From Tests Flashcards
1
Q
What networking components will allow IPv6 data to communicate between a VPC and the internet? [Select 2]
- Direct Connect
- Internet Gateway
- NAT
- Egress-Only Internet Gateway
A
- Internet Gateway
- Egress only
Only two components allow VPC to internet communication using IPv6 addresses and those are “Internet Gateways” and “Egress-Only Internet Gateways”. “NAT Instances” and “NAT Gateways” explicitly do not support IPv6 traffic and a “Direct Connection” carries data between a Data Centre and an AWS VPC, but does not travel over the Internet.
2
Q
Which two things can you define using the Transforms section of the CloudFormation template?
- To specify the use of the Serverless Application Model for Lambda deployments
- To transform API responses to a supported format
- To re-use code located in S3
- To convert between YAML and JSON format templates
A
- To specify the use of the Serverless Application Model for Lambda deployments
- To re-use code located in S3
3
Q
In an IAM policy, what action does IAM:PassRole relate to?
- Passing a role to an AWS service to assign temporary permissions to the service
- Passing a role to an IAM user
- Passing a role to another AWS account
- Associating a role with an EC2 instance
A
- Passing a role to an AWS service to assign temporary permissions to the service
- Passing a role to another AWS account
The IAM:PassRole allows any affected entity to pass roles to AWS services or Accounts, granting them permission to assume the role. The list of roles able to be passed on by an entity to other services or accounts can be restricted with the Resources element of the IAM policy statement.
4
Q
AWS Systems Manager Parameter Store provides secure, hierarchical storage for configuration data and secrets management. Which of the following AWS services natively support the Parameter Store?
A
EC2, Lambda, CloudFormation
5
Q
If you are using Memcached as your caching engine, what parameter should be adjusted if you find that the overhead pool is less than 50MB?
A
Memcached_Connections_Overhead
6
Q
You are trying to copy a custom AMI which has been shared by another account. The AMI has been encrypted. What steps will you need to take to successfully copy the AMI?
A
The sharing account must share the underlying EBS snapshot as well as the original encryption key used to encrypt it. Copy the EBS snapshot and re-encrypt it using your own key, then register it as an AMI
7
Q
You are trying to copy a shared AMI which has an associated billingProducts code. What are the correct steps?
A
Launch an EC2 instance using the shared AMI and create a new AMI from the instance
8
Q
You have been asked to enable encryption at rest on your existing EFS file system. What should you do?
A
Explain that it is not possible to encrypt an existing EFS file system.
9
Q
The security team have asked you to provide them with details of all the IAM users in your account and the status of their credentials including passwords, access keys and registered MFA devices. What is the best way to approach this?
A
Generate a credential report either using the AWS CLI or from the AWS console
10
Q
What networking components will allow IPv6 data to communicate between a VPC and the internet?
A
Only two components allow VPC to internet communication using IPv6 addresses and those are “Internet Gateways” and “Egress-Only Internet Gateways”. “NAT Instances” and “NAT Gateways” explicitly do not support IPv6 traffic and a “Direct Connection” carries data between a Data Centre and an AWS VPC, but does not travel over the Internet.
11
Q
Which of the following S3 operations are examples of bucket level actions?
A
CreateBucket,DeleteBucket,ListBucket
12
Q
During a security audit your team has been asked by the auditor whether the Cloud allows for packet capture in the same way as a fiber tap can work in your old data center. What should you tell them?
A
Yes, VPC Traffic Mirroring supports direct access to the network packets flowing through your VPC by allowing you to mirror and forward them to another network interface in the same or another VPC in the same or another account
Amazon VPC traffic mirroring makes it easy for customers to replicate network traffic to and from an Amazon EC2 instance and forward it to out-of-band security and monitoring appliances for use-cases such as content inspection, threat monitoring, and troubleshooting
13
Q
You are a security administrator for your company’s AWS account. You have enabled CloudTrail for all regions in your master account, and all API calls are centrally logged into an S3 bucket. You have downloaded those logs with the GetObject API call to perform some advanced analytics to inform a security policy. When you look at the CloudTrail activity, you notice that the API calls GetObject are not logged in CloudTrail. How would you troubleshoot this issue?
A
Logging data events is turned off by default. Configure S3 data events in CloudTrail trails.
14
Q
An insurance company has a monolithic application hosted in an EC2 instance and a serverless application hosted in AWS Lambda. After a few months of running the application, the customers have raised multiple delays and performance issues from the applications. The Operations Engineer responsible has mentioned that the latency issues might have been caused by code-level performance issues and the Head of Operations has instructed the team to add code-level monitoring support. How can the team accomplish this?
A
Use AWS X-Ray for both the monolithic application code and the serverless application code.
15
Q
You are a SysOps Administrator setting up a VPN connection between your on-premises data center and with AWS. You currently have an Amazon VPC setup with a Virtual Private Gateway. You have installed a customer gateway to your on-prem data center and router for your on-premises network is showing status OK. When you try to connect the EC2 instance in your Amazon VPC to a virtual machine in your data center it does not work. How should you set up the route table in the Amazon VPC?
A
Configure a route to the virtual private gateway.
16
Q
You would like to run a Lambda function at the same time every night. Which of the following tools could you use to configure this?
A
Schedule an event in CloudWatch to trigger the function.
You can create rules that self-trigger on an automated schedule in CloudWatch Events using cron or rate expressions.
17
Q
Which of the following is part of the failover process for a Multi-Availability Zone RDS instance
A
The DNS record for the RDS endpoint is changed from primary to standby.
18
Q
The engineering team of a FinTech company has migrated their on-premise application to AWS and has decided to use AWS DynamoDB to store the records and a combination of EC2 instances and Lambda functions for the data processing requirements. The Chief Security Officer of the company has mandated that the DynamoDB table is accessed without the use of access keys and secrets. How can the engineering team accomplish this?
- Create and associate IAM resource policies to the EC2 Instances. Create and associate IAM roles to the Lambda functions.
- Create and associate IAM roles to the EC2 Instances. Create and associate Cognito roles to the Lambda functions.
- Create and associate IAM roles to the EC2 Instances and Lambda functions.
- Create and associate IAM roles to the EC2 Instances. Create and associate IAM resource policies to the Lambda functions.
A
Create and associate IAM roles to the EC2 Instances and Lambda functions.
IAM roles allow EC2 instances and similar resources such as Lambda functions to perform operations on other resources without the need for access keys and secrets.
19
Q
Your Dev team in Ireland needs an AMI that was created in us-east-1. The Irish Dev team have a copy of the AMI and are attempting to use it to launch instances in eu-west-1, however they are unable to make it work. Which of the following is the most likely cause of the problem?
- The Dev team does not have launch permissions to use the AMI to launch instances.
- You cannot use AMIs created by a different account
- The Dev team has failed to manually re-create the launch permissions.
- The US based account which created the AMI has not shared it with the Ireland based account.
A
The Dev team has failed to manually re-create the launch permissions.
Copying a source AMI results in an identical but distinct target AMI with its own unique identifier. AWS does not copy launch permissions, user-defined tags, or Amazon S3 bucket permissions from the source AMI to the new AMI. After the copy operation is complete, you must apply launch permissions manually.
20
Q
You need to create a new trail in AWS CloudTrail service. You want the new trail to capture all management events through AWS API or console. The trail should also capture the data events that are performed within the resources. Which types of resources can be configured in the trail for the data events? (Select TWO.)
- S3 buckets.
- EC2 EBS volumes.
- Lambda Functions.
- RDS instances
- DynamoDB tables.
A
S3 buckets.
Lambda Functions
With CloudTrail, you can collect data events that happen within the resources of S3 or Lambda Function. Data events are disabled by default. You can explicitly add the supported resource types when configuring a trail.
21
Q
You need to update the AMI in your EC2 Auto Scaling launch configuration. Which of the following statements are true? Select three.
- Changing the launch configuration of an Auto Scaling group doesn’t affect existing instances.
- Changing the launch configuration of an Auto Scaling group triggers existing instances to be relaunched using the new configuration.
- The existing launch configuration cannot be modified so a new one must be created.
- You can specify multiple launch configurations for an EC2 Auto Scaling group at a time.
- The launch configuration can be modified freely so there is no need to create a new one.
- You can only specify one launch configuration for an EC2 Auto Scaling group at a time.
A
Changing the launch configuration of an Auto Scaling group doesn’t affect existing instances.
The existing launch configuration cannot be modified so a new one must be created.
You can only specify one launch configuration for an EC2 Auto Scaling group at a time.
22
Q
You are providing a storage solution for a customer. The customer requires a scalable, secure, and highly available network file system accessed by EC2 instances to support highly parallelized workloads and performance needs of big data and analytics. What AWS storage solution would you build for your customer?
- Create an EFS file accessible by EC2 via mount targets in each Region. Control traffic flow between Amazon EFS and EC2 instances using NACLs.
- Create an EFS file accessible by EC2 via mount targets in each Availability Zone. Control traffic flow between Amazon EFS and EC2 instances using NACLs.
- Create an EFS file accessible by EC2 via mount targets in each Region. Control traffic flow between Amazon EFS and EC2 instances using security groups.
- Create an EFS file accessible by EC2 via mount targets in each Availability Zone. Control traffic flow between Amazon EFS and EC2 instances using security groups.
A
Create an EFS file accessible by EC2 via mount targets in each Availability Zone. Control traffic flow between Amazon EFS and EC2 instances using security groups.
23
Q
Which of the following distinguishes two CloudWatch metrics that are in the same namespace and have the same name? A. Timestamp B. Data point C. Dimension D. Region
A
CloudWatch uses dimensions to identify metrics that have the same name and are
within the same namespace. Me
24
Q
You update a CloudWatch metric with a timestamp of 10:00:30 and a value of 98.
You then update the same metric with a timestamp of 10:00:59 and a timestamp of 97.
Assuming the metric is a regular-resolution metric, what will CloudWatch do?
A. Record the first value and ignore the second value.
B. Record the second value and overwrite the first value.
C. Record both values.
D. Store the average of the two values.
A
B. CloudWatch can store regular-resolution metrics at no less than 1-minute resolution.
Therefore, updating a metric at 10:00:30 and then again at 10:00:59 will result in
CloudWatch storing only the second value.
25
A week ago, you created a CloudWatch alarm to monitor the CPUUtilization metric on
an EC2 instance. Yesterday, the alarm briefly entered an INSUFFICIENT_DATA state and
then went back to an OK state. What is a possible reason for this?
A. The alarm was paused.
B. The instance was terminated.
C. The CPU utilization went above the alarm threshold.
D. The instance was stopped and restarted.
D. The instance being stopped and restarted would explain the momentary lack of CPU
utilization data
26
```
Which of the following can you use to proactively alert you to possible excess resource
utilization in your AWS account?
A. CloudTrail
B. AWS Budgets
C. CloudWatch Events
D. Cost Explorer
E. AWS Config
```
B. AWS Budgets can alert you via email if your bill exceeds a specified amount—a good
indicator of excessive resource utilization
27
You’re running a relational database on an EC2 instance backed by an EBS gp2 volume.
Recently, as the frequency of writes to the database has increased, database performance
has suffered. CPU and memory utilization remain at less than 50%, even during peak
usage. Which of the following should you look at to determine where the bottleneck is?
A. Volume queue length
B. Network utilization
C. The number of EBS snapshots being stored
D. Provisioned IOPS
A. The volume queue length metric measures the total number of read and write
operation requests waiting for completion. If this has increased and remains high, it’s
a good indication that the volume isn’t able to sustain enough IOPS. Because it’s a gp2
volume, the number of IOPS depends on the size allocated for the volume
28
```
Which of the following Relational Database Service (RDS) instance classes offers
dedicated bandwidth for storage volumes?
A. Burst-capable
B. Memory-optimized
C. Standard
D. Network-optimized
```
. B. Memory-optimized instances have dedicated bandwidth for EBS storage. Standard
instances are not EBS optimized
29
If you enable automatic snapshots, how many days will RDS retain them by default?
7
30
. You’ve configured CloudTrail to log all management events in all regions. How long will
these logs be retained by default?
Indefinitely
CloudTrail logs can be stored in S3 buckets or CloudWatch Logs. By default, S3
and CloudWatch Logs don’t delete any files or logs automatically
31
You want to create an alarm to monitor the VolumeReadOps metric for an EBS volume.
The metric is stored with a 5-minute resolution. You need the alarm to trigger as soon as
the metric crosses a threshold. What period should you use?
B. The period should be greater than or equal to the resolution of the metric. In this case,
you want the alarm to trigger as soon as the metric crosses a threshold, so you should set
the period to 5 minutes
32
Four hours ago, you configured a CloudWatch alarm to monitor CPU utilization on an
EC2 instance, but today the alarm is in an INSUFFICIENT_DATA state. Which of the
following could explain this? (Choose two.)
A. The instance was restarted.
B. The instance is stopped.
C. The CPU utilization hasn’t crossed the alarm threshold.
D. The alarm period hasn’t elapsed yet
The instance is stopped.
| The alarm period hasn’t elapsed yet.
33
You want to be alerted if the average CPU utilization of an instance exceeds 90% or if the
instance is stopped for more than 5 minutes. Which of will achieve this with
minimal effort?
Create a single alarm to monitor the CPUUtilization metric.
Configure the alarm to treat missing data as breaching.
34
You have an account limit of 10,000 customer master KMS keys. How many files can you
store using SSE-KMS encryption before having to request a limit increase?
There is no practical limit to the number of files you can store in S3. The KMS key
limit applies to the number of customer master keys, but you can use the same key to
encrypt each file in S3.
35
One DynamoDB read capacity unit (RCU) will allow you to read, per second, one item up
to what size? (Choose two.)
A. Anything between 1 and 8 KB using a strongly or eventually consistent read
B. 2 KB using a strongly consistent read
C. 4 KB using a strongly consistent read
D. 8 KB using an eventually consistent read
One RCU gets you a strongly consistent read per second of an item up to 4 KB in
size, or two weakly consistent reads per second of 4 KB each
36
Approximately how many in-flight messages can you have in a standard SQS queue?
120,000
37
Approximately how many in-flight messages can you have in a FIFO SQS queue?
20,000
38
```
Which of the following offers the lowest priced transfer up to 1 GB per month?
A. They are all the same.
B. S3 Standard
C. S3 One Zone-Infrequent Access
D. S3 Standard-Infrequent Access
```
S3 standard charges nothing for data transfer up to 1 GB per month. S3 One Zone-IA
and Standard-IA charge US$0.01 per GB.
39
```
Which is best for seeing how your AWS bill has changed over time?
A. Cost and Usage Reports
B. Cost Explorer
C. Budgets
D. Trusted Advisor
```
Cost Explorer lets you analyze your costs and usage for the preceding 13 months.
40
What’s the maximum number of AWS Budgets custom budgets you can create for free?
Two
41
You’re running a set of applications in a single AWS region. You want to expand these
applications to an additional region but need to determine how much it will cost. Which can help you?
. Simple Monthly Calculator
42
(Monitoring)
. Your supervisor has asked you if there is a way to create reports with billing data so that
they can view billing by usage, or the cost per individual log group. What should you tell
your boss?
A. Yes. AWS allows you to get this information with detailed billing.
B. Yes. AWS allows you to get this information with basic billing.
C. No. AWS does not allow you to get this information.
D. No. AWS does not give you the ability to create reports in this way
A. Yes. AWS allows you to get this information with detailed billing.
Detailed billing was made available to AWS customers back in December 2016.
Detailed billing gives customers the ability to create reports to review usage in the AWS
account, or the cost associated with individual log groups. There’s no such thing as basic
billing
43
(Monitoring)
You are the system administrator in charge of getting your organization’s AWS
environment set up. You want to enable billing alerts, but when you log in with your IAM
account, you are unable to do so. Why can’t you create the billing alert?
A. Your IAM account doesn’t have the necessary permissions; you need more access.
B. You can’t set up billing alerts in AWS; you have to arrange them with your technical
account manager.
C. You need to be signed in with the AWS account’s root user credentials to enable
billing alerts.
D. It is not possible to set up billing alerts in AWS
To enable billing alerts, you must be logged in as the root user for the AWS account.
44
```
(Monitoring)
. What are the valid statuses you can get from the Amazon EC2 health checks? (Choose
two.)
A. Pass
B. Fail
C. OK
D. Impaired
E. Offline
```
When a health check is run on an Amazon EC2 instance, you can get types of
statuses. OK means that all of the health checks have passed. If any of the health checks
fail, then the status displayed is Impaired.
45
(Monitoring)
You don’t like the status checks and the alerting done from the status checks that exist on
Amazon EC2. You want to disable the status checks in favor of another solution. How can
you disable the Amazon EC2 status checks?
A. You can disable them by turning off the monitoring in the Amazon EC2 instance.
B. You can disable them by installing the Amazon CloudWatch Logs agent and then
disabling them through the agent.
C. You can’t disable them; they are part of Amazon EC2.
D. You can’t disable them; they are part of Amazon EC2. You can disable the alerts that
trigger off of the status checks.
As the status checks themselves are a part of the Amazon EC2 instances, you can’t
disable them. You can, however, disable the CloudWatch alarms that utilize the status
checks to trigger.
46
(Monitoring)
How long are statistics retained in Amazon CloudWatch?
A. 6 months
B. 12 months
C. 15 months
D. 30 months
15 months
47
(Monitoring)
Your security team has mandated that you need to avoid using service accounts unless
absolutely necessary because of the overhead in managing password rotation. You want to
deploy the Amazon CloudWatch Logs agent. What could you use to authenticate the agent
that is not a service account?
