AWS Practice Exam 2 Flashcards
Which AWS service does AWS Snowball Edge natively support?
-AWS Server Migration Service (AWS SMS)
-Amazon EC2
-AWS Trusted Advisor
-AWS Database Migration Service (AWS DMS)
Amazon EC2
You can run Amazon EC2 compute instances hosted on a Snowball Edge with the sbe1, sbe-c, and sbe-g instance types. The sbe1 instance type works on devices with the Snowball Edge Storage Optimized option. The sbe-c instance type works on devices with the Snowball Edge Compute Optimized option. Both the sbe-c and sbe-g instance types work on devices with the Snowball Edge Compute Optimized with GPU option.
Which AWS service can be used to load data from Amazon S3, transform it, and move it to another destination?
-Amazon Kinesis
-Amazon RedShift
-AWS Glue
-Amazon EMR
AWS Glue
AWS Glue is an Extract, Transform, and Load (ETL) service. You can use AWS Glue with data sources on Amazon S3, RedShift and other databases. With AWS Glue you transform and move the data to various destinations. It is used to prepare and load data for analytics.
Amazon RedShift is a data warehouse. With a data warehouse you load data from other databases such as transactional SQL databases and run analysis. You can analyze data using SQL and Business Intelligence tools.
Amazon EMR is a managed Hadoop framework running on EC2 and S3. It is used for analyzing data, not for ETL.
Amazon Kinesis is used for collecting, processing and analyzing real-time streaming data.
Which Amazon EC2 pricing model should be avoided if a workload cannot accept interruption if capacity becomes temporarily unavailable?
-Spot Instances
-Standard Reserved Instances
-On-Demand Instances
-Convertible Reserved Instances
Spot Instances
Amazon EC2 Spot Instances let you take advantage of unused EC2 capacity in the AWS cloud. Spot Instances are available at up to a 90% discount compared to On-Demand prices.
The downside is that if capacity becomes temporarily unavailable, your instances may be terminated.
Which combination of steps will enable multi-factor authentication (MFA) on an AWS account? (Select TWO.)
-Activate the MFA device by using Amazon GuardDuty.
-Contact AWS Support to initiate MFA activation.
-Activate AWS Shield on an MFA-compatible device.
-Acquire an MFA-compatible device.
-Activate the MFA device in the IAM console or by using the AWS CLI.
-Acquire an MFA-compatible device.
-Activate the MFA device in the IAM console or by using the AWS CLI.
Multi-factor authentication (MFA) in AWS is a simple best practice that adds an extra layer of protection on top of your user name and password. With MFA enabled, when a user signs in to an AWS Management Console, they will be prompted for their user name and password (the first factor—what they know), as well as for an authentication code from their AWS MFA device (the second factor—what they have).
Taken together, these multiple factors provide increased security for your AWS account settings and resources. You can enable MFA for your AWS account and for individual IAM users you have created under your account. MFA can also be used to control access to AWS service APIs.
You will first need a device capable of providing an application which can support virtual MFA. There are several form factors to choose from:
A company requires a dashboard for reporting when using a business intelligence solution. Which AWS service can a Cloud Practitioner use?
-Amazon Athena
-Amazon Kinesis
-Amazon QuickSight
-Amazon Redshift
-Amazon QuickSight
Amazon QuickSight is a scalable, serverless, embeddable, machine learning-powered business intelligence (BI) service built for the cloud.
QuickSight lets you easily create and publish interactive BI dashboards that include Machine Learning-powered insights.
QuickSight dashboards can be accessed from any device, and seamlessly embedded into your applications, portals, and websites.
What can a Cloud Practitioner use the AWS Total Cost of Ownership (TCO) Calculator for?
-Generate reports that break down AWS Cloud compute costs by duration, resource, or tags
-Estimate a monthly bill for the AWS Cloud resources that will be used
-Estimate savings when comparing the AWS Cloud to an on-premises environment
-Enable billing alerts to monitor actual AWS costs compared to estimated costs
Estimate savings when comparing the AWS Cloud to an on-premises environment
The TCO calculators allow you to estimate the cost savings when using AWS, compared to on-premises, and provide a detailed set of reports that can be used in executive presentations. The calculators also give you the option to modify assumptions that best meet your business needs.
“Generate reports that break down AWS Cloud compute costs by duration, resource, or tags” is incorrect. This describes the AWS Cost & Usage Report.
Estimate a monthly bill for the AWS Cloud resources that will be used” is incorrect. This describes the AWS Pricing Calculator (or Simple Monthly Calculator).
Enable billing alerts to monitor actual AWS costs compared to estimated costs” is incorrect. Billing alerts can be enabled using Amazon CloudWatch.
