Secured Architecture

Question 1

When creating a new security group, which of the following are true? (Choose two.)

A) All inbound traffic is allowed by default.
B) All outbound traffic is allowed by default.
C) Connections that are allowed in must also explicitly be allowed back out.
D) Connections that are allowed in are automatically allowed back out.

Answer 1

B, D. Option A is false, but option B is true. Default security groups prevent all traffic in and allow all traffic out. Options C and D are about whether or not a security group is stateful: whether an incoming connection automatically can get back out. Security groups are stateful, so D is true. If the subject of the question was a NACL, then option C would be true, as NACLs are stateless.

Question 2

You have a government-regulated system that will store a large amount of data on S3 standard. You must encrypt all data and preserve a clear audit trail for traceability and third-party auditing. Security policies dictate that encryption must be consistent across the entire data store. Which of the following encryption approaches would be best?

A) SSE-C
B) SSE-KMS
C) SSE-C
D) Encrypt the data prior to upload to S3 and decrypt the data when returning it to the client.

Answer 2

B. D is not a good answer because relying on encryption outside of S3 does not best address the concerns around consistency. It is generally better to allow AWS to handle encryption in cases where you want to ensure all encryption is the same across a data store. SSE-C, SSE-KMS, and SSE-C all provide this. However, among those three, KMS is the best option for providing clear audit trails.

Question 3

You are creating a bastion host to allow SSH access to a set of EC2 instances in a private subnet within your organization’s VPC. Which of the following should be done as part of configuring the bastion host? (Choose two.)

A) Ensure that the bastion host is exposed directly to the Internet.
B) Place the bastion host within the private subnet.
C) Add a route from the bastion host IP into the private subnet into the subnet’s NACLs.
D) Ensure that the bastion host is within the same security group as the hosts within the private subnet.

Answer 3

A, C. A bastion host is a publicly accessible host that allows traffic to connect to it. Then, an additional connection is made from the bastion host into a private subnet and the hosts within that subnet. Because the bastion must be accessed by public clients, it must be exposed to the Internet (A). If it is within a private subnet (B), it will not be accessible, making that answer incorrect. There also must be an explicit route from the bastion host into the private subnet (C); this is usually within a NACL. Finally, the security of the bastion must be different from the hosts in the private subnet. The bastion host should be hardened significantly as it is public, but also accessible; this is in many ways the opposite of the security requirements of hosts within a private subnet.

Question 4

Which of the following are invalid IAM actions? (Choose two.)

A) Limiting the root account SSH access to all EC2 instances
B) Allowing a user account SSH access to all EC2 instances
C) Removing console access for the root account
D) Removing console access for all non-root user accounts

Answer 4

A, C. AWS sometimes asks questions like this to ensure that you understand that the root account is truly a root account and you cannot restrict that account’s access. Anything that involves removing access for the root account is always invalid.

Question 5

Which of the following statements is true?

A) You should store application keys only in your application’s .aws file.
B) You should never store your application keys on an instance, in an AMI, or anywhere else permanent on the cloud.
C) You should only store application keys in an encrypted AMI.
D) You should only use your application key to log in to the AWS console.

Answer 5

B. This is a “gimme question” that AWS will often ask on exams. You should never store your application keys on an instance, in an AMI, or anywhere else permanent on the cloud—meaning option B is true. Additionally, D makes no sense; application keys are for programmatic access, not console access.

Question 6

Your company is setting up a VPN connection to connect its local network to an AWS VPC. Which of the following components are not necessary for this setup? (Choose two.)

A) A NAT instance
B) A virtual private gateway
C) A private subnet in the AWS VPC
D) A customer gateway

Answer 6

A, C. Site-to-site VPN connections require a virtual private gateway (on the AWS side) and a customer gateway (on the local side). A private subnet is optional, but not required, as is a NAT instance.

Question 7

You have a private subnet in a VPC within AWS. The instances within the subnet are unable to access the Internet. You have created a NAT gateway to solve this problem. What additional steps do you need to perform to allow the instances Internet access? (Choose two.)

A) Ensure that the NAT gateway is in the same subnet as the instances that cannot access the Internet.
B) Add a route in the private subnet to route traffic aimed at 0.0.0.0/0 at the NAT gateway.
C) Add a route in the public subnet to route traffic aimed at 0.0.0.0/0 at the NAT gateway.
D) Ensure that the NAT gateway is in a public subnet.

Answer 7

B, D. There are two pairs of answers here, and you need to choose the correct pair in each case. For private subnet instances, you need a route out to a NAT gateway, and that NAT gateway must be in a public subnet—otherwise, it would not itself be able to provide outbound traffic access to the Internet. That means option D is correct, as is answer B: 0.0.0.0/0 means “traffic with a destination in the Internet at large,” more or less.

Question 8

Which of the following statements regarding NAT instances and NAT gateways are false? (Choose two.)

A) Both NAT instances and NAT gateways are highly available.
B) You must choose the instance type and size when creating a NAT gateway but not when creating a NAT instance.
C) It is your responsibility to patch a NAT instance and AWS’s responsibility to patch a NAT gateway.
D) You assign a security group to a NAT instance but not to a NAT gateway.

Answer 8

A, B. The easiest way to handle this question is by thinking of a NAT gateway as essentially a managed service and a NAT instance as an instance (which you manage) for networking. That helps identify B as false (you never choose instance types and sizes for managed services) and C as true (AWS patches managed services). Further, since AWS manages NAT gateways, they are automatically highly available and do not need you to associate security groups. This means that A is false—NAT instances can be made highly available, but not without your manual intervention—and D is true.

Question 9

Which of the following statements is true?

A) A VPC’s default NACLs allow all inbound and outbound traffic.
B) NACLs are stateful.
C) Security groups are stateless.
D) Traffic allowed into a NACL is automatically allowed back out.

Answer 9

A. Option A is true, and if you know that, this is an easy question. However, it doesn’t seem obvious, as all custom NACLs disallow all inbound and outbound traffic. It is only a VPC’s default NACL that has an “allow all” policy. As for B and C, these are both reversed: NACLs are stateless (allowing independent configuration of inbound and outbound traffic) and security groups are stateful. This also explains why D is false: NACLs are stateless.

Question 10

You have changed the permissions associated with a role, and that role is assigned to an existing running EC2 instance. When will the permissions you updated take effect for the instance?

A) Immediately
B) Within 5 minutes
C) Within 1 hour
D) The next time the EC2 instance is restarted

Answer 10

A. Permission changes to a role now take place immediately and apply to all instances using that role.

Question 11

Which of the following statements is true?

A) When creating a new security group, by default, all traffic is allowed in, including SSH.
B) If you need inbound HTTP and HTTPS access, create a new security group and accept the default settings.
C) You must explicitly allow any inbound traffic into a new security group.
D) Security groups are stateless.

Answer 11

C. If an allow-everything doesn’t set off alarm bells, the reference to SSH should. Security groups, by default, don’t allow any traffic in. They require you to explicitly allow inbound traffic (C); the other options are all false. And security groups are stateful—remember this, as it will come up in almost every single exam.

Question 12

Which of the following statements is not true?

A) When creating a new security group, by default, no inbound traffic is allowed.
B) When creating a new security group, by default, all traffic is allowed out, including SSH.
C) When creating a new security group, by default, all traffic is allowed out, with the exception of SSH.
D) When creating a new security group, inbound HTTPS traffic is not allowed.

Answer 12

C. All outbound traffic is allowed to pass out of a VPC by default, although no inbound traffic is allowed.

Question 13

How would you enable encryption of your EBS volumes?

A) Use the AWS CLI with the aws security command.
B) Take a snapshot of the EBS volume and copy it to an encrypted S3 bucket.
C) Select the encryption option when creating the EBS volume.
D) Encrypt the volume using the encryption tools of the operating system of the EC2 instance that has mounted the EBS volume.

Answer 13

C. EBS volumes can be encrypted when they are created. All other options typically affect snapshots of the volume, but not the volume itself.

Question 14

What types of rules does a security group allow? (Choose two.)

A) Allow rules
B) Prevent rules
C) Deny rules
D) Inbound rules

Answer 14

A, D. Security groups only contain allow rules, not deny rules (and prevent rules are not an actual rule type). Then, you can create both inbound and outbound rules.

Question 15

Which of the following are true about security groups? (Choose two.)

A) You can specify deny rules, but not allow rules.
B) By default, a security group includes an outbound rule that allows all outbound traffic.
C) You can specify specific separate rules for inbound and outbound traffic.
D) Security groups are stateless.

Answer 15

B, C. You specify allow rules for security groups, so A is false. B and C are true: Default security groups allow all outbound traffic, and you specify separate inbound and outbound rules. Finally, security groups are stateful, not stateless, so D is false.

Question 16

Which of the following are not true about security groups? (Choose two.)

A) Allow rules take priority over deny rules.
B) Responses to allowed inbound traffic are allowed to flow back out.
C) You can specify specific separate rules for inbound and outbound traffic.
D) If there are no outbound rules, then all outbound traffic is allowed to flow out.

Answer 16

A, D. A is false, as security groups don’t provide for deny rules. B and C are both true (and therefore are not correct answers). D is false, because without specific outbound rules, nothing is allowed to flow out. (Note that by default, there is an allowance for all outgoing traffic in security groups, although that can be removed.)

Question 17

Which of the following must a security group have when you create it? (Choose two.)

A) At least one inbound rule
B) A name
C) A description
D) At least one outbound rule

Answer 17

B, C. A security group can actually have no inbound or outbound rules, so A and D are not required. A security group does require a name and description, though.

Question 18

Which of the following is a security group associated with?

A) An ELB
B) A network interface
C) An ALB
D) A network access list

Answer 18

B. A security group can be attached to multiple constructs, like an EC2 instance, but is ultimately associated with a network interface, which in turn is attached to individual instances. This is a tough question and probably at the very edge of what the exam might ask.

Question 19

Which of the following are default rules on a default security group, such as the one that comes with the default VPC? (Choose two.)

A) Outbound: 0.0.0.0/0 for all protocols allowed
B) Inbound: 0.0.0.0/0 for all protocols allowed
C) Outbound: ::/0 for all protocols allowed
D) Inbound: ::/0 for all protocols allowed

Answer 19

A, C. The easiest way to work this is to recognize that default security groups never allow broad inbound traffic. That eliminates B and D and leaves rules that allow all outbound traffic for both IPv4 (A) and IPv6 (C).

Question 20

Which of the following are parts of a security group rule? (Choose two.)

A) A protocol
B) A subnet
C) An instance ID
D) A description

Answer 20

A, D. Security group rules have a protocol and a description. They do not have a subnet, although they can have CIDR blocks or single IP addresses. Instances can associate with a security group, but a security group does not itself refer to a specific instance.

Question 21

Which of the following allows you to securely upload data to S3? (Choose two.)

A) HTTP endpoints using HTTP
B) SSL endpoints using HTTPS
C) HTTP endpoints using HTTPS
D) SSL endpoints using HTTP

Answer 21

B, C. They key here is not the endpoint, but the actual protocol used to access the endpoint. In this case, HTTPS is secure, while HTTP is not, so the answers using HTTPS—B and C—are correct.

Question 22

Which of the following describes client-side encryption for S3 bucket data?

A) You encrypt and upload data to S3, managing the encryption process yourself.
B) You encrypt and upload data to S3, allowing AWS to manage the encryption process.
C) You request AWS to encrypt an object before saving it to S3.
D) You encrypt an object, but AWS uploads and decrypts the object.

Answer 22

A. Client-side encryption involves the client (you, in this example) managing the entire encryption and decryption process. AWS only provides storage.

Question 23

Which of the following describes server-side encryption for S3 bucket data?