A. Access keys
B. AWS IAM
C. Active Directory
D. There isn’t any option other than a service account
You can use access keys to authenticate the Amazon CloudWatch Logs agent instead
of a username and password.
As the access key is still tied to a username, you may want
to check with your security team that it meets their criteria. While access keys are created
in AWS IAM, AWS IAM is not a granular enough response to satisfy this question. While
you can link your Active Directory environment to AWS, this is still not getting away
from the need for service accounts.
48
(Monitoring)
How would you set a custom metric to use high resolution?
A. Set MetricResolution to 1 using the PutMetricRequest API.
B. Set StorageRetention to 1 using the PutMetricRequest API.
C. Set StorageResolution to 1 using the PutMetricRequest API.
D. Set MetricRetention to 1 using the PutMetricRequest API.
Set StorageResolution to 1 using the PutMetricRequest API.
49
(Monitoring)
Your boss wants to use high-resolution metrics because they want to be able to get data
every 15 seconds. They are concerned about additional cost from using high-resolution
metrics. What should you tell your boss?
A. High-resolution metrics are more expensive.
B. High-resolution metrics are less expensive.
C. High-resolution metrics cost the same as standard.
D. You can’t do 15-second periods with high resolution.
High-resolution metrics don’t cost any more or any less than standard-resolution
metrics. You can do 1-, 5-, 10-, 15-, 30-, and 60-second intervals with high resolution.
50
(Monitoring)
You work for a financial institution and you need to parse your log data for account
numbers. You have a regex query built that has been used in other solutions. How can you
parse your log data for the regex that will find account numbers?
A. Amazon CloudWatch Metric Filters
B. AWS Management Console
C. Amazon CloudWatch
D. Amazon Kinesis
Amazon Kinesis allows you to connect your log stream and process the logs using the
regex that you wanted to search on. Amazon CloudWatch Metric Filters do not support
regex. Neither Amazon CloudWatch nor the AWS Management Console give you the
ability to search by regex
51
(Monitoring)
You want to ensure that AWS Config is enabled for all three regions that your
organization is using. How would you enable AWS Config for all three regions?
A. It is automatically enabled for all regions.
B. You need to enable it once for all regions.
C. You need to enable it once per region.
D. You can’t use AWS Config for that many regions.
C. AWS Config is not enabled by default. You need to enable it once per region for any
region you want to have monitored.
52
(Monitoring)
You currently have 145 individual AWS Config rules built for your organization’s
environment. You need to make 10 more rules for new criteria that your legal team wants
you to monitor for. Will you be able to create 10 more rules?
A. Yes, you can create unlimited rules.
B. Yes, but you will need to request an increase on the limit from AWS.
C. No, because you can’t have more than 150 rules.
D. No, because you can’t add more rules.
B. Yes, but you will need to request an increase on the limit from AWS.
With AWS Config, you are limited to 150 rules
53
(Monitoring)
Your boss wants you to set up a periodic rule in AWS Config, and they want it to run
every 6 hours. How should you respond to this request?
A. Set up the periodic rule for 3 hours because you can’t set it to 6.
B. Set up the periodic rule to run every 6 hours.
C. Set up the periodic rule to run every 12 hours because you can’t set it to 6.
D. Tell your boss that AWS Config can only do change-triggered rules.
You can set periodic rules to run every 1, 3, 6, 12, or 24 hours. So your response
should be to set up the rule to run every 6 hours.
54
(Monitoring)
You have AWS Config configured in your AWS account. You have added a security group
to an Amazon EC2 instance. Which resources will have changes recorded in AWS Config?
A. Amazon EC2 instance
B. The security group
C. Primary resource and related resources
D. All of these
D. When you add a security group to an Amazon EC2 instance, AWS Config records
changes for the Amazon EC2 instance, the security group, primary resources, and related
resources.
55
(Monitoring)
Your Operations Center team would like to know what kinds of things AWS Config can
record. What should you include in your response?
A. All of the following options
B. OS patches
C. Application installations
D. Network configuration
A. You can tell your Operations Center team that AWS Config can record OS patches,
application installations, network configurations, and really any change that is made to
the systems.
56
(Monitoring)
You have a new person in Accounting who is in charge of paying for your AWS account
charges. They have asked you if there is a way to see what the charges are so far. Where
should you tell them to go?
A. AWS Budgets
B. AWS Management Console
C. AWS Billing and Cost Management Dashboard
D. AWS Trusted Advisor
C. The AWS Billing and Cost Management Dashboard will allow them to monitor what
the current spend is now and even sort by service.
57
(Monitoring)
Your accounting department likes the view that the Billing and Cost Management
Dashboard gives them, but they don’t want to have to go to each individual AWS account
to view billing for the entire organization. What should you implement to allow them to
view billing for the entire organization?
A. AWS Trusted Advisor
B. AWS Organizations
C. AWS Management Console
D. AWS Budgets
B. AWS Organizations allows your accounting department to view billing and cost
information for all of the AWS accounts in your organization.
58
(Monitoring)
Your boss wants to view the current amount due on your AWS account. Where should you
tell your boss to look?
A. AWS Management Console
B. AWS Trusted Advisor
C. AWS Budgets
D. AWS Cost Explore
D. AWS Cost Explorer monitors the current amount due on your AWS account
59
(Monitoring)
Your security department wants to know which processes are running on open ports.
How can you give them this information? (Choose two.)
A. Run a scan from Amazon Inspector.
B. Run a scan with Amazon GuardDuty.
C. Use AWS WAF.
D. Install the Amazon Inspector agent
Install the Amazon Inspector agent.
| Run a scan from Amazon Inspector.
60
(Monitoring)
You have been asked to create your own rules packages for Amazon Inspector assessment
templates to use. How do you create a rules package?
A. You can’t create rules packages.
B. Create the rules package inside of the Amazon Inspector Dashboard.
C. Create the rules package inside of the AWS Config Dashboard.
D. Create the rules package inside of the AWS Systems Manager Dashboard.
A. Only the rules provided by AWS are allowed to be used for assessment runs, so you
can’t create rules packages.
61
(Monitoring)
What is the benefit of the Run Command in AWS Systems Manager?
A. Provides console access to the system without the need for remote access ports to be
open
B. Provides console access to Linux hosts via SSH
C. Provides automation of tasks so long as remote access ports are open
D. Provides automation of tasks without the need for remote access
D. The Run Command provides a way to automate common administrative tasks without
the need for remote access provided by opening up SSH or RDP or by using bastion
hosts
62
(Monitoring)
What is the benefit of the Session Manager in AWS Systems Manager?
A. Allows remote console sessions via an interactive web browser with no need to open
inbound ports
B. Allows remote console sessions via an interactive web browser once the necessary
ports are open
C. Allows configuration management and tracking
D. Allows management of APIs
A. Session Manager within AWS Systems Manager allows remote console sessions via an
interactive web browser with no need to open inbound ports or use bastion hosts to access
your systems
63
(Monitoring)
What is the benefit of the Patch Manager in AWS Systems Manager?
A. Patch management and reporting for Windows systems only
B. Patch management and reporting for Linux systems only
C. Patch management and reporting for AWS systems only
D. Patch management and reporting for on-prem and AWS systems
D. AWS Systems Manager Patch Manager provides patch management and reporting for
both Linux and Windows systems on-prem and in the cloud.
64
(Monitoring)
What is the benefit of the State Manager in AWS Systems Manager?
A. Backs up system state for on-prem and AWS resources
B. Backs up system state for AWS resources only
C. Provides configuration management for on-prem and AWS resources
D. Provides configuration management for AWS resources only
C. Provides configuration management for on-prem and AWS resources
65
(Monitoring)
Your boss would like to have a single “source of truth” to run queries against the data
from the AWS services you use. Is there a way to accomplish this within AWS?
A. Yes, you can query data from the other AWS services with Amazon CloudWatch.
B. Yes, you can query data from the other AWS services with Amazon Athena.
C. Yes, you can query data from the other AWS services with AWS CloudTrail.
D. No, there is not a way to accomplish this in AWS.
B. With Amazon Athena, you can query data across a multitude of AWS services,
including AWS CloudTrail, Amazon CloudFront, Elastic Load Balancer, Amazon Virtual
Private Cloud, Amazon CloudFormation, AWS Glue Data Catalog, Amazon QuickSight,
and IAM
66
(Monitoring)
Which of these responses is a benefit of Amazon GuardDuty?
A. Automated responses to identified threats
B. Identification of stale user accounts
C. Identification of users/groups with excessive permissions
D. Automated security assessments
A. Amazon GuardDuty not only identifies threats on your network, it can automatically
respond to those threats as well
Identifying stale user accounts or users/groups with
excessive permissions is something that should be done by your IAM team, utilizing AWS
IAM.
Automated security assessments are performed by Amazon Inspector.
67
(Monitoring)
Which of these responses is a benefit of Amazon GuardDuty?
A. Maintain desired patch levels.
B. Manage encryption keys for your AWS environment.
C. Support a single AWS account.
D. Support multiple AWS accounts.
Amazon GuardDuty can support multiple AWS accounts, giving visibility across your
enterprise
68
(High Availability)
Your boss has heard that EC2 Auto Scaling groups can scale based on metrics monitored in Amazon CloudWatch. However, the traffic to your web servers follows very predictable patterns, so your boss would like to know if you can schedule a scaling event instead.
What should your response be?
A. Yes, scaling events can be triggered on a schedule.
B. No, scaling events can’t be triggered on a schedule.
C. Yes, you can schedule scaling events through Amazon CloudWatch.
D. No, scaling events can only be triggered based on Amazon CloudWatch metrics.
A. Scaling events can be triggered by schedule. The schedule is not created in Amazon
CloudWatch, and you don’t need an alarm from Amazon CloudWatch to scale.
69
(High Availability)
You have created your Auto Scaling group but you notice that you have no EC2 instances
within the group. What is the most likely cause?
A. You didn’t set a desired capacity.
B. Minimum capacity is set to 0, and there is no load.
C. Maximum capacity is set to 1.
D. Autoscaling is not available in your region
B. If minimum capacity is set to 0 and there is no load, then it is entirely possible for you
to have 0 instances.
If you leave desired capacity blank, then the minimum capacity is
used.
If maximum capacity is set to 1, then your Auto Scaling group can have up to one
EC2 instance.
If autoscaling wasn’t available in your region, you wouldn’t have been able
to set up your ASG in the first place
70
(High Availability)
You have assigned a new launch configuration to your Auto Scaling group. You need to
refresh all of your instances, but you can’t have downtime. What is the best option?
A. Set the desired capacity to 0, then once they are all terminated, set it back to its
previous setting.
B. Manually terminate the old instances so they are relaunched using the new
configuration.
C. Choose each instance and assign the new launch configuration.
D. Let the instances age out over time
B. Since you need to avoid downtime, your best option is to manually terminate the
old instances so they are relaunched using the new launch configuration. This allows
you to control how many instances are offline and avoid downtime.
If you set the desired
capacity to zero, you may cause an outage, so this would not be a great solution if the
most important factor is to avoid an outage.
You can’t set the launch configuration per
instance.
Since you need to refresh your instances now, waiting for them to age out is not
a good solution.
71
(High Availability)
You’ve been using launch configurations, but as part of a DevOps model, you want to
begin using versioning to track changes to your launch configurations. How can you
enable versioning for launch configurations?
A. Create a launch template from your launch configurations.
B. Enable versioning on your launch configurations.
C. Manually name your launch configurations with a version number.
D. There is no way to set up versioning for launch configurations.
A. Launch templates use versioning to track changes. You can’t enable versioning on
launch configurations directly. Manually numbering launch configurations is not easily
scalable and would be error prone
72
(High Availability)
```
Which of these can be used to subscribe to an SNS topic?
A. Amazon Simple Storage Service (S3)
B. AWS Lambda
C. Amazon EC2
D. Amazon Simple Workflow Service (SWF)
```
B. There are five different ways to subscribe to an SNS topic. They are:
- AWS Lambda,
- Amazon Simple Queue Service (SQS)
- HTTP and HTTPS,
- email,
- SMS text.
73
(High Availability)
You have a Lambda function in the us-east-1 region and you want to also use the function
in the us-east-2 region. Can you use the same function or would you need to re-create it?
A. Yes, you can use the same function.
B. Yes, but you will need to share the function.
C. No, you will need to create the function in the other region.
D. No, you can’t use the same function.
C. You can’t use the same function because AWS Lambda is based on region.
You can,
however, copy the function to the other region
74
(High Availability)
You are using an application load balancer and you want to route traffic for multiple
domains. What type of routing should you set up that will allow the load balancer to do
what you need?
A. Content-based routing
B. Path-based routing
C. Host-based routing
D. There is no way to accomplish this type of routin
C. Host-based routing will allow you to route traffic based in the domain name in the
request. Content-based routing routes traffic based on the content of the request. Pathbased routing will route traffic based on the URL path that is in the HTTP header.
75
(High Availability)
You have multiple services running behind an application load balancer. You need the load
balancer to route to different servers based on the URL in the HTTP request. What type
of routing should you use?
A. Content-based routing
B. Path-based routing
C. Host-based routing
D. There is no way to accomplish this type of routing.
B. Path-based routing will route traffic based on the URL path that is in the HTTP
header. Host-based routing will allow you to route traffic based in the domain name in
the request. Content-based routing routes traffic based on the content of the request.
76
(Deployment and Provisioning)
You have been asked to automate the deployment of web servers in your organization
to meet demand when the load increases on your existing systems. You need to ensure
that each of the EC2 instances is configured the same way each time. How would you
accomplish this requirement?
A. AWS CloudFormation
B. Auto Scaling groups
C. User data field
D. Amazon CloudWatch
The user data field can be used in conjunction with Auto Scaling groups to configure
your EC2 instances.
77
(Deployment and Provisioning)
Why might you use a template parameter in a CloudFormation template?
A. Specify passwords at creation time.
B. Specify instance type and size at creation time.
C. Specify IAM roles needed at creation time.
D. You can’t use a parameter in a CloudFormation template.
B. One of the most common use cases for a template parameter in CloudFormation is to
specify the instance type and size at the time of creation
78
(Deployment and Provisioning)
```
To create a stack using the AWS CLI, what would you use?
A. aws ec2 create-stack
B. aws cloudformation update-stack
C. aws cloudformation stack-create
D. aws cloudformation create-stack
```
aws cloudformation create-stack.
79
(Deployment and Provisioning)
Which language is not supported in AWS Elastic Beanstalk?
A. Go
B. Python
C. PHP
D. These are all supported.
```
D. Elastic Beanstalk supports multiple languages, including
Go
Java,
.NET,
Node.js,
PHP,
Python,
Ruby.
```
It also supports Docker web applications.
80
(Deployment and Provisioning)
You are using CloudFormation and your system administrators want to be able to update
your application while keeping it available. They tell you that it can run at 50% capacity
with only slight performance degradation later that evening. Your supervisor wants to
ensure that performance is not impacted at all but wants to keep costs down. What is the
best deployment policy to use?
A. All at once
B. Rolling
C. Rolling with additional batch
D. Immutable
C. By using rolling with additional batch, you ensure that you are operating at full
capacity, which will not impact performance as the supervisor requested. Rolling with
additional batch is a less expensive option than immutable as you are only spinning
up instances to cover the systems that are being taken offline as opposed to all of the
instances as you would do if immutable was being used.
81
(Deployment and Provisioning)
Your system administrators want to be able to update your application while keeping it
available. They tell you that it can run at 50% capacity with no performance degradation
later that evening. Your supervisor wants to keep costs down. What is the best deployment
policy to use?
A. All at once
B. Rolling
C. Rolling with additional batch
D. Immutable
B. Since the application will not suffer at 50% capacity later in the evening and your
supervisor wants to keep costs down, rolling is the best option. Since no new instances are
provisioned, this keeps the cost down, and you can specify that only 50% of the instances
are getting updated at any point in time.
82
(Deployment and Provisioning)
You are using CloudFormation and your system administrators want to update your
application to the latest version in the development environment for testing. It is okay for
the application to be unavailable for a brief period of time. Your supervisor wants to keep
costs down. What is the best deployment policy to use?
A. All at once
B. Rolling
C. Rolling with additional batch
D. Immutable
A. Since this is a development environment and it is considered acceptable to have
downtime, all at once is the best deployment policy. It is the fastest method, and the cost
is kept down since no new instances are spun up.
83
(Deployment and Provisioning)
When systems are deployed with CloudFormation, health checks are passing during the
deployment; however, it is found that the health checks are marking instances as healthy
prematurely before all of the services are running that the application relies on. Given a
little more time, the application starts with no issue. What is the most likely cause for this?
A. The health checks are incorrectly marking instances healthy.
B. A health check URL is not configured.
C. The instances are healthy, but the application has issues.
D. This is working by design.
B. If a health check URL is not configured, then instances are marked as healthy as soon
as they accept a TCP connection. The services the application relies on may not be up and
responding by then. It is unlikely that instances are being marked healthy incorrectly. If
the application has issues, it wouldn’t start working after a slightly longer time frame; this
appears to be an issue of dependencies not being met.
84
(Deployment and Provisioning)
You have the AWS CLI installed on your system and you manage your environment with
it. You have full administrative permissions. When you try to run the Elastic Beanstalk
command, eb platform logs, the command is not recognized. What is the most likely
reason the command is not being recognized?
