Quiz
AWS - SAA
Dieses Quiz hat ein Zeitlimit und öffnet sich deshalb im gewohnten Player.
Fragen in diesem Quiz (105)
1Which of the following are characteristics of Amazon VPC subnets? Choose 2 answers
- AEach subnet spans at least 2 Availability Zones to provide a high-availability environment.
- BEach subnet maps to a single Availability Zone.
- CCIDR block mask of/25 is the smallest range supported.
- DBy default, all subnets can route between each other, whether they are private or public.
- EInstances in a private subnet can communicate with the Internet only if they have an Elastic IP.
2Your web application front end consists of multiple EC2 instances behind an Elastic Load Balancer. You configured ELB to perform health checks on these EC2 instances, if an instance fails to pass health checks, which statement will be true?
- AThe instance gets terminated automatically by the ELB.
- BThe instance gets quarantined by the ELB for root cause analysis.
- CThe instance is replaced automatically by the ELB.
- DThe ELB stops sending traffic to the instance that failed its health check.
3In AWS, which security aspects are the customer’s responsibility? Choose 4 answers
- ASecurity Group and ACL (Access Control List) settings
- BDecommissioning storage devices
- CPatch management on the EC2 instance’s operating system
- DLife-cycle management of IAM credentials
- EControlling physical access to compute resources
- FEncryption of EBS (Elastic Block Storage) volumes
4For which of the following use cases are Simple Workflow Service (SWF) and Amazon EC2 an appropriate solution? Choose 2 answers
- AUsing as an endpoint to collect thousands of data points per hour from a distributed fleet of sensors
- BManaging a multi-step and multi-decision checkout process of an e-commerce website
- COrchestrating the execution of distributed and auditable business processes
- DUsing as an SNS (Simple Notification Service) endpoint to trigger execution of video transcoding jobs
- EUsing as a distributed session store for your web application
5A customer needs to capture all client connection information from their load balancer every five minutes. The company wants to use this data for analyzing traffic patterns and troubleshooting their applications. Which of the following options meets the customer requirements?
- AEnable AWS CloudTrail for the load balancer.
- BEnable access logs on the load balancer.
- CInstall the Amazon CloudWatch Logs agent on the load balancer.
- DEnable Amazon CloudWatch metrics on the load balancer.
6A company needs to deploy virtual desktops to its customers in a virtual private cloud, leveraging existing security controls. Which set of AWS services and features will meet the company’s requirements?
- AVirtual Private Network connection. AWS Directory Services, and ClassicLink
- BVirtual Private Network connection. AWS Directory Services, and Amazon Workspaces
- CAWS Directory Service, Amazon Workspaces, and AWS Identity and Access Management
- DAmazon Elastic Compute Cloud, and AWS Identity and Access Management
7You are working with a customer who is using Chef configuration management in their data center. Which service is designed to let the customer leverage existing Chef recipes in AWS?
- AAmazon Simple Workflow Service
- BAWS Elastic Beanstalk
- CAWS CloudFormation
- DAWS OpsWorks
8Which of the following are true regarding AWS CloudTrail? Choose 3 answers
- ACloudTrail is enabled globally
- BCloudTrail is enabled by default
- CCloudTrail is enabled on a per-region basis
- DLogs can be delivered to a single Amazon S3 bucket for aggregation.
- ECloudTrail is enabled for all available services within a region.
- FLogs can only be processed and delivered to the region in which they are generated.
- GCloudTrail is enabled on a per-service basis.
9A company has an AWS account that contains three VPCs (Dev, Test, and Prod) in the same region. Test is peered to both Prod and Dev. All VPCs have non-overlapping CIDR blocks. The company wants to push minor code releases from Dev to Prod to speed up time to market. Which of the following options helps the company accomplish this?
- ACreate a new peering connection Between Prod and Dev along with appropriate routes.
- BCreate a new entry to Prod in the Dev route table using the peering connection as the target.
- CAttach a second gateway to Dev. Add a new entry in the Prod route table identifying the gateway as the target.
- DThe VPCs have non-overlapping CIDR blocks in the same account. The route tables contain local routes for all VPCs.
10You need to configure an Amazon S3 bucket to serve static assets for your public-facing web application. Which methods ensure that all objects uploaded to the bucket are set to public read? Choose 2 answers
- ASet permissions on the object to public read during upload.
- BConfigure the bucket ACL to set all objects to public read.
- CConfigure the bucket policy to set all objects to public read.
- DUse AWS Identity and Access Management roles to set the bucket to public read.
- EAmazon S3 objects default to public read, so no action is needed.
11Which method can be used to prevent an IP address block from accessing public objects in an S3 bucket?
- ACreate a bucket policy and apply it to the bucket
- BCreate a NACL and attach it to the VPC of the bucket
- CCreate an ACL and apply it to all objects in the bucket
- DModify the IAM policies of any users that would access the bucket
12A root account owner has given full access of his S3 bucket to one of the IAM users using the bucket ACL. When the IAM user logs in to the S3 console, which actions can he perform?
- AHe can just view the content of the bucket
- BHe can do all the operations on the bucket
- CIt is not possible to give access to an IAM user using ACL
- DThe IAM user can perform all operations on the bucket using only API/SDK
13A bucket owner has allowed another account’s IAM users to upload or access objects in his bucket. The IAM user of Account A is trying to access an object created by the IAM user of account B. What will happen in this scenario?
