AWS-SA-Pro Flashcards
1
Q
What are the two most common features of AWS Systems Manager?
A
- Run Command
- Patch Manager
2
Q
What is the name of the AWS Systems Manager command that is used for a patch?
A
AWS-RunPatchBaseline
3
Q
Which AWS service can you use if you want to migrate Chef and/or Puppet configuration management tools into the cloud?
A
AWS OpsWorks
4
Q
Are AMI’s global or region-specific?
A
Region-specific
5
Q
AWS OpsWorks is more suited for _______ whereas Elastic Beanstalk is more suited for _______.
A
AWS OpsWorks is more suited for infrastructure engineers whereas Elastic Beanstalk is more suited for development teams.
6
Q
How do the key concepts of AWS OpsWorks interrelate (Stacks, Layers, Apps, Recipes, Cookbooks) ?
A
Stacks = one or more Layers.
Layers = set of EC2 instances grouped by function.
Apps = deployed (from S3) onto the layers.
Recipes = scripts applied to layers.
Cookbooks = collection of recipes that can be stored on GitHub.
7
Q
How are Amazon GuardDuty & Amazon Inspector different from AWS Shield & AWS WAF?
A
GuardDuty & Inspector = detection.
Shield & WAF = protection.
8
Q
Which service creates serverless GraphQL and Pub/Sub APIs?
A
AWS AppSync
9
Q
What 4 services can be used with AWS WAF?
A
(1) CloudFront
(2) ALB
(3) API Gateway
(4) AppSync
10
Q
Which AWS service scans EC2 instances for vulnerabilities and provides a report of findings?
A
Amazon Inspector
11
Q
Which AWS service provides a CVE (common vulnerabilities and exposures) report?
A
Amazon Inspector
12
Q
Differences between Amazon Inspector and Amazon GuardDuty?
A
Inspector scans EC2 instances for vulnerabilities.
GuardDuty scans entire AWS account using ML-based threat detection.
13
Q
Would you use SAML 2.0 Identity Federation with Google, Facebook, Twitter, etc?
A
No. Use SAML 2.0 Identity Federation with an Enterprise Identity Provider (used mainly for on-prem IDs to indirectly login to AWS)
14
Q
What is the difference between Cognito and IAM Identity Center?
A
Cognito will be used for customer login scenarios and IAM Identity Center will be used for enterprise / workforce login scenarios.
15
Q
What’s the difference between Cognito User Pools and Identity Pools?
A
User Pools offer a sign-up or sign-in experience and provide users with a JWT.
Identity Pools offer a way to swap an unauthenticated or authenticated identity for AWS credentials.
16
Q
Can API Gateway accept JWT’s for authentication?
A
Yes
17
Q
How can an AWS admin create predefined products (and IaC templates) that end users can provision without fully accessing the AWS service (e.g. EC2 instances) ?
A
AWS Service Catalog
18
Q
VPC Flow Logs can capture metadata for what three items (levels)?
A
(1) VPC
(2) Subnet
(3) ENI
19
Q
Do VPC Flow Logs provide real-time data?
A
No. There is a delay.
20
Q
What two log destinations can be used with VPC Flow Logs?
A
(1) S3
(2) CloudWatch logs
21
Q
Where is a Network Firewall deployed?
A
At the VPC level
22
Q
What layer does AWS WAF use?
A
L7
23
Q
What is used to configure your WAF rules?
A
A Web ACL
24
Q
What is the default Web ACL Capacity Unit (WCU) maximum?
A
1500
25
What are the three types of WAF Rule Groups? (Rule Group = reusable set of rules that you can add to a web ACL)
(1) Managed groups
(2) Self-managed groups
(3) Service-owned groups (Shield, Firewall Manager)
26
AWS WAF can inspect a request body, header, and cookie (among other items). However, what is the limit for how much can be inspected?
8 KiB (or 8192 bytes)
27
How are you charged for using WAF?
(1) $5 / month / Web ACL
(2) $1 / month / Web ACL Rule
(3) $0.60 / 1 million requests
28
What layer does AWS Shield Standard protect?
L3 and L4
29
Does AWS Shield Advanced get automatically applied to your resources?
No, even after paying for it, you still need to explicitly choose how to configure it for your resources.
30
What are two benefits of AWS Shield Advanced?
(1) DDoS cost protection -- service credits are provided if your resources auto-scale in response to a DDoS attack
(2) Health-based detection -- Shield Advanced can monitor Route 53 health checks to detect changes in resources and more quickly identify threats / attacks
31
Which AWS service offers Desktop-As-A-Service (DaaS)?
Amazon Workspaces
32
Are Amazon Workspaces highly available?
No, they run on EC2 instances inside a single subnet (and therefore AZ).
33
Which AWS Directory Service is best when you have more than 5000 users, you want it to be highly available (2+ AZs), and you want a trust relationship between on-prem and cloud directory?
AWS Directory Service for Microsoft Active Directory
34
Which AWS service uses schema extensions (remote desktop, Sharepoint, SQL, DFS)?
AWS Directory Service for Microsoft Active Directory
35
What is the best AWS directory service to use when you don't want any directory data hosted in AWS?
AD Connector
36
What is the best AWS directory service for continuous operations if the network link between AWS and on-prem environment fails?
AWS Directory Service for Microsoft Active Directory -- because the directory is simultaneously running on AWS EC2 instances in addition to on-prem
37
What AWS service allows your on-premises active directory to use other directory-compatible AWS services -- without any identity data being stored in AWS?
AD Connector
38
What are the three categories of internet networking zones?
(1) Public Internet
(2) AWS Public Zone
(3) AWS Private Zone (VPCs)
39
Can DHCP Option Sets be edited?
No, once created they are immutable
40
When you associate a DHCP Option Set to a VPC, do the changes occur immediately?
No, the changes require a DHCP Renew which takes some time
41
In every subnet, what is the "subnet+1" IP address reserved for?
The VPC router's network interface -- every VPC router needs an interface in every subnet
42
What AWS service would you use to provision infrastructure for a contact center?
Amazon Connect -- also it is omnichannel (voice + chat)
43
What AWS service would you use to ingest the following types of data: security cameras, smartphones, cars, drones, audio, thermal, depth, radar.. ?
Kinesis Video Streams
44
What AWS service will likely be used when the exam mentions GStreamer or RTSP (real-time streaming protocol) ?
Kinesis Video Streams
45
What AWS service is used for serverless ETL ?
AWS Glue
46
How many AWS Glue Data Catalogs can you have?
One catalog per region per account
47
How can you avoid data silos and improve visibility into your data stores across all AWS services?
Use AWS Glue Data Catalog crawlers to discover data
48
What AWS service provides managed web and mobile application testing using a fleet of real browsers and devices?
AWS Device Farm
49
What AWS service uses NLP to analyze text?
Amazon Comprehend
50
What AWS service would you use for intelligent enterprise search capability?
Amazon Kendra
51
What AWS service uses "slots" as parameters to categorize talking points during a conversation?
Amazon Lex
52
What routes traffic between subnets and is controlled by the route tables?
VPC Router
53
Every VPC is created with a _____ that is the default for every subnet in the VPC.
Main route table
54
How many route tables can a subnet have associated to it?
Only 1
55
How does a route table prioritize traffic routing when there are multiple matching entries?
The most specific route is prioritized
56
For a stateless firewall to work smoothly, you often have to ______ all outbound traffic so your server can return the responses to the changing client ephemeral ports.
allow
57
What AWS component has both "allow" and "deny" rules?
NACL
58
How are the NACLs and Security Groups different in regards to their default configurations?
NACLs allow all traffic by default.
Security Groups deny all traffic by default.
59
When you create a Custom NACL, what is the default inbound rule and default outbound rule?
Both are "deny all" rules.
60
Can Security Groups have explicit deny rules?
No. Only allow rules.
61
Security Groups are not actually attached to EC2 Instances; they are attached to _____
ENIs (primary network interface of the EC2 instance)
62
What AWS service would you use when you need single digit millisecond latency and AWS infrastructure physically located closer to your end users?
AWS Local Zones
63
What AWS service is conceptually just a single AZ that is physically closer to your end users?
AWS Local Zones
64
What AWS service converts text into "life-like" speech (no translation service) ?
Amazon Polly
65
What AWS service performs deep learning image and video analysis?
