Untitled

AWS questions

• In the AWS Shared Responsibility Model, whose responsibility is it to patch the host operating system of an Amazon EC2 instance?
• Answer : AWS
• Explanation
• Security and Compliance is a shared responsibility between AWS and the customer. This shared model can help relieve the customer’s operational burden as AWS operates, manages and controls the components from the host operating system and virtualization layer down to the physical security of the facilities in which the service operates.
• The customer assumes responsibility and management of the guest operating system (including updates and security patches), other associated application software as well as the configuration of the AWS provided security group firewall. Customers should carefully consider the services they choose as their responsibilities vary depending on the services used, the integration of those services into their IT environment, and applicable laws and regulations.
• The nature of this shared responsibility also provides the flexibility and customer control that permits the deployment. As shown in the chart below, this differentiation of responsibility is commonly referred to as Security OF the Cloud versus Security IN the Cloud.
• This customer/AWS shared responsibility model also extends to IT controls. Just as the responsibility to operate the IT environment is shared between AWS and its customers, so is the management, operation and verification of IT controls shared. AWS can help relieve customer burden of operating controls by managing those controls associated with the physical infrastructure deployed in the AWS environment that may previously have been managed by the customer. As every customer is deployed differently in AWS, customers can take advantage of shifting management of certain IT controls to AWS which results in a (new) distributed control environment.
• Customers can then use the AWS control and compliance documentation available to them to perform their control evaluation and verification procedures as required. Below are examples of controls that are managed by AWS, AWS Customers and/or both.
• Inherited Controls: Controls which a customer fully inherits from AWS.
• - Physical and Environmental controls
• Shared Controls: Controls which apply to both the infrastructure layer and customer layers, but in completely separate contexts or perspectives. In a shared control, AWS provides the requirements for the infrastructure and the customer must provide their own control implementation within their use of AWS services.
• Examples include:
• - Patch Management: AWS is responsible for patching and fixing flaws within the infrastructure, but customers are responsible for patching their guest OS and applications.
• - Configuration Management: AWS maintains the configuration of its infrastructure devices, but a customer is responsible for configuring their own guest operating systems, databases, and applications.
• - Awareness & Training: AWS trains AWS employees, but a customer must train their own employees.
• Customer Specific: Controls which are solely the responsibility of the customer based on the application they are deploying within AWS services.
• Examples include:
• - Service and Communications Protection or Zone Security which may require a customer to route or zone data within specific security environments.
• The host operating system, which is managed by AWS, is the hypervisor that creates several guest operating systems that can be managed by different customers. Amazon EC2 uses a technology commonly known as virtualization to run multiple operating systems on a single physical machine. Virtualization ensures that each guest operating system receives its fair share of CPU time, memory, and I/O bandwidth to the local disk and to the network using a host operating system, sometimes known as a hypervisor. The hypervisor also isolates the guest operating systems from each other so that one guest cannot modify or otherwise interfere with another one on the same machine.
• Hence, the correct answer is AWS.
• Customer is incorrect because their responsibility is to patch the guest operating system of their EC2 instance and not the host operating system.
• Both AWS and the customer is incorrect because patching the host operating system of the Amazon EC2 instance is the responsibility of AWS. Take note that if you are using a fully-managed service like Amazon DynamoDB or Redshift, AWS will also be responsible for the underlying guest operating system.
• Neither AWS nor the customer is incorrect as this task falls under the responsibilities of AWS.
• References:
• https://aws.amazon.com/compliance/shared-responsibility-model/
• https://d1.awsstatic.com/Marketplace/scenarios/security/SEC_02_TSB_Final.pdf
• https://d1.awsstatic.com/whitepapers/Security/Security_Compute_Services_Whitepaper.pdf
• 2. . Which of the following is the most cost-effective instance purchasing option for hosting an application which will run non-interruptible workloads for a period of three years?
• Amazon ec2 standard reserved instances
• Explanation
• Reserved Instances provide you with a significant discount (up to 75%) compared to On-Demand instance pricing. In addition, when Reserved Instances are assigned to a specific Availability Zone, they provide a capacity reservation, giving you additional confidence in your ability to launch instances when you need them.