- AThe bucket policy may not be created as S3 will give error due to conflict of Access Rights
- BIt is not possible to give permission to multiple IAM users
- CAWS S3 will verify proper rights given by the owner of Account A, the bucket owner as well as by the IAM user B to the object
- DIt is not possible that the IAM user of one account accesses objects of the other IAM user
14You have launched an Amazon Elastic Compute Cloud (EC2) instance into a public subnet with a primary private IP address assigned, an internet gateway is attached to the VPC, and the public route table is configured to send all Internet-based traffic to the Internet gateway. The instance security group is set to allow all outbound traffic but cannot access the internet. Why is the Internet unreachable from this instance?
- AThe instance does not have a public IP address.
- BThe internet gateway security group must allow all outbound traffic.
- CThe instance security group must allow all inbound traffic.
- DThe instance “Source/Destination check” property must be enabled.
15Which of the following are characteristics of a reserved instance? Choose 3 answers
- AIt can be migrated across Availability Zones
- BIt is specific to an Amazon Machine Image (AMI)
- CIt can be applied to instances launched by Auto Scaling
- DIt is specific to an instance Type
- EIt can be used to lower Total Cost of Ownership (TCO) of a system
16Which of the following requires a custom CloudWatch metric to monitor?
- AMemory Utilization of an EC2 instance
- BCPU Utilization of an EC2 instance
- CDisk usage activity of an EC2 instance
- DData transfer of an EC2 instance
17You have multiple Amazon EC2 instances running in a cluster across multiple Availability Zones within the same region. What combination of the following should be used to ensure the highest network performance (packets per second), lowest latency, and lowest jitter? Choose 3 answers
- AAmazon EC2 placement groups
- BEnhanced networking
- CAmazon PV AMI
- DAmazon HVM AMI
- EAmazon Linux
- FAmazon VPC
18Please select the Amazon EC2 resource which cannot be tagged.
- AImages (AMIs, kernels, RAM disks)
- BAmazon EBS volumes
- CElastic IP addresses
- DVPCs
19Select the correct set of steps for exposing the snapshot only to specific AWS accounts
- ASelect public for all the accounts and check mark those accounts with whom you want to expose the snapshots and click Save.
- BSelectPrivate, enter the IDs of those AWS accounts, and click Save.
- CSelectPublic, enter the IDs of those AWS accounts, and click Save.
- DSelectPublic, mark the IDs of those AWS accounts as private, and click Save.
20Select the incorrect statement
- AIn Amazon EC2, the private IP addresses only returned to Amazon EC2 when the instance is stopped or terminated
- BIn Amazon VPC, an instance retains its private IP addresses when the instance is stopped.
- CIn Amazon VPC, an instance does NOT retain its private IP addresses when the instance is stopped.
- DIn Amazon EC2, the private IP address is associated exclusively with the instance for its lifetime
21When will you incur costs with an Elastic IP address (EIP)?
- AWhen an EIP is allocated.
- BWhen it is allocated and associated with a running instance.
- CWhen it is allocated and associated with a stopped instance.
- DCosts are incurred regardless of whether the EIP is associated with a running instance.
22You are tasked with setting up a Linux bastion host for access to Amazon EC2 instances running in your VPC. Only clients connecting from the corporate external public IP address 72.34.51.100 should have SSH access to the host. Which option will meet the customer requirement?
- ASecurity Group Inbound Rule: Protocol – TCP. Port Range – 22, Source 72.34.51.100/32
- BSecurity Group Inbound Rule: Protocol – UDP, Port Range – 22, Source 72.34.51.100/32
- CNetwork ACL Inbound Rule: Protocol – UDP, Port Range – 22, Source 72.34.51.100/32
- DNetwork ACL Inbound Rule: Protocol – TCP, Port Range-22, Source 72.34.51.100/0
23If you want to launch Amazon Elastic Compute Cloud (EC2) instances and assign each instance a predetermined private IP address you should:
- ALaunch the instance from a private Amazon Machine Image (AMI).
- BAssign a group of sequential Elastic IP address to the instances.
- CLaunch the instances in the Amazon Virtual Private Cloud (VPC).
- DLaunch the instances in a Placement Group.
- EUse standard EC2 instances since each instance gets a private Domain Name Service (DNS) already.
24An instance is launched into a VPC subnet with the network ACL configured to allow all inbound traffic and deny all outbound traffic. The instance’s security group is configured to allow SSH from any IP address and deny all outbound traffic. What changes need to be made to allow SSH access to the instance?
- AThe outbound security group needs to be modified to allow outbound traffic.
- BThe outbound network ACL needs to be modified to allow outbound traffic.
- CNothing, it can be accessed from any IP address using SSH.
- DBoth the outbound security group and outbound network ACL need to be modified to allow outbound traffic.
25A company is building a two-tier web application to serve dynamic transaction-based content. The data tier is leveraging an Online Transactional Processing (OLTP) database. What services should you leverage to enable an elastic and scalable web tier?
- AElastic Load Balancing, Amazon EC2, and Auto Scaling
- BElastic Load Balancing, Amazon RDS with Multi-AZ, and Amazon S3
- CAmazon RDS with Multi-AZ and Auto Scaling
- DAmazon EC2, Amazon DynamoDB, and Amazon S3
26You have an environment that consists of a public subnet using Amazon VPC and 3 instances that are running in this subnet. These three instances can successfully communicate with other hosts on the Internet. You launch a fourth instance in the same subnet, using the same AMI and security group configuration you used for the others, but find that this instance cannot be accessed from the internet. What should you do to enable Internet access?
- ADeploy a NAT instance into the public subnet.
- BAssign an Elastic IP address to the fourth instance.
