle transitions.
D. This question is easy if you recall that lifecycle transitions are concerned with moving between these storage classes. Therefore, all of these classes support those transitions.
48
Where is data stored when placed into S3-IA? (Choose two.)
A) In the region specified at bucket creation
B) In a special AWS “global” region for S3 storage
C) In at least three availability zones
D) In a single availability zone within at least three regions
A, C. All S3 and S3-IA data is stored in a single region and within at least three availability zones within that region. There is no “global” region for S3 storage.
49
You need to perform a large amount of OLAP. Which AWS service would you choose?
A) DynamoDB
B) RDS Aurora
C) Redshift
D) Oracle installed on EC2 instances
C. Redshift is the only database or service in this list suitable for online analytics processing (OLAP). DynamoDB is an object database (NoSQL), and both Aurora and Oracle are relational databases, better suited for transaction processing.
50
What is the maximum allowable RDS volume size when using provisioned IOPS storage?
A) 8 TB
B) 16 TB
C) 12 TB
D) 1 PB
B. All the major databases supported by RDS—MariaDB, SQL Server, MySQL, Oracle, and PostgreSQL—allow up to 16 TB of storage for a provisioned IOPS volume.
51
Which of the following EBS volumes is the most performant?
A) Provisioned IOPS
B) Throughput optimized HDD
C) Cold HDD
D) General SSD
A. A provisioned IOPS EBS volume is a solid-state drive that provides the highest performance volume.
52
Which of the following is a valid reason to use a cold HDD EBS volume?
A) You need a performant solid-state drive.
B) You are trying to choose the lowest-cost EBS volume possible.
C) You are performing data warehousing using the volume.
D) You need an inexpensive boot volume.
B. A cold HDD is the cheapest EBS option, so B is correct. It is not solid state (A), it is not appropriate for data warehousing (C), and it is not available to be used as a boot volume.
53
Which of the following are available to use as an EBS boot volume? (Choose two.)
A) General SSD
B) Cold HDD
C) Throughput optimized HDD
D) Provisioned IOPS
A, D. This is easiest to remember by noting that HDD types are not available to use as boot volumes. The SSD types (A, D) are, and are correct.
54
Which of the following is a valid reason to use a General Purpose SSD EBS volume? (Choose two.)
A) You need to support large database workloads.
B) You want a blend of a performant SSD and a cost-sensitive SSD volume.
C) You are performing data warehousing using the volume.
D) You have low-latency apps and want to run them on a bootable volume.
B, D. A General Purpose SSD is the less-expensive SSD (compared to provisioned IOPS), so B is a valid answer. It also provides low-latency performance and is bootable. Option A is more suitable for provisioned IOPS, and C is better for a throughput-optimized HDD.
55
Which of the following is a valid reason to use a magnetic EBS volume? (Choose two.)
A) You want a low-cost option for your EBS volume.
B) You have a set of data that is infrequently accessed but want it stored on an EBS volume rather than S3.
C) You need to perform processing to support Oracle installed on a fleet of EC2 instances.
D) You have low-latency apps and want to run them on a bootable volume.
A, B. Magnetic volumes are older and generally not used much. They are ideal for saving money (A) or for infrequently accessed data (B).
56
Which of the following is a valid reason to use a provisioned IOPS EBS volume? (Choose two.)
A) You want a low-cost option for your EBS volume.
B) You need to support a large MongoDB database workload.
C) You need massive performance and throughput for your applications.
D) You have applications that need a bootable environment but can fail from time to time and be re-created.
B, C. Provisioned IOPS volumes are not inexpensive (A) but are well-suited for critical database workloads and throughput (B and C).
57
Which of the following are characteristics of SSD-backed volumes? (Choose two.)
A) Transactional workloads
B) Streaming workloads
C) Small I/O size
D) Throughput-focused
A, C. An SSD volume is best for transactional workloads (A) with a large number of small I/O sized read/write operations.
58
Which of the following are characteristics of HDD-backed volumes? (Choose two.)
A) Transactional workloads
B) Streaming workloads
C) Small I/O size
D) Throughput-focused
B, D. An HDD-backed volume is best for streaming workloads where throughput needs to be maximized over IOPS.
59
You are charged with installing Oracle on a fleet of EC2 instances due to custom Java-based plug-ins you need to install along with Oracle. Which EBS volume type would you choose to best support your Oracle installation?
A) Magnetic
B) Throughput-optimized HDD
C) Provisioned IOPS SSD
D) General SSD
C. While it is possible that a General Purpose SSD might be sufficient to support an Oracle installation that doesn’t do a lot of processing, the best option is C, a provisioned IOPS SSD. Provisioned IOPS handles transaction processing well and will handle the large number of reads and writes that an Oracle installation would need.
60
You are the solutions architect for a company installing a web application on a set of EC2 instances. The application writes a small amount of user profile data to attached EBS volumes, and accesses that data an average of once every five minutes if the user is still using the web application. Additionally, because of the high cost of the application’s RDS instance, you would like to minimize your EBS volume costs. Which EBS volume type would you choose to support these applications?
A) Magnetic
B) Throughput-optimized HDD
C) Provisioned IOPS SSD
D) General SSD
A. This use case is one where access needs to be minimal, as does cost. If you have infrequently accessed data and cost is a major driver, magnetic drives might be a good option. While throughput-optimized HDDs are still cheaper than SSDs, magnetic is the cheapest option and would work fine for a set of data that is accessed without high performance needs.
61
Which of the following can be an EBS boot volume? (Choose two.)
A) Magnetic
B) Throughput-optimized HDD
C) Provisioned IOPS SSD
D) Cold HDD
A, C. You can boot an EC2 instance off any SSD type, as well as the magnetic type. HDD options are not available to use as boot volumes.
62
Which of the following cannot be used as an EBS boot volume? (Choose two.)
A) General SSD
B) Throughput-optimized HDD
C) Cold HDD
D) Magnetic
B, C. The HDD EBS volume types are not available to use as boot volumes, so B and C are the correct answers.
63
Which of the following is not an Elastic Load Balancing option?
A) Classic load balancer
B) Application load balancer
C) Weighting load balancer
D) Network load balancer
C. There is no such thing as a weighting load balancer. The other options are actual options.
64
Which of the following are valid Elastic Load Balancing options? (Choose two.)
A) ELB
B) MLB
C) ALB
D) VLB
A, C. An ELB is an elastic load balancer and generally refers to a classic load balancer. An ALB is an application load balancer. So A and C are valid; MLB and VLB are not acronyms or abbreviations for load balancers.
65
At what level of the TCP stack does an ALB operate?
A) Level 1
B) Level 4
C) Level 7
D) Level 8
C. An ALB operates at Level 7, the individual request (application) level. Network load balancers operate at Level 4, the connection (transport) level. No load balancers operate at Level 1, and there is no Level 8 in the TCP/OSI stack.
66
At what level of the TCP stack does a network load balancer operate?
A) Level 1
B) Level 4
C) Level 7
D) Level 8
B. An ALB operates at Level 7, the individual request (application) level. Network load balancers operate at Level 4, the connection (transport) level. No load balancers operate at Level 1, and there is no Level 8 in the TCP/OSI stack.
67
At what levels of the TCP stack does a classic load balancer operate? (Choose two.)
A) Level 1
B) Level 4
C) Level 7
D) Level 8
B, C. Classic load balancers operate at both the connection (Level 4) and the request (Level 7) layer of the TCP stack. An ALB operates at Level 7, the individual request level. Network load balancers operate at Level 4, the connection (transport) level.
68
Which of the following is a valid reason to use an application load balancer?
A) You want your applications to automatically scale.
B) You want to balance load across your applications, which reside in containers.
C) You want to achieve better fault tolerance for your applications.
D) All of the above
D. With the newer features of an ALB, all of these use cases are supported. It is important to recognize that ALBs can balance across containers, making B true, and pointing you to D: all of the above.
69
Can you use an elastic load balancer to balance load within a VPC?
A) Yes, as long as the VPC has an internet gateway.
B) Yes, by setting the ELB to be internal to the VPC.
C) No, load balancers can only route traffic from the Internet.
D) No, load balancers cannot operate inside a VPC.
B. This is a difficult question, and right at the edges of what the Architect exam might ask. However, it is possible to use a load balancer to operate within a VPC. It can be pointed internal, instead of Internet-facing, and distribute traffic to the private IPs of the VPC.