An application has highly dynamic usage patterns. Which characteristics of the AWS Cloud make it cost-effective for this type of workload? (Select TWO.)
-Strict security
-Elasticity
-Pay-as-you-go pricing
-Reliability
-High availability
-Elasticity
-Pay-as-you-go pricing
AWS is a cost-effective for dynamic workloads because it is elastic, meaning your workload can scale based on demand. And because you only pay for what you use (pay-as-you-go pricing).
Which AWS service should a Cloud Practitioner use to establish a secure network connection between an on-premises network and AWS?
Amazon Virtual Private Cloud (VPC)
AWS Web Application Firewall (WAF)
Virtual Private Network
AWS Mobile Hub
Virtual Private Network
AWS Virtual Private Network solutions establish secure connections between your on-premises networks, remote offices, client devices, and the AWS global network.
AWS Mobile Hub” is incorrect. This service is used for building, testing, and monitoring mobile applications that make use of one or more AWS services.
“AWS Web Application Firewall (WAF)” is incorrect. This service is used for protecting against common web exploits.
Amazon Virtual Private Cloud (VPC)” is incorrect. This is a virtual network in the cloud. You connect your AWS VPN to your Amazon VPC.
A company needs to use third-party software for its workload on AWS.
Is there a feature or service of AWS that the company can use to purchase the software?
-WS License Manager
-AWS Managed Services
-AWS Marketplace
-AWS Resource Access Manager
AWS Marketplace
AWS Marketplace is a curated digital catalog that makes it easy for organizations to discover, procure, entitle, provision, and govern third-party software. You can find thousands of software listings from popular categories like security, business applications, and data & analytics, and across specific industries, such as healthcare, financial services, and public sector.
“AWS Managed Service” is incorrect as this describes services in which AWS customers don’t have to provision their own infrastructure.
“AWS License Manager” is incorrect as it is a service that makes it easier for you to manage Software Licenses.
“AWS Resource Access Manager” is incorrect as it is a service that helps you to securely share your resources across AWS accounts, within your organization or organizational units (OUs) within AWS and has nothing to do with third party services.
Which of the statements below is correct in relation to Consolidated Billing? (Select TWO.)
-You receive one bill per AWS account
-You pay a fee per linked account
-You are charged a fee per user
-You receive a single bill for multiple accounts
-You can combine usage and share volume pricing discounts
-You receive a single bill for multiple accounts
-You can combine usage and share volume pricing discounts
Consolidated billing has the following benefits:
One bill – You get one bill for multiple accounts.
Easy tracking – You can track the charges across multiple accounts and download the combined cost and usage data.
Combined usage – You can combine the usage across all accounts in the organization to share the volume pricing discounts and Reserved Instance discounts. This can result in a lower charge for your project, department, or company than with individual standalone accounts.
A company is interested in moving its on-premises NoSQL database into the AWS Cloud.
Which AWS service should the company use to replace their existing database?
-Amazon Redshift
-Amazon RDS for MySQL
-Amazon Quantum Ledger Database (Amazon QLDB)
-Amazon DynamoDB
Amazon DynamoDB
Amazon DynamoDB is a fully managed, serverless, key-value NoSQL database designed to run high-performance applications at any scale. DynamoDB offers built-in security, continuous backups, automated multi-Region replication, in-memory caching, and data export tools. When you hear of AWS Managed NoSQL databases, DynamoDB is the only acceptable choice.
Amazon Quantum Ledger Database (QLDB) is a fully managed ledger database that provides transparent, immutable, and cryptographically verifiable transactions- and is not a suitable replacement for an on-premises NoSQL database.
Amazon Redshift” is incorrect, as it is an SQL-based data warehousing solution.
Which of the following tasks can a user perform to optimize Amazon EC2 costs? (Select TWO.)
-Implement Auto Scaling groups to add and remove instances based on demand.
-Create a policy to restrict IAM users from accessing the Amazon EC2 console.
-Create users in a single Region to reduce the spread of EC2 instances globally.
-Set a budget to limit spending on Amazon EC2 instances using AWS Budgets.
-Purchase Amazon EC2 Reserved Instances.
-Implement Auto Scaling groups to add and remove instances based on demand.
-Purchase Amazon EC2 Reserved Instances
Which Amazon EC2 tool acts as a virtual firewall to control inbound and outbound traffic to an EC2 instance?
-Network access control list (ACL)
-AWS WAF
-Security group
-AWS Shield
Security group
A security group acts as a virtual firewall, controlling the traffic that is allowed to reach and leave the resources that it is associated with. For example, after you associate a security group with an EC2 instance, it controls the inbound and outbound traffic for the instance.
AWS Shield is a managed Distributed Denial of Service (DDoS) protection service and does not control traffic.