- CConfigure a publically routable IP Address in the host OS of the fourth instance.
- DModify the routing table for the public subnet.
27A customer is running a multi-tier web application farm in a virtual private cloud (VPC) that is not connected to their corporate network. They are connecting to the VPC over the Internet to manage all of their Amazon EC2 instances running in both the public and private subnets. They have only authorized the bastion-security-group with Microsoft Remote Desktop Protocol (RDP) access to the application instance security groups, but the company wants to further limit administrative access to all of the instances in the VPC. Which of the following Bastion deployment scenarios will meet this requirement?
- ADeploy a Windows Bastion host on the corporate network that has RDP access to all instances in the VPC.
- BDeploy a Windows Bastion host with an Elastic IP address in the public subnet and allow SSH access to the bastion from anywhere.
- CDeploy a Windows Bastion host with an Elastic IP address in the private subnet, and restrict RDP access to the bastion from only the corporate public IP addresses.
- DDeploy a Windows Bastion host with an auto-assigned Public IP address in the public subnet, and allow RDP access to the bastion from only the corporate public IP addresses.
28Which of the following statements are true about Amazon Route 53 resource records? Choose 2 answers
- AAn Alias record can map one DNS name to another Amazon Route 53 DNS name.
- BA CNAME record can be created for your zone apex.
- CAn Amazon Route 53 CNAME record can point to any DNS record hosted anywhere.
- DTTL can be set for an Alias record in Amazon Route 53.
- EAn Amazon Route 53 Alias record can point to any DNS record hosted anywhere.
29A customer is hosting their company website on a cluster of web servers that are behind a public-facing load balancer. The customer also uses Amazon Route 53 to manage their public DNS. How should the customer configure the DNS zone apex record to point to the load balancer?
- ACreate an A record pointing to the IP address of the load balancer.
- BCreate a CNAME record pointing to the load balancer DNS name.
- CCreate a CNAME record aliased to the load balancer DNS name.
- DCreate an A record aliased to the load balancer DNS name
30How can the domain’s zone apex, for example, “myzoneapexdomain.com”, be pointed towards an Elastic Load Balancer?
- ABy using an Amazon Route 53 Alias record
- BBy using an AAAA record
- CBy using an Amazon Route 53 CNAME record
- DBy using an A record
31Your company is getting ready to do a major public announcement of a social media site on AWS. The website is running on EC2 instances deployed across multiple Availability Zones with a Multi-AZ RDS MySQL Extra Large DB Instance. The site performs a high number of small reads and writes per second and relies on an eventual consistency model. After comprehensive tests you discover that there is read contention on RDS MySQL. Which are the best approaches to meet these requirements? (Choose 2 answers)
- ADeploy ElasticCache in-memory cache running in each availability zone
- BImplement sharding to distribute load to multiple RDS MySQL instances
- CIncrease the RDS MySQL Instance size and Implement provisioned IOPS
- DAdd an RDS MySQL read replica in each availability zone
32Is creating a Read Replica of another Read Replica supported?
- AOnly in certain regions
- BOnly with MySQL based RDS
- COnly for Oracle RDS types
- DNo
33Amazon RDS DB snapshots and automated backups are stored in
- AAmazon S3
- BAmazon ECS Volume
- CAmazon RDS
- DAmazon EMR
34What happens to the I/O operations while you take a database snapshot?
- AI/O operations to the database are suspended for a few minutes while the backup is in progress.
- BI/O operations to the database are sent to a Replica (if available) for a few minutes while the backup is in progress.
- CI/O operations will be functioning normally
- DI/O operations to the database are suspended for an hour while the backup is in progress
35When should I choose Provisioned IOPS over Standard RDS storage?
- AIf you have batch-oriented workloads
- BIf you use production online transaction processing (OLTP) workloads.
- CIf you have workloads that are not sensitive to consistent performance
36You are running a successful multitier web application on AWS and your marketing department has asked you to add a reporting tier to the application. The reporting tier will aggregate and publish status reports every 30 minutes from user-generated information that is being stored in your web application s database. You are currently running a Multi-AZ RDS MySQL instance for the database tier. You also have implemented Elasticache as a database caching layer between the application tier and database tier. Please select the answer that will allow you to successfully implement the reporting tier with as little impact as possible to your database.
- AContinually send transaction logs from your master database to an S3 bucket and generate the reports off the S3 bucket using S3 byte range requests.
- BGenerate the reports by querying the synchronously replicated standby RDS MySQL instance maintained through Multi-AZ.
- CLaunch a RDS Read Replica connected to your Multi AZ master database and generate reports by querying the Read Replica.
- DGenerate the reports by querying the ElastiCache database caching tier.
37You manually launch a NAT AMI in a public subnet. The network is properly configured. Security groups and network access control lists are property configured. Instances in a private subnet can access the NAT. The NAT can access the Internet. However, private instances cannot access the Internet. What additional step is required to allow access from the private instances?
- AEnable Source/Destination Check on the private Instances.
- BEnable Source/Destination Check on the NAT instance.
- CDisable Source/Destination Check on the private instances.
- DDisable Source/Destination Check on the NAT instance.
38An existing application stores sensitive information on a non-boot Amazon EBS data volume attached to an Amazon Elastic Compute Cloud instance. Which of the following approaches would protect the sensitive data on an Amazon EBS volume?
- AUpload your customer keys to AWS CloudHSM. Associate the Amazon EBS volume with AWS CloudHSM. Remount the Amazon EBS volume.
- BCreate and mount a new, encrypted Amazon EBS volume. Move the data to the new volume. Delete the old Amazon EBS volume.