70
You are an architect working on adding scalability to an application based on EC2 instances within a public-facing VPC. You want the maximum amount of flexibility in weighting and load balancing options, as you plan to experiment with various routing types to see which handles load most evenly. Which type of load balancer should you use?
A) Classic ELB
B) Application load balancer
C) Network load balancer
D) Either an ALB or ELB would be suitable.
B. ALBs offer the most flexibility in routing and load distribution.
71
You have a host of EC2 instances all with dedicated IP addresses serving results from complex computations. You want to load balance across these instances, each of which receives hundreds of thousands of requests a second currently. Which load balancer would you employ?
A) Classic ELB
B) Application load balancer
C) Network load balancer
D) Either an ALB or ELB would be suitable.
C. Network load balancers can handle the extremely high request load mentioned in the question as well as route between static IP addressed instances.
72
You have a fleet of web-hosting EC2 instances. Currently, you have SSL certificates installed for each EC2 instance, but the cost of maintaining these certificates and installing new ones has become higher over recent years. You want to architect a solution for SSL termination that doesn’t involve multiple certificates. Which load balancer would you suggest?
A) Classic ELB
B) Application load balancer
C) Network load balancer
D) Either an ALB or ELB would be suitable.
B. An ALB offers SSL termination and makes the SSL offload process very simple through tight integration with SSL processes. While an ELB will handle SSL termination, it does not offer the management features that ALBs do.
73
You need a load balancer that supports SSL termination. Which type of load balancer would you choose?
A) Classic ELB
B) Application load balancer
C) Network load balancer
D) Either an ALB or ELB would be suitable.
D. Both ALBs and ELBs offer SSL termination. While an ALB is a better choice when considering the management of SSL certificates—due to its ACM integration—both ELBs and ALBs are correct when considering just SSL termination.
74
How many domains can you register and manage with Route 53?
A) 50
B) 100
C) There is no limit.
D) There is a limit of 50, but it can be raised upon request.
D. Route 53 supports up to 50 domain names by default, but this limit can be raised if requested.
75
Which of the following record sets are supported by Route 53?
A) A records
B) MX records
C) Alias records
D) All of the above
D. Route 53 supports all of the records mentioned, including alias records.
76
Are zone apex records supported by Route 53?
A) Yes
B) No
C) Yes, as long as they point to AWS resources.
D) Not by default, but you can request support by AWS and then support them.
A. Route 53 does support zone apex (naked) domain records.
77
What engines does ElastiCache provide for caching? (Choose two.)
A) memcached
B) redis
C) cacherm
D) gitcache
A, B. ElastiCache offers two engines: memcached and redis. Neither C nor D are even real things!
78
Which of the following do you need to handle when setting up ElastiCache?
A) Patching
B) Backups
C) Monitoring
D) None of the above
D. ElastiCache, when used through AWS, handles all of these tasks and more: hardware provisioning, software patching, setup, configuration, monitoring, failure recovery, and backups.
79
For which of the following would ElastiCache offer performance improvements? (Choose two.)
A) Gaming
B) ElastiCache can improve any application’s performance when used properly.
C) Financial services
D) A and C
B, D. This is another example of an odd answer set, which sometimes appears on the AWS exam. In this case, all answers are valid, which means choosing two: B and D (D references the remaining two, A and C)!
80
Which of the following accurately describe ElastiCache? (Choose two.)
A) An in-memory data store
B) A runtime engine for data distribution
C) A mechanism for sharding application demands
D) A monitoring solution for large datasets
A, C. ElastiCache is an in-memory data store (A) that shards across instances (C). It is not in itself a data distribution mechanism, which is why B is not correct. And it is not a monitoring solution at all (D).
81
Which of the following would you use to interact with a CloudFront distribution?
A) CloudFormation
B) The AWS CLI
C) The AWS REST APIs
D) Any of these
D. CloudFront allows interaction via CloudFormation, the AWS CLI, the AWS console, the AWS CLI, the AWS APIs, and the various SDKs that AWS provides.
82
Which of the following are origin sources usable with a CloudFront distribution? (Choose two.)
A) An ALB
B) DynamoDB
C) AWS Shield
D) An Oracle RDS instance
A, C. CloudFront can front a number of AWS services: AWS Shield, S3, ELBs (including ALBs), and EC2 instances.
83
Which of the following are origin sources usable with a CloudFront distribution? (Choose two.)
A) DynamoDB
B) A fleet of EC2 instances
C) S3 buckets
D) RedShift
B, C. CloudFront can front a number of AWS services: AWS Shield, S3, ELBs (including ALBs), and EC2 instances.
84
Which of the following are origin sources usable with a CloudFront distribution? (Choose two.)
A) Lambda@Edge
B) A static website on S3
C) Aurora on RDS
D) ElastiCache instances
A, B. CloudFront can front a number of AWS services: AWS Shield, S3, ELBs (including ALBs), and EC2 instances. It also most recently supports Lambda@Edge as an origin.
85
Which of the following two are advantages of using a CloudFront distribution? (Choose two.)
A) Performance
B) Fault tolerance
C) Integration with AWS managed services
D) Disaster recovery
A, C. This is a bit difficult, as CloudFront is typically associated with performance (A), and not a lot else. However, CloudFront also provides deep integration with many managed AWS services, such as S3, EC2, ELBs, and even Route 53.
86
How does CloudFront increase the security of content at the edge? (Choose two.)
A) Required HTTPS at all edge locations
B) Integration with AWS WAF (if configured)
C) Automatic client keys encrypted with KMS
D) Automatic deployment of AWS Shield
B, D. CloudFront automatically provides AWS Shield (standard) to protect from DDoS, and it also can integrate with AWS WAF and AWS Shield advanced. These combine to secure content at the edge. HTTPS is not required (so A is incorrect), and there is no KMS involvement with CloudFront (C).
87
# Choose the true statements about edge locations. (Choose two.)
A) There are fewer edge locations than regions.
B) There are more edge locations than regions.
C) There are fewer edge locations than availability zones.
D) There are more edge locations than availability zones.
B, D. Edge locations number more than both regions and availability zones.
88
Which of the following can you do with CloudFront? (Choose two.)
A) Quickly deploy a global network for your content without contracts or startup requirements.
B) Quickly create websites that are dynamic and low latency.
C) Distribute content with low latency and high data transfer rates.
D) Provide storage for static files that are frequently accessed.
A, C. CloudFront is easy to set up and lets you create a global content delivery network without contracts (A). It’s also a mechanism for distributing content at low latency (C). Creating websites and the actual file storage reference in B and D are not features of CloudFront but of LightSail (for example) and S3, respectively.
89
Which of the following can be origin servers for CloudFront? (Choose two.)
A) S3 buckets
B) EC2 instances
C) RedShift workloads
D) SNS notifications
A, B. CloudFront can serve static content from S3 and dynamic content generated by EC2 instances.
90
Which domain name should you use to take advantage of CloudFront?
A) The domain name registered to your S3 buckets in Route 53
B) The domain name registered in CloudFront as the origin for your static and dynamic content
C) The domain name registered in your ALB or ELB pointing to your content
D) The domain name from the AWS console for your CloudFront distribution
B. When you create a CloudFront distribution, you register a domain name for your static and dynamic content. This domain should then be used by clients.
91
Which of the following might occur when content is requested from a CloudFront edge location? (Choose two.)
A) Cached content at the edge location is returned.
B) The request is passed directly to an origin server without CloudFront processing.
C) A request is made to an origin server for the requested content.
D) A redirect is returned to the client.
A, C. CloudFront will always handle requests that it receives. It will either return the requested content if cached (A) or retrieve that content by requesting it from an origin server (C). It will not redirect the client (D), nor will it pass the request on directly (B).
92
Which of the following statements about CloudFront are not true? (Choose two.)
A) CloudFront edge locations are geographically distributed across the world.
B) CloudFront maintains persistent connections with origin servers.
C) A request will be routed by CloudFront to the nearest edge location to the origin server, which will serve that request.
D) CloudFront can use an RDS instance of PostgreSQL as an origin server.
C, D. Both A and B are true. C is not, as routing will occur to the nearest edge location to the client, not the origin server. D is false; RDS is not a valid origin server for CloudFront.
93
How is data transferred out from a region to a CloudFront edge location charged?
