CCP Revision Notes

Question 1

What acts as firewall rules around EC2 Instances?

Controlling Inbound and Outbound traffic?

Answer 1

Security Groups

Question 2

How long can you reserve EC2 instances for?

Answer 2

1 & 3 years

Question 3

What are EC2 spot-instances?

Answer 3

Allows the users to take advantage of unused EC2 instances at up to 90% discount rates.

Spot instances can be terminated if the on-demand price is higher than what the user has set as their max price that they are willing to pay for the instance.

If user is willing to pay $1/hr and the on-demand pricing is at $2 per hour, the customer paying $2/hr will get this instance.

Question 4

What are EC2 on-demand?

Answer 4

Normal EC2 available for users to consume.

Question 5

What is an EBS?

Answer 5

Elastic Block Store that attaches to EC2 while they run.

Similar to a USB stick

EBS are network attached storage and thus suffers latency.

Question 6

Are EBS bound to availability zones?

Answer 6

Yes.

Replication to another AZ must be done through EBS snapshots.

Question 7

What is AMI?

Answer 7

Amazon Machine Images are used when deploying EC2s.

Question 8

What is Image Builder?

Answer 8

Image Builder automates the creation of base VM and container images.

Rather than spinning up and instance and installing software and tools and snapshotting that instance.

Image Builder allows users to define what software and packages needs to be included in the image and this will be a base image available for them.

Question 9

What is EC2 Instance Store?

Answer 9

Instance Store is the physical storage drive attached to each EC2 instance.

Better performance than EBS - as EBS are network drives.

Instance Store data are lost when EC2s are terminated.

Question 10

What is EFS?

Answer 10

Elastic File System is a shared network file system that can be used by multiple EC2 instances at a time.

Similar to a network file share.

Question 11

How does EBS differ to EFS?

Answer 11

EBS is only attached and used by a single EC2 instance.

EFS can be used by multiple EC2 instances at a time.

Question 12

What is AWS FSx

Answer 12

Offers 3rd party file share service in AWS to mimic the function of Elastic File Share (EFS)

Remember it as File Share xternal

Question 13

What is Vertical Scaling?

Answer 13

The ability to scale the size of an instance.

From T2.Micro to T2.Large etc.

Question 14

What is Horizontal Scaling?

Answer 14

The ability to increase the number of instances available for an application.

Question 15

What is High Availability?

Answer 15

Highly available applications runs in multiple availability zones for fault tolerance and increase resilience.

Question 16

What are ELBs?

Answer 16

Elastic load balancers are internet facing servers that forwards traffic downstream to EC2 instances.

Manages load of IFE applications.

EC2 instances are placed in “target groups” and ELB forwards traffic to the specified target groups.

If a target group has 4 instances, traffic is split 4-ways, unless stated otherwise

Question 17

What are the 3 different types of ELBs?

Answer 17

Application LB - Layer 7

Network LB - Layer 4

Gateway LB - Layer 3

Question 18

What is ASG?

Answer 18

Auto-Scaling Groups

Question 19

What are the configuration requirements for ASGs?

Answer 19

Minimum Size

Desired Size

Max Size

Question 20

What is Simple/Step Dynamic Scaling?

Answer 20

Addition or Removal of instances at set states.

If application CPU usage > 70% add 1 instance

If application CPU usage < 30% remove 1 instance

Question 21

What is Target Dynamic Scaling?

Answer 21

Application scales to hit target CPU utilization.

If target is set at 50% CPU utilization, the application will scale or de-scale to try and hit this target.

Question 22

What is Schedule Dynamic scaling?

Answer 22

Sets a schedule when the application will scale up and down.

Busy periods - Black Fridays, Pay Days etc.

Quiet Periods - Sundays, holidays etc.

Question 23

What is Predictive Dynamic Scaling?

Answer 23

Scales based on ML findings and results.

Predictive = ML / AI

Question 24

Does buckets have to have globally unique names regardless of regions and accounts?

Answer 24

Yes

Question 25

Files in S3 buckets are stored as what?

Answer 25

Objects

Question 26

What is the max size for a single object in S3?

Answer 26

5TB Higher than this and the object must be stored as "multi-part"

Question 27

The full object file path within an S3 bucket is referred to as what?

Answer 27

Object Key

Question 28

What is the difference between an IAM role and IAM policy?

Answer 28

IAM Role defines who has access to a resource/account. IAM Policy determines what they can do within that resource/account. Example: IAM Role: Incident Response Access IAM Policy: Read Only, snapshot, stop instances

Question 29

What is S3 Versioning?

Answer 29

Objects are saved in versions. Each object upload is saved as a version of that object. Filev1.txt Filev2.txt etc.

Question 30

Why would you replicated S3 buckets in multiple regions?

Answer 30

Compliance Increased performance for S3 access in multiple regions.

Question 31

Why would you replicate S3 buckets in the same region?

Answer 31

Replication of Test and Prod data.

Question 32

Review the S3 Standard Classes

Answer 32

S3 Standard – General Purpose - User for frequently access data. - Low latency & high throughput - Use Case: Typical standard use for websites and applications. S3 Standard – Infrequent Access (IA) - Less frequently access data compared to S3 general purpose. - Lower cost than S3 standard. - Cost associated per retrieval. Use Case: Disaster Recovery and Backups S3 Standard One Zone-Infrequent Access - Similar to IA but only stored in a single Availability Zone - User Case: Storing Secondary Data backups.

Question 33

Review the S3 Glacier Classes

Answer 33

S3 Glacier – Instant Retrieval - Low-cost storage meant for archiving and backup. - Costs per object retrieval - Minimum storage duration of 90 days. - Use Case: Millisecond retrieval, good for backups. S3 Glacier – Flexible Retrieval - Tiered data retrieval speeds. - Can be up to 12 hours for data retrieval. S3 Glacier – Deep Archive - Long term storage. - Minimum storage of 180 days.

Question 34

What is S3 intelligent tiering?

Answer 34

Objects are moved between tiers as defined by their last accessed dates to save storage costs. Tiers: - Frequent Access: Default Tier - Infrequent Access: Objects not accessed for 30 days. - Archive Instant Access: Objects not accessed for 90 days. - Archive Access: Configurable between 90-700+ days - Deep Archive Access: Configurable between 180-700+ days

Question 35

How durable is AWS S3?

Answer 35

The expectation of high durability 99.9 11 9s 10m objects, 1 will be lost every 10,000 years.

Question 36

What IAM Analyzer?

Answer 36

Surfaces resources and accounts in an organization shared with an external entity. Improves journey towards least privilege.

Question 37

What is the storage capacity of an AWS Snow Cone?

Answer 37

8TB

Question 38

What is the storage capacity of an AWS Snowball?

Answer 38

80TB HDD 210TB SDD for storage optimized

Question 39

What is the storage capacity of AWS SnowMobile?

Answer 39

100PB

Question 40

What is AWS Snow Ops Hub?

Answer 40

Software to be installe in a physical machine that allows management of AWS Snow devices.

Question 41

What is Storage Gateway used for?

Answer 41

Offers a hybrid solution to maintain on-prem and cloud storage solutions.

Question 42

What are relational databases?

Answer 42

A relational database includes tables containing rows and columns Can be queried using SQL

Question 43

What are non-relational databases?

Answer 43

NoSQL databases where data can be stored in JSON. Specific use cases where unstructured can be stored.

Question 44

What is RDS?

Answer 44

Fully managed SQL relational database service.

Question 45

What is AWS Aurora?