WAF is a Web Application Firewall – something that is placed in front of your web applications outside of your VPC – whereas security groups live within your VPC, controlled instance specific inbound and outbound traffic.
Network access control list (ACL)” is incorrect. Although Network ACLs are virtual firewalls which control access within a VPC, Network ACLs exist on the subnet level, not on the instance level.
A company needs an AWS service that can continuously monitor the company’s AWS account. If there are any changes to the architecture, members of the team must be contacted.
Amazon GuardDuty
AWS Trusted Advisor
Amazon Macie
AWS Config
Which service will meet these requirements?
AWS Config
Which AWS service helps customers meet corporate, contractual, and regulatory compliance requirements for data security by using dedicated hardware appliances within the AWS Cloud?
-AWS Directory Service
-AWS CloudHSM
-AWS Secrets Manager
-AWS Key Management Service (AWS KMS)
AWS CloudHSM
The AWS CloudHSM service helps you meet corporate, contractual, and regulatory compliance requirements for data security by using dedicated Hardware Security Module (HSM) instances within the AWS cloud. AWS CloudHSM enables you to easily generate and use your own encryption keys on the AWS Cloud.
AWS Secrets Manager enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle.
AWS Key Management Service (AWS KMS)” is incorrect. This service is also involved with creating and managing encryption keys but does not use dedicated hardware.
AWS Directory Service for Microsoft Active Directory, also known as AWS Managed Microsoft AD, enables your directory-aware workloads and AWS resources to use managed Active Directory in the AWS Cloud.
Which AWS service can be used to perform data extract, transform, and load (ETL) operations so you can prepare data for analytics?
-Amazon S3 Select
-Amazon Athena
-AWS Glue
-Amazon QuickSight
AWS Glue
AWS Glue is a serverless data integration service that makes it easy to discover, prepare, and combine data for analytics, machine learning, and application development. AWS Glue provides all of the capabilities needed for data integration so that you can start analyzing your data and putting it to use in minutes instead of months.
-Amazon QuickSight is a cloud-native, serverless, business intelligence service.
- Amazon Athena is a serverless, interactive query service to query data and analyze big data in Amazon S3 using standard SQL
-This service enables applications to retrieve only a subset of data from an object by using simple SQL expressions.
AWS Glue provides both visual and code-based interfaces to make data integration easier. Users can easily find and access data using the AWS Glue Data Catalog. Data engineers and ETL (extract, transform, and load) developers can visually create, run, and monitor ETL workflows with a few clicks in AWS Glue Studio.
This service enables applications to retrieve only a subset of data from an object by using simple SQL expressions.
-AWS CodePipeline
-AWS CodeCommit
-AWS CodeDeploy
-AWS CodeBuild
AWS CodeCommit
AWS CodeCommit is a fully-managed source control service that hosts secure Git-based repositories. It makes it easy for teams to collaborate on code in a secure and highly scalable ecosystem.
CodeCommit eliminates the need to operate your own source control system or worry about scaling its infrastructure. You can use CodeCommit to securely store anything from source code to binaries, and it works seamlessly with your existing Git tools.
AWS CodeBuild is a fully managed continuous integration service that compiles source code, runs tests, and produces software packages that are ready to deploy.
CodeDeploy is a deployment service that automates application deployments to Amazon EC2 instances, on-premises instances, serverless Lambda functions, or Amazon ECS services.
AWS CodePipeline is a fully managed continuous delivery service that helps you automate your release pipelines for fast and reliable application and infrastructure updates.
A Cloud Practitioner requires a simple method to identify if unrestricted access to resources has been allowed by security groups. Which service can the Cloud Practitioner use?
-AWS CloudTrail
-Amazon CloudWatch
-AWS Trusted Advisor
-VPC Flow Logs
AWS Trusted Advisor checks security groups for rules that allow unrestricted access (0.0.0.0/0) to specific ports. Unrestricted access increases opportunities for malicious activity (hacking, denial-of-service attacks, loss of data). The ports with highest risk are flagged red, and those with less risk are flagged yellow. Ports flagged green are typically used by applications that require unrestricted access, such as HTTP and SMTP.
CloudWatch is used for performance monitoring.
VPC Flow Logs are used to capture network traffic information, they will not easily identify unrestricted security groups.
AWS CloudTrail” is incorrect. This service is used for auditing API actions
Which technology can automatically adjust compute capacity as demand for an application increases or decreases?
-High availability
-Fault tolerance
-Auto Scaling
-Load balancing
Auto Scaling
AWS are able to continue to reduce their pricing due to:
-Reserved instance pricing
-Economies of scale
-The AWS global infrastructure
-Pay-as-you go pricing
Economies of scale
Which benefit of AWS enables companies to replace upfront fixed expenses with variable expenses when using on-demand technology services?