A) At normal egress data rates
B) At half the price of normal egress rates
C) At the lowest available rate for the region from which the data originates
D) There is no charge.
D. There is no charge associated with data moving from any region to a CloudFront edge location.
94
Which of the following are true about both S3 and CloudFront? (Choose two.)
A) They both store files.
B) They both support encryption of their content.
C) They both cache files.
D) They both provide low-latency distribution of content to clients.
A, B. S3 stores files and CloudFront stores copies of files, so A is true. Both also encrypt their files (B) as needed. Only CloudFront caches files (C), and only CloudFront can guarantee low-latency distribution (D).
95
Which of the following content types can be served by CloudFront? (Choose two.)
A) The returned rows from a SQL query
B) The response from a PHP script
C) A Lambda function
D) HTML and CSS
B, D. CloudFront can store and serve both static (HTML and CSS, option D) and dynamic (PHP, option B) content. SQL queries cannot be directly returned, nor can an actual Lambda function. You can front the result of a Lambda@Edge function, but not the function itself.
96
Which of the following can be CloudFront origin servers? (Choose two.)
A) A web server hosted on another cloud provider
B) An EC2 instance fleet spread across two regions
C) A MySQL RDS instance
D) An SNS topic
A, B. CloudFront supports a variety of origin servers, including a non-AWS origin server (A). It supports EC2 (B), regardless of region, as well. It does not support RDS or SNS.
97
What is an edge location?
A) A specific node within a worldwide network of data centers that deliver CloudFront content
B) A virtual cloud of caching stations
C) A fleet of EC2 instances managed by AWS
D) An EC2 instance in a remote region from your primary content
A. An edge location is a data center that delivers CloudFront content. Edge locations are spread across the world.
98
What is a CloudFront distribution?
A) A worldwide network of data centers
B) A set of origin servers whose content is served by CloudFront via various edge locations
C) The cached content on CloudFront edge locations at any given time
D) The cached content from your account stored on CloudFront edge locations at any given time
B. A distribution is the setup including your origin servers and how the content from those servers is distributed via CloudFront. It does not specifically refer to cached content at any given point in time.
99
How long is content cached at an edge location?
A) 24 hours
B) 12 hours
C) 12 hours by default, but this value can be changed.
D) 24 hours by default, but this value can be changed.
D. Edge locations check for updated content every 24 hours by default, but this value can be changed.
100
What is the shortest expiration period allowed for a CloudFront edge location?
A) 0 seconds
B) 5 seconds
C) 30 seconds
D) 1 minute
A. Edge locations can be set to have a 0-second expiration period, which effectively means no caching occurs.
101
You have a CloudFront distribution setup, but you are not seeing any performance benefit to your users. What might be possible causes for the lack of benefit? (Choose two.)
A) Users do not have CloudFront enabled in their client applications and are therefore not getting the benefits of the CloudFront distribution. Enable CloudFront in their client applications.
B) The expiration period is set so low that caching is not happening enough to benefit users. Raise the expiration period time.
C) Your set of origin servers is too small and being flooded by requests from CloudFront. Consider increasing the number or processing power of origin servers.
D) Users are not close enough to edge locations to see a benefit from CloudFront.
B, C. The most obvious culprit is a very low expiration period (B). Ensure that time is not close to 0. Beyond that, it’s possible that—especially in conjunction with a very low expiration period—your compute resources or storage resources are getting flooded with requests. Consider using additional origin servers.
102
Why would you set the expiration period to 0 on a CloudFront distribution?
A) To expire all content on all existing edge locations
B) To ensure caching does not occur for maximum throughput
C) To reduce the chances of a DDoS attack on your edge locations
D) To ensure the most up-to-date content is served at all edge locations
A. Setting an expiration period to 0 expires all content (A). It actually would slow down response time and has nothing to do with DDoS attacks. While it would technically always return the most current content (D), that’s not a good reason to take this step; it defeats the purpose of CloudFront if the period is left at that value.
103
How can you delete a file from an edge location? (Choose two.)
A) Use the AWS console to navigate to the edge location and delete the file.
B) Set the expiration period to 0 on your distribution.
C) Remove the file from your origin servers.
D) Delete the file from your CloudFront distribution using the AWS CLI.
B, C. First, there is no mechanism either in the AWS console (A) or the AWS CLI (D) to interact directly with files on CloudFront distributions or edge locations. Second, the correct solution is to remove the file and then wait for the expiration period to cause a reload—which can be forced by setting that time to 0.
104
Which is the correct order of the steps below to remove a file from an edge location immediately with the least interruption to existing service?
A) First set the expiration time on a CloudFront distribution to 0; then remove the file from the origin servers.
B) First take the CloudFront distribution offline; then remove the file from the origin servers.
C) First remove the file from the origin servers; then set the expiration time on the CloudFront distribution to 0.
D) First, remove the file from the origin servers; then take the CloudFront distribution offline.
C. You need to remove a file from CloudFront’s origin servers before doing anything else, because files are replicated from the origin server. If the file exists, it will end up on an edge location. Then, with the file removed, the expiration period can be set to 0, and the cache will be updated—resulting in the file being removed.
105
Which of the following immediately removes an object from all edge locations?
A) Removing the object from all origin servers
B) Removing all CloudFront edge locations with the object cached
C) Removing the object using the invalidation API
D) Invalidating the CloudFront distribution
C. The invalidation API is the fastest way to remove a file or object, although it will typically incur additional cost.
106
Which of the following provides the highest availability for critical files?
A) S3
B) S3-IA
C) S3 One Zone-IA
D) Glacier
A. S3 will always be the most available S3 storage class. This should be an easy correct answer.
107
Which of the following storage classes has the lowest first byte latency?
A) S3
B) S3-IA
C) S3 One Zone-IA
D) They are all identical.
D. This can be a bit tricky. While S3 is more available, all the S3-based storage classes provide the same first byte latency: milliseconds. Remember that performance is identical; availability is not.
108
Which of the following storage classes provides the fastest data retrieval speeds?
A) S3
B) S3-IA
C) S3 One Zone-IA
D) They are all identical.
D. This is another semi-trick question. With the exception of Glacier, retrieving data from the various S3 storage classes should be virtually identical (network issues notwithstanding). The classes differ in availability, but not in how fast data can be accessed. (They also differ in terms of charging for the number of accesses of that data.)
109
How long does a typical Glacier data retrieval take?
A) 1 hour
B) 1–3 hours
C) 3–5 hours
D) 5–10 hours
C. Glacier data retrieval, using the standard class, takes 3–5 hours on average.
110
Why would you choose S3-IA over S3?
A) You want to save money and don’t need your data as quickly.
B) You want to save money and don’t need your data as frequently.
C) You want to save money and don’t need data in multiple availability zones.
D) You want to save money and don’t need fault tolerance of your data.
B. The difference between S3 and S3-IA is cost, and frequency of access (B). Retrieval is just as fast as S3 (so A is wrong), and data in S3-IA is stored redundantly (C and D).
111
Which of the following statements are not true? (Choose two.)
A) There are more edge locations than availability zones.
B) An edge location is separate from an availability zone.
C) An RDS instance can be an origin server.
D) The default expiration period is 12 hours.
C, D. C and D are both false. RDS instances cannot be origin servers, and the default expiration period is 24 hours, not 12.
112
Which of the following is a valid origin server for a CloudFront distribution?
A) An S3 bucket
B) An EC2 instance
C) An ALB
D) All of the above
D. CloudFront allows all of these as origin servers: S3, EC2 instances, ALBs, etc.
113
What does AWS call a collection of edge locations?
A) CloudFront
B) An edge zone
C) Lambda@Edge
D) A distribution
D. A collection of edge locations is a distribution.
114
What type of distribution should you use for media streaming?
A) Web distribution
B) Media distribution
C) RTMP distribution
D) Edge distribution
C. An RTMP distribution is the Adobe Real-Time Messaging Protocol and is suitable for using S3 buckets as an origin server to serve streaming media.
115
Which of the following are valid media distributions for CloudFront? (Choose two.)
A) Web distribution
B) Media distribution
C) RTMP distribution
D) Edge distribution
A, C. CloudFront supports both web distributions and RTMP distributions. Media and edge distributions are not valid distribution types.
116
Which of the following are valid direct operations on an edge location? (Choose two.)
A) Read an object.
B) Write an object.
C) Delete an object.
D) Update an object.