Amazon Rekognition
66
What AWS service can detect and analyze text in documents such as JPEG, PNG, PDF, or TIFF ?
Amazon Textract
67
What AWS service can you use to generate predictions based on time-series data?
Amazon Forecast
68
What service can you conceptually think of as an IDE for ML model lifecycles?
Amazon SageMaker Studio
69
Which Disaster Recover strategy would be analogous to moving from your current house to building a new backup house from scratch?
Backup & Restore
70
Which Disaster Recover strategy only runs the bare minimum resources required for a recovery?
Pilot Light
71
Which Disaster Recover strategy keeps a fully functional copy of your resources running but in a smaller and scaled down capacity than your current infrastructure?
Warm Standby
72
What keyword is used to describe the main CloudWatch service?
CloudWatch Metrics
73
How would you capture richer and more detailed metrics for CloudWatch?
Install the CloudWatch agent
74
What term is used in CloudWatch to define a container for metrics?
Namespaces
75
What is the term that CloudWatch uses to differentiate metrics between distinct EC2 instances?
Dimensions (a name/value pair that is part of the identity of a metric)
76
What are the two CloudWatch resolutions, which is the default, and what are the time intervals?
1. Standard (default): 60 second granularity
2. High: 1 second granularity
77
What CloudWatch feature can be used to view data aggregation over a time period, such as Min, Max, Sum, Average ?
CloudWatch Statistics
78
How do the three main CloudWatch Logs items interrelate (Log Events, Log Streams, Log Groups) ?
Log Groups contain Log Streams, which contain Log Events, which consist of a timestamp and raw message.
79
If you use the S3 Export feature of CloudWatch Logs, is the data transferred in real time?
No, it can take up to 12 hours
80
What integration would you use if you want near-real-time handling of CloudWatch Logs data?
Kinesis Firehose
81
What integration would you use if you need real-time handling of CloudWatch Logs data?
Lambda functions and/or Kinesis Data Streams
82
How long are CloudTrail Events stored by default at no cost?
90 days
83
What are the three different types of CloudTrail Events?
(1) Management Events
(2) Data Events
(3) Insight Events
84
What type of CloudTrail Events are captured by default?
Management Events, but NOT Data Events
85
What are the two scopes that can be used when creating a CloudTrail Trail?
(1) One Region
(2) All Regions
86
How many CloudTrail Trails can you have per Region?
5
87
How would you capture global service events using CloudTrail for services like IAM, STS, CloudFront ?
This isn't captured by default, so you would have to create a new CloudTrail Trail. The Trail would log these events into us-east-1 since they are global services.
88
Does CloudTrail capture events in real-time?
No, it takes approximately 15 minutes.
89
For CloudTrail, what is the cost to have one Trail for ongoing Management Events delivered to S3 ?
Free
90
Which AWS service is used to trace user requests through your application to identify bottlenecks and view latency data at each stage of the application?
AWS X-Ray
91
The following items are two common examples of AWS-generated ___________ ?
(1) aws:createdBy
(2) aws:cloudformation:stack-name
Cost Allocation Tags
92
After creating a Cost Allocation Tag, is it immediately available?
No, it can take up to 24 hours to be visible and active
93
After creating a Cost Allocation Tag, does it apply retroactively to your cost reporting?
No, it is not retroactive.
94
What are the 7 free AWS Trusted Advisor checks for the AWS Basic Support and AWS Developer Support plans?
(1) S3 Bucket Permissions
(2) Security Groups - Specific Ports Unrestricted
(3) IAM Use (i.e. does each account have IAM users and not using root user)
(4) MFA on Root Account
(5) Are EBS Snapshots public?
(6) Are RDS Snapshots public?
(7) 50 service limit checks (80%+ quota utilization)
95
Which AWS support plans give you access to the AWS Support API to integrate with your applications?
AWS Business Support
AWS Enterprise Support
96
What CloudWatch Logs feature allows you to stream logging data into different systems?
Subscription Filters
97
What protocol operates over TCP/179 ?
Border Gateway Protocol (BGP)
98
What can be conceptually thought of as a network in BGP?
An Autonomous System (AS)
99
What's the difference between iBGP and eBGP?
iBGP (internal) deals with routing within an AS.
eBGP (external) deals with routing between AS's.
100
In BGP, each AS broadcasts ______ to the other AS's.
The shortest ASPATH (doesn't take into account the path performance/latency).
101
How can you configure AS route tables in BGP to manipulate the routes that each AS broadcasts?
You can use Path Prepending to artificially lengthen certain paths. This will solve the problem of AS's broadcasting the shortest path without taking into account latency.
102
What AWS service uses anycast IP addresses, so a customer's request to the IP address will be routed the closest location?
AWS Global Accelerator
103
In regards to the OSI layers, how is Global Accelerator different from CloudFront?
CloudFront only uses L7, but Global Accelerator uses L4 (TCP/UDP) and L7.
104
How are Symmetric Encryption and Asymmetric Encryption different?
Symmetric Encryption is fast but less secure, because both parties use the same key to encrypt/decrypt the data.
Asymmetric Encryption is slower but more secure, because it uses a public key + private key.
105
IKE (Internet Key Exchange) Phase 1 and IKE Phase 2 are the two main phases of ________.
IPSEC VPNs
106
What are the two types of VPNs?
(1) Policy-based VPNs (different rules for different types of traffic)
(2) Route-based VPNs (target matching based on prefixes)
107
With a Site-to-Site VPN, is the Virtual Private Gateway (VGW) highly available?
Yes, behind the scenes there are separate endpoints distributed across AZs.
108
How would you configure a Site-to-Site VPN to be highly available?
Add a second Customer Gateway (CGW).
109
What is the AWS Site-to-Site VPN speed limit?
1.25 Gbps
110
What AWS service would you use to reduce complexity when connecting multiple VPCs and on-prem networks?
AWS Transit Gateway (TGW)
111
What is the benefit of peering TGW's?
You can create connections to other AWS Regions either in the same account or also cross-account.
112
When Transit Gateways (TGWs) are peered, are the routes in each TGW route table automatically shared/propagated between TGWs?
No.
113
How many peering attachments per TGW?
Up to 50
114
A ________ is associated with VPCs, Subnets, Internet Gateways (IGW), Virtual Private Gateways (VGW), and Transit Gateways (TGW).
route table
115
What's the difference between static routes and dynamic routes in a route table?
Static routes are added manually.
Dynamic routes are propagated into the route table, if this is enabled for a TGW or VGW association.
116
What could you do to enable better performance for your Site-to-Site VPN?
Use the Accelerated Site-to-Site VPN feature. This utilizes Global Accelerator edge locations.
117
What would you use for an AWS-managed implementation of OpenVPN, typically as a way for a remote workforce to securely access AWS resources?
Client VPN (different from Site-to-Site VPN)
118
Is the Split Tunnel feature of AWS Client VPN the default?
No, it must be enabled. Split Tunnel allows your client to retain it's existing route tables when associating the Client VPN route table onto it.
119
How are you billed for DX ?
Hourly cost for the port allocation at the DX location.
Outbound data transfer (inbound is free).
120
Is a DX location owned by AWS ?
No, typically these are regional data centers where AWS has rented equipment.
121
What are the 3 speed options for a DX connection?
1, 10, or 100 Gbps
122
How could you secure your DX connection at the L2 level on a hop-by-hop basis?
Use MACsec
123
Regarding a DX connection (which is a L2 connection), what is used to allow multiple L3 networks to run over the DX ?
Virtual Interfaces (VIFs)
124
____ VIFs are used to connect to public IPs in AWS Public Zones.
____ VIFs are used to connect to private IPs within AWS VPCs.
____ VIFs are used to integrate DX with Transit Gateways (TGWs).
Public
Private
Transit
125
An Accelerated Site-to-Site VPN can be used for ____ but not _____.
Can be used for TGW, but not VGW.
126
When using a Private VIF to run over your DX connection, what is the max number of prefixes that you can advertise to the BGP network?
100
127
A ______ ____ is layered over a DX connection and runs from on-prem infrastructure to a Virtual Private Gateway (VGW). It must be attached to a VGW within the same region that the DX connection terminates into.
Private VIF
128
A _____ VIF can access all AWS Regions. There is no region specific limitation like for ______ VIFs.