A) You encrypt and upload data to S3, managing the encryption process yourself.
B) You encrypt and upload data to S3, allowing AWS to manage the encryption process.
C) You request AWS to encrypt an object before saving it to S3.
D) You encrypt an object, but AWS uploads and decrypts the object.

Answer 23

C. With server-side encryption, AWS handles all the object encryption and decryption.

Question 24

Which of the following are valid steps in enabling client-side encryption for S3? (Choose two.)

A) Download the AWS CLI and SSH to your S3 key store.
B) Use a KMS-managed customer master key.
C) Download an AWS SDK for encrypting data on the client side.
D) Turn on bucket encryption for the target S3 buckets.

Answer 24

B, C. For client-side encryption, you’ll need a master key, which can either be a KMS-managed key (option B) or a client-side master key. You’ll also need an SDK for encrypting the client-side data (C).

Question 25

Which of the following is not a way to manage server-side encryption keys for S3? A) SSE-S3 B) SSE-KMS C) SSE-E D) SSE-C

Answer 25

C. You’ll probably simply need to memorize this one. SSE-S3, SSE-KMS, and SSE-C are all valid approaches to S3 encryption; SSE-E is made up.

Question 26

Which of the following encryption key management options is best for ensuring strong audit trails? A) SSE-S3 B) SSE-KMS C) Client-side encryption keys D) SSE-C

Answer 26

B. The word audit should be a trigger for you: always choose KMS when you see a need for strong auditing. SSE-KMS provides a very good audit trail and security, perhaps the best of all these options for most use cases.

Question 27

Which of the following encryption key management options is best for managing keys but allowing S3 to handle the actual encryption of data? A) SSE-S3 B) SSE-KMS C) Client-side encryption keys D) SSE-C

Answer 27

D. SSE-C allows the customer (the C in SSE-C) to manage keys, but S3 then handles the actual encryption of data.

Question 28

You have a customer that has a legacy security group that is very suspicious of all things security in the cloud. The customer wants to use S3, but doesn’t trust AWS encryption, and you need to enable its migration to the cloud. What option would you recommend to address the company’s concerns? A) SSE-S3 B) SSE-KMS C) Client-side encryption keys D) SSE-C

Answer 28

C. Client-side encryption allows the customer to manage keys and encrypt data themselves, then store the data on S3 already encrypted. There’s a lot of overhead with this approach, but it’s ideal for the use case described.

Question 29

You want to begin encrypting your S3 data, but your organization is new to encryption. Which option is a low-cost approach that still offloads most of the work to AWS rather than the organization new to encryption? A) SSE-S3 B) SSE-KMS C) Client-side encryption keys D) SSE-C

Answer 29

A. In general, SSE-S3 is the “starter” option for encryption. It’s by no means a simple or amateur approach to security, but it is low cost compared to KMS and has much less overhead than client-side or SSE-C encryption keys.

Question 30

You are the architect for a company whose data must comply with current EU privacy restrictions. Which of the following S3 buckets are valid options? (Choose two.) A) Buckets in EU Central 1 B) Buckets in US East 2 C) Buckets in EU West 1 D) Buckets in SA East 1

Answer 30

A, C. Here, you must recognize that EU West and EU Central are both EU regions and the other two options are not.

Question 31

Which of the following options could be used to provide availability-zone-resilient fault-tolerant storage that complies with EU privacy laws? (Choose two.) A) S3 buckets in US West 1 B) S3 buckets in EU West 2 C) S3-IA buckets in EU Central 1 D) S3 One Zone-IA buckets in EU-West-1

Answer 31

B, C. Option A isn’t valid because US-West isn’t an EU region. Options B and C are valid as they both provide EU regions, and S3 and S3-IA both can survive the loss of an availability zone; option D would not survive the loss of an AZ.

Question 32

What type of replication will your Multi-AZ RDS instances use? A) Offline replication B) Synchronous replication C) Push replication D) Asynchronous replication

Answer 32

B. Multi-AZ RDS instances use synchronous replication to push changes.

Question 33

You want to provide maximum protection against data in your S3 object storage being deleted accidentally. What should you do? A) Enable versioning on your EBS volumes. B) Turn on MFA Delete on your S3 buckets. C) Set up a Lambda job to monitor and block delete requests to S3. D) Turn off the DELETE endpoints on the S3 REST API.

Answer 33

B. MFA Delete is the most powerful anti-deletion protection you can provide without disabling delete via IAM roles. Option A doesn’t affect your object storage—EBS is block storage. Options C and D both won’t help; delete requests can’t be blocked by Lambda, and there is no “DELETE endpoint” on the S3 API.

Question 34

You want to provide maximum protection against data in your S3 object storage being deleted accidentally. What steps should you take? (Choose two.) A) Enable versioning on your S3 buckets. B) Turn on MFA Delete on your S3 buckets. C) Enable versioning in CloudWatch’s S3 API. D) Remove IAM permissions for deleting objects for all users.

Answer 34

A, B. MFA Delete is the right option here (B), but A is a required step to enable MFA Delete. Option C doesn’t actually make sense, and while option D would technically prevent all deletions, it isn’t what the question is asking: You must prevent accidental deletions, not remove the ability to delete objects altogether.

Question 35

You want to enable MFA Delete on your S3 buckets in the US East 1 region. What step must you take before enabling MFA Delete? A) Disable the REST API for the buckets on which you want MFA Delete. B) Enable cross-region replication on the buckets on which you want MFA Delete. C) Move the buckets to a region that supports MFA Delete, such as US West 1. D) Enable versioning on the buckets on which you want MFA Delete.

Answer 35

D. You must enable versioning to enable MFA Delete. The region of the bucket doesn’t have any effect here (B and C), and there is no way to disable the REST API (A), although you could remove programmatic access via IAM or removal of access keys.

Question 36

What is AWS Trusted Advisor? A) An online resource to help you improve performance B) An online resource to help you reduce cost C) An online resource to help you improve security D) All of the above

Answer 36

D. AWS Trusted Advisor does all three of the above: improve performance, reduce cost, and improve security.

Question 37

On which of the following does AWS Trusted Advisor not provide recommendations? A) Reducing cost B) Improving fault tolerance C) Improving security D) Organizing accounts

Answer 37

D. AWS Trusted Advisor provides advice on cost, fault tolerance, performance, and security but does not address account organization.

Question 38

Which of the following are included in the core AWS Trusted Advisor checks? (Choose two.) A) S3 bucket permissions B) MFA on root account C) Quantity of CloudWatch alarms D) Use of VPC endpoints

Answer 38

A, B. Here, it’s not reasonable to memorize the seven core AWS Trusted Advisor checks. Instead, consider which of these are valid improvements that Trusted Advisor might make. A and B relate to security and permissions, while both C and D are pretty far afield of cost, security, or performance suggestions.

Question 39

Which of the following recommendations might AWS Trusted Advisor make? (Choose two.) A) Turn on MFA for the root account. B) Turn on antivirus protection for EC2 instances. C) Update S3 buckets with public write access. D) Update NAT instances to NAT gateways.

Answer 39

A, C. This is tricky. First, MFA on the root account is a standard recommendation, so you can select that. For the remaining three answers, the one that is most directly a “common security recommendation” would have to be S3 buckets with write access, and that is the correct answer.

Question 40

Which of the following is not possible using IAM policies? A) Requiring MFA for the root account B) Denying the root account access to EC2 instances C) Disabling S3 access for users in a group D) Restricting SSH access to EC2 instances to a specific user

Answer 40

B. The only one of these that’s not possible with IAM is denying the root account access to EC2 instances. That’s not possible—with IAM or any other mechanism.

Question 41

Which of the following are not true about S3 encryption? (Choose two.) A) S3 applies AWS-256 encryption to data when server-side encryption is enabled. B) S3 encryption will use a client key if it is supplied with data. C) Encrypted EBS volumes can only be stored if server-side encryption is enabled. D) S3 will accept locally encrypted data if client-side encryption is enabled.

Answer 41

B, C. A is true, and D is true; if you know this, choosing B and C is simple. Otherwise, you need to recognize that just supplying a client key to S3 is not enough; some form of client-side encryption or server-side encryption using client keys must be enabled. EBS volumes can be encrypted outside of S3 and stored regardless of how S3 is encrypting data.

Question 42

What types of data are encrypted when you create an encrypted EBS volume? (Choose two.) A) Data at rest inside the volume B) Data moving between the volume and the attached instance C) Data inside S3 buckets that store the encrypted instance D) Data in an EFS on instances attached to the volume

Answer 42

A, B. There are four types of data encrypted when an EBS volume is encrypted: data at rest on the volume, data moving between the volume and the instance, any snapshots created from the volume, and any volumes created from those snapshots.

Question 43

What types of data are not automatically encrypted when you create an encrypted EBS volume? (Choose two.) A) A snapshot created from the EBS volume B) Any data on additional volumes attached to the same instance as the encrypted volume C) Data created on an instance that has the encrypted volume attached D) Data moving between the volume and the attached instance

Answer 43

B, C. This is tricky, as both answers that involve unencrypted data have some tricky wording. First, B is not a case of encryption; if data never touches the encrypted volume, it is not automatically encrypted. Second, for C, data that is on the instance but never moves to the encrypted volume is also not automatically encrypted.

Question 44

What of the following types of data is not encrypted automatically when an encrypted EBS volume is attached to an EC2 instance? A) Data in transit to the volume B) Data at rest on the volume C) Data in transit from the volume D) All of these are encrypted.

Answer 44

D. All of these are encrypted. Data moving to and from the volume as well as data at rest on the volume are all encrypted.

Question 45

What encryption service is used by encrypted EBS volumes? A) S3-KMS B) S3-C C) KMS D) Customer-managed keys

Answer 45

C. KMS is used as the encryption service, but this is not the S3-KMS that is specific to S3 encryption. You will also sometimes see this KMS referenced as AWS-KMS.

Question 46

How can you access the private IP address of a running EC2 instance? A) http://169.254.169.254/latest/user-data/ B) http://169.254.169.254/latest/instance-data/ C) http://169.254.169.254/latest/meta-data/ D) http://169.254.169.254/latest/ec2-data/

Answer 46

C. This is a case of pure memorization. The URL is always http://169.254.169.254 and the metadata, which is what you want, is at /latest/meta-data/.

Question 47

If you take a snapshot of an encrypted EBS volume, which of the following will be true? (Choose two.) A) The snapshot will be encrypted. B) All data on the bucket on which the snapshot is stored will be encrypted. C) Any instances using the snapshot will be encrypted. D) Any volumes created from the snapshot will be encrypted.

Answer 47

A, D. Encryption of a volume affects snapshots of the volume and instances created from that snapshot, but nothing else.

Question 48

If you take a snapshot of an encrypted EBS volume, which of the following must you do to use that snapshot as a volume in a separate region? (Choose two.) A) Copy the snapshot to the new region. B) Delete the snapshot from the old region. C) Unencrypt the snapshot once it is in the new region. D) Create a new volume from the snapshot in the new region.

Answer 48

A, D. The only steps required here are to copy the snapshot to the new region (usually via the console), and then create a new volume from it.

Question 49

How do you encrypt an RDS instance? A) Enable encryption on the running instance via the CLI. B) Enable encryption on the running instance via the console. C) Run the encryption process on the running instance via the console. D) Enable encryption when creating the instance.

Answer 49

D. You cannot encrypt a running instance; you have to create the instance with encryption enabled.

Question 50

Which of the following will ensure that data on your RDS instance is encrypted? A) Use client-side encryption keys. B) Enable encryption on the running RDS instance via the AWS API. C) Encrypt the instance on which RDS is running. D) None of these will encrypt all data on the instance.

