Test
Virtual Private Cloud - Aws
Este test tiene tiempo límite, así que se abre en el reproductor de siempre.
Preguntas del test (41)
1You need to host a set of web servers and database servers in an AWS VPC. Which of the following is a best practice in designing a multi-tier infrastructure?
- AA. Use a public subnet for the web tier and a public subnet for the database layer.
- BB. Use a public subnet for the web tier and a private subnet for the database layer.
- CC. Use a private subnet for the web tier and a private subnet for the database layer.
- DD. Use a private subnet for the web tier and a public subnet for the database layer.
2An IT company has a set of EC2 Instances hosted in a VPC. They are hosted in a private subnet. These instances now need to access resources stored in an S3 bucket. The traffic should not traverse the internet. The addition of which of the following would help fulfill this requirement?
- AA. VPC Endpoint
- BB. NAT Instance
- CC. NAT Gateway
- DD. Internet Gateway
3An application consists of the following architecture:
a. EC2 Instances are in multiple AZ’s behind an ELB.
b. The EC2 Instances are launched via an Auto Scaling Group.
c. There is a NAT instance used so that instances can download updates from the internet.
Due to the high bandwidth being consumed by the NAT instance, it has been decided to use a NAT Gateway.
How should this be implemented?- AA. Use NAT Instances along with the NAT Gateway.
- BB. Host the NAT instance in the private subnet.
- CC. Migrate the NAT Instance to NAT Gateway and hostthe NAT Gateway in the public subnet.
- DD. Convert the NAT instance to a NAT Gateway.
4You are planning on hosting a web and MySQL database application in an AWS VPC. The database should only be accessible by the web server. Which of the following would you change to fulfill this requirement?
- AA. Network Access Control Lists
- BB. AWS RDS Parameter Groups
- CC. Route Tables
- DD. Securityg roups
5Having created a Redshift cluster in AWS, you are trying to use SQL Client tools from an EC2 Instance, but aren’t able to connect to the Redshift Cluster. What must you do to ensure that you are able to connect to the Redshift Cluster from the EC2 Instance?
- AA. Install Redshift client tools on the EC2 Instance first.
- BB. Modify the VPC Security Groups.
- CC. Use the AWS CLI instead of the Redshift client tools.
- DD. Modify the NACL on the subnet.
6Your IT Security department has mandated that all traffic flowing in and out of EC2 instances needs to be monitored. Which of the below services can help achieve this?
- AA. Trusted Advisor
- BB. VPC Flow Logs
- CC. Use CloudWatch metrics
- DD. Use CloudTrail
7You currently have 2 development environments hosted in 2 different VPCs in an AWS account in the same region. There is now a need for resources from one VPC to access another. How can this be accomplished?
- AA. Establish a Direct Connect connection.
- BB. Establish a VPN connection.
- CC. Establish VPC Peering.
- DD. Establish Subnet Peering.
8A company hosts a popular web application that connects to an Amazon RDS MySQL DB instance running in a private VPC subnet created with default ACL settings. The IT Security department has identified a DoS attack from a suspecting IP. How can you protect the subnets from this attack?
- AA. Change the Inbound Security Groups to deny access from the suspecting IP.
- BB. Change the Outbound Security Groups to deny access from the suspecting IP.
- CC. Change the Inbound NACL to deny access from the suspecting IP.
- DD. Change the Outbound NACL to deny access from the suspecting IP.
9You want to set up a public website on AWS. Your requirements are as follows:
You want the database and the application server running on AWS VPC.You want the database to be able to connect to the Internet, specifically for patch upgrades.You do not want to receive any incoming requests from the Internet to the database. Which of the following solutions would best satisfy all the above requirements for this planned public AWS website?
Choose the correct answer from the options below.- AA. Setup the database in a private subnet with a security group which only allowsoutbound traffic.
- BB. Setup the database in a public subnet with a security group which only allowsinbound traffic.
- CC. Setup the database in a local data center and use a private gateway to connect theapplication to the database.
