Practice Questions (ACG) Flashcards
Your application needs to process large numbers of job requests and you need to ensure that they are processed in order, and that each request is processed only once. How would you deploy SQS to achieve this end?
Use an SQS FIFO queue to process the jobs.
You are working on a Lambda function which needs to access data in RDS. Which of the below is the current best AWS service to use to securely provide rotated database credentials to Lambda functions?
AWS Secrets Manager
AWS Secrets Manager is the current AWS recommended way of securely provide database credentials to Lambda functions. AWS Secrets Manager aids in the managing and rotating the RDS database passwords.
Systems Manager Parameter Store
Parameter Store provides secure storage for configuration data, connection strings, passwords, and secrets management, so it is viable option from a storage standpoint, but can NOT rotate passwords like AWS Secrets Manager.
You have developed a Lambda function which is not running as performantly as expected. Which of the following approaches can improve the performance of your function?
Establish your database connections from within the Lambda execution environment to enable connection reuse.
Only include the libraries you need to minimize the size of your deployment package.
You have software on an EC2 instance that needs to access both the private and public IP address of that instance. What’s the best way for the software to get that information?
Have the software use cURL or GET to access the instance metadata.
A recent increase in the amount of users of an application hosted on an EC2 instance that you manage has caused the instance’s OS to run out of CPU resources and crash. The crash caused several users’ unsaved data to be lost and your supervisor wants to know how this problem can be avoided in the future. Which of the following would you NOT recommend?
Take frequent snapshots of the EBS volume during business hours to ensure users’ data is backed up.
Frequent snapshots are not recommended, as they can result in performance degradation. Additionally, these snapshots will not capture users’ unsaved data that lives in the instance’s memory.
AWS recommends that you use multipart upload for files larger than _____.
100MB
AWS recommends that you use multipart upload for any files that are greater than 100 MB in size, instead of uploading the object in a single operation.
Which of the following are considered to be serverless?
- SNS
- DynamoDB
- API Gateway
- Elastic Beanstalk
SNS
DynamoDB
API Gateway
If your table item’s size is 3 KB and you want to have 90 eventually consistent reads per second, how many read capacity units will you need to provision on the table?
45
3 / 4 = 0.75 round up to 1
90 / 2 = 45
45 * 1 = 45
Your application needs 100 strongly consistent reads on items that are 9 KB in size every second. How many units of read capacity units should you provision?
300
9 / 4 = 2.25 rounds up to 3
3 * 100 = 300
One of your junior developers has never had AWS access before and needs access to an Elastic Load Balancer in your custom VPC. This is the first and only time she will need access. Which of the following choices is the most secure way to grant this access?
- None of these.
- Add that developer to a group with the requisite access (although that group may have more permissions than are needed for the dev to do her job).
- Let her log in with admin credentials and change the admin password when she is finished.
- Create a new IAM user with only the required permissions and delete that IAM user after the developer has finished her work.
Create a new IAM user with only the required permissions and delete that IAM user after the developer has finished her work.
It’s always best practice to grant users access via IAM roles and groups. In this case, we would not assign the junior dev to an existing group, as most dev groups will have more access than is required for this dev to perform the single task she has been asked to accomplish. Remember, always grant the fewest privileges possible.
Your main application currently stores its credentials as a text file on an EC2 server. Your manager has informed you that this is an insecure practice and has told you to store these credentials in an AWS-managed service instead. AWS Systems Manager Parameter Store and AWS Secrets Manager can be used for the secure storage of credentials. Of the below features, which apply to both Secrets Manager and Parameter Store?
- Can store credentials in hierarchical form
- Manages rotation and lifecycle of credentials
- Integrated with Identity and Access Management
- Supports encryption at rest using customer-owned KMS keys
Can store credentials in hierarchical form
Integrated with Identity and Access Management
Supports encryption at rest using customer-owned KMS keys
You are developing an online banking website which will be accessed by a global customer base. You are planning to use CloudFront to ensure users experience good performance regardless of their location. The security architect working on the project asks you to ensure that all requests to CloudFront are encrypted using HTTPS. How can you configure this? (choose one)
- Set the request protocol policy to redirect HTTP to HTTPS
- Set the session protocol policy to redirect HTTP to HTTPS
- Set the viewer protocol policy to redirect HTTP to HTTPS
- Set the user protocol policy to redirect HTTP to HTTPS
Set the viewer protocol policy to redirect HTTP to HTTPS
Viewer protocol policy defines the protocols which can be used to access CloudFront content.
You have developed a Lambda function which is not running as performantly as expected. Which of the following approaches can improve the performance of your function? (choose 2)
- Only include the libraries you need to minimize the size of your deployment package.
- Store environment variables outside the function.
- Establish your database connections from within the Lambda execution environment to enable connection reuse.
- Package all dependencies with your deployment package.
Only include the libraries you need to minimize the size of your deployment package.
Establish your database connections from within the Lambda execution environment to enable connection reuse.
Using the AWS console, you are trying to scale DynamoDB past its pre-configured maximums. Which service can you increase by raising a ticket to AWS support?
Provisioned throughput limits
Global secondary indexes
Your application is trying to upload a 6 TB file to S3, and you receive an error message telling you that your proposed upload exceeds the maximum allowed object size. What is the best way to accomplish this file upload?
You cannot fix this, as the maximum size of an S3 object is 5 TB.
You created a CloudFormation template that launched a web application running on EC2 instances in us-west-1. However, you are experiencing a problem creating a development stack in us-east-1 to serve clients in another geographical location. What should you do to solve the problem?
Copy the AMI in the template from us-west-1 to us-east-1.