Answer 45

Fully managed high performance SQL relational database service. AWS-implementation of PostgreSQL and MySQL databases. Cloud optimized so have significant improvements over simple RDS.

Question 46

What is ElastiCache?

Answer 46

Cloud implementation of in-memory databases offering high-performance and low latency.

Question 47

What is Dynamo-DB?

Answer 47

Fully managed and highly available non-relational NoSQL database Replication across 3 AZ.

Question 48

What version of Dynamo-DB will offer even better read performance?

Answer 48

DAX or Dynamo-DB Accelerator is in-memory cache for Dynamo DB

Question 49

What is Redshift?

Answer 49

Relational databse used for OLAP - Online Analytical Processing. It’s especially suited to processing analytical queries involving more complex calculations. Redshift is sometimes referred to as a data warehouse.

Question 50

What is EMR or Elastic Map Reduce?

Answer 50

Creation of Hadoop Cluster for big data analytics. Automates the provisioning of instances and services.

Question 51

What is Athena?

Answer 51

Serverless SQL-query service to query files within S3 buckets.

Question 52

What do you use to create SQL queries to query files within an S3 bucket?

Answer 52

Athena

Question 53

What do you use if you want to build a data warehouse for OLAP application?

Answer 53

AWS Redshift

Question 54

What do you use if you want to improve Dynamo-DB performance?

Answer 54

Use DAX to cache the database in memory.

Question 55

What do you use if you want to create dashboard in AWS?

Answer 55

AWS Quicksight

Question 56

What is the AWS implementation of MongoDB?

Answer 56

Document DB Another example of non-relational No SQL database MongoDB and DocumentDB is used to store, query and index JSON data.

Question 57

What do you use if you want to create a graph-style database?

Answer 57

AWS Neptune A social network is an example of a Graph Database. A social network is interconnected and creates a graph when plotted. Wikipedia is an example of a graph database as each article is interconnected.

Question 58

What do you use to create a iummutable ledger-style databse for financial transactions?

Answer 58

Quantum Ledger Database Immutable system and each entry cannot be removed or modified – cryptographically verifiable using cryptographic hashes.

Question 59

What do you use if you want an immutable account of changes made within an application over time?

Answer 59

Quantum Ledger Database Immutable system and each entry cannot be removed or modified – cryptographically verifiable using cryptographic hashes.

Question 60

What do you use if you want to create a blockchain system on AWS?

Answer 60

AWS managed block chain

Question 61

What is AWS Glue?

Answer 61

Managed Extract, Transform and Load (ETL) service. Useful to prepare and transform data for analytics, a service that standardizes data prior to analysis. Takes multiple data sources with minimal standardization and outputs them into standardized, more complimentary data ready for analysis. Glue = Data Standardization prior to analysis

Question 62

What do you use when you want to standardise data prior to analysis?

Answer 62

AWS Glue

Question 63

What do you use if you want to migrate a database?

Answer 63

Database Migration Service (DMS)

Question 64

What do you use if you want to manage your containers in AWS?

Answer 64

ECS - Elastic Container Service A fully managed container orchestration service that helps you easily deploy, manage, and scale containerized applications Underlying infrastructure must be deployed and managed by the user

Question 65

What do you use if you want to launch containers on AWS and not have to worry about the underlying infrastructure?

Answer 65

AWS Fargate AWS Fargate is a technology that you can use with Amazon ECS to run containers without having to manage servers or clusters of Amazon EC2 instances. With Fargate, you no longer have to provision, configure, or scale clusters of virtual machines to run containers.

Question 66

What is Fargate?

Answer 66

Lazy ECS, no need to manage underlying infrastructure. AWS Fargate is a technology that you can use with Amazon ECS to run containers without having to manage servers or clusters of Amazon EC2 instances. With Fargate, you no longer have to provision, configure, or scale clusters of virtual machines to run containers.

Question 67

Where can you store container images on AWS?

Answer 67

Elastic Container Registry (ECR)

Question 68

What is AWS Lambda?

Answer 68

AWS Lambda is a serverless compute service for running code without having to provision or manage servers. You pay only for the compute time you consume.

Question 69

How do you communicate to services in AWS that do not have native API functionality built into them?

Answer 69

AWS API gateway

Question 70

What is AWS Batch?

Answer 70

AWS Batch allows users to efficiently process hundreds of thousands of batch and machine learning computing jobs on AWS. A “batch” job is categorized as a job that has a defined “start” and “end” points. AWS Batch will provision the required number of resources to complete the intended batch job.

Question 71

Lambda vs Batch? Whats the difference?

Answer 71

AWS Lambda short-lived tasks or for event-driven computing use cases. AWS Batch for long running or computation heavy tasks that is conducted regularly such as data analytics.

Question 72

What is AWS Lightsail?

Answer 72

Alternative to provisioning individual AWS services and instances. For users with minimal experience or knowledge of AWS.

Question 73

What do you use to deploy infrastructure as code?

Answer 73

Cloud Formation

Question 74

What do you use if you want to deploy infrastructure as code but you want to use a familiar development language like JS or Python?

Answer 74

Cloud Development Kit (CDK) The code is compiled by CDK into a usable JSON/YAML Cloud Formation format. Allows to deploy infrastructure and application runtime code together as they can share the same language.

Question 75

What do you use if you want to be focused on application code only and leave the infrastructure and platform to AWS?

Answer 75

AWS Beanstalk Beanstalk is a Platform as a Service offering (PaaS) Beanstalk is free but payment for the underlying services used when deployed.

Question 76

What do you use if you want to deploy applications stored in S3, Bitbuckets or Git Repos?

Answer 76

AWS Code Deploy Enables applications to be upgraded automatically. Instances must have Code Deploy agents installed to enable automatic and centralised upgrade mechanism.

Question 77

What is an AWS code repository offering like GitHub?

Answer 77

AWS Code Commit Code Commit is a code repository such as GitHub. It is a git-based repository which allows versioning functionality. Repo = Commit

Question 78

What is used to compile code in AWS?

Answer 78

AWS Code Build a fully managed continuous integration service that compiles source code, runs tests, and produces software packages that are ready to deploy Build = Compile

Question 79

What do you use to automate CI/CD in AWS?

Answer 79

Code Pipeline Continuous delivery service you can use to model, visualize, and automate the steps required to release your software

Question 80

What do you use if you want to manage sharing of software packages, files, libraries and other dependacies across your organization for software deployments?

Answer 80

AWS Code Artifact You can use CodeArtifact with popular build tools and package managers such as the NuGet CLI, Maven, Gradle, npm, yarn, pip, and twine. Librarie, Files and Dlls are all software development artifacts.

Question 81

What do you use if you want to centrally manage your software development activites in one place?

Answer 81

AWS Code Star

Question 82

What is an AWS web-based IDE offering?

Answer 82

AWS Cloud9

Question 83

What do you use if you want to manage cloud and on-prem resources at scale?

Answer 83

AWS SSM or Systems Manager Allows management: Patching Commands and configuration can be deployed across the entire fleet. Store parameters and configuration with SSM parameter store.

Question 84

What is SSM Session manager?

Answer 84

Allows the management of instances without needing to SSH into the instance. Requires an SSM agent to be installed on the host.

Question 85

What is SSM parameter store?

Answer 85

Allows the storage of secrets using SSM. Configurable parameters can be stored here for deployment across the estate using SSM.

Question 86

What do you use if you want to manage CHEF and Puppet on AWS?

Answer 86

AWS Ops Works Chef and Puppet are automation platforms that allow you to use code to automate the configurations of your servers. OpsWorks lets you use Chef and Puppet to automate how servers are configured, deployed, and managed across your Amazon EC2 instances or on-premises compute environments.