Public..... Private
129
What AWS service could you use to connect on-prem infrastructure to multiple VPCs spread across AWS Regions using a single DX connection?
Direct Connect Gateway (DGW)
130
A Direct Connect Gateway (DGW) can be associated with VPCs & ______, or TGWs & a ______, but not both.
Private VIFs.... Transit VIF
131
Would you use a DX Link Aggregation Group (LAG) more for speed purposes or for resiliency purposes?
Speed
132
A DX _____ ____________ _______ is when you utilize multiple DX connections going into a single DX location for faster speeds (parallel data transit).
Link Aggregation Group (LAG)
133
A DX LAG is capable of using 2 ___ GB ports or 4 ports if they use less than ___ GB.
100
134
What AWS service is used to register domains and host zones (nameservers)?
Route 53
135
When you create a Route 53 Hosted Zone, how many nameservers does AWS allocate for your hosted zone?
4
136
In Route 53, a CNAME record can map a domain to another _______, but not to an ___ _________.
... domain.... IP address
137
What type of DNS record is used for a server to find the mail server of a specific domain?
MX records
138
What type of DNS record can be used to prove domain ownership?
TXT records
139
What DNS feature is used to cache DNS query results?
TTL - depending on how long the TTL is, sometimes a query may not use the most up-to-date IP address and the request will take longer to go through
140
What is a Route 53 Hosted Zone in simple terms?
It is a DNS database for a domain
141
What is the difference between CNAME and ALIAS records?
CNAME maps name-->name (does not support apex)
ALIAS maps name-->name (does support apex)
142
What is the main limitation of Route 53 Simple Routing?
doesn't support health checks
143
Which Route 53 routing policy improves availability but is NOT a replacement for load balancing?
Route 53 Multi Value Routing
144
Which Route 53 routing policy would you use to optimize performance and user experience?
Route 53 Latency-Based Routing
145
Which Route 53 routing policy checks for records based on the state, country, and continent?
Route 53 Geolocation Routing
146
Which Route 53 routing policy routes based on physical distance and includes a bias value?
Route 53 Geoproximity Routing
147
When using a Route 53 Private Hosted Zone, what two attributes need to be set to "true" ?
1. enableDnsHostnames
2. enableDnsSupport
148
What AWS service can you use to track changes that are made to your resources?
AWS Config
149
Can you deploy an application to your on-prem servers using Elastic Beanstalk?
No
150
_________ multi-master DB instances are confined to the same region, whereas _________ multi-master DB instances allow read/write to any region.
Aurora... DynamoDB Global Tables...
151
_________ is a serverless Database-Table-as-a-Service (DBaaS), whereas _________ is NOT serverless and is a Database-Server-as-a-Service (DBSaaS).
DynamoDB.... Amazon RDS...
152
Each DynamoDB table item (conceptually, a row) can have a max size of _____ KB.
400
153
Does an ELB provide you with an IP address or a DNS name to use?
ELB only provides you with a DNS name
154
How does AWS incentivize customers to use ALIAS records for mapping from a DNS name to an AWS resource?
They do not charge for this. It is free.
155
For DNS resolution, you would use _____ records to map www.example.com to an IPv4 address.
A
156
Can the Management Account of an AWS Organization be restricted with a Service Control Policy (SCP) ?
No. SCPs do not affect the Management Account.
157
Do SCPs affect service-linked roles?
No. Service-linked roles will still work normally even with an SCP attached.
158
Would you use Amazon Macie to scan your CodeCommit repositories for secret keys?
No, Amazon Macie is generally used for scanning S3 buckets.
159
How many subnets can you have per VPC?
Default is 200
160
Can a Security Group block a specific IP address?
No, because Security Groups block all inbound traffic by default and only use allow rules.
161
How many IAM users can you have per account? Can this quota be changed?
5000.... No, this is a hard limit.
162
What could you set up to ensure your AWS Service Quotas don’t end up restricting your application as its demand grows?
You could create CloudWatch Alarms to notify you when you're approaching your Service Quotas. Then you can request a quota increase before your application hits the quota ceiling.
163
Permissions Boundaries can be applied to ________ or ________.
IAM Users... IAM Roles
164
What are the 6 sequential items that are checked when determining allow/deny status for anything within the SAME AWS account?
1. Check for any "Explicit Deny" rules
2. SCPs
3. Resource Policies
4. Permissions Boundaries
5. Session Policies (only applicable for "assumeRole" situations)
6. Identity Policies
165
AWS Resource Access Manager allows AWS resources to be shared from one account to another AWS _________, _________, or _________.
Account... Organizational Unit (OU)... Organization
166
Is there a cost for using AWS Resource Access Manager?
No cost.
167
Are AZ's always mapped to the same physical data centers, when comparing two accounts? For example, would "us-east-1a" for account A always match "us-east-1a" for account B?
No. AWS rotates how the AZ's are mapped to the physical data centers.
Solution = AZ ID's... These ARE consistent across accounts.
168
When sharing AWS resources using AWS Resource Access Manager between accounts WITHIN the same organization, does the recipient account need to manually accept the invite?
No, the recipient account automatically accepts the invitation.
169
When sharing AWS resources using AWS Resource Access Manager between accounts across DIFFERENT organizations, does the recipient account need to manually accept the invite?
Yes.
170
When using a Shared Services VPC with AWS Resource Access Manager, can the participant accounts provision services into the Shared Services VPC?
Yes
171
When using a Shared Services VPC with AWS Resource Access Manager, can the account that owns/shares the VPC delete or modify resources created by the participant accounts?
No. Ownership of a provisioned resource by a participant account remains with that participant account.
172
VPC Peering allows shared access to ______ VPC resources, whereas AWS PrivateLink only allows access (via interface endpoints) to a ________ VPC service/application.
all ..... specific
173
Does a VPC Gateway Endpoint go into a specific subnet or specific AZ?
Neither, a VPC Gateway Endpoint is used across all AZ's in a region.
Then you can define which subnets will have the Gateway Endpoint prefix added into their route tables.
174
What type of endpoint provides private access to S3 and/or DynamoDB ?
VPC Gateway Endpoint
175
Can VPC Gateway Endpoints access services in other regions?
No, they are a regional service.
176
AWS Internet Gateways are conceptually attached to the perimeter of a _________.
VPC
177
Does your default VPC come with an Internet Gateway?
Yes. Also it comes with a public subnet in each AZ.
178
A VPC ______ Endpoint allows private access to the AWS Public Zone services (S3, DynamoDB) without using an Internet Gateway or NAT Gateway.
Gateway
179
In Amazon ECS, you cannot attach security groups to the ECS Tasks when using the _____ networking mode.
bridge or host
180
In Amazon ECS, which networking mode assigns an ENI and a private IPv4 address to each ECS Task?
awsvpc (this provides more control than the "bridge" networking mode)
181
Are certificates from AWS Certificate Manager regional or global?
Regional. If multiple regions are desired, you must request a certificate for each region.
182
st1 and sc1 are examples of _______ EBS volumes and they have a _______ (high/low) max IOPS count.
HDD... low...
183
To troubleshoot constantly failing EC2 instances in an ASG, are you able to suspend the "Terminate" process of the ASG?
Yes.
184
Even if you enable EC2 instance protection for an EC2 instance, the ______ still has the ability to terminate an EC2 instance that it has created.
ASG
185
For an Amazon SQS Queue, the _______ attribute specifies the number of times a message is delivered to the queue before being moved to a dead-letter queue.
maxReceiveCount
186
A VPC ________ Endpoint goes into a specific subnet whereas a VPC ________ Endpoint is used across all AZ's in a region.
Inferface... Gateway...
187
Network access to a VPC ________ Endpoint can be controlled with a Security Group (b/c it is within a subnet within a VPC) whereas a VPC ________ Endpoint cannot.
Inferface... Gateway...
188
Which type of VPC endpoint uses DNS for its routing?
VPC Interface Endpoint
189
VPC ________ Endpoints use prefix lists and route tables, whereas VPC ________ Endpoints use DNS.
Gateway... Interface...
190
When deploying resources into a public subnet, does the resource need to have a public IP address?
No, you can choose to only assign a private IP address to your resources, even in public subnets.
191
Can a public (aka internet-facing) ALB communicate with instances inside a private subnet?