• Standard Reserved Instances provide you with a significant discount (up to 75%) compared to On-Demand instance pricing and can be purchased for a 1-year or 3-year term. The average discount off On-Demand instances varies based on your term and chosen payment options (up to 40% for 1-year and 60% for a 3-year term). Customers have the flexibility to change the Availability Zone, the instance size, and networking type of their Standard Reserved Instances.
• Convertible Reserved Instances provide you with a significant discount (up to 54%) compared to On-Demand Instances and can be purchased for a 1-year or 3-year term. Purchase Convertible Reserved Instances if you need additional flexibility, such as the ability to use different instance families, operating systems, or tenancies over the Reserved Instance term.
• Hence, the correct answer is Amazon EC2 Standard Reserved Instances.
• The Amazon EC2 Spot Instances option is incorrect because although this is the most cost-effective type, this instance can be interrupted by Amazon EC2 for capacity requirements making it not suitable for non-interruptible workloads.
• The Amazon EC2 Scheduled Reserved Instances option is incorrect because this will just enable you to purchase capacity reservations that recur on a daily, weekly, or monthly basis, with a specified start time and duration for a one-year term only and not for a three-year term. This is more suitable for non-continuous workloads which runs on a specific time of the day only.
• The Amazon EC2 On-Demand Instances option is incorrect because although it is suitable to run non-interruptible workloads for a period of three years, it entails a higher running cost compared to Reserved or Spot instances. In fact, this is actually the most expensive type of EC2 instance and not the cheapest one.
• References:
• https://aws.amazon.com/ec2/pricing/reserved-instances/pricing/
• https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-reserved-instances.html
• https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-purchasing-options.html
• Check out this Amazon EC2 Cheat Sheet:
• https://tutorialsdojo.com/aws-cheat-sheet-amazon-elastic-compute-cloud-amazon-ec2/
• 3. Which of the following best describes the concept of the loose coupling design principle?
• A change or a failure in one component should not cascade to other components.
• Explanation
• The AWS Cloud includes many design patterns and architectural options that you can apply to a wide variety of use cases. Some key design principles of the AWS Cloud include scalability, disposable resources, automation, loose coupling managed services instead of servers, and flexible data storage options.
• As application complexity increases, a desirable attribute of an IT system is that it can be broken into smaller, loosely coupled components. This means that IT systems should be designed in a way that reduces interdependencies — a change or a failure in one component should not cascade to other components.
• A way to reduce interdependencies in a system is to allow the various components to interact with each other only through specific, technology-agnostic interfaces, such as RESTful APIs. In that way, technical implementation detail is hidden so that teams can modify the underlying implementation without affecting other components. As long as those interfaces maintain backward compatibility, deployments of different components are decoupled. This granular design pattern is commonly referred to as a microservices architecture.
• Hence, the correct answer is: A change or a failure in one component should not cascade to other components.
• The option that says: Increase the specifications of an individual resource by upgrading a server with a larger hard drive or a faster CPU is incorrect because this refers to Vertical Scaling.
• The option that says: A change or a failure in one component must be cascade to other components is incorrect because it should be the other way around. IT systems should be designed in a way that reduces interdependencies in which a change or a failure in one component should not cascade to other components.
• The option that says: Increase the number of resources by adding more hard drives to a storage array or adding more servers is incorrect because this refers to Horizontal Scaling.
• References:
• https://d1.awsstatic.com/whitepapers/AWS_Cloud_Best_Practices.pdf
• https://media.amazonwebservices.com/Architecting_and_Managing_Apps_Matt_Tavis_July_2010.pdf
• 4. Which among the services below can you use to test and troubleshoot IAM and resource-based policies?
• IAM Policy Simulator.
• Explanation
• The IAM policy simulator evaluates the policies that you choose and determines the effective permissions for each of the actions that you specify. The simulator uses the same policy evaluation engine that is used during real requests to AWS services. But the simulator differs from the live AWS environment in the following ways:
• - The simulator does not make an actual AWS service request, so you can safely test requests that might make unwanted changes to your live AWS environment.
