AWS CLOUD - ALC - TEST 19 : Question 1 of 46

How can we secure data at rest on an EBS volume? How can we secure data at rest on an EBS volume?

1 Mark(s)

Attach the volume to an instance using EC2’s SSL interface.
Write the data randomly instead of sequentially.
Encrypt the volume using the S3 server-side encryption service.
Use an encrypted file system on top of the EBS volume.

A customer needs corporate IT governance & cost oversight of all AWS resources consumed by its divisions. The divisions want to maintain administrative control of the discrete AWS resources they consume & keep those resources separate from the resources of other divisions. Which of the following options, when used together will support the autonomy/control of divisions while enabling corporate IT to maintain governance & cost oversight? A customer needs corporate IT governance & cost oversight of all AWS resources consumed by its divisions. The divisions want to maintain administrative control of the discrete AWS resources they consume & keep those resources separate from the resources of other divisions. Which of the following options, when used together will support the autonomy/control of divisions while enabling corporate IT to maintain governance & cost oversight?

1 Mark(s)

Use AWS Consolidated Billing & disable AWS root account access for the child accounts.
Enable IAM cross-account access for all corporate IT administrators in each child account.
Create separate VPCs for each division within the corporate IT AWS account.
Write all child AWS CloudTrail and Amazon CloudWatch logs to each child account’s Amazon S3 ‘Log’ bucket.

You have decided to change the instance type for instances running in your application tier that is using Auto Scaling. In which area below would you change the instance type definition? You have decided to change the instance type for instances running in your application tier that is using Auto Scaling. In which area below would you change the instance type definition?

1 Mark(s)

Auto Scaling policy Auto Scaling policy
Auto Scaling group Auto Scaling group
Auto Scaling tags Auto Scaling tags
Auto Scaling launch configuration Auto Scaling launch configuration

A characteristic of Amazon VPC subnets is: A characteristic of Amazon VPC subnets is:

1 Mark(s)

Each subnet spans at least 2 Availability Zones to provide a high-availability environment.
Each subnet maps to a single Availability Zone.
CIDR block mask of/25 is the smallest range supported.
Instances in a private subnet can communicate with the Internet only if they have an Elastic IP.

An instance is launched into a VPC subnet with the network ACL configured to allow all inbound traffic and deny all outbound traffic. The instance’s security group is configured to allow SSH from any IP address and deny all outbound traffic. What changes need to be made to allow SSH access to the instance? An instance is launched into a VPC subnet with the network ACL configured to allow all inbound traffic and deny all outbound traffic. The instance’s security group is configured to allow SSH from any IP address and deny all outbound traffic. What changes need to be made to allow SSH access to the instance?

1 Mark(s)

The outbound security group needs to be modified to allow outbound traffic.
The outbound network ACL needs to be modified to allow outbound traffic.
Nothing, it can be accessed from any IP address using SSH.
Both the outbound security group & outbound network ACL need to be modified to allow outbound traffic.

What is one key difference between an Amazon EBS-backed & an instance-store backed instance? What is one key difference between an Amazon EBS-backed & an instance-store backed instance?

1 Mark(s)

Amazon EBS-backed instances can be stopped & restarted.
Instance-store backed instances can be stopped & restarted.
Auto scaling requires using Amazon EBS-backed instances.
Virtual Private Cloud requires EBS backed instances.

Which features can be used to restrict access to data in S3? Which features can be used to restrict access to data in S3?

1 Mark(s)

Set an S3 ACL on the bucket or the object.
Create a CloudFront distribution for the bucket.
Enable IAM Identity Federation. Enable IAM Identity Federation.
Use S3 Virtual Hosting. Use S3 Virtual Hosting.

A company wants to implement their website in a virtual private cloud (VPC). The web tier will use an Auto Scaling group across multiple Availability Zones (AZs). The database will use Multi-AZ RDS MySQL & should not be publicly accessible. ‘What is the minimum number of subnets that need to be configured in the VPC? A company wants to implement their website in a virtual private cloud (VPC). The web tier will use an Auto Scaling group across multiple Availability Zones (AZs). The database will use Multi-AZ RDS MySQL & should not be publicly accessible. ‘What is the minimum number of subnets that need to be configured in the VPC?