A. You don’t have the EB CLI installed.
B. You have not typed the command properly.
C. You can’t configure Elastic Beanstalk with the AWS CLI.
D. It’s an invalid command.
A. The command that is being used requires the Elastic Beanstalk CLI to be installed.
85
(Deployment and Provisioning)
You currently have 38 RDS database instances on your AWS account. You need to add
10 more. What will you need to do to add the 10 database instances?
A. You can add them as you normally would.
B. You will need to contact AWS to raise the soft limit on your account as you can only
have 40 RDS database instances on your account.
C. You will need to contact AWS to raise the soft limit on your account as you can only
have 50 RDS database instances on your account.
D. You can’t add any more than 40 to your account; it is a hard limit.
B. Each AWS account can have a total of 40 database instances. To be able to go over the
40, which is a soft limit, you would need to contact AWS and request that the limit be
raised.
86
(Deployment and Provisioning)
You are using a MySQL database in Amazon RDS. You have five read replicas and would
like another, but you are unable to create another read replica. Why is that?
A. You don’t have permissions to create a read replica.
B. With MySQL in Amazon RDS, you can have only five read replicas.
C. You can have five read replicas, but that is a soft limit; you will need to request an
increase.
D. Use a multi-AZ configuration instead to get around this limitation.
B. If you are using MySQL in Amazon RDS, then you may only have five read replicas at
any time.
In this case, five read replicas is not a soft limit,
so you can’t request a limit increase.
87
(Deployment and Provisioning)
You had a failure in one of your databases recently and when you tried to restore from
backup, you found that the last backup available was from several weeks ago when there
was a large upload of data. What is the likely reason that this occurred?
A. The last backup was a manual backup and automated backups have never worked.
B. The data transfer overloaded the system and disabled the automated backups.
C. Automated backups were disabled while the large amount of data was loaded.
D. Automated backups were disabled due to a system error
C. In general, it is a bad idea to disable automatic backups. One of the few exceptions
is when you are loading a large amount of data.
88
(Deployment and Provisioning)
. You have multiple container images stored on Docker Hub and you would like to use them
once you migrate to using Amazon ECS. Will you still be able to use Docker Hub as your
container registry?
A. Yes, although Docker Hub is the only supported external registry.
B. Yes, you can use container registries outside of AWS.
C. No, you can only use Amazon Elastic Container Registry (ECR).
D. No, you can’t use external container registries.
B. When using Amazon ECS, you can use container registries inside of AWS and outside
of AWS. So you could use your existing container registry in Docker Hub, and in fact
Docker Hub is used by default
89
(Deployment and Provisioning)
What must you install on your compute resources to utilize them with AWS Batch?
A. AWS Batch Agent
B. Amazon Inspector Agent
C. Amazon ECS Agent
D. AWS Systems Manager Agent
C. AWS Batch uses containers to execute batch jobs. To take advantage of AWS Batch,
you must install the Amazon ECS (Elastic Container Service) Agent on your compute
resources.
90
(Deployment and Provisioning)
You have added the user accounts of your administrators to the docker group so that they
no longer have to use sudo in front of docker commands. However, when they try to use a
simple docker command, they get the error “Cannot connect to the Docker daemon. Is the
docker daemon running on this host?” What should you do?
A. Reboot the host.
B. Add them to the root group instead.
C. Restart the Docker service.
D. Reinstall Docker.
A. Occasionally a reboot is needed after granting permissions to the user accounts so that
they can access the Docker daemon without sudo
91
(Deployment and Provisioning)
You have created a server using Amazon Lightsail. You want to connect it to an RDS
instance in your default VPC. How should you configure communication to work between
Lightsail and the RDS instance?
A. Direct Connect
B. VPN gateway
C. VPC endpoint
D. VPC peering
D. You would need to enable VPC peering on the Lightsail account page, and from there
Lightsail will configure everything for you.
92
(Storage)
Which of these types of encryption can you use with your EBS volumes? (Choose two.)
A. Client level
B. Server level
C. Instance level
D. Volume level
A, D. With EBS volumes, you have a choice between either client-level encryption, which
is done by the operating system, or volume-level encryption, which is managed by AWS
93
(Storage)
```
Which of the following are valid access methods for Amazon S3 buckets? (Choose two.)
A. Bucket-style
B. Virtual-hosted-style
C. URL-style
D. Path-style
```
B, D. Amazon S3 buckets can be either virtual-hosted-style or path-style.
Virtual-hostedstyle includes the bucket name as part of the domain name in the URL.
Using path-style,
the bucket name is not part of the domain name in the URL. The other two options were
made up for this question.
94
(Storage)
```
You currently have snapshots of your EBS volumes going to S3. You need to access the
snapshots. How would you access them?
A. Amazon S3 API
B. Amazon EC2 API
C. Amazon EBS API
D. The AWS Management Console
```
B. While the snapshots are stored in Amazon S3, they are not directly accessible. You
must use the Amazon EC2 API to work with the snapshots.
95
(Storage)
You need to move the data from your on-premises file servers to Amazon EFS. What is the
simplest method for copying data from your file servers to Amazon EFS?
A. Restore from a backup.
B. Robocopy.
C. AWS DataSync.
D. Manually upload the files
C. AWS DataSync is built for this use case. It allows you to sync your existing filesystems
with your Amazon EFS filesystem and can work over the Internet or via an AWS Direct
Connect/AWS VPN connection.
96
(Storage)
You are moving files to Amazon EFS from your on-prem file servers. You want to save the
company money, and you know that some of the data is stale, but you don’t know if it’s
safe to delete the data. What should you do?
A. Create an age-off policy to move stale data to EFS IA.
B. Create an expiration policy to move stale data to EFS IA.
C. Create an age-off policy to move stale data to Amazon S3 IA.
D. Create an expiration policy to move stale data to Amazon S3 IA.
In Amazon EFS, these are called age-off policies
Expiration policies are used in Amazon S3.
97
(Storage)
You have some small text files that are around 100 KB in size. You have enabled Amazon
EFS Lifecycle Management and have noticed that these files have not been moved to
Amazon EFS IA even though they have not been accessed for a long time. What is the
most likely reason these files have not been moved?
A. The files are smaller than 64 KB.
B. The files are smaller than 128 KB.
C. The files are smaller than 256 KB.
D. The files are smaller than 512 KB.
B. Files smaller than 128 KB in size will not be moved by Amazon EFS Lifecycle
Managemen
98
(Storage)
How can you secure your Amazon EFS deployment so that only authorized Amazon
EC2 instances can access the file share with the least amount of administrative effort?
(Choose two.)
A. Network access control lists
B. Security groups
C. IAM policies
D. IAM groups
B, C. VPC security groups can be used to specify which systems or IP ranges are allowed
to access your file shares. IAM policies can be applied to the filesystem.
99
(Storage)
You would like to create a shared directory in Amazon EFS and ensure through the
operating system that certain users will see the shared directory as their root directory.
How can this be accomplished with Amazon EFS?
A. Amazon EFS Peering
B. AWS IAM
C. Amazon EFS Access Point
D. Amazon EFS Endpoint
C. Amazon EFS Access Points allow you to use an operating system user or group to
access a particular shared directory as their root directory. You can further enforce this
by adding an IAM policy on to the access point.
100
(Storage)
. Your security team has required that data be encrypted while in Amazon S3 and that you
maintain control over the keys at all times. As a SysOps administrator, you don’t want to
implement a client-side encryption library; you want something that will not have a high
degree of administrative effort. What should you choose?
A. SSE-S3
B. SSE-C
C. SSE-KMS
D. Amazon S3 Encryption Client
B. SSE-C allows you to maintain control over your keys while still allowing Amazon S3
to handle the actual encryption process. This simplifies administration as you don’t need
to implement a client-side encryption library; you can instead leverage the tools provided
by AWS
101
(Storage)
Your security team has required that data be encrypted while in Amazon S3 and that you
maintain control of the keys. You want to reduce the overhead of encryption on the server
side, so you would like to use a client-side encryption library. What should you choose?
A. SSE-S3
B. SSE-C
C. SSE-KMS
D. Amazon S3 Encryption Client
D. The Amazon S3 Encryption client allows you to maintain control of your keys and
take advantage of client-side encryption libraries.
102
(Storage)
. Your security team has requested that you choose controls to provide a greater deal of
protection than you have currently through Amazon CloudFront. What protection do you
have by default in your AWS account?
A. AWS Shield Standard
B. AWS Shield Advanced
C. AWS WAF
D. Amazon GuardDuty
A. By default, you have access to AWS Shield Standard. You can pay to upgrade to AWS
Shield Advanced if desired. AWS Shield provides protection from DDoS attacks.
103
(Storage)
You want to ensure that people trying to access your website get access through Amazon
CloudFront, but you want to ensure that they can type the web address that you have
advertised. What is the best way to accommodate this need?
A. Set up an A record for the domain name.
B. Set up a PTR record for the IP address of CloudFront.
C. Set up a CNAME record for your domain name.
D. Set up an ALIAS record for your domain name.
C. You should set up an CNAME record with your domain name and point it to the
CloudFront distribution address
104
(Storage)
You have an S3 bucket that has sensitive information in it that should not change. You
want to be notified anytime there is a potential change to the data. Which of these is not a
method that will work for sending notifications when events like this occur?
A. Amazon SNS
B. Amazon SQS
C. AWS Lambda
D. Amazon CloudWatch
D. Amazon S3 notifications can be tied into Amazon SNS, Amazon SQS, or AWS
Lambda. Amazon CloudWatch does not have the same level of integration into S3 that the
other three do.
105
(Storage)
D. Amazon S3 notifications can be tied into Amazon SNS, Amazon SQS, or AWS
Lambda. Amazon CloudWatch does not have the same level of integration into S3 that the
other three do.
C. Amazon S3 doesn’t put a limit on file size, but Amazon CloudFront has a limit for
single files, which is 20 GB. That would explain why you can upload the file to Amazon
S3 with no issue and why it is not being delivered by Amazon CloudFront.
106
(Storage)
You are just starting to work with AWS Snowball. You have ordered the 80 TB unit and
you need to start transferring data to it. What do you need to do first to prepare the
source host for data transfer?
A. Install the file server role on the source host.
B. Install the AWS Snowball client.
C. Compress the directories that you want to move.
D. Deduplicate the files on the source host.
. B. To prepare your source host to transfer data to the AWS Snowball device, you will
need to install the AWS Snowball client. This handles the encryption and compression of
the data as well as the transfer to the AWS Snowball device
107
(Storage)
You have decided to use AWS Snowball to do the initial transfer of data to AWS from your
on-premises datacenter. Your security team wants assurances that the data on the AWS
Snowball device is secure. What should you tell them?
A. AWS Snowball data is not encrypted but is password protected.
B. AWS Snowball data is encrypted with a key stored on the AWS Snowball device.
C. AWS Snowball data is encrypted with a key stored in AWS KMS.
D. AWS Snowball data is encrypted with a key stored in AWS Certificate Manager
C. AWS Snowball data is encrypted with a key stored in AWS KMS.
The best answer to give them is that the data on the AWS Snowball device is encrypted
with an AES-256 bit key and that the private key is not stored on the AWS Snowball
device, it is managed by AWS KMS.
108
(Storage)
```
Which of these is not needed for AWS Snowball setup?
A. AWS Snowball client unlock code
B. Job manifest file
C. AWS Snowball client
D. Job manifest unlock code
```
A. To set up AWS Snowball, you need the AWS Snowball client as well as the job manifest
file and the job manifest unlock code. There is no unlock code for the AWS Snowball
client.
109
(Storage)
. You need to protect the data that is stored in your Amazon EFS implementation. Which
of the following are methods that will allow you to safeguard the Amazon EFS data?
(Choose two.)
A. Enabling lifecycle management
B. AWS Backup Service
C. EFS-to-EFS backup solution
D. EFS-to-S3 backup solution
B, C. To safeguard your data in Amazon EFS, you can use the AWS Backup Service or
the EFS-to-EFS backup solution. Enabling lifecycle management doesn’t safeguard data; it
simply helps reduce cost. EFS-to-S3 backup doesn’t exist.
110
(Storage)
How do you protect your data in Amazon EFS when it is at rest?
A. Use AWS KMS.
B. Use Certificate Manager.
C. Password protect your data.
D. You don’t need to do anything; your data is automatically encrypted.
A. Data at rest in Amazon EFS is protected by AWS KMS if you create the filesystem to
use encryption.
111
(Storage)
How do you protect your data in Amazon EFS when it is in transit?
A. Use AWS KMS.
B. Use Certificate Manager.
C. Password protect your data.
D. You don’t need to do anything; your data is automatically encrypted
D. Data in transit from and to Amazon EFS is automatically encrypted, and the keys are
managed by Amazon EFS.
112
(Storage)
You have enabled encryption on a new Amazon EFS filesystem. Your users are
complaining that they can’t access anything on Amazon EFS. What is a likely cause?
A. Their computers don’t support encryption.
B. Encryption wasn’t enabled properly on Amazon EFS.
C. Your users don’t understand how to decrypt data.
D. The CMK is not in an enabled state.
D. The customer master key (CMK) must be in an enabled state or the users will not have
access to the contents of the filesystem. The process is seamless to users; they don’t need
to know how to decrypt data
113
(Storage)
You want to enable the automatic rotation of your CMK. Your security team requires that
it be rotated at least once every 365 days. Will the automatic key rotation feature in AWS
KMS meet the security team’s requirement?
A. No, key rotation automatically happens every 720 days.
B. Yes, key rotation automatically happens every 90 days.
C. Yes, key rotation automatically happens every 180 days.
D. Yes, key rotation automatically happens every 365 days.
D. From the moment the automatic rotation of keys is enabled, the key will be rotated
every 365 days.
114
(Security)
You have an S3 bucket with versioning disabled. You want to allow a particular IAM user
to delete files in the bucket only for the next 30 days. You’ve decided to create an IAM
customer managed policy to achieve this. Which of the following actions should you add
to the policy?
A. s3:DeleteObject
B. s3:DeleteObjectVersion
C. s3:PutObject
D. s3:RemoveObject
B. The action s3:DeleteObjectVersion deletes a file, regardless of whether versioning
is enabled. s3:PutObject creates a file. s3:DeleteObject and s3:RemoveObject aren’t
valid actions.
115
(Security)
You want to allow anonymous users to download files from an S3 bucket only until
January 1, 2021. You’ve decided to use a bucket policy to achieve this. Which of the
following values should you put in the condition element of the policy?
A. {"DateBefore": {"aws:epochTime": "2021-01-01T00:00:00Z"}}
B. {"DateLessThan": {"aws:epochTime": "2021-01-01T00:00:00Z"}}
C. {"DateBefore": {"aws:CurrentTime": "2021-01-01T00:00:00Z"}}
D. {"DateLessThan": {"aws:CurrentTime": "2021-01-01T00:00:00Z"}}
D. The condition operator DateLessThan returns true if the date and time at policy
evaluation precedes the date and time specified in the key’s value. In this case, the value
is 2021-01-01T00:00:00Z, which is the ISO 8601 representation of January 1, 2021 at
0:00 Universal Coordinated Time (UTC). The aws:CurrentTime key requires the time
to be specified in ISO 8601 format.
DateBefore is not a valid condition operator
The
aws:epochTime key requires the time to be specified in Unix epoch time.
116
(Security)
```
Which of the following elements is not required in a resource-based policy?
A. Principal
B. Action
C. Condition
D. Effect
```
C. The Condition element is not required in a resource-based policy. The other elements
are required.
117
(Security)
Which of the following methods can you use to create a customer managed IAM policy?
(Choose three.)
A. Import an AWS managed policy.
B. Use the AWS CLI to import a JSON policy document.
C. Use the Visual editor in the AWS Management Console.
D. Import a JSON policy document from an S3 bucket.
E. Create an IAM user and copy the user’s default policy to a new policy.
- Import an AWS managed policy.
- Use the AWS CLI to import a JSON policy document.
- Use the Visual editor in the AWS Management Console.
A, B, C. To create a new IAM policy, you can import it from an AWS managed policy,
import an existing policy document using either the AWS CLI or the AWS Management
Console, or use the Visual editor to create a policy from scratch. You can’t import a policy
document from an S3 bucket. When you create an IAM user, it has no default policy
attached
118
(Security)
You’ve created a new network access control list (NACL) and added a rule to allow
inbound SSH access to a public subnet hosting some EC2 instances, but you’re unable to
SSH to these instances. You’ve verified that you have the correct SSH key pair, that the
SSH service is running on each instance, and that each instance’s security group has an
inbound rule permitting SSH from your public IP address. What should you do to resolve
the issue?
A. Add an outbound security group rule allowing SSH traffic.
B. Add an outbound security group rule allowing all traffic.
C. Add an outbound network access control list rule allowing SSH traffic.
D. Add an outbound network access control list rule allowing all traffic.
D. NACLs are stateless and require an outbound rule to explicitly allow return traffic on
an ephemeral port. Because the ephemeral port range varies by operating system, creating
an outbound NACL rule allowing all traffic is sufficient. Security groups are stateful and
thus don’t require an explicit outbound rule to permit return traffic.
119
(Security)
You’re developing a web application that will allow users to upload pictures. The
application will run on EC2 instances. Which of the following AWS services will most
securely let users upload pictures to an S3 bucket in your account?
A. Directory Service
B. Instance profiles
C. Cognito
D. Security Ticket Service
C. Cognito allows you to grant application users temporary access to services in your
AWS account.
120
(Security)
```
Which of the following does the Security Token Service provide? (Choose two.)