Question 87

What is the managed DNS service on AWS?

Answer 87

Route 53

Question 88

What the content delivery network that improves delivery performance by caching regularly accessed files at edge locations?

Answer 88

AWS Cloud Front Caching Files at Edge Locations = Cloud Front

Question 89

What would you use if you want to improve the transfer speed of files into the S3?

Answer 89

AWS Transfer Accelerator File is transferred onto an Edge Location closest to the user - after that, it is routed through the AWS internal network. This does not have to go through the public internet which causes latency.

Question 90

What is the AWS Global Accelerator?

Answer 90

Users connect to their closest Edge location. Traffic then routes through the internal AWS network to improve connectivity speeds and reduce latency.

Question 91

What is an AWS Outpost?

Answer 91

AWS Server Racks installed on-premise that allows organizations to offer a hybrid cloud model but still have control over the underlying infrastructure. Outpost = Server Racks on prem

Question 92

What would you use if you want to leverage the 4G/5G network for AWS use?

Answer 92

AWS Wavelength

Question 93

What are AWS Local Zones?

Answer 93

Extensions of AWS regions in densely populated cities - Boston, Miami, Chicago etc.

Question 94

What would you use if you want to connect IoT devices into AWS using the telecomms network such as: Connected vehicles Interactive Video/Gaming Streams

Answer 94

AWS Wavelength

Question 95

What service would you use if you want to manage a queue service on AWS?

Answer 95

AWS SQS Simple Queue Service

Question 96

What would you use if you want to analyze big data streams at any scale?

Answer 96

AWS Kinesis Big Data Stream on the fly = Kinesis

Question 97

What would you use if you want to create a simple Sub/Pub service offering on AWS?

Answer 97

AWS SNS Simple Notification Service

Question 98

What would you use if you to use a 3rd party provider for SQS and SNS services on AWS?

Answer 98

Message Broker Allows users to use non-cloud native SNS and SQS type service.

Question 99

What service provides telemetry and metrics for every instance on AWS?

Answer 99

Cloud Watch logs

Question 100

What would a user use if they want to an action to trigger on the back of an event? An event could be a cloud watch metric related event, time based, day based etc.

Answer 100

AWS Event Bridge

Question 101

Which service would a user use to refer to when they want to check changes made to an account or service?

Answer 101

Cloud Trail

Question 102

What would a user use if they want to visually present application issues, performance issues, bottlenecks?

Answer 102

AWS X-Ray AWS X-Ray is a service that collects data about requests that your application serves, and provides tools that you can use to view, filter, and gain insights into that data to identify issues and opportunities for optimization.

Question 103

What is AWS Code Guru?

Answer 103

Code Guru uses ML for automated code review and application performance recommendations.

Question 104

What is the difference between Code Guru Profiler and Reviewer?

Answer 104

Code Guru Reviewer is used for static code analysis Code Guru Profiler is used for run time code analysis

Question 105

What dashboard would a user refer to if they want to determine the health of regions, AZ, services across AWS?

Answer 105

AWS Health Dashboard

Question 106

What would a user use if they want to manage multiple accounts at an organization level?

Answer 106

AWS Organizations

Question 107

What tool can be utilized for restriction of account privileges at an Organization level?

Answer 107

AWS SCP Service Control Policies Service control policies (SCPs) are a type of organization policy that you can use to manage permissions in your organization. SCPs offer central control over the maximum available permissions for all accounts in your organization. SCPs help you to ensure your accounts stay within your organization’s access control guidelines.

Question 108

What is the main benefit of using Consolidated Billing?

Answer 108

Allows for the combined billing of all resources used within an organization across all accounts. This increases the amount of discount offered to the organization. i.e. One bill for all EC2 utilization across an organization

Question 109

How would an organization quickly deploy and provision new approved and standardized accounts that are in line with organizational compliance requirements?

Answer 109

AWS Control Tower AWS Control Tower enables end users on your distributed teams to provision new AWS accounts quickly, by means of configurable account templates in Account Factory.

Question 110

What service would alert the organization on accounts that have drifted away from approved templates and best-practices?

Answer 110

AWS Control Tower

Question 111

What service allows the sharing of used resources within the same organization, perhaps across multiple accounts? For example two accounts using the same ELB?

Answer 111

AWS Resource Access Manager (RAM) AWS Resource Access Manager (AWS RAM) helps you securely share your resources across AWS accounts, within your organization or organizational units (OUs) in AWS Organizations, and with IAM roles and IAM users for supported resource types. You can use AWS RAM to share resources with other AWS accounts.

Question 112

What service would an organization refer to if they want to enable/disable the use of specific services across accounts or create a template of approved services for use? i.e. Enable/Disable the use of Kinesis, Athena, Ground Control

Answer 112

AWS Service Catalogue

Question 113

What would you use if you want to estimate the cost for a solution/architecture on AWS?

Answer 113

Pricing Calculator

Question 114

What would you use if you want to see the accrued costs of an account over a time period?

Answer 114

Billing Dashboard

Question 115

What would you use if you want to forecasts your future costs based on historic use of cloud services?

Answer 115

Cost Explorer

Question 116

What would a user use if they want to be alerted if costs are expected to exceed targets and forecasts?

Answer 116

AWS Budgets

Question 117

What would you use if you want to limit a use of a specific service on AWS? For example, limit an account to 100 lambda jobs per day?

Answer 117

AWS Service Quotas

Question 118

What would a user refer to if they want an high-level overview of their account in regards to reducing costs, improving performance and general optimization of their AWS environment?

Answer 118

AWS Trusted Advisor

Question 119

What are the 6 pillars of Trusted Advisor checks?

Answer 119

Cost Optimization Performance Security Fault Tolerance Service Limits Operational Excellence

Question 120

What are the 7 core Trusted Advisor Checks?

Answer 120

S3 Bucket Permissions Security Groups - Specific Ports unrestricted IAM use - at least one IAM role MFA on root account EBS Public snapshots RDS Public snapshots Service Limits

Question 121

What are the different tiers of AWS support plans?

Answer 121

1. Developer 2. Business 3. Enterprise - on ramp 4. Enterprise

Question 122

What is AWS STS and what is it used for?

Answer 122

AWS security token service provides temporary and limited-privilege access to an AWS account or service. Similar to how break-glass access is provisioned, probably uses STS.

Question 123

What would you use if you have an IFE application, and you want to enable users to register, authenticate and use your application without having to grant them IAM roles?

Answer 123

AWS Cognito With Amazon Cognito, you can add user sign-up and sign-in features and control access to your web and mobile applications.

Question 124

What is AWS managed AD?

Answer 124

AWS Managed AD runs MS AD on AWS

Question 125

What would a user use if they want to route AWS originated request to on-prem AD?

Answer 125

AWS AD Connector

Question 126

What would you use if you want to implement SSO across every account within an AWS organization?

Answer 126

AWS IAM Identity Centre AWS IAM Identity Center helps you securely create or connect your workforce identities and manage their access centrally across AWS accounts and applications.

Question 127

What enables a VPC to connect to the outside internet?

Answer 127

Internet Gateway

Question 128

What is the difference between a NAT gateway and Internet Gateway?

Answer 128

Internet Gateway allows both inbound and outbound access to the internet whereas the NAT Gateway only allows outbound access.

Question 129

What level does security groups operate in?

Answer 129

EC2 level

Question 130

What would you use if you want to capture all IP network traffic going through all network interfaces within your AWS environment?

Answer 130

VPC Flow logs

Question 131

What can you use to connect two VPCs together within AWS?