- CUnmount the EBS volume. Toggle the encryption attribute to True. Re-mount the Amazon EBS volume.
- DSnapshot the current Amazon EBS volume. Restore the snapshot to a new, encrypted Amazon EBS volume. Mount the Amazon EBS volume.
39A US-based company is expanding their web presence into Europe. The company wants to extend their AWS infrastructure from Northern Virginia (us-east-1) into the Dublin (eu-west-1) region. Which of the following options would enable an equivalent experience for users on both continents?
- AUse a public-facing load balancer per region to load-balance web traffic, and enable HTTP health checks.
- BUse a public-facing load balancer per region to load-balance web traffic, and enable sticky sessions.
- CUse Amazon Route 53, and apply a geolocation routing policy to distribute traffic across both regions.
- DUse Amazon Route 53, and apply a weighted routing policy to distribute traffic across both regions.
40A company has configured and peered two VPCs: VPC-1 and VPC-2. VPC-1 contains only private subnets, and VPC-2 contains only public subnets. The company uses a single AWS Direct Connect connection and private virtual interface to connect their on-premises network with VPC-1. Which two methods increases the fault tolerance of the connection to VPC-1? Choose 2 answers
- AEstablish a hardware VPN over the internet between VPC-2 ana the on-premises network.
- BEstablish a hardware VPN over the internet between VPC-1 and the on-premises network.
- CEstablish a new AWS Direct Connect connection and private virtual interface in the same region as VPC-2.
- DEstablish a new AWS Direct Connect connection and private virtual interface in a different AWS region than VPC-1
- EEstablish a new AWS Direct Connect connection and private virtual interface in the same AWS region as VPC-1.
41When an EC2 EBS-backed (EBS root) instance is stopped, what happens to the data on any ephemeral store volumes?
- AData is automatically saved in an EBS volume.
- BData is unavailable until the instance is restarted.
- CData will be deleted and will no longer be accessible.
- DData is automatically saved as an EBS snapshot.
42When creation of an EBS snapshot is initiated, but not completed, the EBS volume:
- ACan be used while the snapshot is in progress.
- BCannot be detached or attached to an EC2 instance until the snapshot completes.
- CCan be used in read-only mode while the snapshot is in progress.
- DCannot be used until the snapshot completes.
43How can you secure data at rest on an EBS volume?
- AAttach the volume to an instance using EC2’s SSL interface.
- BWrite the data randomly instead of sequentially.
- CEncrypt the volume using the S3 server-side encryption service.
- DCreate an IAM policy that restricts read and write access to the volume.
- EUse an encrypted file system on top of the EBS volume.
44Which of the following are true regarding encrypted Amazon Elastic Block Store (EBS) volumes? Choose 2 answers
- ASupported on all Amazon EBS volume types
- BSnapshots are automatically encrypted
- CAvailable to all instance types
- DExisting volumes can be encrypted
- EShared volumes can be encrypted
45Which of the following instance types are available as Amazon EBS-backed only? Choose 2 answers
- AGeneral purpose T2
- BGeneral purpose M3
- CCompute-optimized C4
- DCompute-optimized C3
- EStorage-optimized 12
46A t2.medium EC2 instance type must be launched with what type of Amazon Machine Image (AMI)?
- AAn Instance store Hardware Virtual Machine AMI
- BAn Instance store Paravirtual AMI
- CAn Amazon EBS-backed Hardware Virtual Machine AMI
- DAn Amazon EBS-backed Paravirtual AMI
47Which of the following approaches provides the lowest cost for Amazon Elastic Block Store snapshots while giving you the ability to fully restore data?
- AMaintain two snapshots: the original snapshot and the latest incremental snapshot.
- BMaintain a volume snapshot; subsequent snapshots will overwrite one another.
- CMaintain a single snapshot; the latest snapshot is both incremental and complete.
- DMaintain the most current snapshot, archive the original and incremental to Amazon Glacier.
48Your company policies require encryption of sensitive data at rest. You are considering the possible options for protecting data while storing it at rest on an EBS data volume, attached to an EC2 instance. Which of these options would allow you to encrypt your data at rest? (Choose 3 answers)
- AImplement third party volume encryption tools
- BDo nothing as EBS volumes are encrypted by default
- CEncrypt data inside your applications before storing it on EBS
- DEncrypt data using native data encryption drivers at the file system level
- EImplement SSL/TLS for all services running on the server
49How can an EBS volume that is currently attached to an EC2 instance be migrated from one Availability Zone to another?
- ADetach the volume and attach it to another EC2 instance in the other AZ.
- BSimply create a new volume in the other AZ and specify the original volume as the source.
- CCreate a snapshot of the volume, and create a new volume from the snapshot in the other AZ.
- DDetach the volume, then use the ec2-migrate-volume command to move it to another AZ.
50How are the EBS snapshots saved on Amazon S3?
- AExponentially
- BIncrementally
- CEBS snapshots are not stored in the Amazon S3
- DDecrementally
51In order to establish a successful site-to-site VPN connection from your on-premise network to the VPC (Virtual Private Cloud), which of the following needs to be configured inside of the VPC?
- AAssign a public IP address on the customer gateway for the on-premise network
- BModify the main route table to route traffic through a NAT instance
- CNeed to launch a dedicated NAT instance in a public subnet
- DAssign an Elastic IP address to the Virutal Private Gateway
52Which features can be used to restrict access to data in S3? Choose 2 answers
- ASet an S3 ACL on the bucket or the object.