- DD. Setup the public website on a public subnet and set up the database in a privatesubnet which connects to the Internet via a NAT Instance.
10You need to ensure that instances in a private subnet can access the Internet. The solution should be highly available and ensure less maintenance overhead. Which of the following would ideally fit this requirement?
- AA. Host the NAT Instance in the private subnet.
- BB. Host the NAT Instance in the public subnet.
- CC. Use the NAT Gateway in the private subnet.
- DD. Use the NAT Gateway in the public subnet.
11You are required to connect 2 VPCs in different accounts. How can this be achieved?
- AA. Use Security Groups to map both VPCs.
- BB. Use the VPC Route Tables to map both VPCs.
- CC. Use Consolidating billing to connect both accounts.
- DD. Use VPC Peering to connect both VPCs.
12You have created your own VPC and subnet in AWS and launched an instance in that subnet. On attaching an Internet Gateway to the VPC, you see that the instance has a public IP. The route table is shown below: The instance still cannot be reached from the Internet.
Which of the below changes need to be made to the route table to ensure that the issue is resolved?- AA. Add the following entry to the route table 0.0.0.0/0 Internet Gateway
- BB. Modify the above route table 10.0.0.0/16 Internet Gateway
- CC. Add the following entry to the route table 10.0.0.0/16 ->Internet Gateway
- DD. Add the following entry to the route table – 0.0.0.0/16->Internet Gateway
13You plan on hosting a web application consisting of a web server and a database server. These servers are going to be hosted on different EC2 Instances in different subnets in a VPC. Which of the following can be used to ensure that the database server only allows traffic from the web server?
- AA. Make use of Security Groups.
- BB. Make use of VPC Flow Logs.
- CC. Make use of Network Access Control Lists.
- DD. Make use of IAM Roles.
14There is a requirement to host a database server. This server should not be able to connect to the Internet except while downloading required database patches. Which of the following solutions would best satisfy all the above requirements? Choose the correct answer from the options below.
- AA. Setup the database in a private subnet with a security group which only allowsoutbound traffic.
- BB. Setup the database in a public subnet with a security group which only allows inboundtraffic
- CC. Setup the database in a local data center and use a private gateway to connect theapplication to the database.
- DD. Setup the database in a private subnet which connects to the Internet via a NAT Instance.
15A VPC has been setup with a subnet and an internet gateway. The EC2 instance is set up with a public IP but you are still not able to connect to it via the Internet. The right security groups are also in place. What should you do to connect to the EC2 Instance from the Internet?
- AA. Set an Elastic IP Address to the EC2 Instance.
- BB. Set a Secondary Private IP Address to the EC2 Instance.
- CC. Ensure the right route entry is there in the Route table.
- DD. There must be some issue in the EC2 Instance. Check the system logs.
16Currently, you’re helping design and architect a highly available application. After building the initial environment, you discover that a part of your application does not work correctly until port 443 is added to the security group. After adding port 443 to the appropriate security group, how much time will it take before the changes are applied and the application begins working correctly? Choose the correct answer from the options below.
- AA. Generally, it takes 2-5 minutes in order for the rules to propagate.
- BB. Immediately after a reboot of the EC2 Instances belong to that security group.
- CC. Changes apply instantly to the security group, and the application should be able torespond to 443 requests.
- DD. It will take 60 seconds for the rules to apply to all Availability Zones withinthe region.
17A company has assigned two web servers instances to an Elastic Load Balancer. However, the instances and the ELB are not reachable via URL to the elastic load balancer serving the web app data from the EC2 instances. How might you resolve the issue so that your instances are serving the web app data to the public Internet? Choose the correct answer from the options given below
- AA. Attach an Internet Gateway to the VPC and route it to the subnet.
- BB. Add an Elastic IP address to the instance.
- CC. Use Amazon Elastic Load Balancer to serve requests to your instances located in the internal subnet.