Answer 50

D. You cannot encrypt a running RDS instance, so B is incorrect, and you have no access to the underlying instance for RDS, so C is also incorrect. Option A sounds possible, but it will not address any data created by the database itself (such as indices, references to other data in the database, etc.). The only way to encrypt an RDS instance is to encrypt it at creation of the instance.

Question 51

Which of the following will allow you to bring a non-encrypted RDS instance into compliance with an “all data must be encrypted at rest” policy? A) Snapshot the RDS instance and restore it, encrypting the new copy upon restoration. B) Use the AWS Database Migration Service to migrate the data from the instance to an encrypted instance. C) Create a new encrypted instance and manually move data into it. D) None of these will encrypt all data on the instance.

Answer 51

C. The only option here is the manual one. You must set up encryption when creating a new instance from scratch (snapshots won’t work) and then move data into it so that this data is encrypted as it moves into the new instance.

Question 52

Which of the following will allow you to bring a non-encrypted EBS volume into compliance with an “all data must be encrypted at rest” policy? A) Stop the volume, snapshot it, and encrypt a copy of the snapshot. Then restore from the encrypted snapshot. B) Stop the volume, select “Turn on encryption,” and restart the volume. C) Encrypt the volume via the AWS API and turn on the “encrypt existing data” flag. D) None of these will encrypt all data on the volume.

Answer 52

A. You cannot encrypt an existing volume “on the fly.” You must create a snapshot and then encrypt that snapshot as you copy it to another, encrypted snapshot. You can then restore from that new snapshot.

Question 53

Which of the following will allow you to bring a non-encrypted EBS volume into compliance with an “all data must be encrypted at rest” policy? A) Stop the volume, create a snapshot, and restart from the snapshot, selecting “Encrypt this volume.” B) Stop the volume, select “Turn on encryption,” and restart the volume. C) Encrypt the volume via the AWS API and turn on the “encrypt existing data” flag. D) None of these will encrypt all data on the volume.

Answer 53

D. None of these will work. The important thing to remember for a question like this is that you must make a copy of an unencrypted snapshot to apply encryption. There is no in-place encryption mechanism for volumes or snapshots.

Question 54

Which of the following will allow you to bring a non-encrypted EBS volume into compliance with an “all data must be encrypted at rest” policy? A) Create a new volume, attach the new volume to an EC2 instance, copy the data from the non-encrypted volume to the new volume, and then encrypt the new volume. B) Create a new volume with encryption turned on, attach the new volume to an EC2 instance, and copy the data from the non-encrypted volume to the new volume. C) Create a new volume, attach the new volume to an EC2 instance, and use the encrypted-copy command to copy the data from the non-encrypted volume to the new volume. D) None of these will encrypt all data on the volume.

Answer 54

B. The only way to encrypt an EBS volume is to encrypt it at creation time. Remembering this one detail will help on lots of questions in this vein.

Question 55

Which of the following are valid options on an EBS volume? (Choose two.) A) Encrypt the volume. B) Encrypt a snapshot of the volume. C) Encrypt a copy of a snapshot of the volume. D) Restore an encrypted snapshot to an encrypted volume.

Answer 55

C, D. You cannot encrypt an existing EBS volume, so A is incorrect. And you cannot encrypt a snapshot that is unencrypted, so B is incorrect. You can encrypt a copy of a snapshot and restore an encrypted snapshot to a volume that is encrypted (C and D).

Question 56

Which of the following are not true about EBS snapshots? (Choose two.) A) Snapshots of encrypted volumes are automatically encrypted. B) When you copy an encrypted snapshot, the copy is not encrypted unless you explicitly specify. C) You cannot copy an encrypted snapshot unless you unencrypt the snapshot first. D) Volumes that are created from encrypted snapshots are automatically encrypted.

Answer 56

B, C. Snapshots of encrypted volumes stay encrypted—whether you copy them (B and C) or create volumes from them (D). So A and D are true, while B and C are false.

Question 57

Can you copy a snapshot across AWS accounts? A) Yes B) Yes, but you first have to modify the snapshot’s access permissions. C) Yes, but you have to be the owner of both AWS accounts. D) No

Answer 57

B. You can copy snapshots across accounts, but the default permissions do not allow this. So you have to modify those permissions, and then the snapshot can be copied to any other AWS account, regardless of account owner.

Question 58

You have a snapshot of an EBS volume in US East 2. You want to create a volume from this snapshot in US West 1. Is this possible? A) Yes, create the volume in US West 1 based upon the snapshot in US East 2. B) Yes, but you’ll need to copy the snapshot to US West 1 first. C) Yes, but you’ll need to create the instance in US East 2 and then move it to US West 1. D) No

Answer 58

B. You can only create volumes from snapshots in the same region. Since the instance is desired in US West 1, a copy of the snapshot must be made in that region first, so B is correct.

Question 59

Can you copy an EBS snapshot across regions? A) Yes, as long as the snapshot is not encrypted. B) Yes, as long as the snapshot is marked for multi-region use. C) Yes D) No

Answer 59

C. You can copy a snapshot to a different region without any special considerations.

Question 60

Which of the following does a security group attached to an instance control? (Choose two.) A) Inbound traffic B) HTTP error messages C) Outbound traffic D) Access control lists

Answer 60

A, C. Security groups control the inbound and outbound traffic allowed into and out of instances.

Question 61

How many security groups can you attach to a single instance in a VPC? A) None, security groups aren’t attached to instances. B) 1 C) 1 or more D) 2 or more

Answer 61

C. An instance must have a security group but can have more than that.

Question 62

Which of the following can be added to a VPC, in addition to security groups on included instances, to further secure the VPC? A) A NACL B) A port filter C) An ALB D) A flow log

Answer 62

A. In addition to security groups, NACLs (network access control lists) can be used to further refine inbound and outbound routing into and out of a VPC. Security groups are attached to instances, and NACLs to VPCs, building a complete security picture of your VPC and its instances.

Question 63

Which of the following statements is true about a custom, user-created NACL? A) A NACL by default allows all traffic out of a VPC. B) A NACL by default allows all traffic into a VPC. C) A NACL is a virtual firewall for associated subnets. D) A NACL functions at the instance level.

Answer 63

C. NACLs are virtual firewalls, and they operate at the subnet and VPC level rather than at an individual instance level. Also note the words custom, user-created. The default NACL does allow in and out all traffic; created NACLs do not.

Question 64

What do you use to permit and restrict control of a NACL? A) VPC B) WAF C) AWS Organizations D) IAM

Answer 64

D. IAM roles and permissions control access to NACLs.

Question 65

Which of these are true about security groups? (Choose two.) A) Support allow and deny rules B) Evaluate all rules before deciding whether to allow traffic C) Operate at the instance level D) Apply to all instances in the associated subnet

Answer 65

B, C. Security groups support only allow rules (A is false). They do evaluate all rules (B is true) and operate at the instance level (C is true). D is false, as security groups aren’t associated with a subnet.

Question 66

Which of these are true about security groups? (Choose two.) A) Stateful B) Stateless C) Process rules in order D) Associated with an instance

Answer 66

A, D. Security groups are stateful and are associated with an instance (or instances), so A and D are true. They are not stateless, and they process all rules rather than processing rules in order.

Question 67

Which of these are true about NACLs? (Choose two.) A) Stateful B) Stateless C) Process rules in order D) Associated with an instance

Answer 67

B, C. NACLs are stateless; rules must be specified for traffic going both in and out (so A is false, and B is true). They also process rules in order (C is true). They’re associated with subnets, not a particular instance (so D is false).

Question 68

Which of these are true about NACLs? (Choose two.) A) Apply to all instances in an associated subnet B) Only apply if no security group is present C) Support allow and deny rules D) Evaluate all rules before deciding whether to allow or disallow traffic

Answer 68

A, C. NACLs are associated with a subnet (A) and support both allow and deny rules (C). B is false; NACLs and security groups work together. D is false, as rules are processed in order.

Question 69

In which order are NACLs and security groups evaluated? A) NACLs and security groups are evaluated in parallel. B) A NACL is evaluated first, and then the security group. C) A security group is evaluated first, and then the NACL. D) It depends on the VPC setup.

Answer 69

B. NACLs are always evaluated first because they exist at the border of a subnet. As security groups are attached to instances, they are not processed until traffic passes through the NACL and into the instance’s subnet.

Question 70

Which of these statements are true? (Choose two.) A) A security group can apply to two instances at the same time. B) A NACL applies to all instances within a subnet at the same time. C) A security group can apply to only one instance at the same time. D) A NACL can apply to only one instance at the same time.

Answer 70

A, B. Both security groups and NACLs can—and usually do—apply to multiple instances in a subnet. The NACL applies to all instances within the associate subnet, and a security group can be associated with multiple instances.

Question 71

With which of the following is a NACL associated? A) An instance B) A subnet C) A VPC D) A NACL can be associated with all of these.

Answer 71

B. NACLs are associated with subnets.

Question 72

Which of the following are true about the default NACL that comes with the default VPC? (Choose two.) A) It allows all inbound traffic. B) It allows all outbound traffic. C) It disallows all inbound traffic. D) It disallows all outbound traffic.

Answer 72

A, B. The default NACL allows in and out all traffic, which is somewhat unintuitive. Keep in mind that the default security group disallows inbound traffic, but the default NACL allows that traffic in.

Question 73

Which of the following are true about a user-created NACL? (Choose two.) A) It allows all inbound traffic. B) It allows all outbound traffic. C) It disallows all inbound traffic. D) It disallows all outbound traffic.

Answer 73

C, D. Unlike the default NACL that comes with the default VPC, custom NACLs disallow all inbound and outbound traffic by default.

Question 74

In which order are rules in a NACL evaluated? A) From low to high, using the number on the rule B) From high to low, using the number on the rule C) From low to high, using the port of the rule D) From high to low, using the port of the rule

Answer 74

A. Each rule in a NACL has a number, and those rules are evaluated using those numbers, moving from low to high.

Question 75

Which of the following statements is not true? (Choose two.) A) A network ACL has separate inbound and outbound rules. B) Network ACLs are stateful. C) Each subnet in your VPC must be associated with a NACL. D) A network ACL can only be associated with a single subnet.

Answer 75

B, D. A and C are true. B is false; NACLs are stateless. D is false, because a NACL can be associated with multiple subnets.

Question 76

With how many subnets can a NACL be associated? A) One B) One or more C) A NACL is associated with instances, not subnets. D) A NACL is associated with VPCs, not subnets.

Answer 76

B. A NACL is associated with a subnet, not an instance or VPC. It can be associated with a single subnet or multiple subnets.

Question 77

With how many NACLs can a subnet be associated? A) One B) One or more C) A subnet is associated with security groups, not NACLs. D) A subnet is associated with VPCs, not NACLs.

Answer 77

A. A subnet is associated with a NACL. However, a subnet can only be associated to a single NACL at a time.

Question 78

What happens when you associate a NACL with a subnet that already is associated with a different NACL? A) Nothing, both NACLs are associated with the subnet. B) You receive an error. You must remove the first NACL to associate the new one. C) You receive an error. You must first merge the two NACLs to apply them to a subnet. D) The new NACL replaces the previous NACL, and the subnet still only has one NACL association.

Answer 78

D. A subnet is associated with a NACL but can only be associated to a single NACL at a time.

Question 79

Which of the following are part of a network ACL rule? (Choose two.) A) An ASCII code B) A rule number C) An IAM group D) A protocol

Answer 79

B, D. NACL rules have a rule number, a protocol, a choice of ALLOW or DENY, and a CIDR range and port or port range for inbound and outbound traffic.

Question 80

Which of the following are part of a network ACL rule? (Choose two.) A) An ALLOW or DENY specification B) A CIDR range C) An IP address D) A VPC identifier

Answer 80

A, B. NACL rules have a rule number, a protocol, a choice of ALLOW or DENY, and a CIDR range and port or port range for inbound and outbound traffic.