A. Secret access key
B. Short-term credentials
C. Long-term credentials
D. An encrypted access key ID
```
A, B. STS provides short-term credentials consisting of an unencrypted access key ID, a
secret access key, and a token.
121
(Security)
How many managed policies can be attached to an IAM principal?
```
A. 3
B. 5
C. 10
D. 20
E. 50
```
C. You can attach up to 10 managed policies to an IAM principal.
122
(Security)
```
What’s the maximum session duration for an IAM role?
A. 15 minutes
B. 1 hour
C. 12 hours
D. 24 hours
```
C. The maximum session duration for a role is 12 hours. The minimum can be as little as
15 minutes.
123
(Security)
```
What’s the default credential lifetime for an IAM role?
A. 15 minutes
B. 1 hour
C. 12 hours
D. 24 hours
```
B. The default credential lifetime for an IAM role is 1 hour.
124
(Security)
Every IAM user in your AWS account has a “department” resource tag with a value
that corresponds to their department. You need to grant users different levels of access
according to their department. How can you do this with the least amount of effort?
(Choose two.)
A. Create a group for each department.
B. Create an inline policy for each group.
C. Create a single managed policy.
D. Use the Condition policy element to grant access according to the department tag.
C, D. Because users already have department tags, the easiest way to grant them access
according to their tags is to create a single managed policy and use the Condition policy
element. For example, including the following element under a policy statement would
apply the permissions in the statement only to those with a department tag with a value
of marketing:
"Condition":{"StringEquals": {"aws:ResourceTag/department": "marketing"}}
125
(Security)
During the process of launching an Amazon Linux 2 EC2 instance, you fail to download
the SSH key pair. Which of the following could you do next? (Choose two.)
A. Terminate the instance and launch a new one.
B. Log in to the instance using SSM Session Manager.
C. RDP into the instance.
D. Import an existing SSH key pair into the instance
A, B. Terminating the instance and launching a new one is a valid next step. Logging into
the instance using SSM Session Manager is also a possibility. Importing an existing SSH
key pair into the instance is an option only after you’ve gained access to the instance. You
can’t RDP into an Amazon Linux 2 instanc
126
(Security)
Who is responsible for protecting the contents of a KMS master key?
A. Both the customer and AWS
B. AWS only
C. The customer only
D. Nobody; the master key is intended to be public.
B. Because KMS generates and stores the contents of the master key and doesn’t allow
customers to ever see it, AWS is solely responsible for protecting it from release.
127
(Security)
You’ve just scheduled a KMS customer master key for deletion in 30 days. Which of the
following is true? (Choose two.)
A. Once the key is deleted, any data encrypted with it will be permanently lost.
B. You can’t use the key during the 30-day waiting period.
C. You can’t cancel the scheduled deletion.
D. KMS won’t delete the key if any AWS services are using it.
A, B. Once you schedule a key deletion you can’t use the key during the waiting period.
And once the key is deleted, any data encrypted using it will be permanently lost. KMS
doesn’t prevent the deletion just because an AWS service is using the key. You can cancel a
scheduled deletion.
128
(Security)
Your organization requires that all KMS customer master keys be rotated annually. Some
of the keys are imported, while others are generated by KMS. Several custom applications
use these keys to encrypt data. Which of the following can help ease the burden of meeting
the requirement? (Choose two.)
A. Enable automatic key rotation.
B. Use key aliases for imported keys.
C. Perform manual key rotation for all keys.
D. Set an expiration period on imported keys.
A, B. Enabling automatic key rotation will cause KMS to annually rotate the keys that it
generated.
You must manually rotate imported keys, which entails creating new ones and
updating the applications to point to them.
Aliases make this process easier. Instead of
updating the application to reference the key by its ARN or key ID, you reference the key
by its alias. You then update the key’s alias to point to the new key’s ID.
129
(Security)
You’ve disabled a customer master key in KMS. Which of the following is true?
A. The data key is deleted when the customer master key is disabled.
B. The key can’t be rotated automatically.
C. The key can’t be rotated manually.
D. The key can’t be deleted.
B. A disabled key can’t be rotated automatically. Manually rotating a key requires
creating a new key and using it in place of the original one, and disabling the original key
has no effect on this process. A disabled key can be deleted. Disabling a customer master
key doesn’t delete any data key
130
(Security)
```
What is the monthly service-level agreement for CloudHSM?
A. 99.0 percent
B. 99.5 percent
C. 99.95 percent
D. 99.99 percent
```
C. 99.95 percent
131
(Security)
Last year you generated a public, email-validated certificate using Amazon Certificate
Manager. The certificate expires in 60 days. Which of the following will ensure the
certificate is automatically renewed indefinitely? (Choose two.)
A. Associate the certificate with an application load balancer.
B. Revalidate domain ownership using email validation.
C. Revalidate domain ownership using DNS validation.
D. Manually renew the certificate.
A, C. ACM will automatically renew a public certificate if two conditions are met:
First, the certificate must be associated with an AWS service such as an application load
balancer. Second, ACM must be able to validate domain ownership using email or DNS
validation. Email validation is only good for 825 days, but DNS validation will remain
valid as long as the appropriate records exist in the domain’s DNS.
132
(Security)
You’re using a TLS certificate generated by Amazon Certificate Manager to encrypt data
in-transit between users and an elastic load balancer that terminates HTTPS connections.
Which of the following is required to re-create this configuration in another AWS region?
A. Create a network load balancer in the other AWS region.
B. Configure cross-region load balancing in the elastic load balancer.
C. Use the existing certificate in the other region.
D. Create a new TLS certificate in the other region
D. Because ACM is a regional service, you’d have to create a new certificate in the other
region
133
(Security)
You’ve created a customer master key in KMS and configured S3-KMS bucket encryption
using the key. You then granted a user full access to KMS and S3 using an IAM identitybased permissions policy. The user, however, is unable to view any objects in the bucket.
Which of the following could be misconfigured? (Choose three.)
A. The user’s IAM permissions boundaries
B. The bucket policy
C. The object policy
D. The user’s IAM permissions policy
E. The key policy
A, B, E. There are three possible causes:
First, the user may have IAM permissions
boundaries set that prevent access to KMS or S3.
Second, the S3 bucket policy may not
grant the user access to any objects in the bucket.
Finally, the key policy may not allow
the user to use the key.
There’s no such thing as an object policy. The settings in the user’s
IAM policy permissions are correct according to the question.
134
(Security)
```
Which of the following KMS customer master key (CMK) types is used by multiple AWS
customers?
A. Customer managed CMK
B. AWS owned CMK
C. AWS managed CMK
D. Data CMK
```
B. AWS owned CMKs are used by multiple AWS customers. AWS managed CMKs and
customer managed CMKs are for use by only one customer. There’s no such thing as a
data CMK.
135
(Security)
```
How many customer master keys can be stored in KMS per region?
A. 10
B. 100
C. 1000
D. 10,000
E. 100,000
```
10,000
136
(Security)
You need to review which EC2 instances have used a particular key stored in a custom
KMS store. Where will you find this information?
```
A. CloudWatch Events
B. CloudTrail logs
C. CloudHSM logs
D. VPC Flow Logs
E. CloudTrail metrics
```
B. Usage of KMS keys, whether they’re in a custom store or the default key store, are
tracked in CloudTrail logs.
137
(Security)
Which of the following will provide high availability for keys stored in a CloudHSM
cluster? (Choose two.)
A. The use of a custom KMS key store
B. The use of multiple availability zones
C. The use of multiple regions
D. The use of duplicate keys
A, B.
KMS custom key stores use CloudHSM in different availability zones.
Alternatively,
you could create your own CloudHSM cluster in multiple availability zones.
Using
multiple regions wouldn’t provide redundancy for keys since keys are specific to a region.
Storing duplicate keys wouldn’t necessarily provide high availability if the keys are stored
in a CloudHSM cluster in just one availability zone.
138
(Security)
You’ve configured the AWS CLI with the credentials of root user. Which of the following
is true regarding this configuration?
A. Your CLI session is limited to one hour.
B. You can’t assume an IAM role while operating as root.
C. You won’t have access to certain AWS services.
D. The root user credentials can’t be used with the CLI.
B. You can’t assume an IAM role while operating as the root user. You must use an IAM
user instead. There is no CLI session limit, the root user credentials can be used with the
CLI, and the root user has full access to all AWS services.
139
(Security)
Does an IAM trust policy require specifying a principal? Why or why not? (Choose two.)
A. A trust policy does not require specifying a principal.
B. It’s an identity-based policy.
C. It’s a resource-based policy.
D. A trust policy does require specifying a principal
C, D. A trust policy is a resource-based policy and therefore does require specifying a
principal.
140
(Security)
Which of the following is true of an IAM trust policy?
A. The principal must be in the same account as the owner of the trust policy.
B. The principal can’t be a wildcard.
C. The principal can’t be an AWS service.
D. The effect in a trust policy statement must always be Allow.
B. The principal can’t be a wildcard in a trust policy. It can be an AWS service or a
principal in the same account or another account. The effect in a trust policy statement
can be Allow or Deny
141
(Security)
Which of the following tasks may require logging in as the root user?
A. Viewing the canonical user ID
B. Deleting an IAM user
C. Sending mass email from an EC2 instance
D. Assuming an IAM role that has unrestricted access to all AWS resources
C. EC2 throttles outbound traffic on TCP port 25, the port commonly used for the
Simple Mail Transfer Protocol (SMTP). Only the root user can make a request to have this
throttle removed
142
(Security)
A custom application uses a DynamoDB table to store data. You want to encrypt only
particular attributes in the table while leaving the rest unencrypted. How can you achieve
this with the least effort?
A. Have the application encrypt only the attributes that need to be encrypted.
B. Enable DynamoDB server-side encryption for the table.
C. Enable DynamoDB KMS encryption for the table.
D. Enable DynamoDB server-side encryption for only the attributes that need to be
encrypted.
E. Enable DynamoDB KMS encryption for only the attributes that need to be encrypted.
A. DynamoDB server-side and KMS encryption encrypts the entire table. If you want to
encrypt only a subset of the table, such encryption must take place outside of DynamoDB.
143
(Security)
Which of the following is an advantage of resource-based policies over identity-based
policies?
A. Resource-based policies are more restrictive.
B. Resource-based policies restrict the access of users who don’t have an AWS account.
C. Resource-based policies can restrict the permissions of the root user.
D. Resource-based policies replace identity-based policies for some services.
B. Because resource-based policies apply to a resource, they can restrict the access of
users who don’t have an AWS account, such as anonymous users. Resource-based policies
are not necessarily more restrictive, they can’t be used to restrict the root user, and they
don’t replace identity-based policies.
144
(Security)
You’re working with a third-party vendor that wants to grant you read and write access to
an S3 bucket in their AWS account. You plan to store your EBS snapshots in this bucket.
The vendor has asked for your AWS account ID so they can add it to the bucket policy, but
you’re apprehensive about giving it. What’s the most secure alternative?
A. Ask the vendor to use an IAM permissions policy instead of a bucket policy.
B. Ask the vendor to create an IAM user with access to the bucket.
C. Provide your canonical user ID.
D. Create an IAM role and provide them with its ARN.
C. The canonical user ID is a 64-character string that can be used to identify an AWS
account in an S3 bucket policy.
Creating an IAM role and providing the ARN would
permit the vendor to grant that role access, but they’d still need either your AWS account
number or canonical user ID.
145
(Security)
Which version of AWS Signature do all regions support for S3?
A. Signature version 1
B. Signature version 2
C. Signature version 3
D. Signature version 4
D. All regions support Signature version 4.
146
(Security)
When using AWS Signature version 4, which of the following keys is used to sign a request
to S3?
A. Public key
B. Signing key
C. Secret access key
D. Policy key
B. The signing key is used to sign requests. The secret access key is used to create a
signing key, which is valid for up to 7 days.
147
(Security)
Which of the following AWS CLI commands will list the AWS canonical user ID?
A. aws iam list-users
B. aws iam list-account-aliases
C. aws s3 list-buckets
D. aws s3api list-buckets
D. The command aws s3api list-buckets is the only one that will list the canonical
user ID
148
(Security)
You plan to use CodeDeploy to deploy an application to EC2 instances. Which of the
following permissions do you need to grant in the instances’ IAM profile role?
(Choose two.)
A. codedeploy:*
B. s3:Get*
C. autoscaling:*
D. s3:List*
B, D. CodeDeploy deploys EC2/on-premises applications from an S3 bucket, so the
instances need access to list and get buckets and files from S3.
They don’t need access to
the CodeDeploy or Auto Scaling services.
149
(Security)
Which of the following options can you set in a password policy? (Choose two.)
A. Password expiration
B. Maximum length
C. Require multi-factor authentication (MFA)
D. Require an administrator to reset expired passwords
A, D.
You can set a password policy to enforce password expiration and require an
administrator to reset expired passwords
A policy can’t require MFA or set a maximum
length
150
(Security)
Which of the following is not an option for an IAM password policy?
A. Locking a user out after a number of failed login attempts
B. Requiring the use of lowercase letters
C. Preventing password reuse
D. Preventing users from changing their own passwords
A. IAM doesn’t offer lockout policies that lock out a user after a number of failed login
attempts
151
(Security)
Which of the following is true regarding a Security Token Service (STS) session token
obtained from a regional STS endpoint?
A. It’s valid only in the region from which it was requested.
B. It’s valid in all regions.
C. It’s valid for a longer time than one obtained from the global endpoint.
D. It’s smaller than one obtained from the global endpoint.
B. A token obtained from a regional STS endpoint is valid in all regions.
152
(Security)
Your organization is terminating operations in the us-west-1 (N. California) region. A
colleague has disabled the region, but a month later the organization receives a bill for
EC2 instances running in the region. Which of the following do you need to do to avoid
incurring additional costs from the EC2 instances? (Choose two.)
A. Enable the region.
B. Disable the region.
C. Disable STS in the region.
D. Terminate all EC2 instances in the region
A, D. Once a region is disabled, EC2 instances running in it continue to incur charges.
You can’t make changes to resources in a disabled region.
You need to enable the region
and then terminate the EC2 instances. STS has no bearing on whether the region is
enabled or disabled.
153
(Security)
You want to configure web identity federation for your application running on AWS.
Which of the following services can help you easily define and control user permissions?
A. Security Token Service
B. Cognito
C. OpenID Connect
D. Resource Access Manager
B. Cognito can create IAM roles to define permissions for users. STS provides temporary
credentials in exchange for a Cognito token but doesn’t control user permissions. OpenID
Connect is an authentication framework used by some identity providers.
154
(Security)
You want to allow only specific IAM users to be able to change their own passwords.
Other non-administrator users should not be allowed to change their own passwords.
Which of the following two steps are necessary to achieve this? (Choose two.)
A. Create an identity-based policy to grant the specific users permission to perform the
iam:ChangePassword action.
B. Implement a password policy that allows users to change their own passwords.
C. In the policy, specify the resource arn:aws:iam::account-id:user/
${aws:username}.
D. Implement a password policy that requires users to create a random password
A, C. You can grant only specific users access to change their password by creating
and applying an identity-based policy that grants them permission to perform the
iam:ChangePassword action against their own IAM user resource, which is specified by
its ARN in the format arn:aws:iam::account-id:user/${aws:username}. A password
policy allowing users to change their own passwords would apply to all users. It’s not
possible to implement a password policy requiring users to create a random password, and
even if it were, it wouldn’t be necessary for allowing users to change their own passwords
155
(Security)
Several custom Python applications use an AWS SDK to assume a particular IAM role
named AppRole. For only one application, you need to limit the permissions granted by
this role. What’s a secure way to modify the permissions for just this one application?
A. Use a session control policy.
B. Use a managed session policy.
C. Use an IAM permissions boundary.
D. Use an access control policy
B. When assuming a role, you can specify a managed session policy to restrict the
permissions granted to the session.
Access control policies apply only to cross-account
access.
An IAM permissions boundary is an identity-based policy, which in this case
would apply to the role and hence would impact every application that assumes the role.
There’s no such thing as a session control policy.
156
(Security)
You’re creating a policy that allows the TerminateInstances action against all EC2
instances except for one that’s untagged. Which of the following policy elements should
you use?
A. NotAction
B. NotResource
C. NotPrincipal
D. Condition
B. You would need to specify the excepted instance as NotResource. There’s no need to
use the NotAction element. You can’t use Condition to specify an instance. Principal and
NotPrincipal have no effect in an identity-based policy.
157
(Security)
Which of the following Security Token Service (STS) API actions support multi-factor
authentication (MFA)?
A. GetFederationToken
B. AssumeRole
C. AssumeRoleWithWebIdentity
D. AssumeRoleWithSAML
B. AssumeRole and GetSessionToken are the only actions that support MFA.
158
(Networking)
You’re running a web service on EC2 instances in an Auto Scaling group. These instances
are members of an application load balancer target group. How can you ensure an
instance is replaced when the web service fails on it? (Choose two.)
A. Configure the Auto Scaling group to use an EC2 health check.
B. Configure a UDP health check to monitor the web service.
C. Configure an ELB health check to monitor the web service.
D. Configure the Auto Scaling group to use an ELB health check.
4. C, D.
Configuring ELB health checks to monitor the web service and then using that
health check in the Auto Scaling group will ensure that any instance on which the web
service fails will be replaced.
Using an EC2 health check will only look at the system
status and instance status, but not the status of the web service. There is no UDP health
check.