- DD. None of the above
18You have been tasked with creating a VPC network topology for your company. The VPC network must support both internet-facing applications and internal-facing applications accessed only over VPN. Both Internet-facing and internal-facing applications must be able to leverage at least 3 AZs for high availability. At a minimum, how many subnets must you create within your VPC to accommodate these requirements?
- AA. 2
- BB. 3
- CC. 4
- DD. 6
19You plan on creating a VPC from scratch and launching EC2 Instances in the subnet. What should be done to ensure that the EC2 Instances are accessible from the Internet?
- AA. Attach an Internet Gateway to the VPC and add a route for 0.0.0.0/0 to the Route table.
- BB. Attach an NAT Gateway to the VPC and add a route for 0.0.0.0/0 to the Route table.
- CC. Attach an NAT Gateway to the VPC and add a route for 0.0.0.0/32 to the Route table.
- DD. Attach an Internet Gateway to the VPC and add a route for 0.0.0.0/32 to the Routetable.
20A company has an on-premises infrastructure which they want to extend to the AWS Cloud. There is a need to ensure that communication across both environments is possible over the Internet. What would you create in this case to fulfill this requirement?
- AA. Create a VPC peering connection between the on-premises and the AWS Environment.
- BB. Create an AWS Direct connection between the on-premises and the AWS Environment.
- CC. Create a VPN connection between the on-premises and the AWS Environment.
- DD. Create a Virtual private gateway connection between the on-premises and the AWS Environment.
21A customer has an instance hosted in the AWS Public Cloud. The VPC and subnet used to host the instance have been created with the default settings for the Network Access Control Lists. An IT Administrator needs to be provided secure access to the underlying instance. How can this be accomplished?
- AA. Ensure the Network Access Control Lists allow Inbound SSH traffic from the IT Administrator’s Workstation.
- BB. Ensure the Network Access Control Lists allow Outbound SSH traffic from the IT Administrator’s Workstation.
- CC. Ensure that the security group allows Inbound SSH traffic from the IT Administrator’s Workstation.
- DD. Ensure that the security group allows Outbound SSH traffic from the IT Administrator’sWorkstation.
22Instances in your private subnet hosted in AWS, need access to important documents in S3. Due to the confidential nature of these documents, you have to ensure that this traffic does not traverse through the internet. As an architect, how would you you implement this solution?
- AA. Consider using a VPC Endpoint.
- BB. Consider using an EC2 Endpoint.
- CC. Move the instances to a public subnet.
- DD. Create a VPN connection and access the S3 resources from the EC2 Instance.
23Your current setup in AWS consists of the following architecture:2 public subnets, one subnet which has web servers accessed by users across the Internet and another subnet for the database server. Which of the following changes to the architecture adds a better security boundary to the resources hosted in this setup?
- AA. Consider moving the web server to a private subnet.
- BB. Consider moving the database server to a private subnet.
- CC. Consider moving both the web and database servers to a private subnet.
- DD. Consider creating a private subnet and adding a NAT Instance to that subnet.
24Your infrastructure in AWS currently consists of a private and public subnet. The private subnet consists of database servers and the public subnet has a NAT Instance which helps the instances in the private subnet to communicate with the Internet. The NAT Instance is now becoming a bottleneck. Which of the following changes to the current architecture can help prevent this issue from occurring in the future?
- AA. Use a NAT Gateway instead of the NAT Instance.
- BB. Use another Internet Gateway for better bandwidth.
- CC. Use a VPC connection for better bandwidth.
- DD. Consider changing the instance type for the underlying NAT Instance
25An instance is launched into a VPC subnet with the network ACL configured to allow all inbound traffic and deny all outbound traffic. The instance’s security group is configured to allow SSH from any IP address and deny all outbound traffic. What changes need to be made to allow SSH access to the instance?
- AA. The Outbound Security Group needs to be modified to allow outbound traffic.
- BB. The Outbound Network ACL needs to be modified to allow outbound traffic.
- CC. Nothing, it can be accessed from any IP address using SSH.