Question 81

Which of the following inbound rules of a custom NACL would be evaluated first? A) Rule #800 // HTTP // TCP // 80 // 0.0.0.0/0 -> ALLOW. B) Rule #100 // HTTPS // TCP // 443 // 0.0.0.0/0 -> ALLOW. C) Rule * // All // All // All // 0.0.0.0/0 -> DENY. D) Rule #130 // RDP // TCP // 3389 // 192.0.2.0/24 -> ALLOW.

Answer 81

B. Almost none of this detail actually matters. The only key parameter is the rule number. NACLs evaluate lowest-numbered rules first, so Rule #100 would go first, option B.

Question 82

If all of the following inbound rules existed on a custom NACL, would SSH traffic be allowed? Rule #800 // HTTP // TCP // 80 // 0.0.0.0/0 -> ALLOW Rule #100 // HTTPS // TCP // 443 // 0.0.0.0/0 -> ALLOW Rule * // All // All // All // 0.0.0.0/0 -> DENY Rule #130 // RDP // TCP // 3389 // 192.0.2.0/24 -> ALLOW A) Yes, SSH is included as a default protocol on NACLs. B) Yes, SSH is included in the HTTPS protocol. C) Only if the SSH access permission in IAM is granted. D) No

Answer 82

D. SSH is not explicitly mentioned, so it is not allowed on a custom NACL. Every protocol must explicitly be mentioned.

Question 83

If all of the following inbound rules existed on the default VPC’s default NACL, would SSH traffic be allowed? A) Rule #800 // HTTP // TCP // 80 // 0.0.0.0/0 -> ALLOW B) Rule #100 // HTTPS // TCP // 443 // 0.0.0.0/0 -> ALLOW C) Yes, the default VPC’s default NACL allows all inbound traffic by default. D) Yes, SSH is included in the HTTPS protocol. E) Only if the SSH access permission in IAM is granted. F) No

Answer 83

A. SSH is not explicitly mentioned, but because the question asks about the default NACL on the default VPC, all traffic is allowed in unless explicitly denied.

Question 84

If all of the following inbound rules existed on a custom NACL, would SSH traffic be allowed? A) Rule #800 // HTTP // TCP // 80 // 0.0.0.0/0 -> ALLOW B) Rule #100 // HTTPS // TCP // 443 // 0.0.0.0/0 -> ALLOW C) Rule #140 // All // All // All // 0.0.0.0/0 -> DENY D) Rule #120 // SSH // TCP // 22 // 192.0.2.0/24 -> ALLOW E) Yes F) Yes, but only from the CIDR block 192.0.2.0/24. Only if the SSH access permission in IAM is granted. A) No

Answer 84

B. SSH is allowed here, but only from a specific CIDR block.

Question 85

If all of the following inbound rules existed on a custom NACL, would SSH traffic be allowed? A) Rule #800 // HTTP // TCP // 80 // 0.0.0.0/0 -> ALLOW B) Rule #100 // HTTPS // TCP // 443 // 0.0.0.0/0 -> ALLOW C) Rule #110 // All // All // All // 0.0.0.0/0 -> DENY D) Rule #120 // SSH // TCP // 22 // 192.0.2.0/24 -> ALLOW E) Yes F) Yes, but only from the CIDR block 192.0.2.0/24. Only if the SSH access permission in IAM is granted. A) No

Answer 85

D. While there is a rule allowing SSH from the CIDR block 192.0.2.0/24, that rule would be evaluated after the lower-numbered rule 110, which disallows any traffic not allowed in from lower-numbered rules (in this case, just rule #100).

Question 86

Which of the following is the most accurate statement about what the following inbound rule on a NACL will do? A) Rule #120 // SSH // TCP // 22 // 192.0.2.0/24 -> ALLOW B) Allows inbound SSH traffic to the associated subnets C) Allows inbound TCP traffic to the associated subnets D) Allows inbound TCP traffic to the associated subnets from the CIDR block 192.0.2.0/24 E) Allows inbound SSH traffic to the associated subnets from the CIDR block 192.0.2.0/24

Answer 86

D. Technically, B and C are correct; SSH is a type of TCP traffic. However, that is not the most specific answer, which is what the question asks. A is partially correct but does not call out the CIDR block limitation that D does. Therefore, D is the most accurate answer.

Question 87

Which of the following is the most accurate statement about what the following inbound rule on a NACL will do? A) Rule #120 // HTTP // TCP // 80 // 0.0.0.0/0 -> ALLOW B) Allows inbound HTTP traffic to the associated subnets C) Allows inbound IPv4 HTTP traffic to the associated subnets as long as it is not prevented by lower-numbered rules D) Allows inbound IPv4 HTTP traffic to the associated subnets E) Allows inbound IPv4 TCP traffic to the associated subnets

Answer 87

B. The most accurate answer here includes several components: the type of TCP traffic (HTTP), the allowed source CIDR block (the entire Internet), and IPv4. This rule does not explicitly allow IPv6 traffic. Further, this rule is only effective if there are no lower-numbered rules that short-circuit this rule.

Question 88

What does the CIDR block 0.0.0.0/0 represent? A) The entire Internet B) The entire Internet, limited to IPv4 addresses C) The entire Internet, limited to IPv6 addresses D) Inbound traffic from the entire Internet

Answer 88

B. 0.0.0.0/0 represents IPv4 addresses, and the entire Internet. However, a CIDR block does not represent any type of traffic, inbound or outbound.

Question 89

What does the CIDR block ::/0 represent? A) The entire Internet B) The entire Internet, limited to IPv4 addresses C) The entire Internet, limited to IPv6 addresses D) Inbound traffic from the entire Internet

Answer 89

C. ::/0 represents IPv6 addresses, and the entire Internet. However, a CIDR block does not represent any type of traffic, inbound or outbound.

Question 90

Which of the following rules allows IPv6 outbound traffic to flow to the entire Internet through a NAT gateway with the ID nat-123456789? A) 0.0.0.0/0 -> NAT -> nat-123456789 B) ::/0 -> nat-123456789 C) 0.0.0.0/0 -> nat-123456789 D) ::/0 -> NAT -> nat-123456789

Answer 90

B. ::/0 represents IPv6 addresses, so the answer must be either B or D. The route should go from all IPv6 addresses to the ID of the NAT gateway, which is nat-123456789. There is no intermediate -> NAT that should be inserted into the routes.

Question 91

How many availability zones in a single region does a single VPC span? A) None, VPCs do not span availability zones. B) One C) At least two D) All of them

Answer 91

D. A VPC spans all the availability zones in a region.

Question 92

Which of these must be specified when creating a new VPC? (Choose two.) A) An availability zone B) A region C) A CIDR block D) A security group

Answer 92

B, C. You must always select a region to create a VPC, and you must always provide a CIDR block. VPCs span all the AZs in a region, so that is not required, and security groups are associated at the instance level rather than at the VPC level.

Question 93

How many subnets can be added to an availability zone within a VPC? A) None B) One C) One or more D) At least two

Answer 93

C. For a single VPC, you can add one or more subnets to each availability zone within that VPC.

Question 94

To how many availability zones within a region can a single subnet in a VPC be added? A) None B) One C) One or more D) At least two

Answer 94

B. A subnet cannot span availability zones. It can be added to a single AZ.

Question 95

How many availability zones can a subnet span? A) None B) One C) One or more D) At least two

Answer 95

B. A subnet cannot span availability zones. It can be added to a single AZ and can only exist within that single AZ.

Question 96

How many IPv6 CIDR blocks can be assigned to a single VPC? A) None B) One C) One or more D) At least two

Answer 96

B. A VPC can have a single primary CIDR block assigned to it for IPv4 addresses and an optional IPv6 CIDR block. While you can add secondary IPv4 CIDR blocks, you cannot add additional CIDR blocks for IPv6 at this time.

Question 97

How many IPv4 CIDR blocks can be assigned to a single VPC? A) None B) One C) One or more D) At least two

Answer 97

C. A VPC can have a single primary CIDR block assigned to it for IPv4 addresses and an optional IPv6 CIDR block. However, you can add additional secondary CIDR blocks to a VPC (up to four).

Question 98

You have a VPC in US East 1 with three subnets. One of those subnets’ traffic is routed to an internet gateway. What does this make the subnet? A) A private subnet B) A restricted subnet C) The master subnet of that VPC D) A public subnet

Answer 98

D. Any subnet that routes traffic through an internet gateway is a public subnet by definition.

Question 99

You have a public subnet in a VPC and an EC2 instance serving web traffic within that public subnet. Can that EC2 instance be reached via the Internet? A) Yes B) Yes, as long as it has a public IPv4 address. C) Yes, as long as the VPC is marked as public. D) No

Answer 99

B. Instances in a public subnet are not automatically reachable. They must have either a public IPv4 or IPv6 address (B) or an elastic IP address.

Question 100

You have a public subnet within your VPC. Within that subnet are three instances, each running a web-accessible API. Two of the instances are responding to requests from Internet clients, but one is not. What could be the problem? A) The VPC needs to be marked as public-facing. B) The three instances should be moved into an Auto Scaling group. C) There is no internet gateway available for the VPC. D) The unavailable instance needs an elastic IP.

Answer 100

D. A public subnet, as well as existing Internet-accessible instances, indicates a working internet gateway, so C is not correct. A is not an actual AWS option, and B—Auto Scaling—would not address public accessibility. This leaves D, which is correct: Instances in a public subnet that are intended to be Internet accessible need either a public IP address or an elastic IP address assigned to the instance.

Question 101

Which of the following are allowed when creating a new VPC? (Choose two.) A) An IPv4 CIDR block B) VPC description C) An IPv6 CIDR block D) A security group

Answer 101

A, C. When creating a VPC, you can specify an option name, a required IPv4 CIDR block, and an optional IPv6 CIDR block.

Question 102

Which of the following is not a required part of creating a custom VPC? (Choose two.) A) An IPv6 CIDR block B) A VPC name C) A set of VPC tags D) An IPv4 CIDR block

Answer 102

A, C. When creating a VPC, you can specify an option name, a required IPv4 CIDR block, and an optional IPv6 CIDR block. You cannot assign tags to a VPC at creation time.

Question 103

Which of the following defines a subnet as a public subnet? (Choose two.) A) A security group that allows inbound public traffic B) A routing table that routes traffic through the internet gateway C) Instances with public IP addresses D) An internet gateway

Answer 103

B, D. A public subnet is one in which traffic is routed (via a routing table, B) to an internet gateway (D).

Question 104

Which of the following defines a VPN-only subnet? (Choose two.) A) A routing table that routes traffic through the internet gateway B) A routing table that routes traffic through the virtual private gateway C) A virtual private gateway D) An internet gateway

Answer 104

B, C. A VPN-only subnet routes traffic through a virtual private gateway rather than an internet gateway.

Question 105

Which of the following are required components in a VPN-only subnet? (Choose two.) A) A routing table B) A virtual private gateway C) An elastic IP address D) An internet gateway

Answer 105

A, B. At a minimum, a VPC-only subnet must have a routing table routing traffic and a virtual private gateway to which traffic is routed. Neither elastic IP addresses nor internet gateways are required.

Question 106

By default, how many VPCs can you create per region? A) 1 B) 5 C) 20 D) 200

Answer 106

B. You can only create 5 VPCs per region by default. Creating more requires a request to AWS.

Question 107

By default, how many subnets can you create per VPC? A) 1 B) 5 C) 20 D) 200

Answer 107

D. This is a high number, but accurate: You can create 200 subnets per VPC.

Question 108

By default, how many IPv4 CIDR blocks can you create per VPC? A) 1 B) 5 C) 20 D) 200

Answer 108

B. This is a very hard question, but it can come up, albeit rarely. This limit is your primary CIDR block and then, in addition, 4 secondary CIDR blocks.