159
(Networking)
You’re running a web service on an EC2 instance. You want Route 53 to return the public
IP address of the instance even if the web service on the instance is unhealthy. How can
you achieve this? (Choose two.)
A. Create a simple basic resource record.
B. Create a simple alias resource record.
C. Create a simple basic resource record that uses a health check.
D. Create a multivalue answer resource record.
A, D.
A simple basic resource record or a multivalue answer resource record without
a health check will always return the public IP address of the instance.
A simple alias
resource record can’t point directly to an instance.
A simple resource record doesn’t use
health checks.
160
(Networking)
Your organization is running servers on-premises using the IP address range 192.168.10.0/24.
The servers have Internet access. Your organization is merging with another company that
runs EC2 instances in a public subnet that uses the same IP address range. Which of the
following will, with the least effort, enable the on-premises servers to communicate with the
EC2 instances using standard HTTPS communication? (Choose two.)
A. Implement a VPN.
B. Assign a public or elastic IP address to each instance.
C. Implement one-to-one NAT.
D. Create a security group rule to allow inbound access on TCP port 443 from the
on-premises servers.
B, D.
Simply giving the instances a public IP address and permitting inbound HTTPS
access is sufficient and requires minimal effort. Using a VPN is a possibility but would
require implementing NAT to overcome the IP addressing conflicts and would entail a lot
more effort.
161
(Networking)
Which of the following is true of an elastic network interface (ENI)?
A. It must have only one primary private IP address.
B. It can be associated with only one elastic IP address.
C. It can have multiple private IP addresses from different subnets.
D. It must be attached to an instance
A. An elastic network interface must have only one primary private IP address.
It can
have a secondary private IP address, but it must be from the same subnet as the primary.
An ENI can be associated with multiple elastic IP addresses.
It doesn’t have to be attached
to an instance but can be created separately.
162
(Networking)
You’re running a distributed application on EC2 instances in a VPC with a CIDR of
172.31.0.0/24. You’re running out of private IP addresses and need to allocate more for
additional instances. The instances must be able to communicate with each other using
their private addresses. How can you allocate more IP addresses with the least amount of
effort?
A. Change the VPC CIDR to 172.31.0.0/16.
B. Add a secondary CIDR of 172.31.1.0/24.
C. Add a secondary CIDR of 172.31.0.0/16.
D. Create a new VPC.
B. Adding a secondary VPC CIDR of 172.31.1.0/24 is the easiest option. You can’t add
a secondary CIDR that overlaps with the existing CIDR as 172.31.0.0/16 does. You also
can’t change the VPC CIDR. Creating a new VPC for the additional application instances
is possible but would require more effort than just adding a secondary CIDR.
163
(Networking)
Which of the following is an advantage of using Direct Connect instead of a VPN
connection?
A. Reduced cost
B. Data encryption
C. Higher bandwidth
D. Predictable latency
D. A Direct Connect link to AWS provides consistent latency. It doesn’t necessarily
provide higher bandwidth or reduced cost over an Internet VPN connection. Direct
Connect doesn’t provide data encryption.
164
(Networking)
Servers in your datacenter are using a 10 Gbps Internet connection to connect to S3 using
a public endpoint. Which of the following can improve the security of this configuration?
A. Use HTTPS to connect to the S3 endpoint.
B. Use Direct Connect.
C. Use a VPN connection.
D. Use a VPC endpoint.
B. Direct Connect can improve the security of this configuration by bypassing the public
Internet. All AWS services, including S3, use HTTPS for their public endpoints.
A VPN connection can’t be configured between a remote site and S3.
A VPC endpoint only
connects a VPC to an AWS service via a private network, bypassing the Internet.
165
(Networking)
Which of the following BGP configuration tasks is required to use a Direct Connect public
virtual interface?
A. Advertise at least one public IP prefix.
B. Advertise at least one private IP prefix.
C. Specify a public autonomous system number (ASN).
D. Enable jumbo frames.
A. You must advertise at least one public IP prefix to use a public virtual interface. A
public ASN isn’t required. You can use a public ASN if you have one; otherwise, you can
use a private ASN between 64512 and 65534. Jumbo frames aren’t supported on public
virtual interfaces, and even if they were, enabling jumbo frames wouldn’t be required.
166
(Networking)
How many VPN connections can you create to a single VPC?
A. 1
B. 5
C. 10
D. 25
C. 10
167
(Networking)
Which of the following is true regarding an IPv6 BGP peering session over a Direct
Connect virtual interface?
A. You can specify your own IPv6 peer addresses.
B. AWS assigns a /125 IPv6 CIDR to use.
C. Direct Connect doesn’t support IPv6 BGP peering.
D. An IPv4 BGP peering session can’t be used alongside an IPv6 BGP peering session.
B. AWS assigns you a /125 IPv6 CIDR that you and AWS must use to set up an IPv6
BGP peering session. You may not specify your own IPv6 addresses. You may also have a
simultaneous IPv4 BGP peering session.
168
(Networking)
How many routes are you allowed to advertise in a BGP session over a Direct Connect
connection over a private virtual interface?
A. 50
B. 100
C. 500
D. 1000
B. 100
169
(Networking)
You’re unable to create a BGP session over a Direct Connect connection. Which of the
following could be the reason?
A. BGP MD5 authentication mismatch
B. Missing community tags
C. Your router doesn’t support multiprotocol BGP (MP-BGP).
D. UDP port 179 is blocked.
A. BGP MD5 authentication settings must match both on the Direct Connect side and
on your router
170
(Networking)
Your EC2 instance in the us-east-1 region has a primary private IP address of
10.9.13.37/20 and a secondary private IP address of 10.8.13.37/20. Which of the following
is the instance’s private hostname?
A. ip-10-9-13-37.ec2.internal
B. ip-10-8-13-37.ec2.internal
C. ip-10-9-13-37.ec2.compute-1.internal
D. ip-10-8-13-37.ec2.us-east-1.internal
A. The private hostname is ip-10-9-13-37.ec2.internal. In the US East 1 region, the
hostname suffix is ec2.internal, while in other regions it follows the format region
.compute.internal.
171
(Networking)
Which of the following VPC attributes determines whether an instance with a public IP
address receives a public DNS hostname?
A. enableDnsSupport
B. enableDnsHostnames
C. enableDnsResolution
D. enableDns
B. If enableDnsHostnames is set to true, then instances with a public IP address will
receive a public DNS hostname. If enableDnsSupport is enabled, the Amazon DNS server
is enabled. The other two options aren’t valid attributes
172
(Networking)
Which of the following VPC attributes determines whether an instance can resolve the
Amazon-provided private hostname of another instance in the same VPC?
A. enableDnsHostnames
B. enableDnsSupport
C. enableDnsResolution
D. enablePrivateDns
B. If enableDnsSupport is set to true, then instances in a VPC can use the Amazon DNS
server to resolve the Amazon-provided private hostname of another instance in the VPC.
If enableDnsHostnames is set to true, then instances with a public IP address will receive
a public DNS hostname.
173
(Networking)
. A subnet has the CIDR 2001:db8:1234:1a00::/64. Which of the following addresses can
you not assign to an instance?
A. 2001:db8:1234:1a00:ffff::
B. 2001:db8:1234:1a00:1:1
C. 2001:db8:1234:1a00::ffff
D. 2001:db8:1234:1a00::
D. The first four addresses and last address of a subnet are reserved and can’t be assigned
to an instance.
174
(Networking)
You’re unable to RDP to a Windows EC2 instance after a reboot. Prior to this you were
able to RDP into it via the Internet. Which of the following actions can help you determine
the cause?
A. Take an instance screen shot.
B. View the system log.
C. View the CloudTrail logs for the instance.
D. View the AWS Config logs for the instance.
A. An instance screen shot of a Windows instance can reveal whether the instance is at
the logon screen (and hopefully ready to accept RDP connections) or at another screen
where it wouldn’t be ready to accept RDP connections, such as the recovery console
screen, the boot manager screen, the Windows update screen, the Getting Ready screen,
the Chkdsk screen, or the Sysprep screen
175
(Networking)
You’re connected to an EC2 instance via SSH when you’re abruptly disconnected. You
attempt to reconnect to the instance’s elastic IP address but are unsuccessful. Which of the
following could explain this?
A. A rule denying outbound TCP port 22 access was added to the instance’s subnet’s
NACL.
B. The outbound rules for the instance’s security group were removed.
C. All outbound rules for the instance’s subnet’s NACL were removed.
D. A rule denying outbound TCP port 22 access was added to the instance’s security
group.
C. Removing all outbound rules for the instance’s subnet’s NACL will stop all outbound
traffic from the instance. Removing security group rules that allow outbound access
or adding an outbound NACL rule denying access to TCP port 22 wouldn’t prevent
an inbound SSH connection or cause it to drop. You can’t add a deny rule to a security
group.
176
(Networking)
When attempting to SSH to an EC2 instance, you get the error that the user key is not
recognized. You try a different SSH client and get a “permission denied” error. Which of
the following could be the reason?
A. Other users have read and write permissions to your private SSH key.
B. There is a security group or NACL blocking SSH access to the instance.
C. You entered the wrong passphrase for the private SSH key.
D. The username you provided is incorrect.
D. The errors indicate that you’re reaching the instance but it doesn’t recognize your
credentials as valid. Entering the wrong passphrase for the private SSH key or using an
SSH key that grants other users or groups read/write permissions will result in the SSH
client not even attempting the connection. This leaves an incorrect username as the only
possible answer.
177
(Networking)
You need to be able to ping an EC2 instance’s elastic IP address. Which of the following
should you add to the inbound security group rules?
A. ICMPv4 Echo Request
B. ICMPv4 Echo Reply
C. ICMPv6 All
D. ICMPv4 Destination Unreachable
A. You need to allow ICMPv4 Echo Requests inbound to the instance. An ICMPv6 Echo
Reply is what the instance would send in response to the ping. Elastic IP addresses are
IPv4 addresses, so there’s no need to add rules for ICMPv6.
178
(Networking)
You attempt to ping an EC2 instance’s public IPv4 address but get no response. Which of
the following could be the reason?
A. An inbound NACL rule denying UDP traffic
B. An inbound NACL rule denying ICMPv4 Echo Replies
C. An outbound NACL rule denying ICMPv4 Echo Requests
D. An outbound NACL rule denying ICMPv4 Echo Replies
D. An outbound NACL rule that denies ICMPv4 Echo Replies would block the response
to the Echo Request.
179
(Networking)
```
Which of the following IP addresses does AWS use for Windows activation?
A. 169.254.169.250
B. 192.168.169.250
C. 169.168.169.254
D. 169.254.0.254
```
```
A. AWS uses the addresses
169.254.169.250,
169.254.169.251,
169.254.169.254 for
Windows activation.
```
180
(Networking)
When trying to add an alternative domain name to a CloudFront distribution, you get an
“InvalidViewerCertificateException” error. Which of the following could be the reason?
A. The certificate specifies an invalid cipher.
B. The domain name is in all lowercase.
C. The custom certificate you’ve provided isn’t signed by a trusted certificate
authority (CA).
D. The attached certificate contains too many domain names.
C. To add an alternative domain name to a distribution you must specify a valid TLS
certificate issued by a trusted CA, and the certificate must contain the alternative domain
name.
181
(Networking)
You’ve created an RTMP distribution for streaming video. Most users are able to watch
the videos, but users at one location aren’t. Which of the following could be the problem?
A. UDP port 1935 is blocked.
B. The video files aren’t served from an HTTP distribution.
C. The media player files are served from the RTMP distribution.
D. TCP port 1935 is blocked.
D. RTMP uses TCP port 1935 by default.
CloudFront RTMP distributions don’t support
RTMFP, which uses UDP port 1935. The fact that some users can view the videos indicates
that the distributions for the media player and video files are configured correctly.
182
(Networking)
Some users are unable to access an RTMP streaming distribution due to TCP port 1935
being blocked. Only TCP ports 80 and 443 are allowed. Which of the following must
occur in order for the users to access the distribution?
A. Convert the RTMP distribution to HTTP.
B. Switch to RTMPT.
C. Convert the RTMP distribution to HTTPS.
D. Add an inbound security group rule to permit access to TCP port 1935.
B. RTMPT tunnels RTMP over TCP port 80. RTMP distributions can’t be converted to
HTTP/HTTPS distributions. CloudFront doesn’t use security groups
183
(Automation)
```
Which of the following does a CloudWatch metric always contain?
A. Timestamp
B. Dimension
C. Unit of measure
D. Namespace
```
A metric contains a timestamp and a value. It may also contain a unit of measure and
dimension. A metric exists within a namespace, which acts as a container for metrics
184
(Automation)
How long does CloudWatch retain metric data points stored at 1-hour resolution?
A. 1 month
B. 63 days
C. 6 months
D. 15 months
D. Data points stored at 1-hour resolution are deleted after 15 months.
185
(Automation)
You need to graph the individual values stored in a CloudWatch metric. The metric is
stored at 1-minute resolution. Which statistic and period should you use?
A. The Sample Count statistic with a 1-minute period
B. The Average statistic with a 5-minute period
C. The Sum statistic with a 5-minute period
D. The Sum statistic with a 1-minute period
D. To graph the exact data points, specify the Sum statistic and set the period equal to the
metric’s resolution, which is 1 minute.
186
(Automation)
You’re storing several large files in an S3 bucket and making them available for public
download. The files are in the Standard storage class. Over time, transfer and storage
costs for the bucket has increased, resulting in an ever-growing AWS bill. Which of the
following can help you reduce these costs without impacting availability or durability?
A. Move the files to the Standard-Infrequent Access (IA) storage class.
B. Enable versioning.
C. Move the files to Glacier.
D. Delete unneeded files from the bucket.
D. Using the Standard storage class for frequently accessed files is ideal. Standard-IA has
a slightly lower availability and a higher cost for GET requests. Moving the files to Glacier
would also negatively impact availability. Enabling versioning wouldn’t reduce costs but
might increase costs. There’s not much else you can do to reduce costs except to delete
unneeded files from the bucket.
187
(Automation)
Users in your organization have been uploading files to an S3 bucket for temporary
storage and driving up the organization’s AWS bill. You deleted the S3 bucket but want to
know as soon as anyone attempts to create another one. Which of the following services
will assist you in this? (Choose two.)
A. S3 server logs
B. CloudTrail
C. CloudWatch Events
D. AWS Config
C, D. AWS Config and CloudWatch Events can monitor S3 for new buckets and alert
you when they’re created or deleted. CloudTrail can log the API events but won’t do any
alerting. S3 server logging won’t log bucket creation events.
188
(Automation)
. Which of the following Relational Database Service (RDS) instance classes offers
dedicated bandwidth for storage volumes?
A. Burst-capable
B. Memory-optimized
C. Standard
D. Network-optimized
B. Memory-optimized instances have dedicated bandwidth for EBS storage
189
(Automation)
```
You’ve configured CloudTrail to log all management events in all regions. How long will
these logs be retained by default?
A. Indefinitely
B. 14 days
C. 15 days
D. 60 days
E. 90 days
```
A. CloudTrail logs can be stored in S3 buckets or CloudWatch Logs. By default, S3
and CloudWatch Logs don’t delete any files or logs automatically. Therefore, any logs
CloudTrail stores will remain indefinit
190
(Automation)
You’re storing CloudTrail logs and application logs in the same CloudWatch log group.
The retention period for the log group is set to 1 year. Going forward, how can you
ensure that the CloudTrail logs are retained for at least 2 years while the application logs
continue to be retained for only 1 year? (Choose two.)
A. Move the application log stream to a different log group.
B. Change the log group retention period to 2 years.
C. Change the log stream retention period to 2 years for the CloudTrail logs.
D. Export the CloudTrail logs to an S3 bucket.
A, B. Retention periods are set per log group. To have separate retention periods for
different log streams, the streams have to be in different log groups. Exporting CloudTrail
logs to an S3 bucket can preserve the existing logs but won’t affect retention moving
for
191
(Automation)
Four hours ago, you configured a CloudWatch alarm to monitor CPU utilization on an
EC2 instance, but today the alarm is in an INSUFFICIENT_DATA state. Which of the
following could explain this? (Choose two.)
A. The instance was restarted.
B. The instance is stopped.
C. The CPU utilization hasn’t crossed the alarm threshold.
D. The alarm period hasn’t elapsed yet
B, D. The instance being stopped would preclude EC2 from sending any CPU utilization
metrics. If the alarm period were set to something greater than 4 hours—such as 6 hours
or a day—then that would also explain the INSUFFICIENT_DATA state.
192
(Automation)
You need to track the size of files in an S3 bucket over time. Which of the following can
you use to get this information with minimal effort?
A. AWS Config
B. CloudTrail
C. S3
D. CloudWatch
D. Using CloudWatch to graph the BucketSizeBytes metric will give you the data with
minimal effort.
193
(Automation)
```
Approximately how many in-flight messages can you have in a standard SQS queue?
A. 1000
B. 20,000
C. 120,000
D. 1,200,000
```
C. 120,000
194
(Automation)
```
Approximately how many in-flight messages can you have in a FIFO SQS queue?
A. 1000
B. 20,000
C. 120,000
D. 1,200,000
```
B. 20,000
195
(Automation)
```
Which of the following costs money to access via the API but is free using its web-based
user interface?
A. Cost and Usage Reports
B. Budgets
C. Cost Explorer
D. Reserved Instance Reports
```
C. You can access the query engine that powers Cost Explorer via the API for a cost of
US$0.01 per request.
196
(Automation)
You’re running a SQL-backed Linux web application on several EC2 instances. Which
of the following will allow you to run the application with minimal changes and at
minimal cost?