A, B. You can read and write objects directly to an edge location. You cannot delete or update them directly; only the CloudFront service can handle that.
117
Which of the following are valid use cases for using ElastiCache? (Choose two.)
A) Real-time transactions
B) Offline transactions
C) Record storage
D) Business intelligence
A, D. ElastiCache is ideal for high-performance and real-time processing as well as heavy-duty business intelligence. It does not shine as much with offline transactions, where speed is less essential, and it’s not at all suitable for long-term or record storage.
118
Which of the following can ElastiCache be used for? (Choose two.)
A) Web server
B) Database cache
C) Object storage
D) Message broker
B, D. Consider ElastiCache as only useful for storing transient data. Further, it’s not a persistent store; therefore, it’s great for caching data from a database or message service.
119
Which of the following can ElastiCache be used for? (Choose two.)
A) Ephemeral storage
B) Long-term storage
C) Message Queue
D) Logging store
A, C. Consider ElastiCache as only useful for storing transient data. Further, it’s not a persistent store; therefore, it’s great for caching data from a message queue or providing very fast ephemeral storage.
120
What is an ElastiCache shard?
A) A collection of multiple nodes that make up a cluster
B) A collection of clusters in an ElastiCache distribution
C) A collection of edge locations in an ElastiCache distribution
D) A single node in a cluster
A. ElastiCache uses shards as a grouping mechanism for individual redis nodes. So a single node is part of a shard, which in turn is part of a cluster (option A).
121
Which of the following provides low latency access to most frequently accessed data while storing all data in the cloud?
A) Storage gateway – snapshot
B) Storage gateway – virtual tape library
C) Storage gateway – stored volume
D) Storage gateway – cached volume
D. A storage gateway using cached volumes will cache frequently accessed data while storing the entire dataset on S3 in AWS.
122
Which of the following provides low latency access to all data while still storing the dataset in the cloud?
A) Storage gateway – snapshot
B) Storage gateway – virtual tape library
C) Storage gateway – stored volume
D) Storage gateway – cached volume
C. A storage gateway using stored volumes will store all data locally while backing up the data to S3 in AWS as well.
123
Which of the following provides the fastest access to a customer dataset?
A) S3 with Transfer Acceleration
B) Storage gateway – virtual tape library
C) Storage gateway – stored volume
D) S3 standard
C. A storage gateway using stored volumes will store all data locally, while all the other solutions store data in the cloud. Accessing local data will always be faster than accessing cloud data.
124
Which of the following provides access to frequently accessed data at top speeds while still maintaining disaster recovery options?
A) Storage gateway – stored volume
B) Storage gateway – virtual tape library
C) S3-IA
D) S3 standard
A. A storage gateway using stored volumes will store all data locally, providing low latency access to that data. Further, the entire dataset is backed up to S3 for disaster recovery. S3 is durable and available, but not as fast as accessing local data. A VTL provides a tape backup interface, but not necessarily fast data access.
125
You are creating a user data storage system by using an S3 bucket with multiple folders, one folder per user. You want to then tag each folder with the username of the staff member and build IAM permissions based on these tags. Which of the following is a problem with this approach?
A) S3 buckets cannot be permissioned using IAM.
B) Folders in an S3 bucket cannot have individual tags associated with them.
C) Buckets in S3 cannot be tagged with multiple tags.
D) IAM cannot operate based on individual S3 buckets.
B. The problem here is trying to tag individual folders. You can use IAM for permissions, but a particular folder cannot be tagged separately from other folders; only an entire bucket can be tagged.
126
You are in charge of a data migration your company is preparing to undertake. Your company wants to store files on AWS and see if the costs are lower than on-premises storage, but your company is being very cautious. In this first phase, it wants to ensure the lowest possible latency of the majority of the files. Which storage gateway configuration would you recommend?
A) Cached volumes
B) Virtual tape library
C) Snapshot
D) Stored volumes
D. A customer gateway with stored volumes provides the lowest latency for file access. A cached volume would not work because the majority of the files are the concern rather than just a small subset.
127
Why would you choose to configure read replicas across all available AZs as opposed to configuring them in the same region as your primary database source?
A) You have a global customer base.
B) You want to ensure disaster recovery.
C) You want to maximize network throughput.
D) You should never configure read replicas outside of the region of the primary database instance.
A. Configuring read replicas throughout all regions would provide the best response time on reads for customers spread across those same regions (A). While using multiple regions does provide some disaster recovery help, read replicas are really not a particularly effective disaster recovery approach. As for option C, read replicas do not increase network throughput; they just spread load out over the replicas, which may or may not desaturate the networks involved.
128
Why would you choose to configure read replicas across all available AZs in the same single region as your primary database instance as opposed to configuring them across all AWS regions?
A) You have a global customer base.
B) You want to ensure disaster recovery.
C) You have a localized customer base close to the target region.
D) You should never configure all read replicas within the same region of the primary database instance.
C. Read replicas are ultimately about providing faster read access to clients. If all your clients are in one region, then there is little advantage to adding read replicas to additional regions. Instead, providing replicas in the same region as the clients gives them the fastest access (C).
129
All your customers are in a single geographical region, and you have created a database instance and multiple read replicas across the AZs in that region. Is there any value in also creating replicas in additional regions?
A) No, there is no value in that approach.
B) Yes, as you gain some disaster recovery benefits from a replica in another region.
C) Yes, as customers may be routed to different regions when they request data from your databases.
D) Yes, as S3 buckets are in different regions as well.
B. An argument could be made for option A here; customers will not be routed to a different region than the closest one if there are resources in a close region (so C is wrong) and D doesn’t make much sense here. However, it is possible that if the primary region failed altogether, you could convert a replica in another region to a primary database, meaning that B has some merit.
130
Which of the following can be done to a read replica? (Choose two.)
A) Read from it.
B) Write to it.
C) Fail over to it.
D) Back it up.
A, D. Read replicas can be backed up manually, and of course read from. However, they effectively become read-only instances, so cannot be written to. You also cannot fail over to a read replica. You can convert it to a stand-alone instance, but that is a manual process that is not a failover. Therefore, A and D are correct.
131
Which of the following will tend to cause performance improvements in an RDS instance that is currently severely taxed? (Choose two.)
A) Create RDS read replicas of the instance.
B) Switch from RDS to DynamoDB.
C) Configure the instance to use Multi-AZ.
D) Upgrade the RDS instance.
A, D. This is a tough question because there is not much context other than knowing the database is not performing well, in a general sense. However, of the options given, switching to DynamoDB and adding Multi-AZ would do little to improve performance. (Note that switching to DynamoDB could help, as DynamoDB auto-scales to handle load, but this is still not the best of the available answers). Adding read replicas and looking at bigger instances are safer and better answers given this limited context.
132
You have a number of large PDF files stored in an RDS instance. These PDFs are accessed infrequently, but when they are accessed, they need to respond quickly to requests. As the user base increases, the load is beginning to overwhelm the database. What suggestions would you make to improve performance? (Choose two.)
A) Move the PDFs to S3.
B) Install ElastiCache in front of the database.
C) Create read replicas of the primary database.
D) Consider increasing the available memory for the database instance.
C, D. Only C and D would have a guaranteed effect here. While it is possible that S3 would deliver the PDFs faster, you’d still have heavy network traffic over AWS, and there’s no guarantee given the information here that S3 would be faster than RDS. B looks appealing, but note that the files are not accessed frequently. This means that caching is not going to help response time, as the files aren’t accessed enough for caching to kick in and be effective. The best options are setting up read replicas and looking at beefing up the database instance.
133
You have a number of large PDF files stored in an RDS instance used by a company’s internal staff, of which 80% are on-site. These PDFs are accessed infrequently, but when they are accessed, they need to respond quickly to requests. As the company’s support staff has increased, the load is beginning to overwhelm the database. What suggestions would you make to improve performance? (Choose two.)
A) Set up a CloudFront distribution.
B) Upgrade the instance running the RDS database.
C) Consider installing a storage gateway with stored volumes at the customer’s on-premises site.
D) Install ElastiCache in front of the database.
B, C. There are typically a lot of “the database is being overwhelmed” questions on the exam, and this is one of those. The key here is understanding that data is accessed infrequently, meaning that caching solutions (A and D) likely won’t help. Further, the staff is on-site, meaning that a customer gateway (C) could be a valid solution. Finally, it’s almost always safe to at least consider upgrading the database instance.