Answer 131

VPC Peering

Question 132

What would you use if you are a vendor on AWS and you want to expose your service/application to multiple VPCs within the cloud?

Answer 132

AWS Private Link Provides private connectivity between virtual private clouds (VPCs), supported AWS services, and your on-premises networks without exposing your traffic to the public internet.

Question 133

What are the two ways you can connect your on-prem infrastructure to AWS?

Answer 133

Site to Site VPN Direct Connect

Question 134

What is infrastructure AWS Direct Connect?

Answer 134

Offers physical connection between AWS and on-prem infrastructure.

Question 135

How can users connect their machines into an AWS VPC?

Answer 135

AWS Client VPN AWS Client VPN enables you to securely connect users to AWS or on-premises networks.

Question 136

What can you use if you want to connect numerous VPCs together where VPC Peering is scalable enough for the solution required?

Answer 136

AWS Transit Gateway Allows transitive peering between thousands of VPCs and on-premise infrastructure in a hub-and-spoke connection.

Question 137

What AWS service offers DDOS protection?

Answer 137

AWS Shield and AWS WAF

Question 138

What service can be used on AWS that offers management of encryption keys?

Answer 138

AWS KMS Key Management System Managed service that makes it easy for you to create and control the cryptographic keys that are used to protect your data.

Question 139

What hardware devices are used in conjunction with AWS KSM?

Answer 139

Cloud HSMs hardware security module (HSM)

Question 140

Review the different types of Customer Master Keys (CMKs) offered by AWS

Answer 140

Customer-Managed CMK: - Created and managed by the customer. AWS-Managed CMK: - Created and managed by AWS. AWS-Owned CMK: - CMKs that an AWS service owns and managers. - Customer is unable to see these keys. Cloud HSM Keys: - Keys generated from customer own Cloud HSM hardware device. - Key generation occurs within the Cloud HSM cluster service.

Question 141

What would you use if you want to easily manage and provision SSL and TLS certificates on AWS?

Answer 141

AWS ACM Amazon Certificate Manager

Question 142

What would you use if you want to manage secrets on AWS?

Answer 142

AWS secrets manager

Question 143

Where would you go if you want to retrieve AWS compliance documents and support for internal audits and compliance?

Answer 143

AWS Artifact

Question 144

What service offers active threat detection for anomalous and suspicious activity within your AWS accounts?

Answer 144

AWS Guard Duty

Question 145

What would you use to provide automated security assessments on AWS services?

Answer 145

AWS Inspector Amazon Inspector is an automated vulnerability management service that continually scans AWS workloads for software vulnerabilities and unintended network exposure. The service is continuously scanning these running instances against the CVE database.

Question 146

How does AWS config differ to AWS Cloud Trail?

Answer 146

Config reports on what has changed, whereas CloudTrail reports on who made the change, when, and from which location.

Question 147

What would you use if you want to discover and protect sensitive PII data on AWS?

Answer 147

AWS Macie Amazon Macie is a data security service that uses machine learning (ML) and pattern matching to discover and help protect your sensitive data.

Question 147

What would you use to assess, audit, and evaluate the configurations and relationships of your resources.

Answer 147

AWS Config

Question 148

Where would you go if you want to check security posture management (CSPM), best practice checks, aggregates alerts, and enables automated remediation.

Answer 148

AWS Security Hub AWS Security Hub is a cloud security posture management (CSPM) service that performs security best practice checks, aggregates alerts, and enables automated remediation. Security Posture = AWS Security Hub

Question 149

Once security issues and findings are surfaced, what would a user use to help them identify the root cause of the issue within AWS?

Answer 149

AWS Detective Amazon Detective helps you analyze, investigate, and quickly identify the root cause of security findings or suspicious activities. Log Sources: Cloud Trail Logs VPC Flow Logs EKS Audit Logs Guard Duty Findings

Question 150

What would you use if you come across and AWS resource that is conducting illegal activities against the agreed Ts and Cs set out by AWS?

Answer 150

AWS Abuse Report

Question 151

Review Root User account privileges

Answer 151

Root user activities such as: o Change account settings o Close Account o Change & Cancel AWS support plan

Question 152

What can you use to find out which of your AWS resources and services are being shared externally?

Answer 152

AWS IAM Access Analyzer AWS Identity and Access Management Access Analyzer helps you to set, verify, and refine your IAM policies by providing a suite of capabilities. Its features include findings for external and unused access, basic and custom policy checks for validating policies, and policy generation to generate fine-grained policies.

Question 153

What AWS service allows the recognition of people, texts and objects within images and videos?

Answer 153

AWS Rekognition

Question 154

What would you use if you want to convert audio into text using AWS?

Answer 154

AWS Transcribe Audio into text is transcribing Audio = Text like court transcribers

Question 155

What would you use if you want to convert text into speech using AWS?

Answer 155

AWS Polly Parrot = Polly

Question 156

What would you use if you want use language translation services on AWS?

Answer 156

AWS Translate

Question 157

What would you use if you want to create a chatbot on AWS?

Answer 157

AWS Lex and AWS Connect AWS Lex powers Alexa devices AWS Connect commonly used for chatbots and virtual call centres

Question 158

What would you use if you want to create a virtual call centre?

Answer 158

AWS Lex and AWS Connect

Question 159

What would you use if you want to use a natural language processing service and find insights and relationships in text?

Answer 159

AWS Comprehend Comprehend what the text is saying

Question 160

What is a quick service on AWS that allows for the building of machine learning models without the need to provision your own infrastructure?

Answer 160

AWS Sage Maker

Question 161

What would you use on AWS to create accurate forecasts using ML?

Answer 161

AWS Forecasts

Question 162

What would you use if you want to extract answers from text data and documents within AWS?

Answer 162

AWS Kendra Amazon Kendra is a highly accurate and easy-to-use enterprise search service that's powered by machine learning (ML). It allows developers to add search capabilities to their applications so their end users can discover information stored within the vast amount of content spread across their company.

Question 163

What would you use if you want to use ML to suggest personalized suggestions to your users and customers through AWS?

Answer 163

AWS Personalize Amazon Personalize accelerates your digital transformation with ML, making it easier to integrate personalized recommendations into existing websites, applications, email marketing systems, and more.

Question 164

What would you use to extract text from any scanned/hand written document?

Answer 164

AWS Textract

Question 165

What service would you use if you want to deploy virtual desktops (VDIs) using AWS?

Answer 165

AWS WorkSpaces WorkSpaces eliminates the need to procure and deploy hardware or install complex software. You can quickly add or remove users as your needs change. Users can access their virtual desktops from multiple devices or web browsers.

Question 166

What service allows the streaming of applications through a web browser on AWS?

Answer 166

AWS AppStream WorkSpaces is a full VDI while AppStream is app specific only.

Question 167

What service allows the user to connect IoT devices to AWS?

Answer 167

AWS IoT core

Question 168

What would you use if you want to convert media stored in S3 buckets to be compatible as required by the consumer? i.e phone compatible, tablet, web compatible

Answer 168

AWS Elastic Transcoder easy to use and a cost effective way for developers and businesses to convert (or “transcode”) media files from their source format into versions that will playback on devices like smartphones, tablets and PCs.

Question 169

What would you use if you want to synchronize mobile and web application data in real time?

Answer 169

AWS App Sync Uses Graph QL

Question 170

What would a developer use if they have limited cloud experience and want a set of tools for quickly build full stack web and mobile apps?

Answer 170

AWS Amplify

Question 171

What would developers use if they want to test their mobile applications against real desktops and mobile devices for compatibility? Not virtual devices, real devices with different screen resolutions etc.