A. Lambda
B. Auto Scaling
C. ECS
D. DynamoDB
C. ECS will let you run the application in Docker containers at a lower cost than on EC2
instances.
197
(Automation)
Some files in an S3 bucket are usually accessed once every six months but occasionally
are accessed more frequently. Other files in the bucket are accessed daily. How can you
minimize S3 storage costs while keeping these infrequently accessed files available for
immediate access?
A. Move the files to the S3 Intelligent-Tiering storage class.
B. Move the files to the Standard-Infrequent Access storage class.
C. Create a lifecycle policy to move files older than six months to the StandardInfrequent Access storage class.
D. Enable versioning on the bucket.
B. Standard-IA storage is the lowest cost option. Creating a lifecycle policy to transition
files to Standard-IA will leave a 6-month gap before the files are moved to the lower-cost
storage. Versioning will store more data, increasing costs. S3 Intelligent-Tiering incurs a
monthly monitoring and fee per object.1
198
(Automation)
Your Ruby application needs to run a daily batch job that takes approximately 4 hours.
Which of the following is the lowest cost option?
A. Instance reservation
B. Scheduled Spot Instance request
C. Persistent Spot Instance request
D. One-time Spot Instance request
B. A scheduled Spot Instance request can automatically generate a Spot Instance request
daily for a specified duration, such as 4 hours.
A persistent Spot Instance request will
create a new Spot Instance request as soon as the instance from the previous request
terminates.
A one-time Spot Instance request will launch an instance only once, not daily.
An instance reservation will cost more than using Spot Instance requests.
199
(Automation)
You have a branch office connected to a VPC via a VPN. You also have a datacenter
connected to the same VPC via Direct Connect. You need to pass traffic between the
branch office and the data center. How can you do this at the lowest cost?
A. Configure a transit gateway.
B. Configure VPN CloudHub to use the VPC for transit.
C. Add a Direct Connect connection to the branch office.
D. Add a private line between the datacenter and branch office.
B. VPN CloudHub allows you to use a VPC for transit between two connected sites.
A transit gateway lets you route traffic between VPCs and a VPN. The other options are
feasible but cost more.
200
(Automation)
What’s the most cost-effective way to enable searching the last 180 days of API calls on a
single account? (Choose two.)
A. S3 Select
B. Streaming CloudTrail logs to CloudWatch Logs
C. Delivering CloudTrail logs to S3
D. CloudTrail event history
E. CloudWatch Logs Insights
A, C. Sending CloudTrail logs to S3 and using S3 Select to search them is cheaper than
using CloudWatch Logs. CloudTrail event history stores only 90 days of events.
201
(Automation)
You need to log every GET request against an S3 bucket in the us-west-1 region. What’s
the most cost-effective way to do this?
A. Create a CloudTrail to log global service events.
B. Create a CloudTrail to log S3 data events.
C. Create a CloudTrail to log S3 management events.
D. Enable S3 server logging.
B. Logging S3 data events using CloudTrail will do the trick.
Enabling S3 server logging
may not log every request. S3 GET requests are data events, not management events. S3 is
not a global service.
202
(Automation)
How much data transfer out does CloudFront offer in the free tier?
A. 1 GB
B. 5 GB
C. 10 GB
D. 50 GB
D. CloudFront offers 50 GB data transfer out for the first year in the free tier.
203
(Automation)
On a regular basis, you manually update an application running on a fleet of EC2
instances. You’re considering automating the update process so that developers can trigger
automatic updates by simply pushing application updates to an S3 bucket. Which of the
following services is most cost-effective for this task? (Choose two.)
A. CodeCommit
B. CodeBuild
C. CodePipeline
D. CodeDeploy
C, D. It’s free to use CodeDeploy to deploy to EC2 instances. You can automate the
process with CodePipeline, which lets you have one free active pipeline per month.
CodeBuild isn’t free. CodeCommit is a Git repository with options under the free tier but
isn’t necessary in this case since the developers will be pushing updates to an S3 bucket.
204
(Automation)
Which of the following is the most cost-effective and automated option for performing a
rolling application upgrade on EC2 instances in an Auto Scaling group?
A. CodeStar
B. CloudFormation
C. CodeDeploy
D. AWS Systems Manager
C. CodeDeploy can perform a rolling application upgrade on one or more instances
at a time. Using CloudFormation to do the upgrade would require doing an all-at-once
switchover.
205
(Automation)
You have an EC2 instance running Amazon Linux in a private subnet. What’s the most
cost-effective way to temporarily connect it to the Internet to download operating system
updates? (Choose two.)
A. Create a NAT gateway.
B. Create an Internet gateway and default route.
C. Assign the instance an elastic IP address.
D. Use AWS Patch Manager
B, C. Creating an Internet gateway and default route and assigning an elastic IP address
is the most cost-effective option. A NAT gateway will incur charges. Using AWS Patch
Manager to download the updates will still require the instance to have Internet access
206
(Automation)
What happens if your maximum Spot price for an instance consistently exceeds the
on-demand price?
A. Your maximum Spot price will be automatically reduced to the on-demand price.
B. The instance will run indefinitely.
C. The instance will terminate or hibernate.
D. This isn’t allowed; Your Spot price can’t exceed the on-demand price
B. If the maximum Spot price you’ve set consistently meets or exceeds the on-demand
price, the instance will run indefinitely
207
(Automation)
You’re running an RDS instance that is running low on memory, resulting in slow read
queries for your application. What’s the most cost-effective and quickest way to resolve
this?
A. Reboot the instance.
B. Use multi-AZ.
C. Upgrade the instance type.
D. Create a read replica.
C. Upgrading the instance type and creating a read replica are comparable options
pricewise but upgrading is much quicker in part because it doesn’t require reconfiguring
the application to use a read replica.
208
(Automation)
What’s the minimum yearly required utilization for a scheduled instance?
A. 416 hours
B. 600 hours
C. 1200 hours
D. 2400 hours
C. The minimum required utilization for a scheduled instance is 1200 hours per year
209
(Automation)
How can you prevent CloudFormation from deleting your entire stack on failure? [Select 2]
A. Set the Rollback on failure radio button to No in the CloudFormation console
B. Use the --enable-termination-protection flag with the AWS CLI
C. Use the --disable-rollback flag with the AWS CLI
D. Set Termination Protection to Enabled in the CloudFormation console
A. Set the Rollback on failure radio button to No in the CloudFormation console
C. Use the --disable-rollback flag with the AWS CLI
210
(Automation)
In an IAM policy, what action does IAM:PassRole relate to? [Select 2]
A. Associating a role with an EC2 instance
B. Passing a role to another AWS account
C. Passing a role to an IAM user
D. Passing a role to an AWS service to assign temporary permissions to the service
B. Passing a role to another AWS account
D. Passing a role to an AWS service to assign temporary permissions to the service
Explanation
The IAM:PassRole allows any affected entity to pass roles to AWS services or Accounts, granting them permission to assume the role. The list of roles able to be passed on by an entity to other services or accounts can be restricted with the Resources element of the IAM policy statement.
211
(Automation)
A company is using AWS CloudFormation to provision a set of AWS resources across multiple regions. The manager noticed that the configuration of the infrastructure is different from its previous state. As the SysOps Administrator of the company, you need to identify the configuration changes in the resources.
Which of the following could help you achieve this requirement?
A. Select the continue update rollback action to return the stack to its previous state.
B. Create a stack with new resources and delete the existing stack.
C. Use the drift detection action.
D. Update the stack by using a new CloudFormation template.
C. Use the drift detection action.
212
(Security)
A financial organization created a CMK with imported key material. The CMK is used to encrypt the data of a Java web application. To meet the strict security compliance requirements, you must rotate the CMK every 6 months.
Which of the following could help you achieve this requirement?
A. In the current CMK, delete the existing key material and import the new key material.
B. Set up a new customer master key with imported key material. Update the key alias or key ID to point to the new customer master key.
C. Enable automatic key rotation.
D. Rotate the keys automatically by using AWS managed CMK.
B. Set up a new customer master key with imported key material. Update the key alias or key ID to point to the new customer master key.
In this scenario, you will need to rotate the CMK manually. When you import key material into a CMK, the CMK is permanently associated with that key material. You can reimport the same key material, but you cannot import different key material into that CMK. Take note that you cannot enable automatic key rotation for a CMK with imported key material but you can manually rotate a CMK with imported key material.
Remember that automatic key rotation is not supported for imported keys, asymmetric keys, or keys generated in an AWS CloudHSM cluster using the AWS KMS custom key store feature. To meet the strict security compliance requirements, you must rotate the keys manually.
213
A SysOps Administrator created an AWS CloudFormation template and attempted to use it for the first time to create a new stack. The stack creation failed with a status of ROLLBACK_COMPLETE. The issues in the template have been resolved and the administrator wishes to continue with the stack deployment.
How can the administrator continue?
Relaunch the template to create a new stack.
Run the execute-change-set command.
Perform an update-stack action on the failed stack
Run a validate-template command.
Relaunch the template to create a new stack.
The ROLLBACK_COMPLETE status indicates the successful removal of one or more stacks after a failed stack creation or after an explicitly canceled stack creation. Any resources that were created during the create stack action are deleted.
This status exists only after a failed stack creation. It signifies that all operations from the partially created stack have been appropriately cleaned up. When in this state, only a delete operation can be performed.
INCORRECT: "Perform an update-stack action on the failed stack" is incorrect. You cannot update a stack in the ROLLBACK_COMPLETE state.
214
A SysOps Administrator has been tasked with deploying a web application on two Amazon EC2 instances behind an Application Load Balancer (ALB). The database layer will also run on two EC2 instances. The deployment must include high availability across Availability Zones (AZs) and public access must be limited as much as possible.
How should this be achieved within an Amazon VPC?
Create a public subnet in each AZ for the ALB, a public subnet in each AZ for the web servers, and a private subnet in each AZ for the database servers.
Create a public subnet in each AZ for the ALB, a private subnet in each AZ for the web servers, and a private subnet in each AZ for the database servers.
Create a public subnet in each AZ for the ALB, a private subnet in each AZ for the web servers, and a private subnet in each AZ for the database servers.
215
An application encrypts data using an AWS KMS customer master key (CMK) with imported key material. The CMK is referenced by an alias in the application code. Company policy mandates that the CMK must be rotated every 6 months
What is the process to rotate the key?
Enable automatic key rotation for the CMK and specify a period of 6 months.
Import new key material into a new CMK, update the key alias to point to the new CMK.
Use an AWS managed CMK with automatic rotation every 6 months. Update the alias.
Delete the current key material and import new material into the existing CMK.
Import new key material into a new CMK, update the key alias to point to the new CMK.
When you import key material into a CMK, the CMK is permanently associated with that key material. You can reimport the same key material, but you cannot import different key material into that CMK. Also, you cannot enable automatic key rotation for a CMK with imported key material. However, you can manually rotate a CMK with imported key material.
216
An application that uses an Amazon ElastiCache Memcached cluster is receiving a larger increase in traffic. A SysOps Administrator needs to use a larger instance type with more memory.
What does the Administrator need to do to implement this change?
Create a new cache cluster with a new node type using the CreateCacheCluster API.
Modify the existing cache cluster using the ModifyCacheCluster API.
Use the CreateReplicationGroup API and specify a new CacheNodeType.
Specify a new CacheNodeType with the ModifyCacheParameterGroup API.
With Amazon ElastiCache Memcached engine you cannot modify the node type. The way to scale up is to create a new cluster and specify the new node type. You can then update the endpoint configuration in your application to point to the new endpoints and then delete the old cache cluster.
CORRECT: "Create a new cache cluster with a new node type using the CreateCacheCluster API " is the correct answer.
217
Which combination of actions should a SysOps Administrator take to meet these requirements? (Select TWO.)
Use AWS KMS to create TLS/SSL certificates.
Use AWS CloudHSM to encrypt the data using a CMK.
Use AWS Certificate Manager to create TLS/SSL certificates.
Configure an AWS VPN between the on-premises data center and AWS.
Use AWS KMS to manage the encryption keys used for data encryption.
An AWS virtual private network (VPN) connection can be configured to encrypt data over the shared, hybrid network connection. This ensures encryption in-transit and if you don’t have a certificate you can create a pre-shared key.
AWS KMS can be used to manage encryption keys that can be used for data encryption. In this case the keys would then be used outside of KMS to actually encrypt the data.
CORRECT: "Configure an AWS VPN between the on-premises data center and AWS" is the correct answer.
CORRECT: "Use AWS KMS to manage the encryption keys used for data encryption" is the correct answer.
218
An application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). One of the EC2 instances in the target group has exceeded the UnhealthyThresholdCount for consecutive health check failures.
What actions will be taken next? (Select TWO.)
A new EC2 instance will be deployed to replace the unhealthy instance.
The EC2 instance will be rebooted by Amazon EC2 Auto Scaling.
The load balancer will continue to perform the health check on the EC2 instance.
The load balancer will take the EC2 instance out of service.
The EC2 instance will be terminated based on the health check failure.
Explanation
If the health checks exceed UnhealthyThresholdCount consecutive failures, the load balancer takes the target out of service. The load balancer continues to send health checks. When the health checks exceed HealthyThresholdCount consecutive successes, the load balancer puts the target back in service.
CORRECT: "The load balancer will continue to perform the health check on the EC2 instance" is the correct answer.
CORRECT: "The load balancer will take the EC2 instance out of service" is also a correct answer.
219
An Amazon EBS gp2 volume is running low on space. How can this be resolved with MINIMAL effort?
Create a snapshot and restore it to a larger gp2 volume.
Create a new, larger volume, and migrate the data.
Change to an io1 volume type and then modify the volume size.
Use the Elastic Volumes feature to modify the volume size.
With Elastic Volumes, you can dynamically modify the size, performance, and volume type of your Amazon EBS volumes without detaching them.
Use the following process when modifying a volume:
(Optional) Before modifying a volume that contains valuable data, it is a best practice to create a snapshot of the volume in case you need to roll back your changes.
Request the volume modification.
Monitor the progress of the volume modification.
If the size of the volume was modified, extend the volume's file system to take advantage of the increased storage capacity.
CORRECT: "Use the Elastic Volumes feature to modify the volume size" is the correct answer.
220
A company manages a fleet of Amazon EC2 instances in a VPC and wishes to remove their public IP addresses to protect them from internet-based threats. Some applications still require access to Amazon S3 buckets. A SysOps Administrator has been tasked with providing continued access to the S3 buckets.
Which solutions can the Administrator recommend? (Select TWO.)
Create a VPC endpoint in the VPC and configure the route tables appropriately.
Deploy a NAT gateway in a public subnet and configure the route tables in the VPC appropriately.
Add an outbound rule in the security groups of the EC2 instances for Amazon S3 using private IP addresses.
Configure the internet gateway to route connections to S3 using private IP addresses.
Set up AWS Direct Connect and configure a virtual interface between the EC2 instances and the S3 buckets.
Amazon S3 is a public service and there are two ways you can connect to it from EC2 instances with only private IP addresses. The first option is to deploy a NAT gateway in a public subnet and configure routes to the NAT gateway in the subnets where the instances are running.
The second option is to create a VPC endpoint of the gateway endpoint type. This VPC endpoint requires that you configure the route tables with an entry pointing to the gateway and will enable access to S3 using only private IP addresses.
CORRECT: "Deploy a NAT gateway in a public subnet and configure the route tables in the VPC appropriately" is the correct answer.
CORRECT: "Create a VPC endpoint in the VPC and configure the route tables appropriately" is also a correct answer.
221
A company has created an Amazon CloudFront distribution in front of an application. The application uses the domain name www.mywebapp.com which is managed using Amazon Route 53. A SysOps Administrator has been asked to configure the application to be accessed using www.mywebapp.com through CloudFront.
What is the MOST cost-effective way to achieve this?
Create a CNAME record in Amazon Route 53 that points to the CloudFront distribution URL.
Create an Alias record in Amazon Route 53 that points to the CloudFront distribution URL.
Create an A record in Amazon Route 53 that points to the public IP address of the web application.
Create an SRV record in Amazon Route 53 that points to the custom domain name A record.
Explanation
The most cost-effective record type to use is an alias record. Route 53 doesn't charge for alias queries to AWS resources and this includes to Amazon CloudFront distributions. You can create an alias record that uses the www.mywebapp.com domain name and points to the Amazon CloudFront distribution. This will enable users to access the distribution using the custom domain name.
CORRECT: "Create an Alias record in Amazon Route 53 that points to the CloudFront distribution URL" is the correct answer.
222
A company uses an AWS Storage Gateway volume gateway. The virtual machine running the storage gateway must be rebooted. What is the correct process for rebooting the VM?
Synchronize the gateway, then reboot the virtual machine.
Reboot the gateway, then reboot the virtual machine.
Stop the gateway, reboot the virtual machine, then restart the gateway.
Stop the virtual machine, restart the gateway, then turn on the virtual machine.
You might need to shutdown or reboot your VM for maintenance, such as when applying a patch to your hypervisor. Before you shutdown the VM, you must first stop the gateway.
- For file gateway, you just shutdown your VM.
- For volume and tape gateways, stop the gateway, reboot the VM, then start the gateway.
CORRECT: "Stop the gateway, reboot the virtual machine, then restart the gateway" is the correct answer.
223
A company needs to track the allocation of Reserved instance discounts in the company’s consolidated bill.
```
Which AWS tool can be used to find this information?
