Quiz
Domain 3.1
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (20)
1When creating a new security group, which of the following are true? (Choose two.)
- AAll inbound traffic is allowed by default.
- BAll outbound traffic is allowed by default.
- CConnections that are allowed in must also explicitly be allowed back out.
- DConnections that are allowed in are automatically allowed back out.
2You have a government-regulated system that will store a large amount of data on S3
standard. You must encrypt all data and preserve a clear audit trail for traceability and
third-party auditing. Security policies dictate that encryption must be consistent across
the entire data store. Which of the following encryption approaches would be best?- ASSE-C
- BSSE-KMS
- CSSE-C (VERIFICAR)
- DEncrypt the data prior to upload to S3 and decrypt the data when returning it to the
client.
3You are creating a bastion host to allow SSH access to a set of EC2 instances in a private
subnet within your organization’s VPC. Which of the following should be done as part of
configuring the bastion host? (Choose two.)- AEnsure that the bastion host is exposed directly to the Internet.
- BPlace the bastion host within the private subnet.
- CAdd a route from the bastion host IP into the private subnet into the subnet’s NACLs.
- DEnsure that the bastion host is within the same security group as the hosts within the
private subnet.
4Which of the following are invalid IAM actions? (Choose two.)
- ALimiting the root account SSH access to all EC2 instances
- BAllowing a user account SSH access to all EC2 instances
- CRemoving console access for the root account
- DRemoving console access for all non-root user accounts
5Which of the following statements is true?
- AYou should store application keys only in your application’s .aws file.
- BYou should never store your application keys on an instance, in an AMI, or anywhere
else permanent on the cloud. - CYou should only store application keys in an encrypted AMI.
- DYou should only use your application key to log in to the AWS console.
6Your company is setting up a VPN connection to connect its local network to an AWS
VPC. Which of the following components are not necessary for this setup? (Choose two.)- AA NAT instance
- BA virtual private gateway
- CA private subnet in the AWS VPC
- DA customer gateway
7You have a private subnet in a VPC within AWS. The instances within the subnet are
unable to access the Internet. You have created a NAT gateway to solve this problem.
What additional steps do you need to perform to allow the instances Internet access?
(Choose two.)- AEnsure that the NAT gateway is in the same subnet as the instances that cannot
access the Internet. - BAdd a route in the private subnet to route traffic aimed at 0.0.0.0/0 at the NAT
gateway. - CAdd a route in the public subnet to route traffic aimed at 0.0.0.0/0 at the NAT
gateway. - DEnsure that the NAT gateway is in a public subnet.
- AEnsure that the NAT gateway is in the same subnet as the instances that cannot
8Which of the following statements regarding NAT instances and NAT gateways are false?
(Choose two.)- ABoth NAT instances and NAT gateways are highly available.
- BYou must choose the instance type and size when creating a NAT gateway but not
when creating a NAT instance. - CIt is your responsibility to patch a NAT instance and AWS’s responsibility to patch a
NAT gateway. - DYou assign a security group to a NAT instance but not to a NAT gateway.
9Which of the following statements is true?
- AA VPC’s default NACLs allow all inbound and outbound traffic.
- BNACLs are stateful.
- CSecurity groups are stateless.
- DTraffic allowed into a NACL is automatically allowed back out.
10You have changed the permissions associated with a role, and that role is assigned to an
existing running EC2 instance. When will the permissions you updated take effect for the
instance?- AImmediately
- BWithin 5 minutes
- CWithin 1 hour
- DThe next time the EC2 instance is restarted
11Which of the following statements is true?
- AWhen creating a new security group, by default, all traffic is allowed in, including
SSH. - BIf you need inbound HTTP and HTTPS access, create a new security group and
accept the default settings. - CYou must explicitly allow any inbound traffic into a new security group.
- DSecurity groups are stateless.
- AWhen creating a new security group, by default, all traffic is allowed in, including
12Which of the following statements is not true?
- AWhen creating a new security group, by default, no inbound traffic is allowed.
- BWhen creating a new security group, by default, all traffic is allowed out, including
SSH. - CWhen creating a new security group, by default, all traffic is allowed out, with the
exception of SSH. - DWhen creating a new security group, inbound HTTPS traffic is not allowed.
13How would you enable encryption of your EBS volumes?
- AUse the AWS CLI with the aws security command.
- BTake a snapshot of the EBS volume and copy it to an encrypted S3 bucket.
- CSelect the encryption option when creating the EBS volume.
- DEncrypt the volume using the encryption tools of the operating system of the EC2
instance that has mounted the EBS volume.
14What types of rules does a security group allow? (Choose two.)
- AAllow rules
- BPrevent rules
- CDeny rules
- DInbound rules
15Which of the following are true about security groups? (Choose two.)
- AYou can specify deny rules, but not allow rules.
- BBy default, a security group includes an outbound rule that allows all outbound
traffic. - CYou can specify specific separate rules for inbound and outbound traffic.
- DSecurity groups are stateless.
16Which of the following are not true about security groups? (Choose two.)
- AAllow rules take priority over deny rules.
- BResponses to allowed inbound traffic are allowed to flow back out.
- CYou can specify specific separate rules for inbound and outbound traffic.
- DIf there are no outbound rules, then all outbound traffic is allowed to flow out.
17Which of the following must a security group have when you create it? (Choose two.)
- AAt least one inbound rule
- BA name
- CA description
- DAt least one outbound rule
18Which of the following is a security group associated with?
- AAn ELB
- BA network interface
- CAn ALB
- DA network access list
19Which of the following are default rules on a default security group, such as the one that
comes with the default VPC? (Choose two.)- AOutbound: 0.0.0.0/0 for all protocols allowed
- BInbound: 0.0.0.0/0 for all protocols allowed
- COutbound: ::/0 for all protocols allowed
- DInbound: ::/0 for all protocols allowed
20Which of the following are parts of a security group rule? (Choose two.)
- AA protocol
- BA subnet
- CAn instance ID
- DA description
Information
- Description
- AWS (AWS - Practice Book Domain 3) Quiz on Domain 3.1, created by Fausto Trindade on 27/02/2020.
- Author
- Fausto Trindade
- Language
- Português
- Views
- 0
- Tags
- Rating
- No ratings yet Rate this quiz