• - Because the simulator does not simulate running the selected actions, it cannot report any response to the simulated request. The only result returned is whether the requested action would be allowed or denied.
• - If you edit a policy inside the simulator, these changes affect only the simulator. The corresponding policy in your AWS account remains unchanged.
• With the IAM policy simulator, you can test and troubleshoot IAM and resource-based policies in the following ways:
• - Test policies that are attached to IAM users, groups, or roles in your AWS account. If more than one policy is attached to the user, group, or role, you can test all the policies, or select individual policies to test. You can test which actions are allowed or denied by the selected policies for specific resources.
• - Test policies that are attached to AWS resources, such as Amazon S3 buckets, Amazon SQS queues, Amazon SNS topics, or Amazon S3 Glacier vaults.
• - If your AWS account is a member of an organization in AWS Organizations, then you can test the impact of service control policies (SCPs) on your IAM policies and resource policies.
• Hence, the correct answer is IAM Policy Simulator.
• AWS Config is incorrect because this is just a service that enables you to assess, audit, and evaluate the configurations of your AWS resources.
• Systems Manager is incorrect because this service just provides a unified user interface so you can view operational data from multiple AWS services and allows you to automate operational tasks across your AWS resources. Unlike IAM Policy Simulator, it can't be used to simulate your policies.
• Amazon Inspector is incorrect because it is just an automated security assessment service that helps improve the security and compliance of applications deployed on AWS.
• References:
• https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html
• https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_iam_policy-sim-path-console.html
• 5.Which service will allow you to group together users who perform a similar function and apply function-specific privileges?
• Explanation
• AWS Identity and Access Management (IAM) is a web service that helps you securely control access to AWS resources. You use IAM to control who is authenticated (signed in) and authorized (has permissions) to use resources. IAM has various identities such as IAM Users, IAM Groups, and IAM Roles.
• An IAM group is a collection of IAM users. Groups let you specify permissions for multiple users, which can make it easier to manage the permissions for those users. For example, you could have a group called Admins and give that group the types of permissions that administrators typically need. Any user in that group automatically has the permissions that are assigned to the group. If a new user joins your organization and needs administrator privileges, you can assign the appropriate permissions by adding the user to that group. Similarly, if a person changes jobs in your organization, instead of editing that user's permissions, you can remove him or her from the old groups and add him or her to the appropriate new groups.
• Note that a group is not truly an "identity" in IAM because it cannot be identified as a Principal in a permission policy. It is simply a way to attach policies to multiple users at one time.
• Hence, the correct answer is AWS IAM.
• Resource group is incorrect since it is used to organize your AWS resources.
• Tagging is incorrect as well since it has no capability to perform what is asked in the scenaro.
• AWS Directory Service is incorrect. AWS Directory Service provides multiple ways to use Amazon Cloud Directory and Microsoft Active Directory (AD) with other AWS services.
• References:
• https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups.html
• https://docs.aws.amazon.com/IAM/latest/UserGuide/id.html
• Check out this AWS IAM Cheat Sheet:
• https://tutorialsdojo.com/aws-cheat-sheet-aws-identity-and-access-management-iam/
• Which of the following are the characteristics of Amazon EC2 Convertible Reserved Instances? (Select TWO)
• Explanation
• Reserved Instances provide you with a significant discount (up to 75%) compared to On-Demand instance pricing. In addition, when Reserved Instances are assigned to a specific Availability Zone, they provide a capacity reservation, giving you additional confidence in your ability to launch instances when you need them.
• Convertible Reserved Instances provide you with a significant discount (up to 54%) compared to On-Demand Instances and can be purchased for a 1-year or 3-year term. Purchase Convertible Reserved Instances if you need additional flexibility, such as the ability to use different instance families, operating systems, or tenancies over the Reserved Instance term.
• With Reserved Instances (RIs), you can choose the type that best fits the needs of your application:
• - Standard RIs: These provide the most significant discount (up to 75% off On-Demand) and are best suited for steady-state usage.