- DD. Both the Outbound Security Group and Outbound Network ACL need to be modified toallow outbound traffic.
26A company has a set of resources hosted in an AWS VPC. Having acquired another company with its own set of resources hosted in AWS, it is required to ensure that resources in the VPC of the parent company can access the resources in the VPC of the child company. How can this be accomplished?
- AA. Establish a NAT Instance to establish communication across VPCs.
- BB. Establish a NAT Gateway to establish communication across VPCs.
- CC. Use a VPN Connection to peer both VPCs.
- DD. Use VPC Peering to peer both VPCs.
27A data processing application in AWS must pull data from an Internet service. A Solutions Architect is to design a highly available solution to access this data without placing bandwidth constraints on the application traffic.]
Which solution meets these requirements?- AA. Launch a NAT gateway and add routes for 0.0.0.0/0
- BB. Attach a VPC endpoint and add routes for 0.0.0.0/0
- CC. Attach an Internet gateway and add routes for 0.0.0.0/0
- DD. Deploy NAT instances in a public subnet and add routes for 0.0.0.0/0
28A company hosts a popular web application that connects to an Amazon RDS MySQL DB instance running in a private VPC subnet created with default ACL settings. The web servers must be accessible only to customers on an SSL connection and the database must only be accessible to web servers in a public subnet. Which solution meets these requirements without impacting other running applications?
Select 2 answers from the options given below.- AA. Createa network ACL on the Web Server’s subnets, allow HTTPS port 443 inbound andspecify the source as 0.0.0.0/0
- BB. Createa Web Server security group that allows HTTPS port 443 inbound traffic from anywhere(0.0.0.0/0) and apply it to the Web Servers.
- CC. Createa DB Server security group that allows MySQL port 3306 inbound and specify thesource as the Web Server security group.
- DD. Createa network ACL on the DB subnet, allow MySQL port 3306 inbound for Web Serversand deny all outbound traffic.
29There is a requirement to get the IP addresses for resources accessed in a private subnet. Which of the following can be used to fulfill this purpose?
- AA. Trusted Advisor
- BB. VPC Flow Logs
- CC. Use CloudWatch metrics
- DD. Use CloudTrail
30An application needs to access data in another AWS account in the same region. Which of the following can be used to ensure that the data can be accessed as required?
- AA. Establish a NAT instance between both accounts.
- BB. Use a VPN between both accounts.
- CC. Use a NAT Gateway between both accounts.
- DD. Use VPC Peering between both accounts.
31An application currently using a NAT Instance is required to use a NAT Gateway. Which of the following can be used to accomplish this?
- AA. Use NAT Instances along with the NAT Gateway.
- BB. Host the NAT Instance in the private subnet.
- CC. Migrate from a NAT Instance to a NAT Gateway and host the NAT Gateway in the public subnet.
- DD. Convert the NAT Instance to a NAT Gateway.
32An application consists of the following architecture:
a. EC2 Instances in multiple AZ’s behind an ELB
b. The EC2 Instances are launched via an Auto Scaling Group.
c. There is a NAT instance which is used so that instances can download updates from the Internet.
Which of the following is a bottleneck in the architecture?- AA. The EC2 Instances
- BB. The ELB
- CC. The NAT Instance
- DD. The Auto Scaling Group
33There is a requirement for EC2 Instances in a private subnet to access an S3 bucket. It is required that the traffic does not traverse to the Internet. Which of the following can be used to fulfill this requirement?
- AA. VPC Endpoint
- BB. NAT Instance
- CC. NAT Gateway
- DD. Internet Gateway
34There is an application which consists of EC2 Instances behind a classic ELB. An EC2 proxy is used for content management to backend instances. The application might not be able to scale properly. Which of the following can be used to scale the proxy and backend instances appropriately? Choose 2 answers from the options given below.
- AA. Use Auto Scaling for the proxy servers.
- BB. Use Auto Scaling for the backend instances.
