PT1 Flashcards
A data analytics company wants to use clickstream data for Machine Learning tasks, develop algorithms, and create visualizations and dashboards to support the business stakeholders. Each of these business units works independently and would need real-time access to this clickstream data for their applications.
As a Developer Associate, which of the following AWS services would you recommend such that it provides a highly available and fault-tolerant solution to capture the clickstream events from the source and then provide a simultaneous feed of the data stream to the consumer applications?
Correct: Kinesis Data Streams
- enables real-time processing of streaming big data. It provides ordering of records, as well as the ability to read and/or replay records in the same order to multiple Amazon Kinesis Applications. provides the ability for multiple applications to consume the same stream concurrently
Incorrect:
Kinesis Data Firehose
- Kinesis Data Firehose is used to load streaming data into data stores
Kinesis Data Analytics
- Kinesis Data Analytics is used to build SQL queries and sophisticated Java applications
SQS
- For SQS, you cannot have the same message being consumed by multiple consumers at the same time
A cyber forensics application, running behind an ALB, wants to analyze patterns for the client IPs.
Which of the following headers can be used for this requirement?
Correct: To see the IP address of the client, use the X-Forwarded-For request header.
Incorrect:
- To determine the protocol used between the client and the load balancer, use the X-Forwarded-Proto request header
- the X-Forwarded-Port request header helps you identify the destination port that the client used to connect to the load balancer
- X-Forwarded-IP - This is a made-up option and has been added as a distractor
DevOps engineers are developing an order processing system where notifications are sent to a department whenever an order is placed for a product. The system also pushes identical notifications of the new order to a processing module that would allow EC2 instances to handle the fulfillment of the order. In the case of processing errors, the messages should be allowed to be re-processed at a later stage and never lost.
Which of the following solutions can be used to address this use-case?
Correct: SNS + SQS
Incorrect:
SNS + Kinesis
- the retention day period is 7 days, and processing issues would completely block all future messages.
SNS + Lambda
- your EC2 instances cannot “poll” from Lambda functions and as such, this would not work
SQS + SES
- the messages need to be processed twice (once for sending the notification and later for order fulfillment) and SQS only allows for one consuming application
A popular mobile app retrieves data from an AWS DynamoDB table that was provisioned with read-capacity units (RCU’s) that are evenly shared across four partitions. One of those partitions is receiving more traffic than the other partitions, causing hot partition issues.
What technology will allow you to reduce the read traffic on your AWS DynamoDB table with minimal effort?
Correct: Dynamo DAX
a fully managed, highly available, in-memory cache for DynamoDB that delivers up to a 10x performance improvement
Incorrect:
DynamoDB Streams
- A stream record contains information about a data modification to a single item in a DynamoDB table
ElastiCache
- you will need to modify your code to check the cache before querying the main query store. As the given use-case mandates minimal effort, so this option is not correct
More partitions
- This option has been added as a distractor as DynamoDB handles that for you automatically
The development team at a retail organization wants to allow a Lambda function in its AWS Account A to access a DynamoDB table in another AWS Account B.
As a Developer Associate, which of the following solutions would you recommend for the given use-case?
Correct option:
Create an IAM role in account B with access to DynamoDB. Modify the trust policy of the role in Account B to allow the execution role of Lambda to assume this role. Update the Lambda function code to add the AssumeRole API call
Incorrect:
Create a clone of the Lambda function in AWS Account B so that it can access the DynamoDB table in the same account
- Creating a clone of the Lambda function is a distractor as this does not solve the use-case outlined in the problem statement
Add a resource policy to the DynamoDB table in AWS Account B to give access to the Lambda function in Account A
- You cannot attach a resource policy to a DynamoDB table, so this option is incorrect
Create an IAM role in Account B with access to DynamoDB. Modify the trust policy of the execution role in Account A to allow the execution role of Lambda to assume the IAM role in Account B. Update the Lambda function code to add the AssumeRole API call
- As mentioned in the explanation above, you need to modify the trust policy of the IAM role in Account B so that it allows the execution role of Lambda function in account A to assume the IAM role in Account B
Your team-mate has configured an Amazon S3 event notification for an S3 bucket that holds sensitive audit data of a firm. As the Team Lead, you are receiving the SNS notifications for every event in this bucket. After validating the event data, you realized that few events are missing.