Yes, as long as the ALB is running from a public subnet.
192
Can the Fargate deployment type run on AWS Outposts?
No.
193
______ allow us to run multiple L3 networks over the L2 Direct Connect.
VIFs
194
A VIF uses a ______ Peering Session + _______.
BGP... VLAN
195
When creating a site-to-site VPN connection, specify ________ routing if your customer gateway device supports BGP.
dynamic (as opposed to static)
196
Would you use AWS X-Ray to help plan a migration?
No, it is used to debug production applications.
197
A Network ACL can filter requests based on _______ but not ________.
IP addresses... URLs
198
A _______ server acts as an intermediary between the client and the server, effectively functioning like a firewall/filter.
proxy
199
What enables private connections to AWS services without using public IPs, and uses AWS PrivateLink under the hood?
Interface Endpoints
200
Metric Filters and Subscription Filters are components of which AWS service?
CloudWatch Logs
201
Management Events and Data Events are components of which AWS service?
CloudTrail
202
Which AWS services can be directly accessed through Gateway Endpoints?
S3 and DynamoDB
203
How does traffic routing work with Gateway Endpoints in a VPC?
Gateway Endpoints are added as a target for a specific route in your VPC route table
204
When generating an S3 Presigned URL, what permissions get embedded into the link?
The permissions will match those of the IAM user who created the link.
205
Is it a good practice to generate an S3 Presigned URL using an IAM role?
No, because the IAM role will generally expire faster than the URL and then the URL will not work.
206
What AWS service could you use to simplify access to S3 (for example, providing different departments with their own S3 URL each containing separate permissions policies)?
S3 Access Points
207
What CLI command would you use to set up an S3 Access Point?
create-access-point
208
Does S3 Object Lock require versioning to be enabled on the bucket?
Yes. Thus, it is actually the object versions, rather than the object, that are being locked.
209
What are the two types of S3 Object Lock?
(1) S3 Object Lock - Retention
— compliance mode: immutable
— governance mode: some changes allowed
(2) S3 Object Lock - Legal Hold
— on/off switch: prevents deletion
210
What service can be used to monitor and discover sensitive data in S3 (for example, PII) ?
Amazon Macie
211
What service runs discovery jobs based on (1) managed data identifiers and/or (2) custom data identifiers?
Amazon Macie
212
In the context of EBS, 1 IOPS is equal to __ KB per second.
16 KB
213
What is the standard and maximum IOPS for an EBS GP3 volume?
Standard: 3,000 IOPS
Maximum: 16,000 IOPS
214
What are the 3 types of EBS Provisioned IOPS SSD Volumes?
(1) io1
(2) io2
(3) Block Express
215
What are the two types of EBS HDD-Based Volumes?
(1) st1: throughput optimized
(2) sc1: cold, lowest cost
216
Can you attach an instance store volume to an already-launched EC2 instance?
No, instance store volumes must be attached at the time of launch.
217
Instance store volumes are often included in the price of _____
EC2 Instances
218
Can st1 or sc1 EBS volumes be used as EC2 boot volumes?
No.
219
You can aggregate multiple EBS volumes into a RAID0 set, and this can provide up to _____ IOPS of performance.
260,000 IOPS
220
The io1 and io2 EBS volumes can provide up to ____ IOPS and the io2 Block Express volume can provide up to _____ IOPS.
64,000 … 256,000
221
What is the max item size for an item in a DynamoDB table?
400 KB
222
What is the data transfer rate for DynamoDB Table RCU’s and WCU’s ?
RCU: 4KB/s
WCU: 1KB/s
223
What are the two modes of ECS?
(1) EC2 Mode
(2) Fargate Mode
224
Which ECS mode injects ENI’s into your VPC while the EC2 instances are run and hosted within AWS’s internal EC2 pool?
Fargate mode
225
Are SQS and SNS public zone services or private zone services?
Public zone
226
With SQS and SNS, which is one-to-many and which is one-to-one ?
SNS: one-to-many
SQS: one-to-one
227
Which AWS service is kind of a hybrid between SNS and SQS and provides both queues and topics?
AmazonMQ
228
What is the default Lambda function timeout, and the max timeout?
Default: 3 seconds
Max: 15 minutes
229
If you want to always reference the most recent Lambda version, what would you point to (a phrase)?
$LATEST
230
What database compatibility does AWS Aurora offer?
MySQL, PostgreSQL
231
What is a key difference between AWS Aurora and RDS?
Aurora: More scalable, RDS: Broader DB engine options
232
Which AWS service is used for orchestrating multiple AWS Lambda functions?
AWS Step Functions
233
What are the three types of API endpoints offered by AWS API Gateway?
Edge-Optimized, Regional, Private
234
What AWS service integrates with API Gateway for user authentication and authorization?
AWS Cognito
235
What file does AWS SAM use to define serverless resources?
sam-template.yaml
236
What AWS service does AWS SAM internally use to deploy applications?
AWS CloudFormation
237
Which service can be used with AWS CloudFront to protect against DDoS attacks?
AWS Shield
238
Key difference between Trusted Key Groups and Origin Access Identity (OAI) in CloudFront?
Trusted Key Groups: URL signing; OAI: S3 bucket access
239
What AWS service's primary function is to manage SSL/TLS certificates?
AWS Certificate Manager (ACM)
240
When a SSL/TLS certificate is needed for a CloudFront distribution (or any global services), where must the certificate be generated?
us-east-1
241
Which AWS service is commonly used with ElastiCache for database caching?
Amazon RDS
242
Does ElastiCache for Redis or Memcached support complex data types?
Redis
243
Which supports multi-threading, ElastiCache for Redis or Memcached?
Memcached
244
Which ElastiCache option offers persistence and replication?
Redis
245
Key difference between AWS Internet Gateway and AWS NAT Gateway?
Internet Gateway: Two-way internet access; NAT Gateway: Outbound-only for private subnets
246
What format can AWS CloudFormation templates be written in?
JSON, YAML
247
What feature does AWS CloudFormation provide for grouping related resources?
CloudFormation Stacks
248
Can you update a running CloudFormation Stack?
Yes
249
A CloudFormation Stack is a collection of AWS resources that is created as a result of deploying a single _____________.
CloudFormation template
250
Which CloudFormation service can deploy and manage stacks across multiple accounts and regions?
CloudFormation StackSets
251
Key difference between CloudFormation Templates and Stacks?
Templates: JSON or YAML file blueprint of the infrastructure; Stacks: the collection of resources deployed from the template
252
What are the three types of AWS Storage Gateway?
File Gateway, Volume Gateway, Tape Gateway
253
Which type of Storage Gateway is used to store and retrieve objects in S3 using file protocols (NFS, SMB)?
AWS Storage Gateway File Gateway
254
Which AWS Storage Gateway type supports block-based storage?
AWS Storage Gateway Volume Gateway
255
What SSM capability provides a centralized store for configuration data?
SSM Parameter Store
256
What is the main difference between AWS Config and AWS SSM?
Config: resource configuration
SSM: resource operations / automation
257
For a hybrid environment storage solution where on-prem and cloud integration is desired, what AWS service is best?
AWS Storage Gateway File Gateway
258
Between AWS Transfer Family and AWS DataSync, which is best for continuous, regular file transfers and which is best for one-time or batch large-scale data transfer?
AWS Transfer Family: continuous, regular
AWS DataSync: fast high-volume transfer
259
_______ can transfer data quickly to and from Amazon S3, EFS, FSx for Windows File Server.
AWS DataSync
260
What is the maximum data storage capacity of a standard AWS Snowball device?
80 TB
261
What is a Homogeneous Migration in AWS DMS?
Migration between the same database engines
262
What is a Heterogeneous Migration in AWS DMS?
Migration between different database engines
263
What AWS service is often used alongside DMS for schema conversion? Is it used for homogeneous or heterogeneous migrations?
AWS Schema Conversion Tool (SCT)
Only used for heterogeneous migrations.
264
What policies define the maximum permissions for an account, organization, or organizational unit (OU) in AWS Organizations?
SCPs
265
Do SCPs grant permissions?
No, they only restrict permissions
266
Can SCPs override IAM policies?
No, they are used in conjunction with IAM policies
267
Key difference between SCPs and IAM Policies?