- CC. Replace the Classic ELB with Application ELB.
- DD. Use Application ELB for both the front end and backend instances.
35A company wants to host a web application and a database layer in AWS. This will be done with the use of subnets in a VPC. Which of the following is a proper architectural design for supporting the required tiers of the application?
- AA. Use a public subnet for the web tier and a public subnet for the database layer.
- BB. Use a public subnet for the web tier and a private subnet for the database layer.
- CC. Use a private subnet for the web tier and a private subnet for the database layer.
- DD. Use a private subnet for the web tier and a public subnet for the database layer.
36An application running on EC2 Instances processes sensitive information stored on Amazon S3. This information is accessed over the Internet. The security team is concerned that the Internet connectivity to Amazon S3 could be a security risk. Which solution will resolve the security concern?
- AA. Access the data through an Internet Gateway.
- BB. Access the data through a VPN connection.
- CC. Access the data through a NAT Gateway.
- DD. Access the data through a VPC endpoint for Amazon S3.
37You have set up a Redshift cluster in AWS and are trying to access it, but are unable to do so. What should be done so that you can access the Redshift Cluster?
- AA. Ensure the Cluster is created in the right Availability Zone.
- BB. Ensure the Cluster is created in the right region.
- CC. Change the security groups for the cluster.
- DD. Change the encryption key associated with the cluster.
38Currently, you have a NAT Gateway defined for your private instances. You need to make the NAT Gateway highly available. How can this be accomplished?
- AA. Create another NAT Gateway and place is behind an ELB.
- BB. Create a NAT Gateway in another Availability Zone.
- CC. Create a NAT Gateway in another region.
- DD. Use Auto Scaling groups to scale the NAT Gateway.
39A Solutions Architect is designing an online shopping application running in a VPC on EC2 Instances behind an ELB Application Load Balancer. The instances run in an Auto Scaling group across multiple Availability Zones. The application tier must read and write data to a customer managed database cluster. There should be no access to the database from the Internet, but the cluster must be able to obtain software patches from the Internet. Which VPC design meets these requirements?
- AA. Public subnets for both the application tier and the database cluster
- BB. Public subnets for the application tier, and private subnets for the database cluster
- CC. Public subnets for the application tier and NAT Gateway, and private subnets for thedatabase cluster
- DD. Public subnets for the application tier, and private subnets for the database clusterand NAT Gateway
40You have an EC2 Instance placed inside a subnet. You have created the VPC from scratch, and added the EC2 Instance to the subnet. It is required to ensure that this EC2 Instance has complete access to the Internet, since it will be used by users on the Internet. Which of the following options would help accomplish this?
- AA. Launch a NAT Gateway and add routes for 0.0.0.0/0
- BB. Attach a VPC Endpoint and add routes for 0.0.0.0/0
- CC. Attach an Internet Gateway and add routes for 0.0.0.0/0
- DD. Deploy NAT Instances in a public subnet and add routes for 0.0.0.0/0
41A company hosts a popular web application that connects to an Amazon RDS MySQL DB instance running in a private VPC subnet created with default ACL settings. The web servers must be accessible only to customers on an SSL connection and the database should only be accessible to web servers in a public subnet. As an architect, which of the following would you not recommend for such an architecture?
- AA. Create a separate web server and database server security group.
- BB. Ensurethe web server security group allows HTTPS port 443 inbound traffic fromanywhere (0.0.0.0/0) and apply it to the web servers.
- CC. Ensurethe web server security group allows MySQL port 3306 inbound traffic fromanywhere (0.0.0.0/0) and apply it to the web servers.
- DD. Ensurethe DB server security group allows MySQL port 3306 inbound and specify thesource as the web server security group.
Información
- Descripción
- Test sobre Virtual Private Cloud - Aws, creado por Romulo Maciel el 15/06/2020.
- Autor
- Romulo Maciel
- Idioma
- Português
- Visitas
- 6
- Etiquetas
- Valoración
- Aún sin valoraciones Valora este test