1 Mark(s)

A company is storing data on Amazon Simple Storage Service (S3). The company’s security policy mandates that data is encrypted at rest. Which of the following methods can achieve this? A company is storing data on Amazon Simple Storage Service (S3). The company’s security policy mandates that data is encrypted at rest. Which of the following methods can achieve this?

1 Mark(s)

Use Amazon S3 server-side encryption with AWS Key Management Service
Use Amazon S3 server-side encryption with EC2 key pair.
Use Amazon S3 bucket policies to restrict access to the data at rest.
Use SSL to encrypt the data while in transit to Amazon S3.

You are configuring your company’s application to use Auto Scaling & need to move user state information. Which of the following AWS services provides a shared data store with durability & low latency? You are configuring your company’s application to use Auto Scaling & need to move user state information. Which of the following AWS services provides a shared data store with durability & low latency?

1 Mark(s)

AWS ElastiCache Memcached AWS ElastiCache Memcached
Amazon Simple Storage Service Amazon Simple Storage Service
Amazon Simple Storage Service Amazon Simple Storage Service
Amazon EC2 instance storage Amazon EC2 instance storage

A placement group is: A placement group is:

1 Mark(s)

A collection of Auto Scaling groups in the same region.
A feature that enables EC2 instances to interact with each other via high bandwidth, low latency connections.
A collection of authorized CloudFront edge locations for a distribution.
A collection of Elastic Load Balancers in the same Region or Availability Zone.

A customer needs to capture all client connection information from their load balancer every five minutes. The company wants to use this data for analyzing traffic patterns & troubleshooting their applications. Which of the following options meets the customer requirements? A customer needs to capture all client connection information from their load balancer every five minutes. The company wants to use this data for analyzing traffic patterns & troubleshooting their applications. Which of the following options meets the customer requirements?

1 Mark(s)

Enable AWS CloudTrail for the load balancer.
Enable access logs on the load balancer.
Install the Amazon CloudWatch Logs agent on the load balancer.
Enable Amazon CloudWatch metrics on the load balancer.

A company needs to deploy virtual desktops to its customers in a virtual private cloud, leveraging existing security controls. Which set of AWS services & features will meet the company’s requirements? A company needs to deploy virtual desktops to its customers in a virtual private cloud, leveraging existing security controls. Which set of AWS services & features will meet the company’s requirements?

1 Mark(s)

Virtual Private Network connection. AWS Directory Services, & ClassicLink
Virtual Private Network connection. AWS Directory Services, & Amazon Workspaces
AWS Directory Service, Amazon Workspaces, & AWS Identity & Access Management
Amazon Elastic Compute Cloud, & AWS Identity & Access Management

Per the AWS Acceptable Use Policy, penetration testing of EC2 instances: Per the AWS Acceptable Use Policy, penetration testing of EC2 instances:

1 Mark(s)

May be performed by AWS, and will be performed by AWS upon customer request.
May be performed by AWS, and is periodically performed by AWS.
Are expressly prohibited under all circumstances.
May be performed by the customer on their own instances with prior authorization from AWS.

You run an ad-supported photo sharing website using S3 to serve photos to visitors of your site. At some point you find out that other sites have been linking to the photos on your site, causing loss to your business. What is an effective method to mitigate this? You run an ad-supported photo sharing website using S3 to serve photos to visitors of your site. At some point you find out that other sites have been linking to the photos on your site, causing loss to your business. What is an effective method to mitigate this?

1 Mark(s)

Remove public read access & use signed URLs with expiry dates.
Use CloudFront distributions for static content.
Block the IPs of the offending websites in Security Groups.
None None

Which procedure for backing up a relational database on EC2 that is using a set of RAlD EBS volumes for storage minimizes the time during which the database cannot be written to & results in a consistent backup? Which procedure for backing up a relational database on EC2 that is using a set of RAlD EBS volumes for storage minimizes the time during which the database cannot be written to & results in a consistent backup?