Question 109

By default, how many elastic IPs can you create per region? A) 1 B) 5 C) 20 D) 200

Answer 109

B. You’re allowed 5 elastic IP addresses per region, unless you have the default limits raised by AWS.

Question 110

Which of the following is not true? (Choose two.) A) A subnet can have the same CIDR block as the VPC within which it exists. B) A subnet can have a larger CIDR block than the VPC within which it exists. C) A subnet can have a smaller CIDR block than the VPC within which it exists. D) A subnet does not have to have a CIDR block specified.

Answer 110

B, D. Subnets must have CIDR blocks (so D is false), and the block must be the same as or smaller than the CIDR block for the VPC within which it exists, so while A and C are true, B is false.

Question 111

A VPC peering connection connects a VPC to which of the following? A) A subnet within another VPC B) A specific instance within another VPC C) Another VPC D) A virtual private gateway

Answer 111

C. A VPC peering connection connects one VPC to another VPC via networking and routing.

Question 112

An Amazon VPC VPN connection links your on-site network to which of the following? A) A customer gateway B) An internet gateway C) An Amazon VPC D) A virtual private gateway

Answer 112

C. A VPC VPN connection links your on-site network to a VPC within the AWS cloud.

Question 113

Which of the following are required for a VPC VPN connection? (Choose two.) A) A customer gateway B) An internet gateway C) A virtual private gateway D) A public subnet

Answer 113

A, C. A VPC VPN connection requires a customer gateway, a VPN connection, and a virtual private gateway.

Question 114

Which of the following would you use to secure a VPC and its instances? (Choose two.) A) A customer gateway B) A NACL C) A virtual private gateway D) A security group

Answer 114

B, D. Customer gateways (A) and virtual private gateways (C) are used in VPN connections. For security, a NACL (B) is used at the subnet level, and a security group (D) can be used at the instance level.

Question 115

You want to ensure that no incoming traffic reaches any instances in your VPC. Which of the following is your best option to prevent this type of traffic? A) A blacklist B) A NACL C) A virtual private gateway D) A security group

Answer 115

B. A NACL is best for dealing with all traffic at a subnet or VPC level, as it is associated at the subnet level.

Question 116

You want to ensure that no incoming traffic reaches just the database instances in a particular subnet within your VPC. Which of the following is your best option to prevent this type of traffic? A) A blacklist B) A NACL C) A virtual private gateway D) A security group

Answer 116

D. Anytime you are protecting or limiting traffic to or from specific instances, a security group is your best choice. Security groups are associated with specific instances, so they can effectively limit traffic to some instances while allowing other instances—using different security groups—to still be accessible.

Question 117

You have a subnet with five instances within it. Two are serving public APIs and three are providing backend compute power through database instances. What is the best way to secure these instances? (Choose two.) A) Apply NACLs at the subnet level. B) Attach a single security group to all the instances. C) Move the two backend database instances into a different subnet. D) Attach an internet gateway to the VPC.

Answer 117

A, C. This takes a little careful reading. First, it is not considered a good practice to mix private and public instances within a subnet—although this is not a hard-and-fast rule. So C, moving the private database instances into a different subnet, is at least worth considering. D is not helpful in this case. If you have two subnets, one private and one public, then A is a good idea: NACLs can protect one subnet and keep another public. Finally, B is not valid, because of the word single. You cannot have a single security group that allows traffic to one instance but not to another. This leaves A and C as the best combined solution.

Question 118

Security groups operate most like which of the following? A) A blacklist B) A NACL C) A whitelist D) A greylist

Answer 118

C. A security group denies all traffic unless explicitly allowed. This means it functions as a whitelist: Only specific rules allow in traffic, and all other traffic is denied.

Question 119

If you have a NACL and a security group, at what two levels is security functioning? (Choose two.) A) The VPN level B) The service level C) The subnet level D) The instance level

Answer 119

C, D. A security group operates at the instance level, and a NACL operates at the subnet level.

Question 120

What type of filtering does a security group perform? A) Stateful B) Synchronous C) Whitelist D) Stateless

Answer 120

A. A security group performs stateful filtering, meaning that traffic allowed in is automatically allowed back out, without the need for an explicit outbound rule.

Question 121

What type of filtering does a network ACL perform? A) Stateful B) Synchronous C) Whitelist D) Stateless

Answer 121

D. Network ACLs are stateless. Inbound traffic is not automatically allowed back out; an explicit rule must be present for traffic to move from within a subnet back out of that subnet.

Question 122

With which of the following can you create a VPC peering connection? A) A VPC in the same AWS account and same region B) A VPC in another AWS account C) A VPC in the same AWS account but in another region D) All of these

Answer 122

D. VPC peering allows a VPC to connect with any other VPC: in the same region, in a different region, or in a different account altogether.

Question 123

With which of the following can you not create a VPC peering connection? (Choose two.) A) A VPC in another AWS account B) An instance in the same region C) A VPC in the same region D) An internet gateway

Answer 123

B, D. VPC peering allows a VPC to connect with any other VPC, so the options that don’t involve VPCs are incorrect: B and D.

Question 124

You have an instance within a custom VPC, and that instance needs to communicate with an API published by an instance in another VPC. How can you make this possible? (Choose two.) A) Enable cross-VPC communication via the AWS console. B) Configure routing from the source instance to the API-serving instance. C) Add a security group to the source instance. D) Add an internet gateway or virtual private gateway to the source VPC.

Answer 124

B, D. As long as there is a gateway (internet or virtual private) on the source VPC, and routing through that gateway, an instance in a VPC can communicate with other instances. So in this case, you’d want B and D. There is no “cross-VPC communication” option, and security groups won’t actually help this scenario.

Question 125

Which of the following could be used to allow instances within one VPC to communicate with instances in another region? (Choose two.) A) VPN connections B) NACLs C) Internet gateways D) Public IP addresses

Answer 125

A, D. This is a little difficult, but it comes down to accessibility: How can the target instance be reached? Of the answers available, a public IP would make the target available, as would a VPN connection.

Question 126

Which region does not currently support VPCs? A) US East 1 B) EU West 1 C) SA East 1 D) VPC is supported in all AWS regions.

Answer 126

D. VPCs are fundamental to AWS networking and are available in all AWS regions.

Question 127

How many availability zones can a VPC span? A) None, VPCs don’t exist within availability zones. B) One C) Two or more D) All the availability zones within a region

Answer 127

D. A VPC automatically spans all the availability zones within the region in which it exists.

Question 128

When you launch an instance within a VPC, in which availability zone is it launched? A) The default availability zone B) You must specify an availability zone. C) The first availability zone without an instance D) The availability zone with the least resources utilized

Answer 128

B. When you launch an instance, you must specify an availability zone. This could be as simple as accepting the AWS default, but it is your choice.

Question 129

You are the architect at a company that requires all data at rest to be encrypted. You discover several EBS-backed EC2 instances that will be commissioned in the next week. How can you ensure that data on these volumes will be encrypted? A) Use OS-level tools on the instance to encrypt the volumes. B) Specify via the AWS console that the volumes should be encrypted when they are created. C) You cannot enable encryption on a specific EBS volume. D) Start the instances with the volumes and then encrypt them via the AWS console.

Answer 129

B. EBS volumes can be encrypted, but it must be done at launch time (B).

Question 130

Which of the following is required to use a VPC endpoint? A) An internet gateway B) A VPN connection C) A NAT instance D) A VPC endpoint does not require any of these.

Answer 130

D. A VPC endpoint is a connection to an AWS service and explicitly does not use internet gateways, VPN connections, or NAT devices.

Question 131

Which of the following is not true about a VPC endpoint? A) A VPC endpoint can attach to an S3 bucket. B) A VPC endpoint is a hardware device. C) A VPC endpoint does not require an internet gateway. D) Traffic to a VPC endpoint does not travel over the Internet.

Answer 131

B. A VPC endpoint is a virtual device, not a physical one.

Question 132

To which of the following can a VPC endpoint not attach? A) S3 B) SNS C) Internet gateway D) DynamoDB

Answer 132

C. A VPC endpoint is for attaching to AWS services and explicitly does not require an internet gateway (C).

Question 133

Which of the following might you need to create for using a VPC endpoint attached to S3? A) A NAT instance B) A NAT gateway C) An IAM role D) A security group

Answer 133

C. By default, IAM users don’t have permissions to work with endpoints. You may need to create an IAM role. You would not need a NAT device (A or B) or a security group (D) to use a VPC endpoint.

Question 134

Is it possible to SSH into a subnet with no public instances? A) Yes B) Yes, as long as you have a bastion host and correct routing. C) Yes, as long as you have an AWS Direct Connect. D) No

Answer 134

B. A private subnet is not accessible without a bastion host or other connection and routing from the public Internet to an accessible host and finally into private instances.

Question 135

Where should a bastion host be located? A) In a private subnet B) In a public subnet C) In a private VPC D) In a VPC with a virtual private gateway

Answer 135

B. Bastion hosts should be in a public subnet so that they can be accessed via the public Internet. They can then route traffic into a private subnet.

Question 136

What is another name for a bastion host? A) A remote host B) A box host C) A jump server D) A bastion connection

Answer 136

C. Bastion hosts are also sometimes called jump servers, because they allow a connection to “jump” to the bastion and then into a private subnet.

Question 137

To which of the following might a bastion host be used to connect? A) A public instance in a public subnet B) A public instance in a private subnet C) A private instance in a public subnet D) A private instance in a private subnet

Answer 137

D. Bastion hosts are intended to provide access to private instances in private subnets; in other words, instances inaccessible via the public Internet in any other way.

Question 138

Which of these would you use to secure a bastion host? A) A network ACL B) A security group C) OS hardening D) All of the above

Answer 138

D. Bastion hosts are publicly accessible and have access to your private hosts. Therefore, they must be the most secure hosts on your network. Use a network ACL for the subnet in which it resides, a security group for the instance, and OS hardening to reduce access within the instance itself.

Question 139

For a bastion host intended to provide shell access to your private instances, what protocols should you allow via a security group? A) SSH and RDP B) Just SSH C) Just RDP D) Just HTTPS

Answer 139

B. Shell access only requires SSH, and you should therefore only allow that protocol. Always allow only what is absolutely required for bastion hosts.

Question 140

Which of the following statements about internet gateways is false? A) They scale horizontally. B) They are automatically redundant. C) They are automatically highly available. D) They scale vertically.

Answer 140

D. Internet gateways scale horizontally, not vertically. They are also redundant and highly available automatically.

Question 141

To which of the following does an internet gateway attach? A) An AWS account B) A subnet within a VPC C) A VPC D) An instance within a subnet

Answer 141

C. Internet gateways attach to VPCs and serve multiple subnets (if needed).

Question 142

Which of the following destination routes would be used for routing IPv4 traffic to an internet gateway? A) 0.0.0.0/24 B) 0.0.0.0/0 C) ::/0 D) 192.168.1.1

Answer 142

B. The route 0.0.0.0/0 catches all IPv4 traffic intended for the public Internet. ::/0 is for IPv6, 0.0.0.0/24 limits traffic to a certain CIDR block, and D is an internal IP address.

Question 143

Which of the following destination routes would be used for routing IPv6 traffic to an internet gateway? A) 0.0.0.0/24 B) 0.0.0.0/0 C) ::/0 D) 192.168.1.1

Answer 143

C. The route ::/0 catches all IPv6 traffic intended for the public Internet. 0.0.0.0/0 is for IPv6, 0.0.0.0/24 limits traffic to a certain CIDR block, and D is an internal IP address.