SCPs: Restrict permissions at the account/OU level; IAM Policies: Grant specific permissions to users, groups, and roles
268
How many IP addresses are reserved in each subnet in AWS VPC?
5
269
Which specific IP address in a subnet is reserved for the network address?
The first IP address (e.g., 10.0.0.0)
270
Which IP address in a subnet is reserved for the subnet's default gateway (aka router)?
The second (VPC + 1) IP address (e.g., 10.0.0.1)
271
Which specific IP address in a subnet is reserved for DNS?
The third (VPC + 2) IP address (e.g., 10.0.0.2)
272
Which AWS service uses DHCP Option Sets?
Amazon VPC
273
What can be specified in a custom DHCP Option Set?
DNS servers, NTP servers, domain name, NetBIOS name servers, NetBIOS node type
274
What service can be used to capture information about IP traffic going to and from network interfaces in a VPC?
VPC Flow Logs
275
Where can VPC Flow Logs be published to?
CloudWatch Logs, Amazon S3
276
Can VPC Flow Logs be created for subnets and individual network interfaces, in addition to VPCs?
Yes
277
Key difference between VPC Flow Logs and AWS CloudTrail?
Flow Logs: Network traffic logs; CloudTrail: API activity logs
278
Are VPC Flow Logs in AWS real-time?
No, there's a slight delay
279
In VPC Flow Logs, what are the protocol numbers that are used to identify ICMP, TCP, and UDP traffic?
ICMP: 1
TCP: 6
UDF: 17
280
What is the primary use of SAML 2.0 in cloud services?
Single Sign-On (SSO) for web applications
281
In SAML 2.0, what is the role of the "Identity Provider" (IdP)?
Authenticates user's identity and sends SAML assertions
282
What format are SAML 2.0 assertions typically in?
XML
283
How does the Service Provider (SP) use SAML 2.0 in Identity Federation?
Consumes the assertion from IdP to grant user access
284
What are the two main components of AWS Cognito?
User Pools, Identity Pools
285
What does AWS Cognito User Pool provide?
User directory and handles sign-up/sign-in processes
286
What does AWS Cognito Identity Pool enable?
Granting access to AWS services for authenticated and unauthenticated users
287
What is the primary function of AWS Route 53?
Managed Domain Name System (DNS) service
288
Can AWS Route 53 be used for domain registration?
Yes
289
Are VPC Gateway Endpoints region-specific in AWS?
Yes, they are confined to the region in which your VPC is located
290
What happens when you create a VPC Interface Endpoint in a VPC with DNS resolution enabled?
Private DNS entries are automatically added for the service
291
What is the purpose of Route 53 Resolver Endpoints in AWS?
Enable DNS queries to flow between your VPC and your on-prem network
292
What are the two types of Route 53 Resolver Endpoints?
Inbound Endpoints, Outbound Endpoints
293
What AWS service can be used to compile and test code?
AWS CodeBuild
294
What is the build file called in AWS CodeBuild that is stored in the root of the source?
buildspec.yml
295
Can Read Replicas in RDS be promoted to primary instances?
Yes, useful for failover or scaling purposes
296
Are RDS Read Replicas replicated synchronously or asynchronously?
Asynchronously
297
Can RDS Read Replicas be located in different regions than the primary database?
Yes
298
What technology does Gateway Load Balancer utilize to efficiently distribute traffic?
GENEVE protocol
299
How do ALBs differ from Network Load Balancers (NLBs) in AWS?
ALBs operate at Layer 7 (application layer), NLBs at Layer 4 (transport layer)
300
What are the scaling options available in AWS Auto Scaling Groups?
(1) Manual
(2) Scheduled
(3) Dynamic (simple, step, target tracking)
301
Do autoscaling groups have a cost?
No, they are free.
302
Within an autoscaling group, what defines the instance types and instance configurations?
The launch template
303
What can you use to pause EC2 instances in an ASG during launch or termination so that custom actions can occur?
ASG Lifecycle Hooks
304
Do ASGs require a scaling policy?
No, not required.
305
What service is used to simplify the deployment of third-party virtual security appliances in a scalable and fault-tolerant manner?
AWS Gateway Load Balancer (GWLB)
306
What is the default granularity for CloudWatch metrics?
1 minute.
307
What is the difference between CloudWatch Logs and CloudWatch Metrics?
Logs collect text-based log files, Metrics collect quantitative data.
308
What feature does CloudWatch provide to react to metric thresholds being breached?
CloudWatch Alarms that trigger notifications or actions.
309
Which service provides request tracing to debug and analyze applications?
AWS X-Ray
310
What determines the level of access to Trusted Advisor checks and recommendations?
The AWS support plan (Basic, Developer, Business, or Enterprise)
311
What are the two main types of backups for AWS RDS?
Automated backups and manual snapshots.
312
How long does AWS RDS retain automated backups by default?
7 days (configurable up to 35 days).
313
What AWS service provides connection pooling to enhance database efficiency and scalability?
AWS RDS Proxy
314
What are the two main types of indexes in Amazon DynamoDB?
Global Secondary Index (GSI) and Local Secondary Index (LSI)
315
What is a limitation of a Local Secondary Index (LSI) in DynamoDB?
It must be defined at the time of table creation. LSI’s cannot be added or removed later.
316
In DynamoDB, a _____ supports queries over the entire table and a _____ only supports queries within the same partition.
Global Secondary Index (GSI) ... Local Secondary Index (LSI)
317
What is the primary purpose of Amazon DynamoDB Accelerator (DAX)?
To provide in-memory caching for DynamoDB
318
What DynamoDB feature provides multi-region, fully managed, multi-master database replication?
DynamoDB Global Tables
319
How is Amazon Athena priced?
Based on the amount of data scanned by the queries.
320
How does Amazon Athena differ from Amazon Redshift?
Athena is serverless and queries data directly in S3, while Redshift is a managed, petabyte-scale data warehouse that requires data loading.
321
What is the default data retention period for Kinesis Data Streams?
24 hours (extendable up to 365 days).
322
Name four AWS services that Kinesis Data Firehose can deliver data to.
Amazon S3, Redshift, OpenSearch Service, and Splunk.
323
Name two AWS services that can be used as data sources for Kinesis Data Analytics.
Kinesis Data Streams and Kinesis Data Firehose.
324
What processing languages does Kinesis Data Analytics support?
SQL and Java (Apache Flink).
325
What are three open-source frameworks that can be run on Amazon EMR?
Hadoop, Spark, HBase.
326
What are the two types of nodes in Amazon EKS?
Worker nodes and control plane nodes.
327
Name two AWS services that can be integrated with Amazon EKS for logging and monitoring.
Amazon CloudWatch, AWS CloudTrail.
328
What are four AWS services that can be protected by AWS WAF?
(1) CloudFront
(2) API Gateway
(3) ALB
(4) AWS AppSync (GraphQL APIs)
329
How does AWS WAF allow you to control web traffic?
Through web ACLs (Access Control Lists).
330
How does AWS WAF differ from AWS Shield?
WAF provides customizable web traffic control, Shield offers DDoS protection.
331
How can you enable HTTPS for an application running on AWS Elastic Beanstalk?
By applying an SSL certificate to your Elastic Beanstalk environment's load balancer.
332
What AWS Elastic Beanstalk feature could you use for testing changes, blue/green deployments, or quickly replicating environments for different purposes without manual configuration?
Environment cloning
333
What type of file is used to configure multi-container Docker applications?
Docker Compose file
334
What are the three categories of Elastic Beanstalk runtimes/platforms?
Built-in languages, Docker, and custom platforms
335
What is the hierarchical structure of Elastic Beanstalk?
Applications, which contain Environments, which contain Versions.
336
In Elastic Beanstalk, what are the two tier options when configuring an environment?
(1) web server tier (user interacts with)
(2) worker tier (processes application logic)
337
Elastic Beanstalk is great for _______ ___________ _______.
small development teams
338
When using Elastic Beanstalk, should you host the database part of the application within Elastic Beanstalk?
No, create the databases outside of Elastic Beanstalk so they are not accidentally deleted (or data is lost) during blue/green deployments.
339
The term "source bundle" refers to an application within what AWS service?