- BCreate a CloudFront distribution for the bucket.
- CSet an S3 bucket policy.
- DEnable IAM Identity Federation
- EUse S3 Virtual Hosting
53You have a content management system running on an Amazon EC2 instance that is approaching 100% CPU utilization. Which option will reduce load on the Amazon EC2 instance?
- ACreate a load balancer, and register the Amazon EC2 instance with it.
- BCreate a CloudFront distribution, and configure the Amazon EC2 instance as the origin.
- CCreate an Auto Scaling group from the instance using the CreateAutoScalingGroup action.
- DCreate a launch configuration from the instance using the CreateLaunchConfiguration action.
54You have a load balancer configured for VPC, and all back-end Amazon EC2 instances are in service. However, your web browser times out when connecting to the load balancer’s DNS name. Which options are probable causes of this behavior? Choose 2 answers
- AThe load balancer was not configured to use a public subnet with an Internet gateway configured.
- BThe Amazon EC2 instances do not have a dynamically allocated private IP address.
- CThe security groups or network ACLs are not property configured for web traffic.
- DThe load balancer is not configured in a private subnet with a NAT instance.
- EThe VPC does not have a VGW configured.
55A company needs to monitor the read and write IOPs metrics for their AWS MySQL RDS instance and send real-time alerts to their operations team. Which AWS services can accomplish this? Choose 2 answers
- AAmazon Simple Email Service
- BAmazon CloudWatch
- CAmazon Simple Queue Service
- DAmazon Route 53
- EAmazon Simple Notification Service
56The Trusted Advisor service provides insight regarding which four categories of an AWS account?
- ASecurity, fault tolerance, high availability, and connectivity
- BSecurity, access control, high availability, and performance
- CPerformance, cost optimization, security, and fault tolerance
- DPerformance, cost optimization, access control, and connectivity
57You would like to create a mirror image of your production environment in another region for disaster recovery purposes. Which of the following AWS resources do not need to be recreated in the second region? (Choose 2 answers)
- ARoute 53 Record Sets
- BIAM Roles
- CElastic IP Addresses (EIP)
- DEC2 Key Pairs
- ELaunch configurations
- FSecurity Groups
58You are designing a social media site and are considering how to mitigate distributed denial-of-service (DDoS) attacks. Which of the below are viable mitigation techniques? (Choose 3 answers)
- AAdd multiple elastic network interfaces (ENIs) to each EC2 instance to increase the network bandwidth.
- BUse dedicated instances to ensure that each instance has the maximum performance possible.
- CUse an Amazon CloudFront distribution for both static and dynamic content.
- DUse an Elastic Load Balancer with auto scaling groups at the web, app and Amazon Relational Database Service (RDS) tiers
- EAdd alert Amazon CloudWatch to look for high Network in and CPU utilization.
- FCreate processes and capabilities to quickly add and remove rules to the instance OS firewall.
59You are building a solution for a customer to extend their on-premises data center to AWS. The customer requires a 50-Mbps dedicated and private connection to their VPC. Which AWS product or feature satisfies this requirement?
- AAmazon VPC peering
- BElastic IP Addresses
- CAWS Direct Connect
- DAmazon VPC virtual private gateway
60When using the following AWS services, which should be implemented in multiple Availability Zones for high availability solutions? Choose 2 answers
- AAmazon DynamoDB
- BAmazon Elastic Compute Cloud (EC2)
- CAmazon Elastic Load Balancing
- DAmazon Simple Notification Service (SNS)
- EAmazon Simple Storage Service (S3)
61You have an Amazon Elastic Cloud Compute (EC2) security group with several running EC2 instances. You change the security group of rules to allow inbound traffic on a new port and protocol, and launch several new instances in the same security group. The new rules apply:
- ATo all instances, but it may take several minutes for old instances to see the changes.
- BImmediately to the new instances, but old instances must be stopped and restarted before the new rules apply. Mark this item for later review.
- CImmediately to the new instances only.
- DImmediately to all instances in the security group.
62You are developing a highly available web application using stateless web sewers. Which services are suitable for storing session state data?
Choose 3 answers- AElastic Load Balancing
- BAmazon ElastiCache
- CAmazon CloudWatch
- DAmazon DynamoDB
- EAmazon Relational Database Service (RDS)
- FAWS Storage Gateway
63You are deploying an application on Amazon Elastic Cloud Compute (EC2) that must call AWS APIs. What method of securely passing credentials to the apptication should you use?
- APass API credentials to the instance using instance userdata
- BUse AWS Identity and Access Management roles for EC2 instances.
- CEmbed the API credentials into your JAR files.
- DStore API credentials as an object in Amazon Simple Storage Service
64You are working with a customer who has 10 TB of archival data that they want to migrate to Amazon Glacier. The customer has a 1-Mbps connection to the Internet. Which service or feature provides the fastest method of getting the data into Amazon Glacier?
- AAmazon Glacier multipart upload
- BAWS Storage Gateway
- CVM Import/Export
- DAWS Import/Export
65A customer has a single 3-TB volume on-premises that is used to hold a large repository of images and print layout files. This repository is growing at 500 GB a year and must be presented as a single logical volume. The customer is becoming increasingly constrained with their local storage capacity and wants an off-site backup of this data, while maintaining low-latency access to their frequently accessed data. Which AWS Storage Gateway configuration meets the customer requirements?