AWS Cost and Usage report
Amazon Inspector
AWS Budgets
AWS Organizations
```
The AWS Cost and Usage Report contains the most comprehensive set of data about your AWS costs and usage, including additional information regarding AWS services, pricing, and reservations. By using the AWS Cost and Usage report, you can gain a wealth of reservation-related insights about the Amazon Resource Name (ARN) for a reservation, the number of reservations, the number of units per reservation, and more. It can help you do the following:
Calculate savings – Each hourly line item of usage contains the discounted rate that was charged, as well as the public On-Demand rate for that usage type at that time. You can quantify your savings by calculating the difference between the public On-Demand rates and the rates you were charged.
Track the allocation of Reserved Instance discounts – Each line item of usage that receives a discount contains information about where the discount came from. This makes it easier to trace which instances are benefitting from specific reservations.
CORRECT: "AWS Cost and Usage report" is the correct answer.
224
A SysOps Administrator has been asked to monitor the costs incurred by each user in an AWS account.
How can a SysOps Administrator collect this information? (Select TWO.)
Analyze the usage with Cost Explorer.
Create user metrics in Amazon CloudWatch.
Use Amazon Inspector to advise on resource costs.
Create a billing alarm in AWS Budgets.
Activate the createdBy tag in the account.
The AWS generated tags createdBy is a tag that AWS defines and applies to supported AWS resources for cost allocation purposes. After the tag is activated, AWS starts applying the tag to resources that are created after the AWS generated tags was activated.
The AWS generated tags is available only in the Billing and Cost Management console and reports, and doesn't appear anywhere else in the AWS console, including the AWS Tag Editor. The createdBy tag does not count towards your tags per resource limit.
CORRECT: "Activate the createdBy tag in the account" is the correct answer.
CORRECT: "Analyze the usage with Cost Explorer" is the correct answer.
225
A SysOps Administrator launched an Amazon EC2 instance and noticed it went from the pending state to the terminated state immediately after starting it. What is a possible cause of this issue?
AWS does not currently have enough available On-Demand capacity to service the request.
The limit on the number of instances that can be launched in the Region has been exceeded.
The root EBS volume is encrypted and the Administrator does not have permissions to access the KMS key for decryption.
The API action for launching the specific instance type has been restricted in the AWS account.
The following are a few reasons why an instance might immediately terminate:
- You've reached your EBS volume limit.
- An EBS snapshot is corrupt.
- The root EBS volume is encrypted and you do not have permissions to access the KMS key for decryption.
- The instance store-backed AMI that you used to launch the instance is missing a required part (an image.part.xx file).
CORRECT: "The root EBS volume is encrypted and the Administrator does not have permissions to access the KMS key for decryption" is the correct answer.
226
A company experienced a security incident and has decided to block public access to HTTP (TCP port 80). All incoming web traffic must use HTTPS (TCP port 443). A SysOps Administrator must provide real-time compliance reporting on security groups in the Amazon VPC.
How can the Administrator provide near real-time compliance reporting?
Use AWS Config to enable the restricted-common-ports rule and add port 80 to the parameters.
Schedule an AWS Lambda function to run hourly to scan and evaluate all security groups and send a report.
Enable AWS Trusted Advisor create a CloudWatch alarm that triggers on Red alerts for the unrestricted ports check
Use Amazon Inspector to evaluate the security groups during scans and send the completed reports.
Explanation
The AWS Config restricted-common-ports check is used to check whether the security groups in use do not allow unrestricted incoming TCP traffic to the specified ports. The rule is COMPLIANT when the IP addresses for inbound TCP connections are restricted to the specified ports. This rule applies only to IPv4.
CORRECT: "Use AWS Config to enable the restricted-common-ports rule and add port 80 to the parameters" is the correct answer
227
A SysOps Administrator has created an Amazon VPC with an IPv6 CIDR block. Amazon EC2 instances in the VPC should be able to connect to IPv6 domains on the internet but connectivity from the internet should be restricted.
What must be configured to enable the required connectivity?
Create an egress-only internet gateway and add a route to the route table pointing to the gateway for the target ::/0
Create an egress-only internet gateway and add a route to the route table pointing to the gateway for the target 0.0.0.0/0
Create an internet gateway and add a route to the route table pointing to the gateway for the target ::/0
Create a NAT gateway and add a route to the route table pointing to the gateway for the target 0.0.0.0/0
An egress-only internet gateway is a horizontally scaled, redundant, and highly available VPC component that allows outbound communication over IPv6 from instances in your VPC to the internet and prevents the internet from initiating an IPv6 connection with your instances.
A route must be added to the route table pointing to the gateway. For IPv6 the target should be configured as ::/0 which is the equivalent of the 0.0.0.0/0 (IPv4) address.
CORRECT: "Create an egress-only internet gateway and add a route to the route table pointing to the gateway for the target ::/0" is the correct answer.
228
A web application runs on several Amazon EC2 instances in an Auto Scaling group across all Availability Zones in the Region. A SysOps Administrator notices that the ASG does not launch new instances during busy periods. The maximum capacity of the ASG has not been reached.
What should the Administrator do to identify the cause of the issue? (Select TWO.)
Use AWS CloudTrail to check the result of RunInstances requests.
Use Amazon Inspector to view performance information.
Monitor limits in AWS Systems Manager.
Check the AWS Personal Health Dashboard for outage events.
Use AWS Trusted Advisor to check if service limits have been reached.
You can use AWS Trusted Advisor’s Service Limit Dashboard to determine whether the service limits for EC2 instances have been reached. This is one possible cause of the issue. Additionally, the Administrator can check CloudTrail logs to view the results of the RunInstances requests. If a permissions issue exists this will be identified.
CORRECT: "Use AWS Trusted Advisor to check if service limits have been reached" is the correct answer.
CORRECT: "Use AWS CloudTrail to check the result of RunInstances requests" is also a correct answer.
229
A group of systems administrators use IAM access keys to manage Amazon EC2 instances using the AWS CLI. The company policy mandates that access keys are automatically disabled after 60 days.
Which solution can be used to automate this process?
Use an AWS Config rule to identify noncompliant keys. Create a custom AWS Systems Manager Automation document for remediation.
Create an Amazon CloudWatch alarm to trigger an AWS Lambda function that disables keys older than 60 days.
Configure Amazon Inspector to provide security best practice recommendations and automatically disable the keys.
Create a script that checks the key age and disables keys older than 60 days. Use a cron job on an Amazon EC2 instance to execute the script.
This solution can be implemented by adding an automatic remediation to the AWS Config access-keys-rotated rule. This AWS Config rule checks whether the active access keys are rotated within the number of days specified in maxAccessKeyAge. The rule is NON_COMPLIANT if the access keys have not been rotated for more than maxAccessKeyAge number of days.
The automatic remediation can be configured to execute an AWS Systems Manager automation document that resolves the IAM user name and then disables and creates new access keys using the API.
CORRECT: "Use an AWS Config rule to identify noncompliant keys. Create a custom AWS Systems Manager Automation document for remediation" is the correct answer.
230
A SysOps Administrator has been tasked with setting up a record set in Amazon Route 53 to point to an Application Load Balancer (ALB). The hosted zone and the ALB are in different accounts.
What is the MOST cost-effective and efficient solution to this requirement?
Create a CNAME record in the hosted zone pointing to an alias record to the Application Load Balancer.
Create an alias record in the hosted zone pointing to the Application Load Balancer.
Create an Application Load Balancer in the same account as the hosted zone and forward connections cross-account to the other ALB.
Create an asynchronous replica of the hosted zone in the account with the Application Load Balancer.
It is possible to create an Alias record that points to a resource in another account. In this case the fully qualified domain name of the ALB must be obtained and then entered when creating the record set. This is the most cost-effective option as you do not pay for Alias records and there is minimal configuration required.
CORRECT: "Create an alias record in the hosted zone pointing to the Application Load Balancer" is the correct answer.
231
A company’s security team requested that all Amazon EBS volumes should be encrypted with a specific AWS KMS customer master key (CMK). A SysOps Administrator is tasked with verifying that the security team’s request has been implemented.
What is the MOST efficient way for the Administrator to verify the correct encryption key is being used?
Create an AWS Lambda function to run on a daily schedule, and have the function run the aws ec2 describe-volumes --filters encrypted command.
Log in to the AWS Management Console on a daily schedule, then filter the list of volumes by encryption status, then export this list.
Use AWS Config to configure the encrypted-volumes managed rule and specify the key ID of the CMK.
Create an AWS Organizations SCP that only allows encrypt API actions that use the specific KMS CMK.
The AWS Config encrypted-volumes rule Checks whether the EBS volumes that are in an attached state are encrypted. If you specify the ID of a KMS key for encryption using the kmsId parameter, the rule checks if the EBS volumes in an attached state are encrypted with that KMS key.
CORRECT: "Use AWS Config to configure the encrypted-volumes managed rule and specify the key ID of the CMK" is the correct answer.
232
A database runs on Amazon Aurora and is experiencing some performance issues. A SysOps Administrator needs to monitor memory utilization and OS level metrics. How can the Administrator access these metrics?
Enable detailed monitoring for the RDS instance to increase metric frequency.
Install the unified CloudWatch agent on the RDS instance to generate the metrics.
Enable enhanced monitoring and view the metrics in the RDS console.
Use Amazon CloudWatch to view the standard metrics for RDS.
Amazon RDS provides metrics in real time for the operating system (OS) that your DB instance runs on. You can view the metrics for your DB instance using the console. Also, you can consume the Enhanced Monitoring JSON output from Amazon CloudWatch Logs in a monitoring system of your choice. You can enable and disable Enhanced Monitoring using the AWS Management Console, AWS CLI, or RDS API.
CORRECT: "Enable enhanced monitoring and view the metrics in the RDS console." is the correct answer.
233
Application Load Balancers handle all these protocols except:
HTTP
HTTPS
TCP
Websockets
TCP
234
Your boss wants to scale your ASG based on the number of requests per minute your application makes to your database.
You politely tell him it's impossible
You create a CloudWatch custom metric and build an alarm on this to scale your ASG
You enable detailed monitoring and use that to scale your ASG
You create a CloudWatch custom metric and build an alarm on this to scale your ASG
The metric "requests per minute" is not an AWS metric, hence it needs to be a custom metric
235
Your application load balancer is hosting 3 target groups with hostnames being users.example.com, api.external.example.com and checkout.example.com. You would like to expose HTTPS traffic for each of these hostnames. How do you configure your ALB SSL certificates to make this work?
Use SNI
Use a wildcard SSL certificate
Use an HTTP to HTTPS redirect rule
Use a security group SSL certificate
SNI (Server Name Indication) is a feature allowing you to expose multiple SSL certs if the client supports it. Read more here: https://aws.amazon.com/blogs/aws/new-application-load-balancer-sni/
236
A media firm is using Convertible Reserved Instance for its web application. To get Reserved Instance cost details, you are currently using Detailed Billing Report, but are planning to migrate to AWS Cost & Usage Report. Senior Management is looking for changes in AWS Cost & Usage report with comparison to Detailed Billing Report. Which of the following is a key differentiator for AWS Cost & Usage Report ?
A.Single file with a fixed list of columns.
B.Multiple files with flexible column structure
C.Single file with flexible column structure
D.Multiple files with fixed list of columns.
B.Multiple files with flexible column structure
Cost & Usage reports can have multiple files which consists of data files for usage, separate file for discounts if any & a manifest file listing data files in a report. Columns in Cost & Usage Reports can be added or removed based upon customer requirements.
237
A large engineering firm has uploaded all its project documents in Amazon S3 Glacier. This 1 PB data needs to be audited by a team of auditors as a part of an annual IT audit. You have been assigned a task to provide this data to auditors who are planning to start working in one week.
Which of the following steps can be used to retrieve this data at lowest cost?
A.Initiate an archive retrieval job specifying archive ID & using Standard retrieval option.
B.Initiate an archive retrieval job specifying archive ID & using Bulk retrieval option.
C.Initiate an archive retrieval job specifying Job ID & using Bulk retrieval option.
D.Initiate an archive retrieval job specifying Job ID & using Standard retrieval option.
B.Initiate an archive retrieval job specifying archive ID & using Bulk retrieval option.
238
You have enabled S3 server access logs on a Production S3 bucket. For security reasons, all S3 buckets in the Production environment are encrypted using SSE-KMS. For logs, Source Bucket is BucketA while the Target bucket is BucketB without any prefix. You need to find out the IP address of the requestor who deleted critical files from S3 buckets. After checking the target bucket, no logs are generated even after 4 hours. What could be a possible reason for logs not getting delivered in a selected bucket?
A. Source & target bucket are on a different bucket.
B. BucketB has SSE-KMS encryption enabled which is not supported.
C. Logs will be delivered in the target bucket only after 24 hours of enabling logs.
D. The prefix in a BucketB needs to be specified while enabling logging.
B. BucketB has SSE-KMS encryption enabled which is not supported.
For logs to be delivered in the target bucket, it should have bucket encryption as SSE-S3 & not as SSE-KMS. While enabling Server access logs, Source & Target bucket can be on the same bucket or different bucket & logs are delivered with few hours after enabling logs
239
A large multinational firm is using a 3-tier application installed on EC2 instance in VPC. They are using Amazon GuardDuty for monitoring malicious activities & traffic patterns hitting web application. Initially, they were using Amazon GuardDuty for a master account in the us-west-1 region which now has been expanded to other member accounts in the same region. One of the member accounts is observing a huge amount of traffic from an IP address accessing the web application. Security lead for this member account is looking for detail activities from this IP address. Which of the following actions will meet this requirement?
A. Request users from the master account to modify the Threat list to include this IP address.
B. Request users from member account to modify the Threat list to include this IP address.
C. Request users from the master account to blacklist this IP address from the Trusted IP list.
D. Request users from member account to blacklist this IP address from the Trusted IP list.
A. Request users from the master account to modify the Threat list to include this IP address.
Amazon GuardDuty can be used to include custom IP addresses for generating findings to detect malicious activities. Amazon GuardDuty maintains two types of list: Trusted IP list & Threat List. Trusted IP List consists of IP address which is whitelisted & Amazon GuardDuty do not generate any findings for this IP address. Threat List consist list of the malicious IP address for which Amazon GuardDuty generates findings.
240
Your company is planning on setting up an AWS account. They would be hosting highly critical revenue generating applications on the AWS platform. They want to purchase the right support plan with AWS. This support plan needs to have operational reviews for the operations department and need to have a response time of 30 mins or less for critical issues. Which of the following support plan would you recommended?
A. Developer
B. Basic
C. Business
D. Enterprise
D. Enterprise
241
An engineering firm has created multiple VPC based upon business verticals with VPC peering connection enabled between these VPC. Sales team is using Amazon EFS in Sales VPC for uploading all Sales orders. Account team requires access to these Sales orders stored in EFS from EC2 instance launched in Accounts VPC & looking for your support to mount EFS. You have created a directory & have got all IAM authorization to mount EFS.
Which of the following is additional required to be done for mounting EFS from another VPC?
A. Enable VPC Transit Gateway between these Sales & Accounts VPC.
B. Create a public hosted zone & resource record set for EFS mount target IP address.
C. Create a private hosted zone & resource record set for EFS mount target IP address.
D. Enable Shared VPC between these Sales & Accounts VPC.
C. Create a private hosted zone & resource record set for EFS mount target IP address.
DNS resolution is not supported while mounting EFS which is accessed over another VPC. To mount an EFS, either an IP address needs to be used or a private hosted zone can be created in Route 53.
242
A financial firm is using AWS services for deploying client banking applications. Web application servers are deployed on various EC2 instances created in multiple AZ’s of the us-east-1 region. Any unplanned configuration changes will be disastrous & will lead to huge financial loss. Operations Director needs to have a notification for configuration changes & a configuration history on all resources for audit purposes. While Security head wants detailed records of user activity to AWS resources for security compliance. As a SysOps administrator which of the following services you will enable to meet this requirement?
A. Enable AWS Config globally to check configuration changes made to EC2 instance & specify S3 bucket to collect AWS CloudTrail logs which will capture user activity.
B. Enable AWS Config in us-east-1 to check configuration changes made to EC2 instance & enable AWS CloudTrail in us-east-1 region specifying S3 bucket to collect AWS CloudTrail logs which will capture user activity.
C. Enable AWS Config in us-east-1 to check configuration changes made to EC2 instance & specify S3 bucket to collect AWS CloudTrail logs which will capture user activity.
D. Enable AWS Config globally to check configuration changes made to EC2 instance & enable AWS CloudTrail in us-east-1 region specifying S3 bucket to collect AWS CloudTrail logs which will capture user activity.
C. Enable AWS Config in us-east-1 to check configuration changes made to EC2 instance & specify S3 bucket to collect AWS CloudTrail logs which will capture user activity.
AWS Config can be enabled per region to track & notify for configuration changes made to AWS resources. AWS CloudTrail which is enabled when an account is created can be used to record API calls made by users to AWS resources. It saves all these activities log in a specified Amazon S3 bucket.
243
You are working for a large pharma organization using AWS for hosting 3 tier web application. They have multiple accounts created across regions based upon operational verticals. For consolidated billing, they are now planning to create AWS Organisations for which they have a Master account created. Which of the following features are associated with a Master Account? (Select Three.)