Answer 171

AWS Device Farm Device Farm is an app testing service that you can use to test and interact with your Android, iOS, and web apps on real, physical phones and tablets that are hosted by Amazon Web Services (AWS).

Question 172

What would you use if you want a fully managed and automated back up service across multiple AWS services?

Answer 172

AWS Backup AWS Backup is a fully-managed service that makes it easy to centralize and automate data protection across AWS services, in the cloud, and on premises. Using this service, you can configure backup policies and monitor activity for your AWS resources in one place.

Question 173

Review the disaster recovery strategies on AWS

Answer 173

Backup and Restore o Data is backed up in the cloud and can be restored in case of a disaster. Pilot Light o Minimal critical functions of an app are up and running in the cloud – similar to a warm site. Warm Standby o Full version of the app running but at a minimum size a hot site but not a failover version. Hot Site o Failover app – full version of the app at full size ready for failover.

Question 174

What would you use if you want to an automated/managed disaster recovery strategy service on AWS.

Answer 174

AWS Elastic Disaster Recovery

Question 175

What would you use if you want to migrate large amounts of data from on-prem into the cloud?

Answer 175

AWS Data Sync AWS DataSync is a secure, online service that automates and accelerates moving data between on premises and AWS Storage services.

Question 176

What service is available to users that allows for the discovery of application network dependencies prior to migration?

Answer 176

AWS Application Discovery Service AWS Application Discovery Service helps you plan migrations to the cloud by collecting usage and configuration data about your on-premises servers.

Question 177

What service offers a simple lift and shift solution into cloud?

Answer 177

AWS Application Migration Service (MGN)

Question 178

What service offers to build a data-driven case for migration into the cloud?

Answer 178

AWS Migration Evaluator

Question 179

Where would you go if you want a centralized view of all migration activities?

Answer 179

AWS Migration Hub

Question 180

What service is offered on cloud that offers chaos engineering for resiliency testing?

Answer 180

AWS Fault Injector Service AWS Fault Injection Service is a fully managed service for running fault injection experiments on AWS that makes it easier to improve an application's performance, observability, and resilience.

Question 181

What service is available to users if they want to visualize lambda functions and build server-less workflows, presented in a visual manner?

Answer 181

AWS Step Functions

Question 182

What service allows the control and management of satellites?

Answer 182

AWS Ground Control

Question 183

What service on AWS allows for the management of two-way marketing straight from the cloud?

Answer 183

AWS PinPoint Amazon Pinpoint is an AWS service that you can use to engage with your customers across multiple messaging channels. You can use Amazon Pinpoint to send push notifications, in-app notifications, emails, text messages, voice messages, and messages over custom channels.

Question 184

What are the 6 pillars of the well-architected framework?

Answer 184

1. Operational Excellence 2. Security 3. Reliability 4. Performance Efficiency 5. Cost Optimization 6. Sustainability

Question 185

What tool is available to review against the 6 WAF pillars?

Answer 185

AWS Well Architected Tool

Question 186

What are the 6 Operational Capabilities within the Cloud Adoption Framework?

Answer 186

Business People Governance Platform Security Operations

Question 187

What are the 4 Use Case Domains within the Cloud Adoption Framework?

Answer 187

Technology Process Organization Product

Question 188

What are the 4 Transformation Phases within the Cloud Adoption Framework?

Answer 188

Envision Align Launch Scale

Question 189

Where would you find common AWS FAQs?

Answer 189

AWS Knowledge Centre

Question 190

Where would you find professional AWS help quickly? Offering contractors for project work?

Answer 190

AWS IQ

Question 191

Where would you find an AWS crowd-source type forum where you can ask and answer technical AWS questions?

Answer 191

AWS re:Post Forum, Crowd Sourcing = RePost

Question 192

What service does AWS offer whereby users can seek AWS professionals to help manage their infrastructure and workload related to the cloud?

Answer 192

AWS Managed Services

Question 193

What is an example of a hardware 2FA device that can be used within AWS?

Answer 193

U2F Security Key

Question 194

An AWS user is trying to launch an EC2 instance in a given region. What is the region-specific constraint that the Amazon Machine Image (AMI) must meet so that it can be used for this EC2 instance?

Answer 194

You must use an AMI from the same region as that of the EC2 instance. The region of the AMI has no bearing on the performance of the EC2 instance The AMI must be in the same region as that of the EC2 instance to be launched. If the AMI exists in a different region, you can copy that AMI to the region where you want to launch the EC2 instance. The region of AMI has no bearing on the performance of the EC2 instance.

Question 195

Data encryption is automatically enabled for which of the following AWS services?

Answer 195

Amazon S3 Glacier - Amazon S3 Glacier (S3 Glacier), is a storage service optimized for infrequently used data, or "cold data. Data at rest stored in S3 Glacier is automatically server-side encrypted using 256-bit Advanced Encryption Standard (AES-256) with keys maintained by AWS. ----------------------------------------------- AWS Storage Gateway - AWS Storage Gateway is a hybrid cloud storage service that gives you on-premises access to virtually unlimited cloud storage. All data transferred between the gateway and AWS storage is encrypted using SSL (for all three types of gateways - File, Volume and Tape Gateways).

Question 196

Which of these services provides the lowest latency for users? Direct Connect? Edge Locations? Local Zones? Wavelength?

Answer 196

Local Zones

Question 197

Review abstracted services and their impact to the shared responsibility model.

Answer 197

"For abstracted services like Amazon S3, AWS operates the infrastructure layer, the operating system, and platforms" - For abstracted services, such as Amazon S3 and Amazon DynamoDB, AWS operates the infrastructure layer, the operating system, and platforms, and customers access the endpoints to store and retrieve data.

Question 198

An IT company is on a cost-optimization spree and wants to identify all EC2 instances that are under-utilized. Which AWS services can be used off-the-shelf to address this use-case without needing any manual configurations?

Answer 198

AWS Trusted Advisor AWS Trusted Advisor is an online tool that provides real-time guidance to help provision your resources following AWS best practices. Whether establishing new workflows, developing applications, or as part of ongoing improvement, recommendations provided by Trusted Advisor regularly help keep your solutions provisioned optimally. AWS Trusted Advisor analyzes your AWS environment and provides best practice recommendations in five categories: Cost Optimization, Performance, Security, Fault Tolerance, Service Limits. AWS Trusted Advisor checks the Amazon Elastic Compute Cloud (Amazon EC2) instances that were running at any time during the last 14 days and alerts you if the daily CPU utilization was 10% or less and network I/O was 5 MB or less on 4 or more days. ------------------------------------------------------- AWS Cost Explorer AWS Cost Explorer has an easy-to-use interface that lets you visualize, understand, and manage your AWS costs and usage over time. AWS Cost Explorer includes a default report that helps you visualize the costs and usage associated with your top five cost-accruing AWS services, and gives you a detailed breakdown of all services in the table view. The reports let you adjust the time range to view historical data going back up to twelve months to gain an understanding of your cost trends. The rightsizing recommendations feature in Cost Explorer helps you identify cost-saving opportunities by downsizing or terminating EC2 instances. You can see all of your underutilized EC2 instances across member accounts in a single view to immediately identify how much you can save.

Question 199

What are the differences between CloudTrail and Config?

Answer 199

You can use CloudTrail to log, monitor and retain account activity related to actions across your AWS infrastructure. CloudTrail provides an event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command-line tools, and other AWS services. ------------------ Config - AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations. ------------------ Config configurations and desired states are defined by the user - not by AWS.