Economies of scale
Pay-as-you-go pricing
High availability
Global reach
Pay-as-you-go pricing
A Cloud Practitioner is re-architecting a monolithic application. Which design principles for cloud architecture do AWS recommend? (Select TWO.)
-Implement loose coupling.
-Implement manual scalability.
-Use self-managed servers.
-Design for scalability.
-Rely on individual components.
Implement loose coupling.
Design for scalability.
What should a Cloud Practitioner ensure when designing a highly available architecture on AWS?
A single monolithic application component handles all operations.
There are enough servers to run at peak load available at all times.
Servers have low-latency and high throughput network connectivity.
The failure of a single component should not affect the application.
The failure of a single component should not affect the application.
In a highly available system the failure of a single component should not affect the application. This means that if a single component such as an application server fails, there should be other applications servers available that can seamlessly take over operations and ensure the application continues to operate.
In a highly available system the failure of a single component should not affect the application. This means that if a single component such as an application server fails, there should be other applications servers available that can seamlessly take over operations and ensure the application continues to operate.
EC2 security groups
AWS Config
Amazon Macie
Amazon Inspector
Amazon Inspector
Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS. Amazon Inspector automatically assesses applications for exposure, vulnerabilities, and deviations from best practices.
After performing an assessment, Amazon Inspector produces a detailed list of security findings prioritized by level of severity. These findings can be reviewed directly or as part of detailed assessment reports which are available via the Amazon Inspector console or API.
Security groups are instance-level firewalls used for controlling network traffic reaching and leaving EC2 instances.
. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect sensitive data in AWS.
A company is interested in moving its on-premises NoSQL database into the AWS Cloud.
Which AWS service should the company use to replace their existing database?
-Amazon DynamoDB
-Amazon Redshift
-Amazon RDS for MySQL
-Amazon Quantum Ledger Database (Amazon QLDB)
Amazon DynamoDB
Which AWS service can act as a hybrid storage solution to connect on-premises workloads with the AWS cloud?
-AWS Direct Connect
-Amazon Connect
-AWS Storage Gateway
-AWS Backup
AWS Storage Gateway
AWS Storage Gateway is a hybrid cloud storage service that gives you on-premises access to virtually unlimited cloud storage. You can use Storage Gateway to simplify storage management and reduce costs for key hybrid cloud storage use cases.
These include moving backups to the cloud, using on-premises file shares backed by cloud storage, and providing low-latency access to data in AWS for on-premises applications.
To support these use cases, the service provides four different types of gateways – Tape Gateway, Amazon S3 File Gateway, Amazon FSx File Gateway, and Volume Gateway – that seamlessly connect on-premises applications to cloud storage, caching data locally for low-latency access.
Connect is a cloud-based telecommunications service providing managed cloud-based customer contact centers.
AWS Backup” is incorrect as this is a service which manages backups in a cost-effective, fully managed, policy-based manner.
Although Direct Connect is a service for creating hybrid connections to on-premises data centers, it is a direct physical cable connection and not a storage service.
Which AWS service does AWS Snowball Edge natively support?
-AWS Server Migration Service (AWS SMS)
-AWS Database Migration Service (AWS DMS)
-AWS Trusted Advisor
-Amazon EC2
You can run Amazon EC2 compute instances hosted on a Snowball Edge with the sbe1, sbe-c, and sbe-g instance types. The sbe1 instance type works on devices with the Snowball Edge Storage Optimized option. The sbe-c instance type works on devices with the Snowball Edge Compute Optimized option. Both the sbe-c and sbe-g instance types work on devices with the Snowball Edge Compute Optimized with GPU option.
A company needs a consistent and dedicated connection between AWS resources and an on-premise system.
Which AWS service can fulfil this requirement?
-AWS Direct Connect
-AWS Managed VPN
-AWS DataSync
-Amazon Connect
AWS Direct Connect
An AWS Direct Connect connection is a private, dedicated link to AWS. As it does not use the internet, performance is consistent.
According to the AWS shared responsibility model, which task is the customer’s responsibility?
-Maintaining Amazon API Gateway infrastructure.
-Updating the guest operating system on Amazon EC2 instances.
-Updating the operating system of AWS Lambda instances.
-Maintaining the infrastructure needed to run Amazon DynamoDB.
-Updating the guest operating system on Amazon EC2 instances.
According to the shared responsibility model, which security-related task is the responsibility of the customer?
-Maintaining physical networking configuration.
-Maintaining server-side encryption.
-Securing servers and racks at AWS data centers.
-Maintaining firewall configurations at a hardware level.
Maintaining server-side encryption.
All client-side and server-side encryption is a responsibility of the customer using the AWS Cloud.