• - Convertible RIs: These provide a discount (up to 54% off On-Demand) and the capability to change the attributes of the RI as long as the exchange results in the creation of Reserved Instances of equal or greater value. Like Standard RIs, Convertible RIs are best suited for steady-state usage.
• - Scheduled RIs: These are available to launch within the time windows you reserve. This option allows you to match your capacity reservation to a predictable recurring schedule that only requires a fraction of a day, a week, or a month.
• Hence, the correct answers are:
• - Allows the change of instance family, operating system, tenancy, and payment option
• - Has the capability to change the attributes of the RI as long as the exchange results in the creation of Reserved Instances of equal or greater value.
• The option that says: Allows you to match your capacity reservation to a predictable recurring schedule that only requires a fraction of a day, a week, or a month is incorrect because this is a description for Scheduled RIs and not for Convertible RIs.
• The option that says: Allows you to change the attributes of the RI as long as the exchange results in the creation of Reserved Instances of equal or lesser value is incorrect because it should be "equal or greater value" and not "equal or lesser value"
• The option that says: Provides the most significant discount (up to 75% off On-Demand) and are best suited for steady-state usage is incorrect because this is a characteristic of Standard RIs and not Convertible RIs.
• References:
• https://aws.amazon.com/ec2/pricing/reserved-instances/pricing/
• https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-reserved-instances.html
• Which of the following cloud best practices reinforces the use of the Service-Oriented Architecture (SOA) design principle?
• Explanation
• There are various best practices that you can follow which can help you build an application in the AWS cloud. The notable ones are:
• 1. Design for failure
• 2. Decouple your components
• 3. Implement elasticity
• 4. Think parallel
• In Decouple your components, the key is to build components that do not have tight dependencies on each other, so that if one component were to die (fail), sleep (not respond) or remain busy (slow to respond) for some reason, the other components in the system are built so as to continue to work as if no failure is happening. The cloud reinforces the Service-Oriented Architecture (SOA) design principle that the more loosely coupled the components of the system, the bigger and better it scales.
• You can build a loosely coupled system using messaging queues such as SQS. If a queue/buffer is used to connect any two components together, it can support concurrency, high availability and load spikes. As a result, the overall system continues to perform even if parts of the components are momentarily unavailable. If one component dies or becomes temporarily unavailable, the system will buffer the messages and get them processed when the component comes back up.
• In essence, loose coupling isolates the various layers and components of your application so that each component interacts asynchronously with the others and treats them as a “black box”. For example, in the case of web application architecture, you can isolate the app server from the web server and from the database. The app server does not know about your web server and vice versa, this gives decoupling between these layers and there are no dependencies code-wise or functional perspectives. In the case of batch-processing architecture, you can create asynchronous components that are independent of each other.
• The AWS specific tactics for implementing this best practice are:
• 1. Use Amazon SQS to isolate components
• 2. Use Amazon SQS as buffers between components
• 3. Design every component such that it exposes a service interface and is responsible for its own scalability in all appropriate dimensions and interacts with other components asynchronously
• 4. Bundle the logical construct of a component into an Amazon Machine Image so that it can be deployed more often
• 5. Make your applications as stateless as possible. Store session state outside of component (in Amazon SimpleDB, if appropriate)
• Hence, the correct answer in this scenario is: Decouple your components
• Think parallel is incorrect because this just internalizes the concept of parallelization when designing architectures in the cloud. It advocates to not only implement parallelization wherever possible but also automate it because the cloud allows you to create a repeatable process every easily.
• Implement elasticity is incorrect because this principle is primarily implemented by automating your deployment process and streamlining the configuration and build process of your architecture. This ensures that the system can scale without any human intervention.
• Design for failure is incorrect because it only encourages you to be a pessimist when designing architectures in the cloud; assume things will fail. In other words, you should always design, implement and deploy for automated recovery from failure.
• References:
• https://media.amazonwebservices.com/AWS_Cloud_Best_Practices.pdf
• https://www.slideshare.net/AmazonWebServices/best-practices-for-architecting-in-the-cloud-jeff-barr
• Question 8: Incorrect
• Which of the following AWS Cost Management tools enable you to forecast future costs and usage of your AWS resources based on your past consumption?

Slide 2