Question 144

Which of the following is not necessary for an instance to have IPv6 communication over the Internet? A) A VPC with an associated IPv6 CIDR block B) A public IPv6 assigned to the instance C) A subnet with an associated IPv6 CIDR block D) A virtual private gateway with IPv6 enabled

Answer 144

D. An instance must have IPv6 communication from itself (with a public IP address) through a subnet with IPv6 addresses, in a VPC with IPv6 addresses, to reach the Internet via IPv6. A virtual private gateway is not connected with any of these.

Question 145

Which of the following are possible options for assigning to an instance that needs public access? (Choose two.) A) A public IP address B) An elastic IP address C) An IAM role D) A NACL

Answer 145

A, B. For an instance to reach and be reached to and from the public Internet, the instance must have either a public IP address or an elastic IP address associated with it. IAM roles do not provide public access, and NACLs are attached to subnets, not instances.

Question 146

Which of the following will have internet gateways available? (Choose two.) A) A public subnet B) An IPv6 elastic IP address C) The default VPC D) An ALB

Answer 146

A, C. A public subnet, by definition, is a subnet with an internet gateway attached. And the default VPC has an internet gateway automatically attached.

Question 147

What does ALB stand for? A) Access load balancer B) Application load balancer C) Adaptive load balancer D) Applied load balancer

Answer 147

B. ALB stands for application load balancer.

Question 148

At what OSI layer does an application load balancer operate? A) 4 B) 7 C) 4 and 7 D) 6

Answer 148

B. Application load balancers operate at the Application layer, which is layer 7 of the OSI model. ELBs (classic load balancers) operate at the Transport layer, layer 4, as well as layer 7, and network load balancers operate at layer 4 as well.

Question 149

At what OSI layer does a network load balancer operate? A) 4 B) 7 C) 4 and 7 D) 6

Answer 149

A. Application load balancers operate at the Application layer, which is layer 7 of the OSI model. ELBs (classic load balancers) operate at the Transport layer, layer 4, as well as layer 7, and network load balancers operate at layer 4 as well.

Question 150

At what OSI layer does a classic load balancer operate? A) 4 B) 7 C) 4 and 7 D) 6

Answer 150

C. Application load balancers operate at the Application layer, which is layer 7 of the OSI model. ELBs (classic load balancers) operate at the Transport layer, layer 4, as well as layer 7, and network load balancers operate at Level 4 as well.

Question 151

Which type of load balancer operates at the Transport layer? A) Classic load balancer B) Application load balancer C) Network load balancer D) Both classic and network load balancers

Answer 151

D. Both network and classic load balancers operate at the Transport layer. Classic load balancers also operate at layer 7, the Application layer. Application load balancers operate at the Application layer, which is layer 7 of the OSI model.

Question 152

Which type of load balancer operates at the Application layer? A) Classic load balancer B) Application load balancer C) Network load balancer D) Both classic and application load balancers

Answer 152

D. Both classic and application load balancers operate at the Application layer. Classic load balancers also operate at layer 4, the Transport layer. Network load balancers operate at the Transport layer, which is layer 4 of the OSI model.

Question 153

What type of subnets are the default subnets in the default VPC? A) Private B) Hybrid C) Public D) Transport

Answer 153

C. By default, subnets in the default VPC are public. The default VPC has an internet gateway attached and the default subnets are public as a result.

Question 154

What type of subnets are the default subnets in a custom VPC? A) Private B) Hybrid C) Public D) Transport

Answer 154

A. By default, subnets in custom VPCs are private. Other than the default VPC, custom VPCs don’t have internet gateways attached by default, and created subnets don’t have public access.

Question 155

Which of the following is not automatically created for an instance launched into a non-default subnet? A) A private IPv4 address B) A security group C) A public IPv4 address D) A route to other instances in the subnet

Answer 155

C. Instances launched into non-default subnets have a private IPv4 address, but not a public one, so C is correct. All instances have a security group created or associated, and instances can always talk to other instances in the subnet by default.

Question 156

Which of the following would be needed to allow an instance launched into a non-default subnet Internet access? (Choose two.) A) A private IPv4 address B) A security group C) An elastic IP address D) An internet gateway

Answer 156

C, D. Instances launched into non-default subnets have a private IPv4 address, but not a public one, so they need an elastic IP address, as answer C indicates. (A public IP address would work as well.) You’d also need an internet gateway for the instance (D).

Question 157

Which of the following would you need to add or create to allow an instance launched into a default subnet in the default VPC Internet access? A) A public IPv4 address B) An internet gateway C) An elastic IP address D) None of these

Answer 157

D. Instances launched into default subnets in the default VPC can automatically reach out to the public Internet, as that VPC has an internet gateway and instances get a public IPv4 address.

Question 158

Which of the following would you use to allow outbound Internet traffic while preventing unsolicited inbound connections? A) A NAT device B) A bastion host C) A VPC endpoint D) A VPN

Answer 158

A. A NAT device—network address translation—provides routing for instances to an internet gateway but can prevent undesired inbound traffic.

Question 159

What does a NAT device allow? A) Incoming traffic from the Internet to reach private instances B) Incoming traffic from other VPCs to reach private instances C) Outgoing traffic to other VPCs from private instances D) Outgoing traffic to the Internet from private instances

Answer 159

D. A NAT device provides access to the Internet from private instances—they allow outgoing traffic rather than incoming traffic.

Question 160

Which of the following are NAT devices offered by AWS? (Choose two.) A) NAT router B) NAT instance C) NAT gateway D) NAT load balancer

Answer 160

B, C. AWS offers two NAT devices: a NAT instance and a NAT gateway.

Question 161

Which of the following requires selecting an AMI? (Choose two.) A) Launching an EC2 instance B) Backing up an EBS volume C) Creating an EBS volume D) Launching a NAT instance

Answer 161

A, D. Instances always require an AMI. In this question, the two instances are EC2 instances (A) and NAT instances (D).

Question 162

For which of the following do you not need to worry about operating system updates? A) NAT instance B) NAT gateway C) EC2 instance D) ECS container

Answer 162

B. A NAT gateway is an entirely managed device from AWS. All the other options require maintenance by the user of OS-level patches and updates.

Question 163

Which of the following does not automatically scale to meet demand? A) DynamoDB B) NAT instance C) SNS topic D) NAT gateway

Answer 163

B. A NAT instance does not provide automatic scaling, whereas DynamoDB and NAT gateways are managed services and do. There is really no such thing as “scaling” of an SNS topic, although SNS as a service does do some scaling in the background to ensure that demand is met.

Question 164

Which of the following, without proper security, could be most dangerous to your private instances? A) Bastion host B) VPC endpoint C) Internet gateway D) NAT instance

Answer 164

A. Of these options, only bastion hosts and NAT instances are unmanaged services, making them the only two possible answers. A bastion host typically has SSH routing and permissions to private instances, making it the most important to properly secure. While a NAT instance is usually available to private instances, traffic flows out from the NAT instance and not into the private instances.

Question 165

Which of the following could be used as a bastion host? A) NAT gateway B) VPC endpoint C) Internet gateway D) NAT instance

Answer 165

D. A NAT instance is a candidate for a bastion server. The other options are all managed services.

Question 166

You are building out a site-to-site VPN connection from an on-site network to a private subnet within a custom VPC. Which of the following might you need for this connection to function properly? (Choose two.) A) An internet gateway B) A public subnet C) A virtual private gateway D) A customer gateway

Answer 166

C, D. A site-to-site VPN connection requires a virtual private gateway on the VPC side (C) and a customer gateway on the on-site side (D).

Question 167

You are building out a site-to-site VPN connection from an on-site network to a custom VPC. Which of the following might you need for this connection to function properly? (Choose two.) A) A NAT instance B) A DynamoDB instance C) A private subnet D) An internet gateway

Answer 167

A, C. A site-to-site connection is going to require a private subnet on the AWS side (C), with private instances within it. Further, you’ll need a NAT instance (A) or similar device to route traffic and receive traffic as a static IP holder.

Question 168

With which of the following is an egress-only internet gateway most closely associated? A) IPv4 B) IPv6 C) A NAT instance D) A NAT gateway

Answer 168

B. An egress-only gateway is for use with IPv6 traffic only.

Question 169

You are responsible for securing an EC2 instance with an IPv6 address that resides in a public subnet. You want to allow traffic from the instance to the Internet but restrict access to the instance. Which of the following would you suggest? A) VPC endpoint B) Internet gateway C) Egress-only internet gateway D) A NAT gateway

Answer 169

C. An egress-only gateway is for use with IPv6 traffic and only allows outbound traffic. A VPC endpoint connects to managed AWS services, and an internet gateway (that isn’t egress only) allows both inbound and outbound traffic. A NAT gateway is for allowing outbound traffic from a private subnet rather than a public subnet.

Question 170

You have just created a NAT instance and want to launch the instance into a subnet. Which of these need to be true of the subnet into which you want to deploy? (Choose two.) A) The subnet is public. B) The subnet is private. C) The subnet has routing into the private subnets in your VPC. D) The subnet has routing to the public subnets in your VPC.

Answer 170

A, C. A NAT instance must be in a public subnet so that it is accessible from the Internet. It also must have access to private instances in private subnets in your VPC.

Question 171

Which of the following are true about an egress-only internet gateway? (Choose two.) A) It only supports IPv4 traffic. B) It is stateful. C) It only supports IPv6 traffic. D) It is stateless.

Answer 171

B, C. Egress-only internet gateways are stateful and support IPv6 traffic. This is a matter of memorization, although you can somewhat reason that the gateway—absent a NACL—allows responses to come back to instances that use it to communicate with the public Internet.

Question 172

Which of these would be used as the destination address in a routing table for a VPC that uses an egress-only internet gateway? A) 0.0.0.0/0 B) 0.0.0.0/16 C) ::/0 D) ::/24

Answer 172

C. The most important thing here is to remember that egress-only internet gateways only work with IPv6 addresses. This eliminates A and B. Then, only C addresses the entire public Internet in an IPv6 format.

Question 173

Which of the following are true about IPv6 addresses? (Choose two.) A) They are globally unique. B) They are in the format x.y.z.w. C) They require underlying IPv4 addresses. D) They are public by default.

Answer 173

A, D. IPv6 addresses are public by default (D) because they are globally unique. There is no need to have private IPv6 addresses because the range is so large.

Question 174

What is an elastic network interface? (Choose two.) A) A hardware network interface on an EC2 instance B) A virtual network interface C) An interface that can have one or more IPv6 addresses D) An interface that does not have a MAC address

Answer 174

B, C. An elastic network interface is virtual and can have multiple IPv4 and IPv6 addresses as well as security groups, a MAC address, and a source/destination check flag.

Question 175

Which of the following is not part of an elastic network interface? A) A primary IPv4 address B) A MAC address C) A source/destination check flag D) A NACL

Answer 175

D. An elastic network interface is virtual and can have multiple IPv4 and IPv6 addresses as well as security groups, a MAC address, and a source/destination check flag. NACLs apply to subnets, though, not network interfaces on instances.

Question 176

How many network interfaces can a single instance have? A) None B) One and only one C) One or more D) At least two, up to five

Answer 176

C. An instance has a primary network interface in all cases but can have additional network interfaces attached, so the answer is C, one or more.

Question 177

If an elastic network interface is moved from one instance to another, what happens to network traffic directed at the interface? A) It is redirected to the elastic network interface that has moved to the new instance. B) It is redirected to the primary network interface on the original instance. C) It is redirected to the primary network interface on the new instance. D) It is lost and must be re-sent to the elastic network interface on the new instance.

Answer 177

A. Traffic follows the network interface rather than sticking to any particular instance. So in this case, traffic is redirected to the new instance but stays targeted at the elastic network interface (A).