What could be the reason for this behavior and how to avoid this in the future?
Correct:
If two writes are made to a single non-versioned object at the same time, it is possible that only a single event notification will be sent
- If two writes are made to a single non-versioned object at the same time, it is possible that only a single event notification will be sent. If you want to ensure that an event notification is sent for every successful write, you can enable versioning on your bucket
Incorrect:
Someone could have created a new notification configuration and that has overridden your existing configuration - It is possible that the configuration can be overridden. But, in the current scenario, the team lead is receiving notifications for most of the events, which nullifies the claim that the configuration is overridden
Versioning is enabled on the S3 bucket and event notifications are getting fired for only one version - This is an incorrect statement. If you want to ensure that an event notification is sent for every successful write, you should enable versioning on your bucket
Your notification action is writing to the same bucket that triggers the notification - If your notification ends up writing to the bucket that triggers the notification, this could cause an execution loop. But it will not result in missing events.
You are storing your video files in a separate S3 bucket than your main static website in an S3 bucket. When accessing the video URLs directly the users can view the videos on the browser, but they can’t play the videos while visiting the main website.
What is the root cause of this problem?
Correct option:
Enable CORS
Incorrect:
Change the bucket policy - we know that’s not the case because it works using the direct URL but it doesn’t work when you click on a link to access the video
Amend the IAM policy - This scenario refers to public users of a website and they need not have an IAM user account
Disable Server-Side Encryption - Disabling encryption is not an issue because you can access the video directly using an URL but not from the main website
A large firm stores its static data assets on Amazon S3 buckets. Each service line of the firm has its own AWS account. For a business use case, the Finance department needs to give access to their S3 bucket’s data to the Human Resources department.
Which of the below options is NOT feasible for cross-account access of S3 bucket objects?
Correct option:
Use IAM roles and resource-based policies delegate access across accounts within different partitions via programmatic access only - IAM roles and resource-based policies delegate access across accounts only within a single partition.
Incorrect:
Use Resource-based policies and AWS Identity and Access Management (IAM) policies for programmatic-only access to S3 bucket objects - Use bucket policies to manage cross-account control and audit the S3 object’s permissions. If you apply a bucket policy at the bucket level, you can define who can access (Principal element), which objects they can access (Resource element), and how they can access (Action element).
Use Resource-based Access Control List (ACL) and IAM policies for programmatic-only access to S3 bucket objects - Use object ACLs to manage permissions only for specific scenarios and only if ACLs meet your needs better than IAM and S3 bucket policies.Use Cross-account IAM roles for programmatic and console access to S3 bucket objects - Not all AWS services support resource-based policies. This means that you can use cross-account IAM roles to centralize permission management when providing cross-account access to multiple services.
A junior developer working on ECS instances terminated a container instance in Amazon Elastic Container Service (Amazon ECS) as per instructions from the team lead. But the container instance continues to appear as a resource in the ECS cluster.
As a Developer Associate, which of the following solutions would you recommend to fix this behavior?
Correct option:
You terminated the container instance while it was in STOPPED state, that lead to this synchronization issues - If you terminate a container instance while it is in the STOPPED state, that container instance isn’t automatically removed from the cluster. You will need to deregister your container instance in the STOPPED state by using the Amazon ECS console or AWS Command Line Interface
Incorrect:
You terminated the container instance while it was in RUNNING state, that lead to this synchronization issues - If you terminate a container instance in the RUNNING state, that container instance is automatically removed
The container instance has been terminated with AWS CLI, whereas, for ECS instances, Amazon ECS CLI should be used to avoid any synchronization issues - This is incorrect and has been added as a distractor
A custom software on the container instance could have failed and resulted in the container hanging in an unhealthy state till restarted again - This is an incorrect statement. It is already mentioned in the question that the developer has terminated the instance.
You work as a developer doing contract work for the government on AWS gov cloud. Your applications use Amazon Simple Queue Service (SQS) for its message queue service. Due to recent hacking attempts, security measures have become stricter and require you to store data in encrypted queues.