Elastic Beanstalk
340
To decouple an existing RDS instance from within an Elastic Beanstalk environment to be a standalone RDS instance, you should create an _____ _________, click on "________ _______ __________" for the RDS instance, create a new EB environment without RDS, swap environments, and then terminate the old environment.
RDS snapshot... Enable Delete Protection
341
Behind the scenes, Elastic Beanstalk uses _______________ to provision resources for your application.
CloudFormation
342
You can customize your Elastic Beanstalk environment by creating a ____________ folder within the application source bundle and adding YAML or JSON CloudFormation files ending in ________.
.ebextensions
.config
343
What AWS service automates server setup, configuration, deployment, and management with Chef and Puppet?
AWS OpsWorks
344
What AWS Systems Manager feature allows you to define the desired state of your AWS resources?
State Manager.
345
What AWS service is best suited for automated patch management, executing remote commands, and inventory management?
AWS Systems Manager
346
Does Systems Manager Run Command require SSH/RDP access?
No, it connects via the Systems Manager agent that is installed on the EC2 instance and/or on-prem instances.
347
In AWS Systems Manager, a ________ _________ is a set of rules for auto-approving patches.
Patch Baseline
348
In AWS Systems Manager, what is used to logically separate instances, allowing for different patch baselines to be applied to different sets of instances?
Patch Groups
349
In AWS Systems Manager, what is used to schedule tasks such as patching, automation, or software updates to run on instances at specific times?
Maintenance Windows
350
In AWS Systems Manager, ______ __________ specify the patches to apply, ______ __________ categorize instances for patching, and __________ ________ determine when patching occurs.
Patch Baselines... Patch Groups... Maintenance Windows
351
In Systems Manager Patch Manager, there are some predefined Patch Baselines that contain security patches and updates. What do each of these refer to?
(1) AWS-AmazonLinux2DefaultPatchBaseline
(2) AWS-UbuntuDefaultPatchBaseline
(3) AWS-DefaultPatchBaseline
(4) AWS-WindowsPredefinedDefaultPatchBaseline-OS
(5) AWS-WindowsPredefinedDefaultPatchBaseline-OS-Applications
(1) default for Linux
(2) default for Ubuntu
(3) default for Windows (2 possible names)
(4) default for Windows (2 possible names)
(5) defaults for Windows + MS App updates
352
What is the name of the AWS Systems Manager command that patches the instances?
AWS-RunPatchbaseline
353
What is the default behavior of a newly created custom NACL in AWS?
It denies all inbound and outbound traffic until rules are added to allow traffic.
354
How are rules in a NACL evaluated by AWS?
Sequentially, based on the rule number, from lowest to highest.
355
What is the default behavior of a newly created Security Group in AWS?
Allows all outbound traffic; denies all inbound traffic
356
The rules in a ____________ allow traffic based on protocol, port, and source/destination.
Security Group
357
Often an AWS Site-to-Site VPN can be configured in less than ...
1 hour
358
What are the three key components of an AWS Site-to-Site VPN connection?
(1) Virtual Private Gateway (VGW)
(2) Customer Gateway (CGW)
(3) the IPsec tunnel
359
What are the two types of AWS Site-to-Site VPNs?
(1) Static VPN
(2) Dynamic VPN
360
How is an AWS Static VPN different from a Dynamic VPN?
Static = route table routes are added manually
Dynamic = "route propagation" (if enabled) allows routes to be automatically added to the route tables using BGP
361
What is the speed limit for AWS Site-to-Site VPNs?
1.25 Gbps
362
What are four supported attachments for the Transit Gateway?
(1) VPCs
(2) Site-to-Site VPNs (i.e. VGW)
(3) Direct Connect Gateways
(4) Other TGWs
363
Can a Transit Gateway peer with another Transit Gateway in a different AWS account?
Yes. Transit Gateway supports cross-account, and cross-region, peering.
364
Is there a cost for using the AWS RAM?
No
365
In AWS RAM, what are the three "principals" with whom a resource can be shared?
(1) Account
(2) OU
(3) Organization
366
When subnets are shared across AWS accounts using RAM, if a participant account provisions resources into the shared subnet, who owns the resource?
The account that provisions the resource owns the resource (in this example, the RAM participant account).
367
When subnets are shared across AWS accounts using RAM, can the VPC (subnet) owner delete or modify resource created by participant accounts?
No.
368
To attach a Direct Connect Gateway to a Transit Gateway, you would need a ________ ______ running over the DX connection.
transit VIF
369
What AWS service allows you to use on-premises Active Directory with AWS services without any directory data stored in AWS?
AD Connector - this redirects requests to on-prem servers
370
What service provides a fully managed Active Directory in AWS?
AWS Managed Microsoft AD
371
The AWS AD Connector injects ENIs into _____ subnets within your VPC and these go into (different/same) AZs.
two... different
372
The AWS AD Connector requires a _______ or ________ for connecting to your on-premises Active Directory.
Site-to-Site VPN or Direct Connect
373
The AWS-Managed _____________ service is highly available by default and it deploys the domain controller into 2 AZ's by default.
Microsoft AD
374
What AWS service supports RADIUS-based MFA?
AWS-Managed Microsoft AD
375
To enhance the speed of Direct Connect connections, you can combine multiple DX connections (up to 4), assuming they are all terminating into the same endpoint, using ____________.
Link Aggregation Groups
376
What key feature does Managed Microsoft AD support that Simple AD does not?
Trust relationships with on-premises Active Directory.
377
What is the maximum speed for an AWS DX LAG?
200Gbps
378
In DNS, an A record maps a _______ to a ________.
host... IPv4 address
379
In DNS, an AAAA record maps a _______ to a ________.
host... IPv6 address
380
In DNS, a CNAME record maps a _______ to a ________.
host... host
381
In DNS, if the resolver has to walk the tree in order to find the destination IP address, this result is known as an _____________ answer.
authoritative
382
In DNS, if the resolver does NOT have to walk the tree in order to find the destination IP address (i.e. the result is already cached on the DNS resolver server) this result is known as a _____________ answer.
non-authoritative
383
What is meant by Resource Records within a Route 53 Public Hosted Zone?
Resource Records are simply the collection of A, AAAA, CNAME, MX, TXT, etc records
384
What R53 feature is ideal if you want to use the same domain name for public access and private access, but you want the records to be different for each?
Route 53 Split View Hosted Zone
385
Let's say within DNS, you want to map the following:
catagram.io -> ALB
Could you use a CNAME record for this?
No, because CNAME records don't support the apex (e.g. catagram.io).
You would use an ALIAS record for this.
386
Does R53 Simple Routing support health checks?
No
387
Route 53 health checks are conducted every ____ seconds by default, or up to ____ seconds for an extra cost.
30... 10
388
What three protocols can be used for Route 53 health checks?
(1) HTTP
(2) HTTPS
(3) TCP
389
Route 53 health checks can monitor what three things?
(1) endpoints
(2) status of other health checks
(3) state of CloudWatch alarms
390
Is KMS a regional or global service?
regional
391
AWS KMS has been validated by the United States National Institute of Standards and Technology (NIST) under what level of security?
Federal Information Processing Standards (FIPS) 140-2 (Level 3)
392
The term CMKs (Customer Master Keys) in KMS has been superseded by simply __________.
KMS Keys
393
KMS Keys can be used for up to ___ KB of data.
4KB
394
For encrypting data > 4KB, you can't use KMS directly, but you can use KMS to generate ___________ which then encrypts and decrypts the data.
Data Encryption Keys (DEKs)
395
Can an EBS volume be encrypted after its creation?
No, you would have to a take an EBS snapshot, encrypt the snapshot, and create a new EBS volume from the encrypted snapshot.
396
Can an EBS volume be attached to multiple EC2 instances simultaneously?
No, except for EBS Multi-Attach enabled volumes.
397
What are the three throughput modes of EFS?
(1) elastic (default)
(2) provisioned (predictable)
(3) bursting (unpredictable)
398
____________ is specific for managing secrets, whereas _________ is used for a wider range of configuration data and secrets.
Secrets Manager... Parameter Store
399
Which AWS service supports automatic rotation of credentials without application changes?
AWS Secrets Manager
400
If the exam mentions needing to store passwords or API keys, and Parameter Store and Secrets Manager are both options, you should default to choosing _____________.
Secrets Manager
401
What service directly integrates with other AWS services (such as RDS) for automatic key rotation?