134
You have a number of large PDF files stored in an RDS instance used by a company’s geographically distributed user base. These PDFs are accessed infrequently, but when they are accessed, they need to respond quickly to requests. As the company’s user base has increased, the load is beginning to overwhelm the database. What is the best option for improving database performance?
A) Set up a CloudFront distribution.
B) Create read replicas across the regions in which the user base accesses the application.
C) Consider installing a storage gateway with stored volumes at the customer’s on- premises site.
D) Install ElastiCache in front of the database.
B. Here, the key details are infrequent data access and a geographically distributed customer base. This means that read replicas spread out across the country are the best bet (B). Caching won’t help, so A and D are out, and a storage gateway won’t help customers that aren’t accessing the data on-site.
135
You have a number of large images stored in an RDS instance used by a company’s geographically distributed user base. Each of these images is accessed several thousand times a day and needs to respond quickly to requests. As the company’s user base has increased, the load is beginning to overwhelm the database. What is the best option for improving database performance?
A) Upgrade the instance running the RDS database.
B) Create read replicas across the regions in which the user base accesses the application.
C) Consider installing a storage gateway with stored volumes at the customer’s on- premises site.
D) Install ElastiCache in front of the database.
D. This is a tough question, as several answers are valid. However, the key consideration here is that a single image is accessed several thousand times a day. Rather than adding instance power or read replicas (A and B), caching the images is the best approach, as it reduces overall database reads. In general, pulling an image from a cache (D) is far faster than performing a database read.
136
Which of the following are valid routing policies for Route 53? (Choose two.)
A) Simple routing
B) Fault recovery routing
C) Latency-based routing
D) Cached routing
A, C. Route 53 offers a number of different routing policies: simple, failover, geolocation, geoproximity, latency-based, multivalue answer, and weighted.
137
Which of the following are valid routing policies for Route 53? (Choose two.)
A) Geolocation routing
B) Weighted routing
C) Round-robin routing
D) Distributed routing
A, B. Route 53 offers a number of different routing policies: simple, failover, geolocation, geoproximity, latency-based, multivalue answer, and weighted.
138
Which of the following are valid routing policies for Route 53? (Choose two.)
A) FIFO routing
B) Multivalue answer routing
C) Geoproximity routing
D) Distributed routing
B, C. Route 53 offers a number of different routing policies: simple, failover, geolocation, geoproximity, latency-based, multivalue answer, and weighted.
139
Which of the following routing policies sends traffic to a single resource, such as a web server?
A) Geolocation routing
B) Weighted routing
C) Simple routing
D) Latency-based routing
C. Simple routing is ideal for sending all traffic to a single resource.
140
Which of the following routing policies sends traffic to a single resource, unless that resource is unhealthy, and then routes to a backup resource?
A) Health-based routing
B) Failover routing
C) Simple routing
D) Latency-based routing
B. Failover routing is used to send traffic to a single resource but then to failover routing to a secondary resource if the first is unhealthy.
141
Which of the following routing policies chooses a route for a user based on the user’s geographic location?
A) Health-based routing
B) Failover routing
C) Geolocation routing
D) Region-based routing
C. Geolocation routing uses the location of a user’s DNS query to determine which route to use.
142
Which of the following routing policies chooses a route for a user based on the latency of the available region to which traffic can be directed?
A) Health-based routing
B) Latency-based routing
C) Geolocation routing
D) Region-based routing
B. Latency-based routing uses the latency of regions to determine where routing should direct users.
143
Which of the following routing policies can direct traffic to multiple resources as long as those resources are healthy?
A) Health-based routing
B) Latency-based routing
C) Multivalue answer routing
D) Region-based routing
C. Multivalue answer routing can direct requests to multiple resources and also performs health checks on those resources.
144
Which of the following routing policies uses assigned weights to shape traffic to different resources?
A) Health-based routing
B) Latency-based routing
C) Multivalue answer routing
D) Weighted routing
D. Weighted routing uses predefined weights to determine how traffic is routed across multiple resources.
145
Which of the following routing policies is ideal for routing traffic to a single web server?
A) Simple routing
B) Latency-based routing
C) Multivalue answer routing
D) Weighted routing
A. When there is a single resource to which traffic should be directed, simple routing is the best option.
146
Which of the following Route 53 routing policies are ideal for a geographically distributed user base? (Choose two.)
A) Geolocation routing
B) Geographical routing
C) Geoproximity routing
D) Weighted routing
A, C. The two options here that are valid are geolocation and geoproximity routing, both of which consider the location of the user before routing that user to a resource. Geographical routing is not a valid routing policy for Route 53.
147
Which of the following values is an invalid weight for a weighted routing policy?
A) 1
B) 255
C) 125
D) These weights are all valid.
D. Weights are simply integers that can be summed to determine an overall weight and the fractional weights of each resource to which traffic is directed.
148
How does a weight of 0 affect routing on Route 53 when using a weighted routing policy?
A) 0 is an invalid weight.
B) All traffic is directed to the resource with a weight of 0, as long as that resource is healthy.
C) No traffic is directed to the resource with a weight of 0.
D) Traffic is routed to the resource, but health checks are not performed.
C. A weight of 0 removes the resource from service in a weighted routing policy.
149
You have three resources in a weighted routing policy. Resource A has a weight of 100, resource B has a weight of 100, and resource C has a weight of 200. How will traffic be routed in this scenario?
A) 25% of traffic to resource A, 25% of traffic to resource B, and 50% of traffic to resource C
B) 10% of traffic to resource A, 10% of traffic to resource B, and 20% of traffic to resource C
C) 33% of traffic to resource A, 33% of traffic to resource B, and 33% of traffic to resource C
D) There is not enough information to know how routing will occur in this scenario.
A. In a weighted routing policy, the numerical weights are added up, and each resource’s weight is divided by the sum of all the weights. In this case, the total weight is 400, so A is 25% of that (100/400), B is 25% (100/400), and C is 50% (200/400).
150
Which of the following statements concerning Route 53 routing policies are true? (Choose two.)
A) You can have multiple primary resources in a simple routing policy.
B) A weighted routing policy uses weights for routing, but not health checks.
C) You can have multiple secondary resources in a simple routing policy.
D) Health checks are ignored if a resource has a weight of over 100 in a routing policy.
A, C. A simple routing policy allows single and multiple resources for both the primary and secondary resources, so A and C are true. Weighted policies do honor health checks (so B is false), and D is inaccurate as weight numbers do not affect health checks.
151
You are responsible for a media-serving website backed by a database that has a global user base. The fleet of EC2 instances serving the website is responding well to requests from the US, but requests from the EU are taking nearly five times as long to receive a response. Database CPU utilization stays between 70% and 90% throughout the day. What suggestions would you make to attempt to improve performance of this website? (Choose two.)
A) Install ElastiCache in front of the RDS instance to cache common queries and reduce database reads and therefore overall load.
B) Set up CloudFront to enable caching of data at edge locations closer to the EU user base.
C) Set up an Auto Scaling group with low CPU thresholds to scale up the EC2 instances.
D) Create additional EC2 instances that will serve the website, and locate them in a South Asia region.
A, B. The issues here are geographical proximity from EU users and load on the database, which has high CPU utilization. Therefore, those problems must be addressed. ElastiCache (A) should reduce load on the RDS instance, and CloudFront (B) caches responses in a way that should serve EU users more quickly.
152
Which of the following are not valid instance types? (Choose two.)
A) T3
B) E1
C) M5
D) Q2
B, D. This is another memorization question. Valid instance types begin with T, M, C, R, X, Z, D, H, I, F, G, and P. Frankly, it’s hard to memorize these; the questions like this aren’t frequent, but they can sometimes appear. In this case, E and Q are not valid instance type prefixes.
153
What is the primary purpose of IAM?
A) Deployment of applications
B) Management of permissions in AWS
C) User authentication for applications
D) Configuration of applications
B. IAM offers permissions for AWS resources as well as access rights for users of the AWS platform.
154
Which of the following statements about IAM are accurate? (Choose two.)
A) IAM manages access from one AWS resource to another.
B) IAM manages the authentication interface for the AWS console.
C) IAM manages access from a user to the AWS console.
D) IAM manages single sign-on for users to AWS applications.
A, C. IAM controls permissions for resource-to-resource interaction as well as user access to the AWS console. It does not provide an authentication interface or single sign-on.