1 Mark(s)

Detach EBS volumes 2. Start EBS snapshot of volumes 3. Re-attach E
Stop the EC2 Instance. 2. Snapshot the EBS volumes
Suspend disk I/O 2. Create an image of the EC2 Instance 3. Resume disk I/O
Suspend disk I/O 2. Start EBS snapshot of volumes 3. Resume disk I

A characteristic of Amazon S3 is: A characteristic of Amazon S3 is:

1 Mark(s)

S3 offers Provisioned IOPS. S3 offers Provisioned IOPS.
S3 offers Provisioned IOPS. S3 offers Provisioned IOPS.
S3 allows you to store unlimited amounts of data.
S3 should be used to host a relational database.

Choose a valid statement about Amazon S3: Choose a valid statement about Amazon S3:

1 Mark(s)

S3 provides read-after-write consistency for any type of PUT or DELETE.
Consistency is not guaranteed for any type of PUT or DELETE.
A successful response to a PUT request only occurs when a complete object is saved.
Partially saved objects are immediately readable with a GET after an overwrite PUT.

Which of the following requires a custom CloudWatch metric to monitor? Which of the following requires a custom CloudWatch metric to monitor?

1 Mark(s)

Memory Utilization of an EC2 instance Memory Utilization of an EC2 instance
CPU Utilization of an EC2 instance CPU Utilization of an EC2 instance
Disk usage activity of an EC2 instance Disk usage activity of an EC2 instance
Data transfer of an EC2 instance Data transfer of an EC2 instance

When an EC2 instance that is backed by an S3-based AMI is terminated, what happens to the data on the root volume? When an EC2 instance that is backed by an S3-based AMI is terminated, what happens to the data on the root volume?

1 Mark(s)

Data is automatically saved as an EBS snapshot.
Data is automatically saved as an EBS volume.
Data is unavailable until the instance is restarted.
Data is automatically deleted. Data is automatically deleted.

The service that allows the customer to retain full administrative privileges of the underlying EC2 instances is: The service that allows the customer to retain full administrative privileges of the underlying EC2 instances is:

1 Mark(s)

Amazon Relational Database Service Amazon Relational Database Service
Amazon Elastic MapReduce Amazon Elastic MapReduce
Amazon ElastiCache Amazon ElastiCache
Amazon DynamoDB Amazon DynamoDB

A company is building a two-tier web application to serve dynamic transaction-based content. The data tier is leveraging an Online Transactional Processing (OLTP) database. What services should we leverage to enable an elastic and scalable web tier? A company is building a two-tier web application to serve dynamic transaction-based content. The data tier is leveraging an Online Transactional Processing (OLTP) database. What services should we leverage to enable an elastic and scalable web tier?

1 Mark(s)

Elastic Load Balancing, Amazon EC2, & Auto Scaling
Elastic Load Balancing, Amazon RDS with Multi-AZ, & Amazon S3
Amazon RDS with Multi-AZ & Auto Scaling
Amazon EC2, Amazon DynamoDB, & Amazon S3

You are working with a customer who has 10 TB of archival data that they want to migrate to Amazon Glacier. The customer has a 1-Mbps connection to the Internet. Which service or feature provides the fastest method of getting the data into Amazon Glacier? You are working with a customer who has 10 TB of archival data that they want to migrate to Amazon Glacier. The customer has a 1-Mbps connection to the Internet. Which service or feature provides the fastest method of getting the data into Amazon Glacier?

1 Mark(s)

Amazon Glacier multipart upload. Amazon Glacier multipart upload.
AWS Storage Gateway. AWS Storage Gateway.
VM Import/Export. VM Import/Export.
AWS Import/Export. AWS Import/Export.

A customer is leveraging Amazon Simple Storage Service in eu-west-1 to store static content for a web-based property. The customer is storing objects using the Standard Storage class. Where are the customers objects replicated? A customer is leveraging Amazon Simple Storage Service in eu-west-1 to store static content for a web-based property. The customer is storing objects using the Standard Storage class. Where are the customers objects replicated?