Question 200

What is the difference between Config and Control Tower?

Answer 200

Control tower implements PREVENTATIVE Guard Rails thought SCP -------------------------- Config provides DETECTIVE Guard Rails against approved organization defined use cases for AWS.

Question 201

A start-up would like to quickly deploy a popular technology on AWS. As a Cloud Practitioner, which AWS tool would you use for this task?

Answer 201

AWS Quick Starts references Quick Starts are built by AWS solutions architects and partners to help you deploy popular technologies on AWS, based on AWS best practices for security and high availability. These accelerators reduce hundreds of manual procedures into just a few steps, so you can build your production environment quickly and start using it immediately. Each Quick Start includes AWS CloudFormation templates that automate the deployment and a guide that discusses the architecture and provides step-by-step deployment instructions.

Question 202

An IT company wants to run a log backup process every Monday at 2 AM. The usual runtime of the process is 5 minutes. As a Cloud Practitioner, which AWS services would you recommend to build a serverless solution for this use-case?

Answer 202

Lambda and CloudWatch CloudWatch - Amazon CloudWatch is a monitoring and observability service built for DevOps engineers, developers, site reliability engineers (SREs), and IT managers. CloudWatch provides data and actionable insights to monitor applications, respond to system-wide performance changes, optimize resource utilization, and get a unified view of operational health. ------------------------------ Lambda - AWS Lambda lets you run code without provisioning or managing servers. You pay only for the compute time you consume. The lambda has a maximum execution time of 15 minutes, so it can be used to run this log backup process. ------------------------------ To build the solution for the given use-case, you can create a CloudWatch Events rule that triggers on a schedule via a cron expression. You can then set the Lambda as the target for this rule.

Question 203

What is the primary benefit of deploying an RDS database in a Read Replica configuration?

Answer 203

Read Replica improves database scalability ----------------------------------- Amazon Relational Database Service (Amazon RDS) makes it easy to set up, operate, and scale a relational database in the cloud. Read Replicas allow you to create read-only copies that are synchronized with your master database. Read Replicas are used for improved read performance. You can also place your read replica in a different AWS Region closer to your users for better performance. Read Replicas are an example of horizontal scaling of resources.

Question 204

A Cloud Practitioner would like to get operational insights of its resources to quickly identify any issues that might impact applications using those resources. Which AWS service can help with this task?

Answer 204

AWS Systems Manager --------------------------------- AWS Systems Manager allows you to centralize operational data from multiple AWS services and automate tasks across your AWS resources. You can create logical groups of resources such as applications, different layers of an application stack, or production versus development environments. --------------------------------- With Systems Manager, you can select a resource group and view its recent API activity, resource configuration changes, related notifications, operational alerts, software inventory, and patch compliance status. You can also take action on each resource group depending on your operational needs. Systems Manager provides a central place to view and manage your AWS resources, so you can have complete visibility and control over your operations.

Question 205

An IT company has a hybrid cloud architecture and it wants to centralize the server logs for its EC2 instances and on-premises servers. Which of the following is the MOST effective for this use-case?

Answer 205

Use CloudWatch Logs for both the EC2 instance and the on-premises servers --------------------------------- You can use Amazon CloudWatch Logs to monitor, store, and access your log files from Amazon Elastic Compute Cloud (Amazon EC2) instances, AWS CloudTrail, Route 53, and other sources such as on-premises servers. -------------------------------- CloudWatch Logs enables you to centralize the logs from all of your systems, applications, and AWS services that you use, in a single, highly scalable service. You can then easily view them, search them for specific error codes or patterns, filter them based on specific fields, or archive them securely for future analysis.

Question 206

Which of the following AWS services offer block-level storage? (Select two)

Answer 206

EBS and Instance Store Both are the same thing, one is network attached the other is physically attached.

Question 207

What constitutes an AWS Region?

Answer 207

An AWS regions contains a minimum of 3 Availability Zones

Question 208

What constitutes an AWS Availability Zone?

Answer 208

Each AZ contains at least one discrete data centre.

Question 209

Which services can be used to decouple components of a microservice based application on AWS?

Answer 209

SQS and SNS Decouple microservices = SQS and SNS

Question 210

What is the DynamoDB global table service?

Answer 210

Amazon DynamoDB global tables is a fully managed, serverless, multi-Region, and multi-active database. Global tables provide you 99.999% availability, increased application resiliency, and improved business continuity.

Question 211

What services are available for reservations in AWS for optimized costs?

Answer 211

EC2 DynamoDB ElastiCache RDS Redshift

Question 212

What additional services are protected by Shield Advanced?

Answer 212

Global Accelerator Route 53 ELB Cloud Front

Question 213

What is the approved method for accessing AWS resources programatically?

Answer 213

Access Key ID and Secret Access Key

Question 214

What is AWS compute Optimizer?

Answer 214

AWS Compute Optimizer recommends more efficient AWS compute resources for your workloads to reduce costs and improve performance.

Question 215

What services can utilize VPC Endpoint Gateway?

Answer 215

Dynamo DB and S3

Question 216

Which AWS service have encryption enabled by default?

Answer 216

AWS S3 services Any services that utilizes S3 as the storage backend will have encryption at default. SSE-S3 (Server Side Encryption S3)

Question 217

What rules can be set with Security Groups?

Answer 217

Allow rules only!

Question 218

What is AWS MQ

Answer 218

Also referred to as Message Broker

Question 219

Access Key ID and Secret Access Key are tied to which AWS IAM Identity?

Answer 219

IAM User

Question 220

What type of storage is S3?

Answer 220

Object Based

Question 221

What type of storage is EBS?

Answer 221

Block Based

Question 222

What type of storage is EFS?

Answer 222

File Based

Question 223

Does a VPC span a single AZ within a region or all AZ within the region?

Answer 223

All AZs within the region it has been deployed.

Question 224

How many AZ's does a subnet span?

Answer 224

Single - just the AZ it was deployed/created in.

Question 225

What are examples of global AWS Services? (4)

Answer 225

Cloud Front IAM Route 53 WAF

Question 226

What services can be used to protect services against DDos attacks? (3)

Answer 226

Shield WAF CloudFront with Route 53

Question 227

Name 3 methods that allows access to all AWS services?

Answer 227

Management Console CLI SDK

Question 228

What type of data transfer is charged on AWS?

Answer 228

Outbound data transfer

Question 229

What services are in scope for AWS Compute Optimizer? (4)

Answer 229

EC2 Instances EBS Volumes ECS including Fargate Lambda

Question 230

What are the different gateways supported by Storage Gateway? (3)

Answer 230

Tape, File and Volume gateways

Question 231

Which service allows secure shell access to EC2 instances without the need of opening new ports?

Answer 231

AWS SSM

Question 232

Which Budget Types can be created within AWS Budgets? (4)

Answer 232

Usage Budgets Cost Budgets Reservation Budgets Savings Plans Budget AWS Budgets enable you to plan your service usage, service costs, and instance reservations. AWS Budgets information is updated up to three times a day. Updates typically occur between 8 to 12 hours after the previous update. Budgets track your unblended costs, subscriptions, refunds, and RIs. There are four different budget types you can create under AWS Budgets - Cost budget, Usage budget, Reservation budget and Savings Plans budget. Cost budget - Helps you plan how much you want to spend on a service. Usage budget - Helps you plan how much you want to use one or more services. Reservation budget - This helps you track the usage of your Reserved Instances (RI). Two ways of doing it - Reserved Instance (RI) utilization budgets (This lets you see if your Reserved Instances (RI) are unused or under-utilized), Reserved Instance (RI) coverage budgets (This lets you see how much of your instance usage is covered by a reservation).