155
What does IAM stand for?
A) Improved Access Management
B) Identity and Access Management
C) Information and Access Management
D) Identity and Authorization Management
B. IAM stands for Identity and Access Management.
156
Which of the following does IAM manage? (Choose two.)
A) Management of users accessing the AWS platform
B) Management of permissions for hosted application features
C) Management of roles affecting resources within AWS
D) Management of cost controls for user actions
A, C. IAM only applies to permissions for users, roles, and groups and does not affect billing or cost or specific application feature accessibility.
157
Which of these is not managed by IAM? (Choose two.)
A) Groups of users that share permissions in AWS
B) Groups of users that can log in to a hosted web application
C) Which resources receive notifications from SNS
D) A role that allows EC2 instances to access S3 buckets
B, C. IAM does handle user permissions for accessing AWS (A) and EC2-to-S3 access (D), so these are both true and therefore incorrect. It does not handle hosted application permissions (B) or relate to SNS, making B and C the correct answers.
158
Which of the following is not a feature of IAM?
A) Multi-Factor Authentication for AWS console access
B) Multi-Factor Authentication for object deletion in S3
C) Centralized control of AWS resource access
D) Integration with Active Directory accounts
B. IAM is not the managed service for handling MFA Delete setup on S3 buckets.
159
Which of the following is a security risk as you grow your AWS developer base?
A) Turning on MFA for AWS console access
B) Using a single developer account across your team
C) Creating an account for each developer
D) Requiring passwords with 12 or more characters
B. Anytime a single account in AWS is shared, you likely have a security risk.
160
Which of the following is required when you create additional IAM users beyond the root user?
A) Turning on MFA for all accounts
B) Turning on MFA for the root account
C) Creating a customized sign-in link for users in addition to the AWS root account sign-in link
D) Creating IAM groups for each new user
C. The only requirement here is creating a sign-in link that is not the same as the root sign-in link. Turning on MFA for the root or all accounts is not required, and while it is common to create an IAM group at this stage, it is not required for access.
161
Which of the following are components of IAM? (Choose two.)
A) Users
B) Groups
C) Organizations
D) Organizational units
A, B. Users, groups, roles, permissions, and similar constructs are part of IAM. Organizations and organizational units are part of AWS Organizations, a different facility.
162
Which of the following are components of IAM? (Choose two.)
A) Roles
B) User policies
C) Connections
D) Permissions
A, D. Users, groups, roles, permissions, and similar constructs are part of IAM.
163
You are tasked with ensuring that a fleet of EC2 instances can retrieve data from S3 buckets. Which of the following might you need to create? (Choose two.)
A) Role
B) User
C) Policy
D) Group
A, C. In this case, you’d need to create a role that allows an EC2 instance to communicate with another AWS service, in this case S3. While a default role would probably cover this use case, you might also write a custom policy if you had particular needs for something other than the default role’s allowances.
164
Which types of access can you give a user via IAM? (Choose two.)
A) Console
B) Application
C) Organizational
D) Programmatic
A, D. You can provide console access and programmatic access via IAM. Programmatic access incudes API and CLI access.
165
Which of the following are valid AWS and IAM policy types? (Choose two.)
A) Access control lists
B) Application-based
C) Resource-based
D) Permission-based
A, C. There are four types of policies in IAM: identity-based, resource-based, organization SCPs, and access control lists (ACLs).
166
In what language do you write IAM policies?
A) YAML
B) JSON
C) PHP
D) ACSCII
B. IAM policies are written in JSON.
167
To which of the following can an IAM policy be attached? (Choose two.)
A) Users
B) Database entries
C) Groups
D) Passwords
A, C. IAM policies can be attached to users, groups, and roles in the case of identity-based policies, and AWS services and components via resource-based policies.
168
What does MFA stand for?
A) Multi-Fraction Authentication
B) Multi-Factor Authentication
C) Multi-Factor Authorization
D) Multi-Fraction Authorization
B. MFA stands for Multi-Factor Authentication and can be enabled on a user account by IAM.
169
How does IAM provide scalability benefits to your application deployments? (Choose two.)
A) It allows assignment of permissions to users en masse via groups.
B) It handles allowing users access to hosted applications en masse.
C) It allows consistency in access from instances to managed AWS services across large numbers of instances.
D) It ensures that users do not accidentally delete objects from S3 stores.
A, C. IAM aids in scalability primarily by consolidating and centralizing management of permissions, both to AWS users (A) and from instances to services (C).
170
Which of the following provide centralized user management across your AWS resources? (Choose two.)
A) KMS
B) S3 SSE-C
C) IAM
D) AWS Organizations
C, D. IAM provides permissions, groups, users, and roles, and AWS Organizations provides logical groupings and account management. Both operate across all AWS resources.
171
What is power user access, as it relates to IAM roles?
A) The AWS name for the root user
B) All IAM users are considered power users.
C) A type of user that has full access to all AWS services and resources but not group or user management
D) A user that can access application deployment profiles
C. Power user access is a predefined policy that allows access to all AWS services with the exception of group or user management within IAM.
172
Which of the following can the root user not do?
A) Create users.
B) Remove user access to the console.
C) Delete a role.
D) The root user can do all of these.
D. Root users can perform all actions related to IAM.
173
Which of the following can a power user not do?
A) Create users.
B) Create a new SNS topic.
C) Stop a running EC2 instance created by another user.
D) The power user can do all of these.
A. Power users can work with managed services, but they cannot create (or otherwise manage) IAM users.
174
Which of the following is a best practice for handling root user access keys?
A) Store them only in an instances-protected .aws/ directory.
B) Delete them and instead use different user IAM credentials.
C) Only use them for API access but avoid console access.
D) Enable MFA Delete for when they are used in association with S3.
B. Although it might sound odd, AWS strongly recommends you delete your root user access keys and create IAM users for everyday use.
175
Which of the following require root user credentials? (Choose two.)
A) Close an AWS account.
B) Delete IAM users.
C) Create a CloudFront key pair.
D) Create an IAM policy.
A, C. As a starting point, always consider that the root account is typically required for account-level operations, such as closing an account (A). It’s also needed for very privileged access; in this case, that’s creating a CloudFront key pair, which essentially provides signed access to applications and is a very trusted action. IAM does allow you to distribute user and policy management (B and D).
176
Which of the following do not require root user credentials? (Choose two.)
A) Resizing an existing RDS instance
B) Deploying an application via a CloudFormation template
C) Restoring revoked permissions for a user
D) Changing support options for an AWS account
A, B. Affecting another account is generally something that requires root account level access. In this case, that’s D, as well as restoration of user permissions (C). Both A and B are available to non-root users.
177
How do you remove the AWS account root user’s access to your application EC2 instances?
A) Delete all the keys in the instance’s .aws/ directory.
B) Switch the instance to only accept SSH logins.
C) Remove any keys from the instance’s .ssh/ directory.
D) You can’t remove access for an AWS account root user.
D. It is impossible to remove access for the AWS account’s root user.
178
In a typical single-account AWS environment, which group of users should have root-level account access?
A) Developers and managers
B) Account auditors and developers
C) 2 to 3 developers or engineers responsible for account management
D) Nobody
C. This is a bit of a “gimme” question but sometimes comes up. AWS firmly believes that root account access should be highly limited, but also not confined to a single user. C, having a very small group of engineers (ideally AWS certified) is the best approach to reducing root account level access as much as possible.
179
Which of the following is not a predefined AWS IAM policy?
A) Administrator
B) Power User
C) Billing
D) These are all predefined policies in IAM.
D. AWS defines and keeps updated a number of IAM policies for users, including Administrator, Billing, and Power User.
180
You want to set your DevOps team up quickly in IAM. You have created users for each member of the team. What additional steps should you take? (Choose two.)
A) Create sign-in URLs for the users.
B) Check the DevOps option for each user in the console.
C) Attach the Developer Power User policy to each user.
D) Attach the View-Only User policy to each user.
A, C. You will always need to provide non-root sign-in URLs for new users, so A is essential. The remaining answers are concerned with permissions, and of the choices (B, by the way, isn’t an actual option), the Developer Power User policy is a much better fit than the View-Only User policy.
181
Which of the following policies would be the best fit for a manager who wants access to the company’s main AWS account?