- AGateway-Cached volumes with snapshots scheduled to Amazon S3
- BGateway-Stored volumes with snapshots scheduled to Amazon S3
- CGateway-Virtual Tape Library with snapshots to Amazon S3
- DGateway-Virtual Tape Library with snapshots to Amazon Glacier
66A customer implemented AWS Storage Gateway with a gateway-cached volume at their main office. An event takes the link between the main and branch office offline. Which methods will enable the branch office to access their data? Choose 3 answers
- AUse a HTTPS GET to the Amazon S3 bucket where the files are located
- BRestore by implementing a lifecycle policy on the Amazon S3 bucket.
- CMake an Amazon Glacier Restore API call to load the files into another Amazon S3 bucket within four to six hours.
- DLaunch a new AWS Storage Gateway instance AMI in Amazon EC2, and restore from a gateway snapshot
- ECreate an Amazon EBS volume from a gateway snapshot, and mount it to an Amazon EC2 instance.
- FLaunch an AWS Storage Gateway virtual iSCSI device at the branch office, and restore from a gateway snapshot
67What does specifying the mapping /dev/sdc=none when launching an instance do?
- APrevents /dev/sdc from creating the instance.
- BPrevents /dev/sdc from deleting the instance.
- CSet the value of /dev/sdc to ‘zero’.
- DPrevents /dev/sdc from attaching to the instance.
68Is Federated Storage Engine currently supported by Amazon RDS for MySQL?
- AOnly for Oracle RDS instances
- BNo
- CYes
- DOnly in VPC
69Will my standby RDS instance be in the same Availability Zone as my primary?
- AOnly for Oracle RDS types
- BYes
- COnly if configured at launch
- DNo
70Are Reserved Instances available for Multi-AZ Deployments?
- AOnly for Cluster Compute instances
- BYes for all instance types
- COnly for M3 instance types
- DNo
71Which if the services could spread across Multi-AZ?
- ARDS
- BELB
- CEC2
- DDynamoDB
- EEBS
72You have a business critical application that requires it to be highly available with 6 instances always running. What should you do to achieve this?
(choose 3 correct answers)- AAuto Scaling rule for 6 instances always running
- BAuto scaling rule for 3 instance always running in each zone
- CAuto Scaling Replace the lost capacity in case of zone failure in the other zone
- D2 EC2 in 3 regions with ELB on top
- E3 EC2 in 2 AZ with ELB on top
- FAuto Scaling Replace the lost capacity in case of region failure in other region
73A customer's nightly EMR job processes a single 2-TB data file stored on S3. The amazon EMR job runs on two on-demand core nodes and three on-demand task nodes. Which of the following may help reduce the EMR job completion time? choose 2
- AChange the input split size in the mapreduce job configuration.
- BAdjust the number of simultaneous mapper tasks.
- CUse three spot instances rather than three on-demand instances for the task nodes.
- DUse a bootstrap action to present the s3 bucket as a local filesystem.
- ELaunch the core nodes and task nodes within an amazon virtual cloud.
- FEnable termination protection for the job flow
74You run a two-tiered application with the following components: an Elastic Load Balancer (ELB), three web/application server on Amazon Elastic Compute Cloud (EC2), and one MySQL RDS database. With growing load, database query take longer and longer and slow down the overall response time for user requests. What of the following options could speed up performance ? choose 3
- ACreate an RDS read-replica and redirect half of the database read request to it
- BCache database queries in Amazon ElastiCache
- CShard the database and distribute loads between shards.
- DSetup RDS in Multi-AZ mode.
- EUse AWS CloudFront to cache database queries.
75What is true about RDS?
(choose 3 correct answers)- AYou can create multiple read replica for ready heavy applications
- BDaily backups are automatically taken
- CYou can have provisioned IOPS for your RDS database
- DYou can have a read replica of a read replica
- EYou can enable Multi-AZ option to have automatic failover in a different region
76Which of the following requires a custom cloudwatch metric to monitoring?
- ADisk full percentage of an Elastic Block Store volume
- BDisk usage activity of the ephemeral volumes of an Amazon EC2 instance
- CCPU Utilisation of an Amazon Elastic Compute Cloud (EC2) instance
- DDisk usage activity of an Elastic Block Store volume attached to an Amazon EC2 instance
77How do you achieve single sign on with AWS?
(choose 1 correct answer)- AIt is configurable in the IAM policies for the user
- BBy Using Multi-factor authentication
- CBy Configuring SAML 2.0
- DIt is currently not possible in AWS
- EBy Using Active Directory and LDAP integration
78Your web application is using Auto Scaling and Elastic Load Balancer. You want to monitor the application to ensure that it maintain a good quality of service for your customers, defined by the application’s page load time. What metric in AWS CloudWatch can best be used for this?
(choose one correct answer)- ARequest count reported by ELB
- BAggregate networking for the web tier
- CAggregate CPU Utilisation for the web tier
- DLatency reported by the Elastic Load Balancer(ELB)
79Which of the following benefits does adding Multi-AZ deployment in RDS provide?
(choose multiple if more than one is true)- AMulti-AZ deployed database can tolerate an Availability Zone failure
- BMake database more available during maintenance tasks
- CDecrease latencies if app servers accessing database are in multiple availability zones
- DMake database access times faster for all app servers
80Which of the following is true with respect to serving private content through CloudFront? Choose 3 answers
- ASigned URLs can be created to access objects from CloudFront edge locations
- BMark the S3 bucket private and and create an Origin Access Identity to access the objects
- CDirect access to S3 URLs can be removed therefore allowing access only through CloudFront URLs
- DMark the S3 bucket private and allow access to CloudFront by means of Roles
Previous
81Choose the right statements about EC2 instance
(choose 2 correct answers)- AYou can use the instance based storage for your root volume
- BData on the instance based storage remains intact when you reboot the instance
- CThe instance based storage is automatically saved in S3
- DYou can attach multiple Elastic IPs to a single EC2
- EThe public DNS of the EC2 remains intact when you shut down the EC2 and start it again
82What is true about VPC?