Question 233

What components are required for an AWS Site-to-Site VPN?

Answer 233

Virtual Private Gateway Customer Gateway

Question 234

A startup wants to set up its IT infrastructure on AWS Cloud. The CTO would like to receive detailed reports that break down the startup's AWS costs by the hour in an Amazon Simple Storage Service (Amazon S3) bucket. As a Cloud Practitioner, which AWS service would you recommend for this use-case?

Answer 234

AWS Cost & Usage Report (AWS CUR) AWS Cost & Usage Report (AWS CUR) contains the most comprehensive set of cost and usage data available. You can use AWS Cost & Usage Report (AWS CUR) to publish your AWS billing reports to an Amazon Simple Storage Service (Amazon S3) bucket that you own. You can receive reports that break down your costs by the hour or month, by product or product resource, or by tags that you define yourself. AWS updates the report in your bucket once a day in comma-separated value (CSV) format.

Question 235

Which of the following is the best way to protect your data from accidental deletion on Amazon S3?

Answer 235

Amazon S3 Versioning Versioning is a means of keeping multiple variants of an object in the same bucket. You can use versioning to preserve, retrieve, and restore every version of every object stored in your Amazon S3 bucket. With versioning, you can easily recover from both unintended user actions and application failures. Versioning-enabled buckets enable you to recover objects from accidental deletion or overwrite. For example: if you delete an object, instead of removing it permanently, Amazon S3 inserts a delete marker, which becomes the current object version.

Question 236

An e-commerce company uses AWS Cloud and would like to receive separate invoices for development and production environments. As a Cloud Practioner, which of the following solutions would you recommend for this use-case?

Answer 236

Create separate accounts for Production and Development environments. Requires 2 accounts for 2 invoices. Tags cannot create two separate invoices of the same account.

Question 237

What level of infrastructure can EFS span? AZ Regions or VPCs?

Answer 237

All of them

Question 238

An AWS hardware failure has impacted one of your Amazon Elastic Block Store (Amazon EBS) volumes. Which AWS service will alert you of the affected resources and provide a remedial action?

Answer 238

AWS Your Account Health Dashboard

Question 239

What is the primary benefit of deploying an Amazon Relational Database Service (Amazon RDS) database in a Read Replica configuration?

Answer 239

Read Replica improves database scalability Read Replicas are an example of horizontal scaling of resources. Read Replica cannot enhance database availability - because read replicas are created in the same Regions.

Question 240

What are the 6 CAF groups?

Answer 240

Business, People, Governance, Platform, Security, and Operations.

Question 241

An IT company would like to move its IT resources (including any data and applications) from an AWS Region in the US to another AWS Region in Europe. Which of the following represents the correct solution for this use-case?

Answer 241

The company should just start creating new resources in the destination AWS Region and then migrate the relevant data and applications into this new AWS Region - The company needs to create resources in the new AWS Region and then move the relevant data and applications into the new AWS Region. There is no off-the-shelf solution or service that the company can use to facilitate this transition. ----------------------------------- AWS CloudFormation cannot help with moving data and applications into another Region.

Question 242

Amazon CloudWatch billing metric data is stored in which AWS Region?

Answer 242

US East (N. Virginia) - us-east-1 You can monitor your estimated AWS charges by using Amazon CloudWatch. Billing metric data is stored in the US East (N. Virginia) Region and represents worldwide charges. This data includes the estimated charges for every service in AWS that you use, in addition to the estimated overall total of your AWS charges.

Question 243

Which Cost Allocation tags requires activation before they can appear in Cost Explorer or on a cost allocation report?

Answer 243

AWS generated tags and user-defined tags

Question 244

Which AWS services support High Availability by default? Instance Store EBS EFS RedShift DynamoDB

Answer 244

DynamoDB and EFS All of your data is stored on solid-state disks (SSDs) and is automatically replicated across multiple Availability Zones (AZ) in an AWS Region, providing built-in high availability and data durability. Amazon EFS is a regional service storing data within and across multiple Availability Zones (AZ) for high availability and durability.

Question 245

What are the five categories for Trusted Advisor's core recommendations?

Answer 245

Cost Optimization Performance Security Fault Tolerance Service Limits

Question 246

Are security groups stateful or stateless?

Answer 246

A security group is stateful, that is, it automatically allows the return traffic A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. Security groups act at the instance level, not at the subnet level. Security groups are stateful — if you send a request from your instance, the response traffic for that request is allowed to flow in regardless of inbound security group rules. A security group evaluates all rules before deciding whether to allow traffic.

Question 247

Compared to the on-demand instance prices, what is the highest possible discount offered for reserved instances (RI)?

Answer 247

72% Savings

Question 248

AWS Identity and Access Management (AWS IAM) policies are written as JSON documents. Which of the following are mandatory elements of an IAM policy?

Answer 248

Effect, Action Statement – Use this main policy element as a container for the following elements. You can include more than one statement in a policy. Sid (Optional) – Include an optional statement ID to differentiate between your statements. Effect – Use Allow or Deny to indicate whether the policy allows or denies access. Principal (Required in only some circumstances) – If you create a resource-based policy, you must indicate the account, user, role, or federated user to which you would like to allow or deny access. If you are creating an IAM permissions policy to attach to a user or role, you cannot include this element. The principal is implied as that user or role. Action – Include a list of actions that the policy allows or denies. Resource (Required in only some circumstances) – If you create an IAM permissions policy, you must specify a list of resources to which the actions apply. If you create a resource-based policy, this element is optional. If you do not include this element, then the resource to which the action applies is the resource to which the policy is attached. Condition (Optional) – Specify the circumstances under which the policy grants permission.

Question 249

Which of the following use cases is best suited for Amazon EFS Standard-Infrequent Access (EFS Standard-IA) storage class?

Answer 249

Storing files accessibly for audit requirements. AWS recommends Amazon EFS Standard-Infrequent Access (EFS Standard-IA) storage class if you need your full dataset to be readily accessible and want to automatically save on storage costs for files that are less frequently accessed. Examples include keeping files accessible to satisfy audit requirements, performing historical analysis, or performing backup and recovery.

Question 250

Which AWS entity enables you to privately connect your Amazon Virtual Private Cloud (Amazon VPC) to an Amazon Simple Queue Service (Amazon SQS) queue?

Answer 250

VPC Interface Endpoint You may see a question around this concept in the exam. Just remember that only Amazon S3 and Amazon DynamoDB support VPC gateway endpoint. All other services that support VPC Endpoints use a VPC interface endpoint (note that Amazon S3 supports the VPC interface endpoint as well).

Question 251

What interface does S3 and DynamoDB use to connect to a VPC?

Answer 251

VPC Gateway Endpoint A Gateway Endpoint is a gateway that you specify as a target for a route in your route table for traffic destined to a supported AWS service. The following AWS services are supported: Amazon S3, DynamoDB.

Question 252

Reserved instances are region specific or Availability Zone specific?

Answer 252

AZ specific

Question 253

Which of the following AWS entities lists all users in your account and the status of their various account aspects such as passwords, access keys, and MFA devices?

Answer 253

Credentials Report You can generate and download a credentials report that lists all users in your account and the status of their various credentials, including passwords, access keys, and MFA devices. You can use the credentials report to assist in your auditing and compliance efforts. You can use the report to audit the effects of credential lifecycle requirements, such as password and access key rotation. You can provide the report to an external auditor, or grant permissions to an auditor so that he or she can download the report directly.