A) Administrator
B) Power User
C) Security Auditor
D) View-Only User
D. Unless your manager is both highly technical and working on actual development issues, D is the best option: It provides View-Only access to AWS without adding unneeded privileges for the manager.
182
Which of the following policies would be the best fit for a team member running Hadoop jobs and queries to determine application usage patterns?
A) Administrator
B) Power User
C) Security Auditor
D) Data Scientist
D. The Data Scientist policy is designed for just this purpose: running queries used for data analytics and business intelligence
183
Which of the following policies would be the best fit for a team member responsible for setting up resources for the development team, working with AWS directory service, and potentially setting up DNS entries?
A) System Administrator
B) Power User
C) Security Auditor
D) Data Scientist
A. This is a System Administrator role. While Power User would give permissions to the same services, it is likely too permissive. Remember, the key with these questions is to find the role that allows the specified operations without going beyond those any more than is necessary.
184
Which of the following are not possible to do with IAM policies and permissions? (Choose two.)
A) Remove access for a user from EC2 instances.
B) Remove access for the root user from EC2 instances.
C) Give the root user access to a hosted web application.
D) Add an additional user with access to all EC2 instances.
B, C. It is impossible to remove a root user’s access to EC2 instances (B). Further, IAM is concerned with the raw AWS resources, not access to running web applications (C).
185
What does logging out of the AWS console and then logging back in accomplish?
A) Applies any IAM policies attached to the user since their last login
B) Applies any IAM policies attached to groups that the user was added to since their last login
C) Applies any updates to IAM policies via JSON or the AWS REST API that have been made since the user’s last login
D) Nothing, all changes to an account are immediate and do not require logging in or back out.
D. IAM changes apply immediately to all users across the system; there is no lag, and no need to log out and back in (D).
186
You have created a new user for a new developer at your company. What permissions will this user have before you take any additional actions?
A) They will not have any access to any AWS services.
B) They will have read-only access to all AWS services.
C) They will have administrator-level access to all AWS services.
D) They will have the same permissions as the root user until restricted.
A. New users have no access to AWS services. They are “bare” or “empty” or “naked” users, in that it is merely a login to the AWS console (if a URL is provided). They cannot make any changes to AWS services or even view services.
187
You have created a new user for a new developer at your company. What steps do you need to take to ensure they can work with EC2 instances? (Choose two.)
A) Set the user up as part of the AWS-defined EC2 Users group.
B) Set the user up as a Developer user in the AWS console.
C) Provide the user with a URL for signing in.
D) Add the user to a group such as Administrators or power users.
C, D. New users have no access to AWS services. They will need a URL to use for logging in (C) and permissions via a valid AWS group such as Administrators or power users. Options A and B refer to groups that are not predefined by AWS.
188
How can you ensure that the new users you have created only can access AWS via the API rather than through the console? (Choose two.)
A) Do not create a sign-in URL for the users.
B) Only provide the users with an access key ID and secret access key.
C) Uncheck the Log In To Console box next to the user in the AWS console.
D) Turn off MFA for the user.
A, B. To access the console, users need a sign-in URL (A) and a username and password. This is not the access key ID and secret access key referenced in B. Therefore, A and B would effectively block a user from accessing the console. There is no Log In To Console box for users.
189
To what degree do usernames have to be unique across AWS?
A) Across the region in which the user exists
B) Across all AWS accounts
C) Across the AWS account in which the user exists
D) Usernames don’t have to be unique, but email addresses do.
C. AWS usernames have to be unique across the AWS account in which that user exists.
190
Which of the following does a user need in order to access AWS resources programmatically? (Choose two.)
A) Username
B) Access key ID
C) Password
D) Secret access key pair
B, D. Programmatic access requires an access key ID and a secret access key pair. Usernames and passwords are used for console access.
191
Which of the following does a user need in order to access the AWS console? (Choose two.)
A) Username
B) Access key ID
C) Password
D) Secret access key pair
A, C. Console access requires a username and password. Access keys and pairs are used for programmatic access, not console access.
192
In what language are policy documents written?
A) JavaScript
B) JSON
C) Node.js
D) Ruby
B. IAM policy documents are written in JSON.
193
Which of the following would apply to giving federated users access to the AWS console via single sign-on?
A) SAML
B) JSON
C) SSO
D) IAM
A. Of these, SSO is single sign-on, IAM is more generally applied here, and JSON is the language used for policy documents. But SAML, the Security Assertion Markup Language, is used directly to implement single sign-on.
194
You have a large user base in an Active Directory and want to give these users access to the AWS console without creating individual users in AWS for each. What approach would you take?
A) Set the AWS console to use the Read Users From Another Authentication Source feature.
B) Use the database migration tool to migrate the Active Directory database into RDS.
C) Set up AWS to federate the users from the Active Directory into AWS.
D) You cannot use a non-AWS Active Directory for access to AWS.
C. If you have an external Active Directory, you’d want to federate those users into AWS. This allows you to use the existing user base, not re-create each individual user.
195
Which of the following is a collection of permissions?
A) Group
B) Role
C) Topic
D) Policy
D. A policy document is a collection of permissions in IAM.
196
You want to add a small group of developers located in a different region than your main development office. How would you handle scaling out users and permissions to this new region?
A) Create the new users in the second region.
B) Create the new users in the primary region and then replicate them to the new region.
C) Create the new users in the primary region, set up IAM replication, and then apply correct permissions to the replicated users in the new region.
D) Create the new users and they will apply to all regions.
D. IAM users are global to an AWS account and are not region-specific.
197
What considerations do you need to take to ensure that your policy documents will scale across your entire organization and set of AWS resources?
A) Make sure each policy has a name unique within the region to which it applies.
B) Make sure each policy document has the region: * attribute so it applies to all regions.
C) Nothing, policy documents are automatically applicable across all AWS resources within an account.
D) When you create the policy document, ensure that you select the Avoid Regional Conflicts option.
C. Like IAM users, policy documents are global. There are no changes or steps you need to take to make these work globally.
198
Which of the following does Auto Scaling address? (Choose two.)
A) Application monitoring
B) Capacity management
C) Cost limiting
D) Permissions management
A, B. Auto Scaling is most focused on capacity management (B), ensuring that your applications can perform by keeping the capacity sufficient. Further, it performs a minimal amount of monitoring to effect this (A). It does not limit cost, although it does help in cost reduction, and it has nothing to do with permissions management.
199
Which of the following are benefits of Auto Scaling? (Choose two.)
A) Pay for only what you need.
B) Improve network performance.
C) Set up scaling quickly.
D) Reduce VPC management overhead.
A, C. Auto Scaling helps you to quickly set up scaling (C) and to then keep costs to a minimum (A). It does not affect network performance, and while there is a reduction of overhead, this is not related to maintaining individual VPCs (D).
200
Which of the following can be scaled using the Auto Scaling interface? (Choose two.)
A) DynamoDB
B) Route 53 domains
C) Aurora read replicas
D) ALBs
A, C. Auto Scaling can be applied to both Aurora (and specifically read replicas) and DynamoDB.
201
Which of the following can be scaled using the Auto Scaling interface? (Choose two.)
A) ECS containers
B) SNS topics
C) Redshift
D) EC2 instances
A, D. EC2 instances as well as ECS containers can both be scaled up and down by Auto Scaling.
202
What does AWS call a collection of components that can grow or shrink to meet user demand?
A) Auto Scaling policy
B) Launch configuration
C) Auto Scaling group
D) Capacity group
C. A collection of components, such as EC2 instances that will grow and shrink to handle load, is an Auto Scaling group.
203
Which of the following can you not specify in an Auto Scaling group? (Choose two.)
A) Minimum size
B) Instances to add
C) Desired capacity
D) Desired cost
B, D. When creating an Auto Scaling group, you can specify the minimum and maximum size as well as a desired capacity and scaling policy. You cannot specify how many instances to add at once, nor the desired cost.
204
Which of the following can you specify in an Auto Scaling group? (Choose two.)
A) Maximum size
B) Scaling policy
C) Minimum processing threshold
D) Memory allocation
A, B. When creating an Auto Scaling group, you can specify the minimum and maximum size as well as a desired capacity and scaling policy. While you can specify triggers that are used to grow or shrink the group, you can not specify a memory allocation or a minimum processing threshold (neither is an actual AWS term).
205
Which of the following are part of an Auto Scaling launch configuration? (Choose two.)