Question 178

To how many instances can an elastic network interface be attached? A) One and only one B) One or more C) One at a time, but it can be moved from one instance to another. D) Up to five

Answer 178

C. An elastic network interface can only be attached to a single instance at one time but can be moved from one instance to another.

Question 179

Which of these is not a reason to attach multiple network interfaces to an instance? A) You are creating a management network. B) You are attempting to increase network throughput to the instance. C) You need a high-availability solution and have a low budget. D) You need dual-homed instances.

Answer 179

B. You actually can’t increase network throughput with multiple interfaces, making B false. All three other options are legitimate reasons to attach multiple interfaces to an instance.

Question 180

Which of the following can you not do with regard to network interfaces? A) Detach a secondary interface from an instance. B) Attach an elastic network interface to an instance with an existing interface. C) Detach a primary interface from an instance. D) Attach an elastic network interface to a different instance than originally attached.

Answer 180

C. An instance’s primary network interface cannot be detached (C), making that the correct answer. You can detach secondary interfaces (A), attach multiple interfaces (B), and move network interfaces (D).

Question 181

Which of the following is not a valid attribute for an elastic network interface? A) An IPv6 address B) An IPv4 address C) A source/destination check flag D) A routing table

Answer 181

D. Elastic network interfaces do not have routing tables, but they do have (or can have) IPv4 and IPv6 addresses and a source/destination check flag.

Question 182

Why might you use an elastic IP address? A) You need an IPv4 address for a specific instance. B) You need an IPv6 address for a specific instance. C) You want to mask the failure of an instance to network clients. D) You want to avoid making changes to your security groups.

Answer 182

C. Elastic IP addresses are specifically for avoiding being tied to a specific instance, so A and B are not correct. Security groups are typically not associated with a specific IP address (D). This leaves C, a valid reason for an elastic IP address: It can move from one instance (if the instance fails) to another.

Question 183

Which of the following can you not do with an elastic IP address? A) Change the IP address associated with it while it is in use. B) Move it from one instance to another. C) Move it across VPCs. D) Associate it with a single instance in a VPC.

Answer 183

A. Elastic IP addresses are, by definition, an IP address that will not change, so A is correct—you cannot change the IP address while it is in use. You can move elastic IPs (B), including across VPCs (C), and you absolutely would associate it with a single instance (D).

Question 184

Which of the following are advantages of an elastic IP? (Choose two.) A) Reduces the number of IP addresses your VPC uses B) Provides protection in case of an instance failure C) Allows all attributes of a network interface to be moved at one time D) Provides multiple IP addresses for a single instance

Answer 184

B, C. An elastic IP can mask the failure of an instance (B) by moving traffic to another running instance transparently. It also allows all the network interface attributes to be moved at one time (C).

Question 185

Which of the following would you need to do to create an elastic IP address? (Choose two.) A) Allocate an elastic IP address for use in a VPC. B) Allocate an IP address in Route 53. C) Detach the primary network interface on an instance. D) Associate the elastic IP to an instance in your VPC.

Answer 185

A, D. To use an elastic IP, you must first allocate it for use in a VPC and then associate it with an instance in that VPC (A and D). Route 53 is not involved at this stage, and you cannot detach the primary network interface on an instance.

Question 186

Which of these is not a valid means of working with an Amazon EBS snapshot? A) The AWS API B) The AWS CLI C) The AWS console D) The AWS EBS management tool

Answer 186

D. There is not such thing as an “EBS management tool” separate from the AWS API, CLI, and console.

Question 187

Where are individual instances provisioned? A) In a VPC B) In a region C) In an availability zone D) In an Auto Scaling group

Answer 187

C. Although instances exist in a region and VPC, and can be part of an Auto Scaling group, they are provisioned into specific availability zones (C).

Question 188

How are EBS snapshots backed up to S3? A) Incrementally B) In full, every time they are changed C) EBS snapshots are backed up to RDS. D) Sequentially

Answer 188

A. EBS snapshots are backed up to S3 incrementally.

Question 189

You have an existing IAM role in use by several instances in your VPC. You make a change in the role, removing permissions to access S3. When does this change take effect on the instances already attached to the role? A) Immediately B) Within 60 seconds C) The next time the instances are restarted D) The instances preserve the pre-change permissions indefinitely.

Answer 189

A. Changes to IAM roles take place immediately.

Question 190

How many IAM roles can you attach to a single instance? A) One B) One or two C) As many as you want D) None, roles are not assigned to instances.

Answer 190

A. You can only assign a single role to an instance.

Question 191

How can you attach multiple IAM roles to a single instance? (Choose two.) A) You can attach as many roles as you want to an instance. B) You cannot, but you can combine the policies each role uses into a single new role and assign that. C) You can assign two IAM roles to an instance, but no more than that. D) You cannot; only one role can be assigned to an instance.

Answer 191

B, D. You can only assign a single role to an instance (D), but you can also create a new role that combines the desired policies (B).

Question 192

You need to make a change to a role attached to a running instance. What do you need to do to ensure the least amount of downtime? (Choose two.) A) Update the IAM role via the console or AWS API or CLI. B) Re-attach the updated role to the instance. C) Restart the instance. D) Other than updating the role, no additional changes are needed.

Answer 192

A, D. You always need to make the actual role changes (A). There are then no more actions required for these changes to take effect on the instances.

Question 193

You have a new set of permissions that you want to attach to a running instance. What do you need to do to ensure the least amount of downtime? (Choose two.) A) Remove the instance’s IAM role via the console or AWS API or CLI. B) Create a new IAM role with the desired permissions. C) Stop the instance, assign the role, and restart the instance. D) Attach the new role to the running instance.

Answer 193

B, D. You’ll first need to create an IAM role with the desired permissions (B). Then, you can attach the role to a running instance to avoid downtime completely (D). Note that this is relatively new; older versions of AWS required restarting the instance.

Question 194

How can you delete a snapshot of an EBS volume when it’s used as the root device of a registered AMI? A) You can’t. B) You can, but only using the AWS API or CLI. C) Delete the snapshot using the AWS console. D) Ensure that you have correct IAM privileges and delete the AMI.

Answer 194

A. If a snapshot is the root device of a registered AMI, it cannot be deleted.

Question 195

Which of these is the best option for encrypting data at rest on an EBS volume? A) Configure the volume’s encryption at creation time. B) Configure AES 256 encryption on the volume once it’s been started. C) Configure encryption using the OS tools on the attached EC2 instance. D) Back up the data in the volume to an encrypted S3 bucket.

Answer 195

A. Encryption can only be applied to EBS volumes at creation time, so A is correct.

Question 196

How can you ensure that an EBS root volume persists beyond the life of an EC2 instance, in the event that the instance is terminated? A) The volume will persist automatically. B) Configure the EC2 instance to not terminate its root volume and the EBS volume to persist. C) You cannot; root volumes always are deleted when the attached EC2 instance is terminated. D) Ensure that encryption is enabled on the volume and it will automatically persist.

Answer 196

B. By default, root volumes do get deleted when the associated instance terminates. However, you can configure this to not be the case using the AWS console or CLI (B).

Question 197

Which of the following is not part of the well-architected framework? A) Apply security at all layers. B) Enable traceability. C) Use defaults whenever possible. D) Automate responses to security events.

Answer 197

C. Using defaults is not part of the well-architected framework, and it often is not the most secure approach.

Question 198

Which of the following should you attempt to automate, according to the AWS well- architected framework? (Choose two.) A) Security best practices B) Scaling instances C) Responses to security events D) IAM policy creation

Answer 198

A, C. The well-architected framework recommends automating security best practices and responses to security events.

Question 199

Which of the following statements are true? (Choose two.) A) You are responsible for security in the cloud. B) AWS is responsible for security of the cloud. C) AWS is responsible for security in the cloud. D) You are responsible for security of the cloud.

Answer 199

A, B. AWS is responsible for securing the cloud itself, and then you as a customer are responsible for securing your resources and data in the cloud.

Question 200

For which of the following is AWS responsible for security? (Choose two.) A) Edge locations B) Firewall configuration C) Network traffic D) Availability zones

Answer 200

A, D. AWS is responsible for securing the cloud itself, which means anything that is infrastructure, such as edge locations and availability zones.

Question 201

For which of the following is AWS not responsible for security? A) Networking infrastructure B) RDS database installations C) S3 buckets D) Networking traffic

Answer 201

D. AWS is responsible for networks, but not the actual traffic across those networks (D).

Question 202

For which of the following are you not responsible for security? A) DynamoDB B) Operating system configuration C) Server-side encryption D) Application keys

Answer 202

A. AWS manages DynamoDB as a managed service. All the other options are your responsibility as a customer of AWS.

Question 203

Which of the following is not included in the well-architected framework’s definition of security? A) Data protection B) Infrastructure protection C) Reduction of privileges D) Defective controls

Answer 203

C. The well-architected framework includes four areas for security in the cloud: data protection, infrastructure protection, privilege management, and defective controls.

Question 204

Which of the following is a principle of the well-architected framework’s security section? A) Encrypt the least amount of data possible. B) Always encrypt the most important data. C) Encrypt everything where possible. D) Encrypt data at rest.

Answer 204

C. The well-architected framework suggests encrypting everything where possible, whether it is at rest or in transit.

Question 205

Which of the following are principles of the well-architected framework’s security section? (Choose two.) A) Encrypt data at rest. B) Encrypt data in transit. C) Encrypt data in groups rather than individually. D) Encrypt data at the destination.

Answer 205

A, B. The well-architected framework suggests encrypting everything where possible, whether the data is at rest or in transit.

Question 206

Who is responsible for encrypting data in the cloud? A) You B) AWS C) AWS provides mechanisms such as key rotation for which they are responsible, but you are responsible for appropriate usage of those mechanisms. D) AWS provides an API, but you are responsible for security when using that API.

Answer 206

C. While you are ultimately responsible for the security of your data, AWS provides and accepts responsibility for tools to enable security.

Question 207

What is the term used to represent the resiliency of data stored in S3? A) 9 9s B) 11 9s C) 7 9s D) 99th percentile

Answer 207

B. S3 durability is 99.999999999%, which is often called “11 9s” (or sometimes “11 nines”) of durability.

Question 208

Which of these statements is not true? A) AWS recommends encrypting data at rest and in transit. B) AWS will never move data between regions unless initiated by the customer. C) AWS will initiate moving data between regions if needed. D) Customers move data between regions rather than AWS.

Answer 208

C. AWS will never initiate the movement of data between regions. Content in a region must be moved by the customer or moved in response to a customer action.

Question 209

Which of the following can be part of a strategy to avoid accidental data overwriting of S3 data? A) IAM roles B) MFA Delete C) Versioning D) All of these

Answer 209

D. S3 data can be protected via MFA Delete and versioning, both of which provide a layer of protection against accidental deletes. Additionally, IAM roles can ensure that only those who should be able to delete data can delete data.

Question 210

Which of the following should always be done to protect your AWS environment? (Choose two.) A) Enable MFA on the root account. B) Enable MFA Delete on your S3 buckets. C) Set a password rotation policy for users. D) Create custom IAM roles for all users.

Answer 210

A, C. All of these options are valid, but only two should be done for all environments: enabling MFA on the root account and setting a password rotation policy. Enabling MFA Delete on S3 is a good idea but may not apply to all situations. Further, not all users may need an IAM role; some, for example, are fine with the default roles.

Question 211

At what level does infrastructure protection exist in AWS? A) The physical hardware layer B) OSI layer 4 C) The VPC layer D) OSI layer 7

Answer 211

C. AWS infrastructure operates at the VPC layer and is almost entirely virtual.

Question 212

Which of the following might be used to detect or identify a security breach in AWS? (Choose two.) A) CloudWatch B) CloudFormation C) CloudTrail D) Trusted Advisor

Answer 212

A, C. CloudWatch and CloudTrail both provide monitoring and logging, both of which can identify security breaches. CloudFormation is a deployment mechanism, and Trusted Advisor can identify potential holes, but not actual breaches.