A. Create an organization & organizational unit.
B. Any Member account can be upgraded to Master Account.
C. Invite an external account to join your organization.
D. Pay all charges accrued by all the accounts in its organization.
E. Pay all charges accrued by all the accounts in its organizational unit.
F. A master account of an organization can be granted permission using service control policies.
A. Create an organization & organizational unit.
C. Invite an external account to join your organization.
D. Pay all charges accrued by all the accounts in its organization.
244
A large e-commerce furniture company is using a Web application supported by Application Load Balancer. ALB invokes a Lambda function based upon query parameter key within HTTP headers in client request. When clients are searching products on this application with size & colour options, they are getting response only on one of the options & not both. Marketing Team is looking for a quick resolution for this error.
Which of the following can be done to resolve this error?
A. Enable HTTP header condition for Target groups with Target as Lambda function.
B. Enable Path based routing for Target groups with Target as Lambda function.
C. Enable Host based routing for Target groups with Target as Lambda function.
D. Enable Multi-Value headers for Target groups with Target as Lambda function.
By default, ALB considers last value within query parameters while invoking Lambda Function. In case of multiple query parameters, Multi-value headers need to be enabled to pass all query parameters values to Lambda function.
245
A start-up firm has created 4 VPC’s – VPC-1, VPC-2, VPC-3 & VPC-4 for deploying its AWS resources. VPC-3 & VPC-4 are used for production environments while VPC-1 & VPC-2 are used for test environments. The Development Team needs to test a new serverless web application using AWS Lambda. IT Head wants you to ensure that Development team users only use VPC-1 & VPC-2 for Lambda functions & no resources are being used from VPC-3 & VPC-4.
Which of the following settings can be configured to meet this requirement?
A.Use IAM Condition keys to specify VPC to be used by Lambda function.
B.Specify VPC ID of VPC-1 & VPC-2 to be used as input parameters to the CreateFunction request.
C.Deny VPC ID of VPC-3 & VPC-4 to be denied as input parameter to the CreateFunction request.
D.Use IAM "aws:SourceVpce" to specify VPC to be used by Lambda function.
AWS Lambda uses Condition keys to specify additional permission controls for Lambda function. Following condition keys are supported in IAM policies,
a. lambda:VpcIds - To allow or deny specific VPC to be used by Lambda functions.
b. lambda: SubnetIds- To allow or deny specific subnet in a VPC to be used by Lambda functions.
c. lambda:SecurityGroupIds- To allow or deny specific security groups to be used by Lambda functions.
246
Your company currently has a set of Images that are placed in an S3 bucket. To give better user experience to users across the world, you have created a CloudFront distribution with the S3 bucket as the origin. But in your monitoring reports, you now see that a lot of users are bypassing the CloudFront URL and directly going to the S3 bucket and downloading the images. Which of the following steps can be performed to remediate this issue. Choose 2 answers from the options given below.
A. Create a Cloudfront origin access identity
B. Create a separate IAM user
C. Ensure that only the Cloudfront origin access identity has access to read objects from the S3 bucket.
D. Ensure that only the IAM user has access to read objects from the S3 bucket.
A. Create a Cloudfront origin access identity
| C. Ensure that only the Cloudfront origin access identity has access to read objects from the S3 bucket.
247
Your company has a set of EC2 Instances in a private subnet (10.0.1.0/24). These EC2 Instances now need to download updates via HTTPS from the Internet. You setup a NAT instance in the public subnet. Which of the following needs to be added as an incoming rule to the Security group for the NAT instance
A. Allow Incoming from Source 0.0.0.0/0 on port 80
B. Allow Incoming from Source 10.0.1.0/24 on port 80
C. Allow Incoming from Source 0.0.0.0/0 on port 443
D. Allow Incoming from Source 10.0.1.0/24 on port 443
D. Allow Incoming from Source 10.0.1.0/24 on port 443
248
You are deploying several Cloudformation templates. Whilst deploying the templates, you are getting the below error.
Sender
Throttling
Rate exceeded
Which of the following can be done to resolve the issue?
A. Add a pause in the Cloudformation templates
B. Add an exponential backoff between the calls to the createStack API
C. Use a large instance from where the cloudformation template is being deployed
D. Combine the stacks into one template and deploy the stack.
B. Add an exponential backoff between the calls to the createStack API
The error is happening because the create stack API is creating too many resources at the same time. You can add some delayed between the requests using a concept called exponential backoff
249
You are running an application in 3 AZ, with an Auto Scaling Group and a Classic Load Balancer. It seems that the traffic is not evenly distributed amongst all the backend EC2 instances, with some AZ being overloaded. Which feature should help distribute the traffic across all the available EC2 instances?
```
Stickiness
Cross Zone Load Balancing
Target Group Routing Rules
HTTPS termination
```
Cross Zone Load Balancing
250
Your Application Load Balancer (ALB) currently is routing to two target groups, each of them is routed to based on hostname rules. You have been tasked with enabling HTTPS traffic for each hostname and have loaded the certificates onto the ALB. Which ALB feature will help it choose the right certificate for your clients?
```
TLS Termination
Server Name Indication (SNI)
SSL Security Policies
Host Header
```
Server Name Indication (SNI)
251
You have provisioned an 8TB gp2 EBS volume and you are running out of IOPS. What is NOT a way to increase performance?
```
Increase the EBS volume size
Mount EBS volumes in RAID 0
Change to an io1 volume type
```
Increase the EBS volume size
EBS IOPS peaks at 16,000 IOPS. or equivalent 5334 GB.
252
Which RDS Classic (not Aurora) feature does not require us to change our SQL connection string?
Read Replicas
Multi AZ
Multi AZ keeps the same connection string regardless of which database is up. Read Replicas imply we need to reference them individually in our application as each read replica will have its own DNS name
253
You have a requirement to use TDE (Transparent Data Encryption) on top of KMS. Which database technology does NOT support TDE on RDS?
```
PostgreSQL
Oracle
MS SQL Server
```
PostgreSQL
254
Which RDS database technology does NOT support IAM authentication?
```
Oracle
PostgreSQL
MySQL
```
Oracle
255
You would like to ensure you have a database available in another region if a disaster happens to your main region. Which database do you recommend?
```
RDS Read Replicas
RDS Multi AZ
Aurora Read Replicas
Aurora Global Database
```
Aurora Global Database
Global Databases allow you to have cross region replication
256
Your company has a production Node.js application that is using RDS MySQL 5.6 as its data backend. A new application programmed in Java will perform some heavy analytics workload to create a dashboard, on a regular hourly basis. You want to the final solution to minimize costs and have minimal disruption on the production application, what should you do?
Enable Multi-AZ for the RDS database and run the analytics workload on the standby database
Create a Read Replica in a different AZ and run the analytics workload on the replica database
Create a Read Replica in a different AZ and run the analytics workload on the source database
Create a Read Replica in the same AZ and run the analytics workload on the replica database
Create a Read Replica in the same AZ and run the analytics workload on the replica database
this will minimize cost because the data won't have to move across AZ
257
You would like to create a disaster recovery strategy for your RDS PostgreSQL database so that in case of a regional outage, a database can be quickly made available for Read and Write workload in another region. The DR database must be highly available. What do you recommend?
Create a Read Replica in the same region and enable multi-AZ on the main database
Create a Read Replica in a different region and enable multi-AZ on the main database
Create a Read Replica in the same region and enable multi-AZ on the read replica
Enable Multi-Region on the main database
| Create a Read Replica in a different region and enable multi-AZ on the main database
258
You are managing a PostgreSQL database and for security reasons, you would like to ensure users are authenticated using short-lived credentials. What do you suggest doing?
Install PostgreSQL on EC2 and install the pg_iam module. Authenticate using IAM username and password
Use PostgreSQL for RDS and install the pg_iam module. Authenticate using IAM username and password
Use PostgreSQL for RDS and authenticate using a token obtained through the RDS service.
Use PostgreSQL for RDS and force SSL connections. Authenticate using SSL certificates that you regularly rotate
Use PostgreSQL for RDS and authenticate using a token obtained through the RDS service.
259
An application is running in production, using an Aurora database as its backend. Your development team would like to run a version of the application in a scaled-down application, but still, be able to perform some heavy workload on a need-basis. Most of the time, the application will be unused. Your CIO has tasked you with helping the team while minimizing costs. What do you suggest?
```
Use an Aurora Global Database
Use an RDS database instead
Use Aurora Serverless
Run Aurora on EC2, and write a script to shut down the EC2 instance at night
```
Use Aurora Serverless
260
A IT Consulting company uses a Redshift cluster in AWS as the data warehouse for its online analytics processing application. As part of their business continuity plan, you were instructed to ensure that the backups of the cluster is always available in the event that the primary region experienced an outage.
How can you accomplish this?
Enable the Cross-Region Replication feature in Amazon Redshift and it will automatically replicate the data to your nominated region.
Establish a VPC peering connection between two VPCs, on different regions, each with a Redshift cluster. Configure an automated data sync between the two clusters.
Configure the Amazon Redshift cluster to automatically copy snapshots of a cluster to another region.
Store the snapshots in an S3 bucket and then enable the Cross-Region Replication feature. Use the snapshots in S3 to create a replica of your cluster in another region.
Configure the Amazon Redshift cluster to automatically copy snapshots of a cluster to another region.
You can configure Amazon Redshift to automatically copy snapshots (automated or manual) for a cluster to another region. When a snapshot is created in the cluster’s primary region, it will be copied to a secondary region; these are known respectively as the source region and destination region.
261
A multinational company has over 10,000 employees around the globe that would be granted access to Amazon S3 for storage of their work-related documents. You are required to set up a solution that incorporates single sign-on feature from your corporate AD or LDAP directory and also restricts access of each individual user to a designated user folder in an S3 bucket.
Which of the following actions should you do to satisfy this requirement with the LEAST amount of effort? (Select TWO.)
Configure an IAM role and an IAM Policy to access the bucket.
Setup up a matching IAM user for all users in your corporate directory that need access to a folder in the S3 bucket.
Manually add a resource tag on each folder in the S3 bucket.
Use 3rd party Single Sign-On solutions such as Atlassian Crowd, OKTA, OneLogin and many others.
Set up a Federation proxy or an Identity provider, and use AWS Security Token Service to generate temporary tokens.
Configure an IAM role and an IAM Policy to access the bucket.
Set up a Federation proxy or an Identity provider, and use AWS Security Token Service to generate temporary tokens.
The question refers to one of the common scenarios for temporary credentials in AWS. Temporary credentials are useful in scenarios that involve identity federation, delegation, cross-account access, and IAM roles. In this example, it is called enterprise identity federation considering that you also need to set up a single sign-on (SSO) capability.
The correct answers are:
- Setup a Federation proxy or an Identity provider
- Setup an AWS Security Token Service to generate temporary tokens
- Configure an IAM role
262
A popular entertainment website, which provides Hollywood events and celebrity news articles, is using a CloudFront web distribution. One of their writers accidentally posted a fake photo which was automatically cached in CloudFront. The photo should be removed immediately even before the cache expires.
What will you do in order to fix this issue? (Select TWO.)
Switch to a CloudFront RTMP distribution to easily remove the photo from the cache.
Use file versioning to serve a different version of the file that has a different name.
Invalidate the file from edge caches.
Use the CloudFront Geo Restriction feature.
Manually remove the photo from the CloudFront servers by using the AWS CLI.
Secure the photo using Field-Level Encryption.
If you need to remove a file from CloudFront edge caches before it expires, you can do one of the following:
- Invalidate the file from edge caches. The next time a viewer requests the file, CloudFront returns to the origin to fetch the latest version of the file.
- Use file versioning to serve a different version of the file that has a different name.
263
In the recently concluded IT audit in your company, it was discovered that the disaster recovery plan in place for your cloud infrastructure does not meet the strict compliance requirements. You have been requested to ensure that when the snapshots of EBS volumes are completed, these will be automatically copied to another region to improve data durability.
How can you achieve this requirement? (Select TWO.)
Set up Lambda functions to copy the snapshots to another region.
Integrate CloudWatch Events with EBS.
Use S3 bucket events to automatically copy the snapshots to another region.
Launch a workflow in SWF that automatically copies the snapshot to another region.
Integrate CloudWatch Events with EBS.
Set up Lambda functions to copy the snapshots to another region.
Amazon EBS emits notifications based on Amazon CloudWatch Events for a variety of snapshot and encryption status changes. With CloudWatch Events, you can establish rules that trigger programmatic actions in response to a change in snapshot or encryption key state. For example, when a snapshot is created, you can trigger an AWS Lambda function to share the completed snapshot with another account or copy it to another region for disaster-recovery purposes.
264
Can you delete a security group, that is still attached to an instance?
You can delete a security group only if there are no instances assigned to it (either running or stopped). You can assign the instances to another security group before you delete the security group (see Changing an instance's security groups). You can't delete a default security group.
265
You need to migrate an EC2 Linux instance with a root EBS volume containing a
database from one Availability Zone (AZ) to another. What would be the right
approach to perform this action?
A. Shut down the instance. Create a new volume in the other AZ. Specify the
EC2 instance's volume as the origin. Start the instance in the new AZ with
the new volume.
B. Create a snapshot of the instance. Use the c2-migrate-volume command
to move the EBS volume to the other AZ. Start an instance from the copied
volume.
C. Shut down the instance. Create an AMI from the instance. Start a new
instance from the AMI in the other AZ.
D. Shut down the instance. Detach the volume. Attach it to any other EC2
instance in the other AZ
C. Shut down the instance. Create an AMI from the instance. Start a new
instance from the AMI in the other AZ.
You need to create an AMI because it is the root volume. The AMI can be deployed into any AZ.
266
You have an application on an EC2 instance that is running in the default VPC.
The application needs to be PCI compliant and needs to be moved to dedicated
hardware. How can this be done in the simplest manner?
A. Create a dedicated VPC and migrate the instance to the new VPC.
B. Use the AWS CLI with ec2-configure-instances and set the
parameter as dedicated=true.
C. Change the properties of the instance and check the box for dedicated
tenancy.
D. Stop the instance, create an AMI, launch a new instance with
tenancy=dedicated, and terminate the old instance.
D. Stop the instance, create an AMI, launch a new instance with
tenancy=dedicated, and terminate the old instance.
267
While automating administration tasks, you have noticed that some AWS
services can deliver fully functional services with a built-in setting. Which of
these would represent such a service? Choose all that apply:
A. Creating daily EBS backups
B. Creating daily RDS backups
C. Creating daily S3 bucket snapshots
D. Creating daily EC2 snapshots
B. Creating daily RDS backups
268
Your e-commerce application requires six servers to run on a daily basis but will
be required to scale up to 18 when sales are on. Your application processes
payments that may take up to 4 minutes to complete once initiated. What types
of instance plan would you recommend to minimize costs while providing high
availability?
A. 9 Reserved Instances and 9 On-Demand Instances
B. 6 Reserved Instances and 12 On-Demand Instances
C. 6 Reserved Instances, and 6 On-Demand Instances, and 6 Spot Instances
D. 3 Reserved Instances, and 3 On-Demand instances, and 12 Spot Instances
B. 6 Reserved Instances and 12 On-Demand Instances
You can't use spot instances as the payments can take up to four
minutes. Spot instances might get terminated with a two-minute
warning, which could mean you would lose transactions.
269
You are migrating your application to AWS. Your on-premises deployment
mode uses Ansible as the configuration management tool. You need to make the
transition as simple as possible and deliver a solution with the least management
overhead. Which deployment option meets these requirements?
A. Create a new stack within OpsWorks for Ansible Automation and import
the Ansible configuration to the layers of the stack.
B. Migrate your application to Elastic Beanstalk.
C. Launch EC2 instances through CloudFormation and then perform
configuration management with your Ansible scripts.
D. Launch and configure an Ansible Server on an EC2 instance and launch
the application via the AWS CLI.
C. Launch EC2 instances through CloudFormation and then perform
configuration management with your Ansible scripts.
There is no service in AWS for Ansible. Simply launch EC2
instances and manage them like you do on-premise servers.
270
You are choosing a schema for the usernames for your organisation. Which
would not be a valid IAM username to choose for the schema?
A. Marko.cloud
B. Marko@cloud
C. Marko=cloud
D. Marko#cloud
D. Marko#cloud
can't be used in IAM usernames.
271
You have an application that requires the lowest latency possible between
instances. You have spun up five instances in a cluster placement group and the
application is working correctly. Now you need to double the size of the group.
You try to deploy another five instances, but you are unable to put them in the
same cluster placement group. How would you fix this?
A. Create an Auto Scaling group for the cluster placement group and set the
desired number of instances to 10.
B. Change the cluster placement group desired size setting to 10.
C. Delete the five instances in the cluster placement group and redeploy with
10 instances.
D. It is not possible to increase the size of a cluster placement group
C. Delete the five instances in the cluster placement group and redeploy with
10 instances.
The number of instances in a placement group can only be defined
at startup time.
272
Your company is using S3 for storage of mission critical, sensitive data. A full
regional EC2 outage in a separate region raised the question of whether the
availability of S3 is enough to comply with the 99.9999% availability you are
required to maintain for your data as per your SLA. Your engineers have come
back from their research with different answers – which one is correct?
A. S3 has an availability of 99.999999999%, which is far better than the SLA.
No action is required.
B. We would need to implement cross-region bucket replication on the
mission-critical data to meet the SLA.
C. S3 has a durability of 99.999999999%. Even if the service is down, the data
will survive, so no action is required. We will meet our 99.9999% SLA.
D. We need to create a static website and serve the bucket contents via
CloudFront. This will be the cheapest solution and will replicate our bucket
across the world via the CloudFront CDN.
B. We would need to implement cross-region bucket replication on the
mission-critical data to meet the SLA.