(choose 3 correct answers)- AThere will always be atleast 1 default VPC
- BA VPC is always across multiple availability zones within a region
- CYou may use a third party software VPN to create a site to site or remote access VPN connection with your VPC via the Internet Gateway
- DYou can have one EC2 in more than 1 VPC
- EYou can either have a VPC with public subnet or private subnet
83What action is required to establish an Amazon VPC VPN connection between an on-premises data center and Amazon VPC Virtual Private Gateway?
- AAssign a static internet-routable ip address to Amazon VPC Customer Gateway
- BEstablished a dedicated network connection using AWS Direct Connect
- CModify the main route table to allow traffic to a network address translation instance.
- DUse a dedicated network address translation instance in the public subnet
84You have an Amazon Virtual Private Cloud with a public subnet. Three Amazon Elastic Compute Cloud (EC2) instances currently running inside the subnet can successfully communicate with other hosts on the internet. You launch a fourth instance in the same subnet, using the same amazon machine image (AMI) and security group configuration, you used for others, but find that this instance cannot be accessed from the internet. What should you do to enable internet access?
- AAssign an elastic ip address to the fourth instance.
- BDeploy a NAT instance into the public subnet.
- CModify the routing table for the public subnet.
- DConfigure a publically routable IP address in the host OS of the fourth instance.
85Which one is an operational process performed by AWS for data security?
(choose 1 correct answer)- ADecommissioning of storage device using industry-standard practices
- BAES 256 bit encryption of data stored on any shared storage device
- CReplication of data across multiple geographic regions
- DSecure wiping of EBS volumes when they are un-mounted
- EBackground virus scans of EBS volumes and EBS snapshots
86What combination of the following options will protect Amazon Simple Storage Service (S3) objects from both accidental deletion and accidental overwriting? Choose 2 answers
- AAccess S3 data using only signed URL.
- BEnable multi-factor authentication (MFA) protected access.
- CDisable S3 delete using an IAM bucket policy.
- DEnable S3 versioning on the bucket.
- EEnable S3 Reduced Redundancy Storage.
87After creating a new AWS account, you use the API to request 40 on-demand Amazon Elastic Compute Cloud (EC2) instances in a single Availability Zone. After 20 successful requests, subsequent requests failed. What could be a reason for this issue, and how would you resolve it?
- AYou need to use Amazon Virtual Private Cloud (VPC) in order to provision more than 20 instances in a single Availability Zone. Simply terminate the resources already provisioned and re-launch them all in a VPC.
- BYou encountered an API throttling situation and should try the failed requests using an exponential decay retry algorithm
- CAWS allows you to provision no more than 20 instances per Availability Zone. Select a different Availability Zone and retry the failed request.
- DYou encountered a soft limit of 20 instances per region. Submit the limit increase form and retry the failed requests once approved.
88You have an application running in us-west-2 that requires six EC2 instances running at all times. With three AZs available in that region (us-west-2a, us-west-2b, and us-west-2c), which of the following deployments provides 100 percent fault tolerance if any single AZ in us-west-2 becomes unavailable? Choose 2 answers
- AUs-west-2a with two EC2 instances, us-west-2b with two EC2 instances, and us-west-2c with two EC2 instances
- BUs-west-2a with three EC2 instances, us-west-2b with three EC2 instances, and us-west-2c with no EC2 instances
- CUs-west-2a with four EC2 instances, us-west-2b with two EC2 instances, and us-west-2c with two EC2 instances
- DUs-west-2a with six EC2 instances, us-west-2b with six EC2 instances, and us-west-2c with no EC2 instances
- EUs-west-2a with three EC2 instances, us-west-2b with three EC2 instances, and us-west-2c with three EC2 instances
89You need to design a VPC for a web-application consisting of an Elastic Load Balancer (ELB). a fleet of web/application servers, and an RDS database The entire Infrastructure must be distributed over 2 availability zones. Which VPC configuration works while assuring the database is not available from the Internet?
- AOne public subnet for ELB one public subnet for the web-servers, and one private subnet for the database
- BOne public subnet for ELB two private subnets for the web-servers, two private subnets for RDS
- CTwo public subnets for ELB two private subnets for the web-servers and two private subnets for RDS
- DTwo public subnets for ELB two public subnets for the web-servers, and two public subnets for RDS
90A user wants to access RDS from an EC2 instance using IP addresses. Both RDS and EC2 are in the same region, but different AZs. Which of the below mentioned options help configure that the instance is accessed faster?
- AConfigure the Private IP of the Instance in RDS security group
- BSecurity group of EC2 allowed in the RDS security group
- CConfiguring the elastic IP of the instance in RDS security group
- DConfigure the Public IP of the instance in RDS security group
91Which two components provide connectivity with external networks? When attached to an Amazon VPC which two components provide connectivity with external networks? Choose 2 answers
- AElastic IPs (EIP)
- BNAT Gateway (NAT)
- CInternet Gateway (IGW)
- DVirtual Private Gateway (VGW)
92A company needs to deploy services to an AWS region which they have not previously used. The company currently has
an AWS identity and Access Management (IAM) role for the Amazon EC2 instances, which permits the instance to have
access to Amazon DynamoDB. The company wants their EC2 instances in the new region to have the same privileges.