Question 213

Which of the following AWS services is associated with privilege management? A) AWS Config B) RDS C) IAM D) VPC

Answer 213

C. IAM provides access management through users, roles, and permissions, all of which are related to privileges.

Question 214

Which of the following AWS services is associated with privilege management? A) Internet gateway B) S3-IA C) CloudTrail D) MFA

Answer 214

D. MFA is Multi-Factor Authentication, which adds a layer of protection related to privilege management.

Question 215

Which of the following AWS services is associated with identifying potential security holes? A) Trusted Advisor B) CloudFormation C) Security Detector D) Security Advisor

Answer 215

A. Trusted Advisor is AWS’s service for looking at your system and finding standard “holes” in your infrastructure that might allow for security breaches and then to suggest remediation.

Question 216

Which of the following is not one of the five pillars in the cloud defined by the AWS well-architected framework? A) Operational excellence B) Performance efficiency C) Organizational blueprint D) Cost optimization

Answer 216

C. AWS’s well-architected framework provides for five pillars: operational excellence, security, reliability, performance efficiency, and cost optimization. Organizational issues are considered outside of this framework (C).

Question 217

Which of the following is not one of the five pillars in the cloud defined by the AWS well-architected framework? A) Performance efficiency B) Usability C) Security D) Reliability

Answer 217

B. AWS’s well-architected framework provides for five pillars: operational excellence, security, reliability, performance efficiency, and cost optimization. Usability is not a key concern of the cloud (B), although it is important for applications hosted within the cloud.

Question 218

Which of the following is not one of the security principles recommended by AWS’s well-architected framework? A) Automate security best practices. B) Enable traceability. C) Apply security at the highest layers. D) Protect data in transit and at rest.

Answer 218

C. C is a misstatement of the correct principle; apply security at all layers. Security should be present at all layers, not just at the highest layers.

Question 219

Which of the following is one of the security principles recommended by AWS’s well-architected framework? A) Make sure all users have passwords. B) Only protect data at rest. C) Turn on MFA Delete for S3 buckets. D) Keep people away from data.

Answer 219

D. While A and C are both good ideas, they are more specific than the well-architected framework’s principles. B is a part of a principle, but data should be protected at rest and in transit. This leaves D, and people should be kept away from direct access to data. Instead, tools and APIs should provide a layer between users and data.

Question 220

The AWS’s well-architected framework defines five areas to consider with respect to security. Choose the two that are part of this set. (Choose two.) A) Identity and Access Management B) User management C) Virtual private networks D) Incident response

Answer 220

A, D. The five areas are Identity and Access Management (A), detective controls, infrastructure protection, data protection, and incident response (D).

Question 221

Who is responsible for physically securing the infrastructure that supports cloud services? A) AWS B) You C) Your users D) AWS and you have joint responsibility.

Answer 221

A. AWS takes responsibility for physically securing cloud infrastructure.

Question 222

Which of the following statements about the root account in an AWS account are true? (Choose two.) A) It is the first account created. B) It is ideal for everyday tasks. C) It is intended primarily for creating other users and groups. D) It has access keys that are important to keep.

Answer 222

A, C. The root account is the first account in every account (A), but it should only be used for creating other users and groups (C). It is not intended for everyday tasks (B), and once account setup is complete, you are encouraged by AWS to delete any access keys (D).

Question 223

Which of the following are appropriate password policy requirements? (Choose two.) A) Maximum length B) Recovery C) Minimum length D) Complexity

Answer 223

C, D. A good password policy has minimum length and complexity requirements.

Question 224

What additional requirements should users that can access the AWS console have? A) Users with console access should have more stringent password policy requirements. B) Users with console access should have to use their access keys to log in. C) Users with console access should be required to use MFA. D) None. These users should be treated the same as other users.

Answer 224

C. Users with console access are more privileged users and should be required to use MFA (C). Password policies apply to all users, so A is incorrect. Further, passwords are the mechanism for logging into the console, so B is wrong in that access keys are not used for console login.

Question 225

Which of the following provide a means of federating users from an existing organization? (Choose two.) A) SAML 2.0 B) Web identities C) LDAP D) UML 2.0

Answer 225

A, B. SAML 2.0 and web identities both provide a means of working with an existing organizational identity provider.

Question 226

Which of the following principles suggests ensuring that authenticated identities are only permitted to perform the most minimal set of functions necessary? A) Principle of lowest privilege B) Principle of least priority C) Principle of least privilege D) Principle of highest privilege

Answer 226

C. The principle of least privilege suggests that users only be allowed to do what they have to in order to perform their job functions.

Question 227

What is an AWS Organizations OU? A) Orchestration unit B) Organizational unit C) Operational unit D) Offer of urgency

Answer 227

B. AWS Organizations groups accounts into organizational units (OUs), allowing for groupings of permissions and roles.

Question 228

What is an AWS Organizations SCP? A) Service control policy B) Service control permissions C) Standard controlling permissions D) Service conversion policy

Answer 228

A. An SCP in AWS Organizations is a service control policy and can be applied to an organizational unit (OU) to affect all users within that OU. It effectively applies permissions at an organizational level, much the way that a group applies them at a user level.

Question 229

To which of the following constructs is an AWS Organizations SCP applied? A) To a service control policy B) To an IAM role C) To an organizational unit D) To a SAML user store

Answer 229

C. Service control policies (SCPs) are applied to OUs (organizational units) in AWS Organizations.

Question 230

Which of the following can be used to centrally control AWS services across multiple AWS accounts? A) A service control policy B) An organizational unit C) An LDAP user store D) IAM roles

Answer 230

A. Service control policies (SCPs) provide for working across AWS accounts (A). Organizational units (OUs) are groupings of accounts, and IAM roles are applied to users and groups, not cross-account structures.

Question 231

What AWS service would you use for managing and enforcing policies for multiple AWS accounts? A) AWS Config B) AWS Trusted Advisor C) AWS Organizations D) IAM

Answer 231

C. AWS Organizations offers a means of organizing and managing policies that span AWS accounts.

Question 232

Which of the following does AWS provide to increase privacy and control network access? A) Network firewalls built into Amazon VPC B) Encryption in transit with TLS across all services C) Connections that enable private and dedicated connections from an on-premises environment D) All of these

Answer 232

D. AWS provides all of the above options as a means of providing security of the AWS environment.

Question 233

You have an application that uses S3 standard for storing large data. Your company wants to ensure that all data is encrypted at rest while avoiding adding work to your current development sprints. Which S3 encryption solution should you use? A) SSE-C B) SSE-S3 C) SSE-KMS D) Amazon S3 Encryption Client

Answer 233

B. SSE-S3 offers encryption at rest while deferring key management to AWS. SSE-KMS does the same but has a higher cost and is more suitable for stringent auditing. The other two options involve work on the client side, which the question states is undesirable.

Question 234

You are the architect of an application that allows users to send private messages back and forth. You want to ensure encryption of the messages when stored in S3 and a strong auditing trail in case of a breach. You also want to capture any failed attempts to access data. What Amazon encryption solution would you use? A) SSE-C B) SSE-S3 C) SSE-KMS D) Amazon S3 Encryption Client

Answer 234

C. SSE-KMS is the best solution for any encryption problem that requires a strong audit trail.

Question 235

Your company has just hired three new developers. They need immediate access to a suite of AWS services. What is the best approach to giving these developers access? A) Give the developers the admin credentials and change the admin password when they are finished for the day. B) Create a new IAM user for each developer and assign the required permissions to each user. C) Create a new IAM user for each developer, create a single group with the required permissions, and assign each user to that group. D) Create a new SCP and assign the SCP to an OU with each user’s credentials within that OU.

Answer 235

C. New users should be given a new IAM user, and when permissions are the same across users, a group should be used instead of individually assigning permissions.

Question 236

Your application requires a highly available storage solution. Further, the application will serve customers in the EU and must comply with EU privacy laws. What should you do to provide this storage? A) Create a new EC2 instance in EU-Central-1 and set up EBS volumes in a RAID configuration attached to that instance. B) Create a new S3 standard bucket in EU-West-1. C) Create a new Glacier vault in EU-South-1. D) Create a new Auto Scaling group in EU-West-1 with at least three EC2 instances, each with an attached Provisioned IOPS EBS volume.

Answer 236

B. Most of these answers are overly complicated. S3 is highly available by default, so simply setting up a bucket in an EU region is sufficient.

Question 237

Which of the following provides SSL for data in transit? A) S3 standard B) S3 One Zone-IA C) Glacier D) All of these

Answer 237

D. All S3 storage classes provide SSL for data at transit as well as encryption of data at rest.

Question 238

Which of the following does not provide encryption of data at rest? A) S3 standard B) S3 One Zone-IA C) Glacier D) All of these encrypt data at rest.

Answer 238

D. All S3 storage classes provide SSL for data at transit as well as encryption of data at rest.

Question 239

What is the AWS shared responsibility model? A) A model that defines which components AWS secures and which you as an AWS customer must secure B) A model that defines which components you secure and which components your customers must secure C) A model that defines how connections between offices or on-premises data centers and the cloud must work together to secure data that moves between the two D) A model that defines how the five pillars of the AWS well-architected framework interact

Answer 239

A. The shared responsibility model defines the portions of the cloud that AWS secures, and the portions that you, the AWS customer, must secure.

Question 240

Which of the following is not one of the types of services that AWS offers, according to the shared responsibility model? A) Infrastructure services B) Managed services C) Containers services D) Abstracted services

Answer 240

B. This is pretty tough unless you’ve read the AWS shared responsibility white papers and FAQs. It’s really a matter of memorization and knowing that while AWS uses the term managed services in lots of areas, that term is not used in the shared responsibility model as one of the core types of services.

Question 241

For which of the following are you not responsible for security? A) Operating systems B) Credentials C) Virtualization infrastructure D) AMIs

Answer 241

C. AWS is responsible for the security of virtualization infrastructure. All other items in this list are your responsibility. As a hint on questions like this and related to the AWS shared responsibility model, AWS is typically responsible for anything with the word infrastructure, although there are some exclusions (for example, application infrastructure).

Question 242

Which of the following is used to allow EC2 instances to access S3 buckets? A) IAM role B) IAM policy C) IAM user D) AWS organizational unit

Answer 242

A. An IAM role is assumed by an EC2 instance when it needs to access other AWS services, and that role has permissions associated with it. While these permissions are formally defined in a policy (B), it is the role that is used by the instance for actual service access.

Question 243

You have a task within a Docker container deployed via AWS ECS. The application cannot access data stored in an S3 bucket. What might be the problem? (Choose two.) A) The IAM role associated with the task doesn’t have permissions to access S3. B) The task is not in a security group with inbound access allowed from S3. C) The task does not have access to an S3 VPC endpoint. D) There is no policy defined to allow ECS tasks to access S3.

Answer 243

A, D. Just as is the case with a compute instance (EC2), a task in a container needs an IAM role with permissions to access S3 (A), which in turn requires a policy specifying a permission that lets ECS tasks access S3 (D). Both of these are required to ensure access. Security groups apply to network traffic and would not affect S3 access, and while a VPC endpoint could be used (C), it is not required.

Question 244

What is the default security on a newly created S3 bucket? A) Read-only B) Read and write is permitted from EC2 instances in the same region. C) Completely private, reads and writes are disallowed. D) There is no policy defined to allow ECS tasks to access S3.

Answer 244

C. By default, newly created S3 buckets are private. They can only be accessed by a user that has been granted explicit access.