AWS Secrets Manager
402
When choosing between Secrets Manager and Systems Manager Parameter Store, and you need to store either of the following:
(1) hierarchical configuration information
(2) CloudWatch agent configuration
then you should lean towards ____________ as the correct answer.
Systems Manager Parameter Store
403
__________ is a continuous security monitoring service for threat detection. It identifies unexpected and unauthorized activity.
Amazon Guard Duty
404
_____________ can support multiple AWS accounts via an administrator account that manages threat detection on behalf of the member accounts.
Amazon Guard Duty
405
Which AWS logs does Amazon Guard Duty analyze to identify threats and malicious activity?
(1) VPC Flow Logs
(2) CloudTrail
(3) DNS Logs
406
What is required to enable AWS Config across multiple accounts in an organization?
Enable AWS Config in each account and designate an aggregator account to collect the configuration and compliance data.
407
Can AWS Config track changes to IAM roles and policies?
Yes
408
Which AWS service records configuration changes over time on resources?
AWS Config
409
Can AWS Config prevent changes from happening?
No, it simply records changes.
410
AWS Config is a ________ (regional/global) service by default.
regional
411
Where is AWS Config data stored?
In an S3 bucket that you specify during AWS Config setup.
412
Using _____________, your AWS resources can be evaluated with predefined or custom rules (using Lambda) and labeled as 'compliant' or 'non-compliant'. These compliant / non-compliant states can then trigger remediation via EventBridge.
Config Rules (a feature of AWS Config)
413
One distinction between Guard Duty and Inspector is that _________ focuses more narrowly on EC2 instances.
Inspector
414
__________ focuses on vulnerability and deviations from best practices within EC2 instances, while __________ focuses on broader threat detection across the AWS environment.
Inspector... Guard Duty
415
Which AWS service provides a "security report" of findings as its output?
Amazon Inspector
416
Which AWS service might have an output containing a data attribute called "UnrecognizedPortWithListener"?
Amazon Inspector
417
When you see keywords on the exam like host assessments, common vulnerabilities and exposures (CVEs), and Center for Internet Security (CIS) benchmarks, the answer is likely ____________.
Amazon Inspector
418
Which AWS service gives you a centralized view of your security alerts and security posture across your AWS accounts?
AWS Security Hub
419
What are two main functions of AWS Security Hub?
(1) Aggregating security findings
(2) Performing automated security checks against AWS best practices
420
What does PCI DSS stand for, and what is the primary purpose?
Payment Card Industry Data Security Standard
To protect cardholder data and secure payment card transactions.
421
What intrinsic function in CloudFormation returns the value of a specified parameter or resource?
'Ref'
422
How can you concatenate values in a CloudFormation template?
'Fn::Join'
423
What feature of CloudFormation can be used to store and reference predefined values outside of the CloudFormation template?
CloudFormation Mappings
424
What CloudFormation attribute would you use to ensure resources are created and configured in a specific order?
DependsOn
425
What CloudFormation feature can you use to pause resource creation until a custom condition is met?
Wait Conditions
426
When sharing a Route 53 Hosted Zone across accounts, the account with the hosted zone must __________ the association, and the account receiving the access must then accept the _____________.
authorize... authorization
427
What is a fully qualified domain name (FQDN)?
It is the complete address of a host (for example, www.example.com)
428
When using ACM to create certificates for a multi-region deployment of ELBs, can you create all of the certificates in us-east-1?
No, that only works for global services (such as CloudFront). For a multi-region deployment of ELBs, you need to create ACM certificates within each desired region.
429
What feature allows AWS S3 to automatically replicate data across multiple AWS regions?
S3 Cross-Region Replication.
430
How do you ensure that AWS resources can only be accessed within your organization?
Implement a private hosted zone in Amazon Route 53.
431
Which AWS service is used to manage containerized workloads across AWS and on-premises environments?
Amazon ECS Anywhere.
432
How can AWS Lambda be triggered by changes in an AWS CodeCommit repository?
Based on CodeCommit push events.
433
For a static website hosted on S3 to be publicly accessible, how would you do this in the console?
Uncheck (i.e. disable) the “Block Public Access” checkboxes
434
To avoid simultaneous EC2 instance reboots during patching, what feature should you configure?
Non-overlapping maintenance windows.
435
What feature allows you to transfer S3 data transfer costs to the requester?
Requester Pays.
436
Which DynamoDB feature allows automatic deletion of items after a specified time?
Time to Live (TTL).
437
What is the recommended way to collect logs from EC2 instances for analysis?
Configure a unified CloudWatch Logs agent.
438
What are the three ECS networking modes?
(1) bridge (default for Linux)
(2) host
(3) awsvpc
439
Which ECS networking mode creates an ENI for each task?
awsvpc
440
Which network mode should be used in ECS to allow task-level security groups?
awsvpc
441
____________ is a free and open-source implementation of the Java Platform, Standard Edition (Java SE). It is an alternative to the commercially-licensed OracleJDK.
OpenJDK, or Open Java Development Kit
442
To save on Oracle Java SE licensing costs when migrating to AWS, what could you use as an alternative?
OpenJDK
443
_____________ is a unique type of IAM role in AWS that is predefined by the service, and only the linked service can assume the role.
service-linked role
444
What adjustment to SQS redrive policy can help prevent premature dead-letter queue transfers?
Increase maxReceiveCount.
445
Is multi-region deployment for read and write operations supported by RDS?
No, although it does support the creation of cross-Region read replicas for some database engines.
446
For a global application needing fault tolerance across regions with relational database features, what AWS database service fits best?
Amazon Aurora Global Database.
447
To comply with strict IT security policies at the container level, which AWS service and feature should be used?
Amazon ECS with awsvpc network mode and security groups.
448
What are two ways to ensure security for logs stored in S3?
(1) Enable MFA Delete
(2) configure bucket policies
449
Which AWS service is used to migrate VMs from on-premises to AWS with minimal downtime?
AWS Application Migration Service (MGN)
450
By default, CloudTrail trails created via the AWS Management Console have _______ ________ events enabled.
global service
451
Which AWS service allows automated OS patching and management of EC2 instances?
AWS Systems Manager
452
To securely pass database credentials to an Amazon ECS container, you can use AWS Secrets Manager or AWS Systems Manager Parameter Store to store the sensitive data, and you also need to ensure that _____________.
the IAM execution role for the ECS task has the necessary permissions to retrieve the credentials.
453
The AWS Application Migration Service uses ___________ _________, that are installed on each source server, to facilitate the migration of on-premises servers to AWS.
replication agents
454
CloudTrail ______________ is a feature that allows you to check the integrity of your CloudTrail log files to determine if they have been changed after delivery.
log file validation
455
________________ with CloudFront is a feature that allows you to set up CloudFront with two origins: a primary and a secondary.
Origin failover
456
A ____________ is a globally available network device that allows you to connect your AWS Direct Connect connection to VPCs in remote Regions. It can be created in any AWS Region and accessed from all other Regions.
Direct Connect Gateway
457
How could you enable inter-region VPC access from your corporate environment?
Use a Direct Connect connection with a Direct Connect Gateway
458
___________Gateway focuses on private connectivity from on-premises, whereas ___________Gateway focuses on interconnectivity between VPCs, VPNs, and Direct Connect Gateways.
Direct Connect Gateway... Transit Gateway
459
What service enables the creation of a cloud-based contact center?
Amazon Connect
460
Which service allows you to build conversational interfaces with automatic speech recognition?
Amazon Lex
461
What AWS feature can trigger a Lambda function upon data file upload to S3?
Amazon S3 event notifications
462
In the context of the AWS Schema Conversion Tool (SCT), a ___________ can be installed on a separate on-premises server from the one running AWS SCT, allowing for the parallel extraction of data.
extraction agent
463
Large-scale data migrations of tens of TB of data often use the AWS SCT (Schema Conversion Tool) along with a ______________ for the migration.
Snowball Edge device
464
When a user attempts to access AWS resources, a ______________ is generated by the organization's identity provider (IdP) after the user's identity is verified (the "authentication" portion of authentication and authorization)
SAML assertion
465
______________ is a service that monitors and provides alerts on containerized applications at scale.
Amazon Managed Service for Prometheus
466
An example architecture for processing data from IoT devices to Amazon RDS might use ________ to trigger ________.