A) Application language
B) AMI ID
C) Security group
D) API endpoint
B, C. A launch configuration contains an AMI ID, key pair, instance type, security groups, and possibly a block device mapping.
206
Which of the following are not part of an Auto Scaling launch configuration? (Choose two.)
A) Instance type
B) Maximum memory utilization
C) Cluster size
D) Security group
B, C. A launch configuration contains an AMI ID, key pair, instance type, security groups, and possibly a block device mapping. Cluster size is not part of a launch configuration, although a maximum number of instances can be added to an Auto Scaling group. Maximum memory utilization also is not part of a launch configuration but can be a trigger for scaling.
207
Which of the following are valid scaling options for an Auto Scaling group? (Choose two.)
A) Manual scaling
B) Memory-based scaling
C) Schedule-based scaling
D) Security-based scaling
A, C. There are a number of valid scaling policies for Auto Scaling: Maintain current instance levels, manual scaling, schedule-based scaling, and demand-based scaling.
208
Which of the following are valid scaling options for an Auto Scaling group? (Choose two.)
A) Demand-based scaling
B) Instance-based scaling
C) Resource-based scaling
D) Maintain current instance levels
A, D. There are a number of valid scaling policies for Auto Scaling: Maintain current instance levels, manual scaling, schedule-based scaling, and demand-based scaling. Resource-based scaling and instance-based scaling are not actual scaling policy options.
209
Which Auto Scaling policy would you use to ensure that a specific number of instances is running at all times?
A) Demand-based scaling
B) Instance-based scaling
C) Resource-based scaling
D) Maintain current instance levels
D. You can choose to maintain current instance levels at all times. This is essentially ensuring that no instances are added unless an instance fails its health checks and needs to be restarted or replaced.
210
Which Auto Scaling policy would you use to add and remove instances based on CPU utilization?
A) Demand-based scaling
B) Schedule-based scaling
C) Resource-based scaling
D) Maintain current instance levels
A. Demand-based scaling allows you to specify parameters to control scaling. One of those parameters can be CPU utilization, so this is the policy you’d use for this use case.
211
Which Auto Scaling policy would you use to add and remove instances at a certain time of day when usage is regularly high?
A) Demand-based scaling
B) Schedule-based scaling
C) Resource-based scaling
D) Maintain current instance levels
B. This one should be pretty easy. Schedule-based scaling allows you to specify a particular time period during which resources should scale up or down.
212
Which Auto Scaling policy would you use to control scaling yourself, within a specified maximum and minimum number of instances?
A) Demand-based scaling
B) Schedule-based scaling
C) Manual-based scaling
D) Maintain current instance levels
C. Manual scaling allows you to specify a minimum and maximum number of instances as well as a desired capacity. The Auto Scaling policy then handles maintaining that capacity.
213
Which of these would you supply for a manual Auto Scaling policy?
A) Desired capacity
B) Time to scale up
C) Maximum CPU utilization
D) Scaling condition
A. Manual scaling allows you to specify a minimum and maximum number of instances as well as a desired capacity. You would specify a time to scale up for a schedule-based policy and maximum CPU utilization as well as scaling conditions for a demand-based policy.
214
Which of the following can be used to trigger scaling up or down for an Auto Scaling group? (Choose two.)
A) CloudWatch
B) SNS
C) The AWS console
D) Route 53
A, C. The most common approach is to use CloudWatch triggers—such as memory or CPU utilization—to notify AWS to scale a group up or down. However, you can also manually scale up or down with the AWS console.
215
You have an Auto Scaling group with an instance that you believe is passing its health checks but is not responding properly to requests. What is the best approach to troubleshoot this instance?
A) Restart the instance.
B) Remove the instance from the Auto Scaling group and then trouble shoot it.
C) Put the instance into the Standby state and troubleshoot it normally.
D) Add a CloudWatch metric to the instance to trigger Auto Scaling.
C. While you can remove the instance altogether (B), you’d eventually want to put it back in the group, meaning you’re incurring extra work. The best approach is to put the instance into Standby mode. This allows the group to scale up if needed, and then you can troubleshoot the instance and then put it back into the InService state when complete.
216
Which of the following are valid instance states for instances in an Auto Scaling group? (Choose two.)
A) Deleted
B) ReadyForService
C) InService
D) Standby
C, D. InService and Standby are valid states for an instance, while Deleted and ReadyForService are not.
217
What is the correct order of tasks to create an Auto Scaling group?
A) Verify your group, create an Auto Scaling group, create a launch configuration.
B) Create a launch configuration, create an Auto Scaling group, verify your group.
C) Create an Auto Scaling group, create a launch configuration, verify your group.
D) Create a launch configuration, verify your group, create an Auto Scaling group.
B. You have to create a launch configuration first, then an Auto Scaling group, and then you can verify your configuration and group.
218
How many AMIs can you use within a single Auto Scaling group launch configuration?
A) None, you do not specify an AMI for a launch configuration.
B) One for all instances within the group
C) One for each instance in the group
D) One for each class of instance in the group
B. A launch configuration needs a single AMI ID to use for all instances it launches.
219
How many security groups can you use within a single Auto Scaling group launch configuration?
A) None, you do not specify a security group for a launch configuration.
B) One security group for all instances within the group
C) One security group for incoming requests and 1 security group for all outgoing requests
D) As many as you like
D. Security groups work for launch configurations just as they do with instances: You may use as many as you like.
220
From which of the following can you create an Auto Scaling group?
A) An EC2 instance
B) A launch configuration
C) A launch template
D) Any of these
D. All of these are valid options for creating an Auto Scaling group.
221
You have an EC2 instance running a web application. You’ve lately seen large increases in traffic and the application is responding slowly several times a day. What are the best steps to take to ensure consistent performance? (Choose two.)
A) Create a launch configuration with an AMI ID and instance parameters.
B) Create an Auto Scaling group from the current EC2 instance.
C) Set up an Auto Scaling group with demand-based scaling.
D) Set up an Auto Scaling group with manual scaling.
B, C. All of these are acceptable options, but the best options are to use the existing EC2 instance as a basis for a new Auto Scaling group and to set up demand-based scaling. Anytime you have an existing instance that is working, you can simply start from there, rather than using a launch configuration and duplicating the setup. Demand-based scaling will respond to changing conditions better than having to manually scale up and down or to set a desired capacity (which is unknown based on the question).
222
You have an application that is peaking daily. You have determined that a large user base on the East Coast is accessing the application every evening, causing the application’s performance to degrade during those hours. What steps would you take to level out performance? (Choose two.)
A) Create an Auto Scaling group with schedule-based scaling.
B) Consider hosting your Auto Scaling group in a US East region.
C) Implement CloudFront to cache responses to user requests.
D) Set up an Auto Scaling group with manual scaling.
A, B. This is a case of having a recurring performance issue, which points to using schedule-based scaling. Further, you know that access is centered around the US East regions. C might help the issue, but without knowing more about the application, it’s not possible to tell if caching content would significantly improve performance.
223
You are in charge of the backup processes for converting an in-house network storage system to S3 on AWS. You want to minimize the costs of cloud storage but preserve the lowest possible latency for requests to the cloud-hosted files. What storage class would you suggest?
A) S3 standard
B) S3-IA
C) S3 One Zone-IA
D) Glacier
C. Here, the determining factor is the requirement of instant access. S3 One Zone-IA will give you that access, at a lower cost than S3 standard and S3-IA. According to AWS, all three classes have the same first byte latency (milliseconds).
224
Which of the following will take the longest to retrieve data from?
A) S3 standard
B) S3-IA
C) S3 One Zone-IA
D) Glacier
D. Glacier takes 3–5 hours to deliver the first byte.
225
Which of the following will take the longest to retrieve data from?
A) S3 standard.
B) S3-IA.
C) S3 One Zone-IA.
D) They are all equal.
D. This is easy to miss, and often is. All three of these S3 storage classes share the same first-byte latency: milliseconds.
226
You are in charge of a CPU-intensive application that has been refactored to perform the most compute-heavy portions of processing separate from normal daily operations. These compute-heavy tasks must finish every month but can be stopped and started without affecting the overall progress of the job. You want to reduce costs associated with this processing; which instance pricing model would you suggest?
A) Reserved instances
B) On-demand instances
C) Dedicated hardware instances
D) Spot instances
D. Spot instances offer you significant costs savings as long as you have flexibility and application processes can be stopped and started.