Which of the following steps can you take to meet your requirements without making changes to the existing code?
Correct option: Enable SQS KMS encryption
Incorrect:
Use the SSL endpoint - The given use-case needs encryption at rest
Use Client-side encryption - will require a code change, so this option is incorrect
*Use Secrets Manager * - Secrets Manager cannot be used for encrypting data at rest
AWS CloudFormation helps model and provision all the cloud infrastructure resources needed for your business.
Which of the following services rely on CloudFormation to provision resources (Select two)?
Correct:
AWS Elastic Beanstalk and AWS Serverless Application Model (AWS SAM)
Incorrect:
AWS Lambda - does not need CloudFormation to run
AWS Autoscaling - used CloudFormation but is not a mandatory requirement.
CodeBuild - CodePipeline uses AWS CloudFormation as a deployment action but is not a mandatory service
A company that specializes in cloud communications platform as a service allows software developers to programmatically use their services to send and receive text messages. The initial platform did not have a scalable architecture as all components were hosted on one server and should be redesigned for high availability and scalability.
Which of the following options can be used to implement the new architecture? (select two)
Correct: ALB + ECS
When you use ECS with a load balancer such as ALB deployed across multiple Availability Zones, it helps provide a scalable and highly available REST API.
API Gateway + Lambda
API Gateway and Lambda help achieve the same purpose integrating some capabilities such as authentication in a serverless fashion, with fully scalable and highly available architectures
Incorrect:
SES + S3 - The combination of these services only provide email and object storage services
CloudWatch + CloudFront - The combination of these services only provide monitoring and fast content delivery network (CDN) services.
EBS + RDS - The combination of these services only provide elastic block storage and database services
Your e-commerce company needs to improve its software delivery process and is moving away from the waterfall methodology. You decided that every application should be built using the best CI/CD practices and every application should be packaged and deployed as a Docker container. The Docker images should be stored in ECR and pushed with AWS CodePipeline and AWS CodeBuild.
When you attempt to do this, the last step fails with an authorization issue. What is the most likely issue?
Correct option:
The IAM permissions are wrong for the CodeBuild service
Incorrect:
The ECR repository is stale, you must delete and re-create it - You can delete a repository when you are done using it, stale is not a concept within ECR
CodeBuild cannot talk to ECR because of security group issues - A security group acts as a virtual firewall at the instance level and it is not related to pushing Docker images
The ECS instances are misconfigured and must contain additional data in /etc/ecs/ecs.config - The error Authorization is an indication that there is an access issue, therefore you should not look at your configuration first but rather permissions
You team maintains a public API Gateway that is accessed by clients from another domain. Usage has been consistent for the last few months but recently it has more than doubled. As a result, your costs have gone up and would like to prevent other unauthorized domains from accessing your API.
Which of the following actions should you take?
Correct option:
Restrict access by using CORS - When your API’s resources receive requests from a domain other than the API’s own domain and you want to restrict servicing these requests, you must disable cross-origin resource sharing (CORS) for selected methods on the resource
Incorrect:
Use Account-level throttling - this is about limit on the number of requests and is not a suitable answer for the current scenario
Use Mapping Templates - Mapping Templates have nothing to do with access and are not useful for the current scenario
Assign a Security Group to your API Gateway - You can restrict IP address using this, the downside being, an IP address can be changed by the accessing user
A retail company manages its IT infrastructure on AWS Cloud via Elastic Beanstalk. The development team at the company is planning to deploy the next version with MINIMUM application downtime and the ability to rollback quickly in case deployment goes wrong.
As a Developer Associate, which of the following options would you recommend to the development team?
Correct option:
Deploy the new version to a separate environment via Blue/Green Deployment, and then swap Route 53 records of the two environments to redirect traffic to the new version
Deploy the new application version using ‘All at once’ deployment policy - Although ‘All at once’ is the quickest deployment method, but the application may become unavailable to users (or have low availability) for a short time
Deploy the new application version using ‘Rolling’ deployment policy - rollback process is via manual redeploy, so it’s not as quick as the Blue/Green deployment
Deploy the new application version using ‘Rolling with additional batch’ deployment policy - rollback process is via manual redeploy, so it’s not as quick as the Blue/Green deployment