How should the company achieve this?- ACreate a new IAM role and associated policies within the new region
- BAssign the existing IAM role to the Amazon EC2 instances in the new region
- CCopy the IAM role and associated policies to the new region and attach it to the instances
- DCreate an Amazon Machine Image (AMI) of the instance and copy it to the desired region using the AMI Copy feature
93Which set of Amazon S3 features helps to prevent and recover from accidental data loss?
- AObject lifecycle and service access logging
- BObject versioning and Multi-factor authentication
- CAccess controls and server-side encryption
- DWebsite hosting and Amazon S3 policies
94You are deploying an application to track GPS coordinates of delivery trucks in the United States. Coordinates are transmitted from each delivery truck once every three seconds. You need to design an architecture that will enable realtime processing of these coordinates from multiple consumers. Which service should you use to implement data ingestion?
- AAmazon Kinesis
- BAWS Data Pipeline
- CAmazon AppStream
- DAmazon Simple Queue Service
95A photo-sharing service stores pictures in Amazon Simple Storage Service (S3) and allows application sign-in using an OpenID Connect-compatible identity provider. Which AWS Security Token Service approach to temporary access should you use for the Amazon S3 operations?
- ASAML-based Identity Federation
- BCross-Account Access
- CAWS Identity and Access Management roles
- DWeb Identity Federation
96You try to connect via SSH to a newly created Amazon EC2 instance and get one of the following error messages: "Network error: Connection timed out" or "Error connecting to [instance], reason: -> Connection timed out: connect," You have confirmed that the network and security group rules are configured correctly and the instance is passing status checks. What steps should you take to identify the source of the behavior? Choose 2 answers.
- AVerify that the private key file corresponds to the Amazon EC2 key pair assigned at launch.
- BVerify that your IAM user policy has permission to launch Amazon EC2 instances.
- CVerify that you are connecting with the appropriate user name for your AMI.
- DVerify that the Amazon EC2 Instance was launched with the proper IAM role.
- EVerify that your federation trust to AWS has been established.
97Which of the following services natively encrypts data at rest within an AWS region? Choose 2 answers.
- AAWS Storage Gateway
- BAmazon DynamoDB
- CAmazon CloudFront
- DAmazon Glacier
- EAmazon Simple Queue Service
98A company is building software on AWS that requires access to various AWS services. Which configuration should be used to ensure mat AWS credentials (i.e., Access Key ID/Secret Access Key combination) are not compromised?
- AEnable Multi-Factor Authentication for your AWS root account.
- BAssign an IAM role to the Amazon EC2 instance.
- CStore the AWS Access Key ID/Secret Access Key combination in software comments.
- DAssign an IAM user to the Amazon EC2 Instance.
99Which statements are true about Elastic Network Interface (ENI)? (Choose 2 answers)
- AYou can attach an ENI in one AZ to an instance in another AZ
- BYou can change the security group membership of an ENI
- CYou can attach an instance to tow different subnets within a VPC by using two ENIs
- DYou can attach an ENI in one VPC to an instance in another VPC
100A company is deploying a new two-tier web application in AWS. The company has limited staff and requires
high availability, and the application requires complex queries and table joins. Which configuration provides
the solution for the company’s requirements?- AMySQL Installed on two Amazon EC2 Instances in a single Availability Zone
- BAmazon RDS for MySQL with Multi-AZ
- CAmazon ElastiCache
- DAmazon DynamoDB
101Which of the following are use cases for Amazon DynamoDB? Choose 3 answers.
- AStoring BLOB data.
- BManaging web sessions.
- CStoring JSON documents.
- DStoring metadata for Amazon S3 objects.
- ERunning relational joins and complex updates.
- FStoring large amounts of infrequently accessed data.
102In which of the following situations might you benefit from using DynamoDB? (Choose 2 answers)
- AYou need fully managed database to handle highly complex queries
- BYou need to deal with massive amount of “hot” data and require very low latency
- CYou need a rapid ingestion of clickstream in order to collect data about user behavior
- DYour on-premises data center runs Oracle database, and you need to host a backup in AWS cloud
103What features allows to auto scale ahead of expected load? Choose 2
- AMetric-based
- BHealthe check grace period
- CDesired capacity
- DCooldown period
- EScheduled scaling
104You have a distributed application that periodically processes large volumes of data across multiple Amazon EC2 Instances. The application is designed to recover gracefully from Amazon EC2 instance failures. You are required to accomplish this task in the most cost effective way.
Which of the following will meet your requirements?- ASpot Instances
- BReserved instances
- CDedicated instances
- DOn-Demand instances
105A customer wants to leverage Amazon Simple Storage Service (S3) and Amazon Glacier as part of their backup and archive infrastructure. The customer plans to use third-party software to support this integration. Which approach will limit the access of the third party software to only the Amazon S3 bucket named “company-backup”?
- Acustom bucket policy limited to the Amazon S3 API in three Amazon Glacier archive “company-backup”
- BA custom bucket policy limited to the Amazon S3 API in “company-backup”
- CA custom IAM user policy limited to the Amazon S3 API for the Amazon Glacier archive “company-backup”.
- DA custom IAM user policy limited to the Amazon S3 API in “company-backup”.
Informationen
- Beschreibung
- Quiz am AWS - SAA, erstellt von Linh Phan Van am 12/07/2017.
- Autor
- Linh Phan Van
- Sprache
- English
- Aufrufe
- 216
- Schlagwörter
- Bewertung
- Noch keine Bewertungen Bewerte dieses Quiz