Amazon S3 event notifications... a Lambda function
467
The _______ record is specific to AWS Route 53 and provides a Route 53–specific extension to DNS functionality.
ALIAS
468
In Route 53, __________ records are nearly always preferred over __________ records, except when pointing to non-AWS resources.
Alias... CNAME
469
If another AWS account needs to copy information to or from a resource in your own AWS account, you can set up cross-account access with a __________ Policy
resource-based
470
Which AWS service allows you to create data-driven workflows to automate and orchestrate the movement and transformation of data?
AWS Data Pipeline
471
Which AWS service utilizes a standby instance for automatic failovers?
Amazon RDS
472
When you choose a ____________ deployment, Amazon RDS automatically creates a primary DB instance and synchronously replicates the data to a standby instance in a different Availability Zone.
Multi-AZ
473
_____________ is a scalable marketing communications AWS service that helps businesses connect with their customers through personalized multichannel communications.
Amazon Pinpoint
474
The "rehost" migration strategy is also known as ____________ and does not re-configure anything.
lift and shift
475
Between Amplify and Elastic Beanstalk, ________ is optimized for serverless and frontend-driven applications, whereas ________ is for traditional app deployments with more backend control.
Amplify… Elastic Beanstalk
476
The "Replatform" migration strategy could also be described as _______________.
lift and shift with optimization
477
When a company's migration encompasses a transition from a self-managed database to an AWS managed database (such as RDS), this would be an example of a __________ migration strategy.
Replatform
478
How can you restrict access to files in Amazon S3 to ensure they can only be accessed via CloudFront URLs?
Use the CloudFront feature called Origin Access Control (OAC).
479
______________ defines a way for client web applications (typically the JavaScript) that are loaded in one domain to interact with resources in a different domain.
Cross-origin resource sharing (CORS)
480
___________ is used for simplified (fully managed, aka serverless) deployment and management of containerized web applications, whereas ___________ is used for more flexible, larger, and configurable containerized workloads.
AWS App Runner... ECS
481
_________ APIs are often used in real-time applications such as chat applications, collaboration platforms, multiplayer games, and financial trading platforms.
WebSocket APIs
482
_________ provide full-duplex communication over a single TCP connection. Unlike ______, the connection is persistent and not closed after each request/response.
WebSocket APIs... Rest APIs
483
_________ use HTTP only briefly during the initial handshake phase when establishing the connection to upgrade from HTTP to _________ protocol. Once upgraded, all further messaging happens directly over TCP.
WebSocket APIs... WebSocket
484
_________ is a fully managed serverless GraphQL service.
AWS AppSync
485
What are three common types of APIs?
(1) REST API
(2) GraphQL API
(3) WebSocket API
486
An EC2 instance _______ is a container for an IAM role that is used to pass role information to an Amazon EC2 instance when the instance starts.
profile
487
What is the default configuration (enabled/disabled) of cross-zone load balancing ALBs, NLBs, and GLBs?
(1) ALB: enabled
(2) NLB: disabled
(3) GLB: disabled
488
A load balancer ________ checks for connection requests from clients, using the protocol and port that you configure, and forwards requests to a target group.
listener
489
A ________ Load Balancer offers support for static IP addresses (because it operates at _____ of the OSI model).
Network Load Balancer... L4
490
A ________ Load Balancer can route requests to multiple applications on a single EC2 instance, using different ports for each application
Network Load Balancer
491
A ________ Load Balancer is capable of managing sudden and unpredictable workloads, scaling to millions of requests per second
Network Load Balancer
492
Which AWS service integrates data flows between SaaS and AWS services?
Amazon AppFlow
493
What are the two primary methods to allow external users to access AWS resources?
(1) granting federated access via the IAM Identity Center
(2) Cognito Identity Pools
494
__________ is used for managing access to AWS resources for human users within your organization, while __________ is used for providing temporary, limited access to AWS resources for users of mobile and web applications.
IAM Identity Center... Cognito Identity Pools
495
Are RDS automated backups enabled by default?
Yes
496
___________ occur once per day during a user-configurable period known as the backup window.
Amazon RDS automated backups
497
The S3 Glacier standard retrieval time is approximately ___________.
3 to 5 hours
498
Which CloudFormation intrinsic function allows you to retrieve attribute properties of other resources created within the CloudFormation template.
Fn::GetAtt
499
In the context of the AWS Storage Gateway, the term "iSCSI" indicates that _______ storage is being used, and thus the Storage Gateway _______ Gateway may be the answer.
block... Volume
500
__________ is an open-source platform developed by Red Hat for implementing Java applications, it provides a full range of Java EE (Enterprise Edition) features, and it is used as a framework by many software companies.
JBoss Application Server
501
_________ is a utility built into Oracle databases that automates the process of backup and recovery.
Oracle RMAN (Recovery Manager)
502
__________ is a search service purpose-built for simplicity, whereas __________ is a managed distribution of open-source Elasticsearch supporting advanced analytics features.
CloudSearch... OpenSearch Service
503
The ______________ is an identity authentication protocol that can help prevent replay attacks (where an adversary intercepts traffic and redirects or delays it).
Challenge-Handshake Authentication Protocol (CHAP)
504
Similar to how a NAT Gateway is used for outbound IPv4 traffic from a private subnet, a _______ is used for outbound IPv6 traffic.
egress-only Internet Gateway
505
What are the two Storage Gateway - Volume Gateway options?
(1) Cached Volumes
(2) Stored Volumes
506
What is the term for a workflow within AWS Step Functions?
a state machine
507
Can AWS Step Functions read and write from DynamoDB?
Yes
508
____________ manages compute environments and job queues, allowing users to easily run thousands of jobs of any scale using Amazon ECS, Amazon EKS, and AWS Fargate with an option between Spot or on-demand resources.
AWS Batch
509
_________ is designed for running batch computing workloads of any scale, while _________ is tailored for processing vast amounts of data using open source big data tools.
AWS Batch... Amazon EMR
510
Is the Oracle feature called Real Application Clusters (RAC) supported in Amazon RDS?
No
511
The ___________ (error type) in AWS Lambda typically occurs when the function reaches the account's concurrency limit or when the request throughput limit is exceeded.
TooManyRequestsException
512
In DynamoDB, the ___________ error means that your request rate is too high for a table or global secondary index. To solve this, you can increase the ___________ of your DynamoDB table.
ProvisionedThroughputExceededException ... Write Capacity Units (WCUs)
513
When an EC2 instance assumes an IAM role, does it retrieve its security credentials from the instance metadata or user data?
metadata (from the instance metadata service (IMDS) within the instance itself)
514
To keep your SSL/TLS keys secure, you can use ____________ to offload SSL/TLS processing for your web servers.
AWS CloudHSM
515
Which disaster recover strategies would you use for the following:
(1) RTO of 24 hours or less
(2) RTO of hours
(3) RTO of minutes
(4) RTO essentially zero
(1) backup and restore
(2) pilot light
(3) warm standby
(4) active-active
516
CloudFront _____________ allow you to control access to your content without changing your current URLs. It is also used when you want to provide access to multiple restricted files rather than a single file.
signed cookies
517
In Amazon Kinesis, a _______ is a high-level class within the Kinesis Client Library (KCL) that Kinesis applications use to start processing data.
worker
518
In AWS Lambda, what are the two types of concurrency?
(1) Reserved concurrency
(2) Provisioned concurrency
519
In AWS Lambda, ________ concurrency represents the maximum number of concurrent instances allocated to your function, whereas ________ concurrency is the number of pre-initialized execution environments allocated to your function.
reserved... provisioned
520
The _________ metric in AWS Lambda represents the number of function execution attempts that were throttled due to invocation rates exceeding the current limits.
Throttles metric
521
Each separate source of logs in CloudWatch Logs makes up a separate _____ __________.
Log Stream
522
Would you use SNS or SQS as part of an architecture to help with scaling?
SQS
523
Is S3 or EBS the ideal storage solution you need to scaling an application?
S3
524
The _________ ___________ is a built-in SSL/TLS certificate that is associated with the CloudFront default domain name (*.cloudfront.net)
default certificate
525
A CloudFront ________ origin refers to any web server or AWS resource that is not an Amazon S3 bucket
custom
526