Question 254

Which AWS services can be used to forecast your AWS account usage and costs?

Answer 254

Cost Explorer

Question 255

Which of the following AWS services can be used to forecast your AWS account usage and costs?

Answer 255

Cost Explorer

Question 256

What are the 4 cost componets for S3?

Answer 256

storage pricing request and data retrieval pricing data transfer and transfer acceleration pricing data management features pricing

Question 257

What are 3 examples of free data transfer out of S3?

Answer 257

Inbound transfer from the internet Outbound to EC2 in the same region Outbound to CloudFront

Question 258

Which AWS service will help you deploy application code automatically to an Amazon Elastic Compute Cloud (Amazon EC2) instance?

Answer 258

Code Deploy

Question 259

What can you use to run a bootstrap script while launching an Amazon Elastic Compute Cloud (Amazon EC2) instance?

Answer 259

Amazon EC2 instance user data Amazon EC2 instance user data is the data that you specified in the form of a bootstrap script or configuration parameters while launching your instance.

Question 260

Name two services in AWS that uses Edge Locations?

Answer 260

CloudFront Global Accelerator

Question 261

Any question that mentions USB, Hardware, Plug-In and MFA is what?

Answer 261

U2F Security Key

Question 262

What AWS storage service can be directly used with on-premises systems?

Answer 262

EFS To access EFS file systems from on-premises, you must have an AWS Direct Connect or AWS VPN connection between your on-premises datacenter and your Amazon VPC. You mount an EFS file system on your on-premises Linux server using the standard Linux mount command for mounting a file system

Question 263

What is considered best practice in regards to accessing services on AWS? IAM role or IAM Access Keys?

Answer 263

IAM Roles Access keys are long-term credentials for an IAM user or the AWS account root user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK). Access keys consist of two parts: an access key ID and a secret access key. As a user name and password, you must use both the access key ID and secret access key together to authenticate your requests. As a best practice, AWS suggests the use of temporary security credentials (IAM roles) instead of access keys.

Question 264

Which AWS service can be used to set up billing alarms to monitor estimated charges on your AWS account?

Answer 264

Cloud Watch Amazon CloudWatch can be used to create an alarm to monitor your estimated charges. When you enable the monitoring of estimated charges for your AWS account, the estimated charges are calculated and sent several times daily to CloudWatch as metric data. You can choose to receive alerts by email when charges have exceeded a certain threshold. These alerts are triggered by Amazon CloudWatch and messages are sent using Amazon Simple Notification Service (Amazon SNS). Billing metric data is stored in the US East (N. Virginia) Region and reflects worldwide charges. The alarm triggers when your account billing exceeds the threshold you specify. It triggers only when actual billing exceeds the threshold. It doesn't use projections based on your usage so far in the month.

Question 265

What is the difference between AWS Cloud Watch Billing Alarms and AWS Budgets?

Answer 265

Amazon CloudWatch Billing Alarms: Sends an alarm when the actual cost exceeds a certain threshold which is defined by the user. AWS Budgets: Sends an alarm when the actual cost exceeds the budgeted amount or even when the cost forecast exceeds the budgeted amount.

Question 266

An e-commerce company wants to review the Payment Card Industry (PCI) reports on AWS Cloud. Which AWS resource can be used to address this use-case?

Answer 266

AWS Artifact

Question 267

A corporation would like to simplify access management to multiple AWS accounts as well as facilitate AWS Single Sign-On (AWS SSO) access to its AWS accounts. As a Cloud Practitioner, which AWS service would you use for this task?

Answer 267

IAM Identity Centre AWS IAM Identity Center is the successor to AWS Single Sign-On (AWS SSO). It is built on top of AWS Identity and Access Management (IAM) to simplify access management to multiple AWS accounts, AWS applications, and other SAML-enabled cloud applications.

Question 268

Which AWS service can be used to view the most comprehensive billing details for the past month?

Answer 268

AWS Cost & Usage Report (AWS CUR) The AWS Cost & Usage Report (AWS CUR) contains the most comprehensive set of cost and usage data available. You can use Cost and Usage Reports to publish your AWS billing reports to an Amazon Simple Storage Service (Amazon S3) bucket that you own.

Question 269

A Cloud Practitioner would like to get operational insights of its resources to quickly identify any issues that might impact applications using those resources. Which AWS service can help with this task?

Answer 269

AWS SSM Operational Insights = SSM

Question 270

A company based in Sydney hosts its application on an Amazon Elastic Compute Cloud (Amazon EC2) instance in ap-southeast-2. They would like to deploy the same Amazon EC2 instances in eu-south-1. Which of the following AWS entities can address this use case?

Answer 270

AWS AMI An Amazon EBS snapshot is a point-in-time copy of your Amazon EBS volume. EBS snapshots are one of the components of an AMI, but EBS snapshots alone cannot be used to deploy the same EC2 instances across different Availability Zones (AZs).

Question 271

Where are Amazon EBS snapshots stored in the AWS Cloud?

Answer 271

S3 buckets

Question 272

A start-up would like to monitor its cost on the AWS Cloud and would like to choose an optimal Savings Plan. As a Cloud Practitioner, which AWS service would you use?

Answer 272

Cost Explorer

Question 273

What is the minimum bill time interval for EC2 on demand?

Answer 273

EC2 usage is billed in one-second increments, with a minimum of 60 seconds. Similarly, provisioned storage for Amazon Elastic Block Store (Amazon EBS) volumes is billed per-second increments, with a 60-second minimum.

Question 274

Which AWS serverless service allows you to prepare data for analytics?

Answer 274

AWS Glue

Question 275

Which of the following services are provided by Amazon Route 53? (Select Two)

Answer 275

Domain Name Registration Health checks and Monitoring

Question 276

Which AWS Identity and Access Management (AWS IAM) Security Tools allows you to review permissions granted to an IAM user?

Answer 276

IAM Access Advisor

Question 277

True or False - all traffic between AZ's is encrypted?

Answer 277

True

Question 278

What services does AWS WAF support? (4)

Answer 278

Amazon CloudFront, Application Load Balancer (ALB) Amazon API Gateway AWS AppSync

Question 279

Historically, IT departments had to over-provision for peak demand. IT professionals may bring this legacy mindset to the table when they build their cloud infrastructure leading to over-provisioned resources and unnecessary costs. Right-sizing of resources is necessary to reduce infrastructure costs while still using cloud functionality optimally. Which feature of the AWS Cloud refers to right-sizing the resources?

Answer 279

Elasticity or Vertical Scaling Key is "right-sizing" which refers to vertical scaling

Question 280

What are the three types of Savings Plans?

Answer 280

Compute Savings Plans EC2 Instance Savings Plans Amazon SageMaker Savings Plans

Question 281

Which Snow device is associated with IoT use cases?

Answer 281

Snowcone ts small form factor makes it a perfect fit for tight spaces or where portability is a necessity and network connectivity is unreliable. You can use Snowcone in backpacks on first responders, or for IoT, vehicular, and drone use cases. You can execute compute applications on the edge, and you can ship the device with data to AWS for offline data transfer, or you can transfer data online with AWS DataSync from edge locations.

Question 282

A company has defined a baseline that mentions the number of AWS resources to be used for different stages of application testing. However, the company realized that employees are not adhering to the guidelines and provisioning additional resources via API calls, resulting in higher testing costs. Which AWS service will help the company raise alarms whenever the baseline resource numbers are crossed?

Answer 282

AWS CloudTrail Insights AWS CloudTrail Insights helps AWS users identify and respond to unusual activity associated with write API calls by continuously analyzing CloudTrail management events.