1 Mark(s)

A single facility in eu-west-1 and a single facility in eu-central-1
A single facility in eu-west-1 and a single facility in us-east-1
Multiple facilities in eu-west-1 Multiple facilities in eu-west-1
A single facility in eu-west-1 A single facility in eu-west-1

Which of the following items are required to allow an application deployed on an EC2 instance to write data to a DynamoDB table? Assume that no security keys are allowed to be stored on the EC2 instance. Which of the following items are required to allow an application deployed on an EC2 instance to write data to a DynamoDB table? Assume that no security keys are allowed to be stored on the EC2 instance.

1 Mark(s)

Create an IAM Role that allows write access to the DynamoDB table.
Add an IAM Role to a running EC2 instance.
Create an IAM User that allows write access to the DynamoDB table.
Add an IAM User to a running EC2 instance.

A company has a workflow that sends video files from their on-premise system to AWS for transcoding. They use EC2 worker instances that pull transcoding jobs from SQS. Why is SQS an appropriate service for this scenario? A company has a workflow that sends video files from their on-premise system to AWS for transcoding. They use EC2 worker instances that pull transcoding jobs from SQS. Why is SQS an appropriate service for this scenario?

1 Mark(s)

SQS guarantees the order of the messages.
SQS synchronously provides transcoding output.
SQS checks the health of the worker instances.
SQS helps to facilitate horizontal scaling of encoding tasks.

If we want to launch Amazon Elastic Compute Cloud (EC2) instances & assign each instance a predetermined private IP address you should: If we want to launch Amazon Elastic Compute Cloud (EC2) instances & assign each instance a predetermined private IP address you should:

1 Mark(s)

Launch the instance from a private Amazon Machine Image (AMI).
Assign a group of sequential Elastic IP address to the instances.
Launch the instances in the Amazon Virtual Private Cloud (VPC).
Launch the instances in a Placement Group.

Which Amazon Elastic Compute Cloud feature can you query from within the instance to access instance properties? Which Amazon Elastic Compute Cloud feature can you query from within the instance to access instance properties?

1 Mark(s)

Instance user data Instance user data
Resource tags Resource tags
Instance metadata Instance metadata
Amazon Machine Image Amazon Machine Image

You launch an Amazon EC2 instance without an assigned AWS identity and Access Management (IAM) role. Later, you decide that the instance should be running with an IAM role. Which action must you take in order to have a running Amazon EC2 instance with an IAM role assigned to it? You launch an Amazon EC2 instance without an assigned AWS identity and Access Management (IAM) role. Later, you decide that the instance should be running with an IAM role. Which action must you take in order to have a running Amazon EC2 instance with an IAM role assigned to it?

1 Mark(s)

Create an image of the instance, and register the image with an IAM role assigned and an Amazon EBS volume mapping.
Create a new IAM role with the same permissions as an existing IAM role, and assign it to the running instance.
Create an image of the instance, add a new IAM role with the same permissions as the desired IAM role, and deregister the image with the new role assigned.
Create an image of the instance, and use this image to launch a new instance with the desired IAM role assigned.

For which of the following use cases are Simple Workflow Service (SWF) and Amazon EC2 an appropriate solution? For which of the following use cases are Simple Workflow Service (SWF) and Amazon EC2 an appropriate solution?

1 Mark(s)

Using as an endpoint to collect thousands of data points per hour from a distributed fleet of sensors.
Managing a multi-step and multi-decision checkout process of an e-commerce website.
Using as an SNS (Simple Notification Service) endpoint to trigger execution of video transcoding jobs.
Using as a distributed session store for your web application.

You are tasked with setting up a Linux bastion host for access to Amazon EC2 instances running in your VPC. Only clients connecting from the corporate external public IP address 72.34.51.100 should have SSH access to the host. Which option will meet the customer requirement? You are tasked with setting up a Linux bastion host for access to Amazon EC2 instances running in your VPC. Only clients connecting from the corporate external public IP address 72.34.51.100 should have SSH access to the host. Which option will meet the customer requirement?

1 Mark(s)

Security Group Inbound Rule: Protocol -TCP. Port Range -22, Source 72.34.51.100/32
Security Group Inbound Rule: Protocol -UDP, Port Range -22, Source 72.34.51.100/32
Network ACL Inbound Rule: Protocol -UDP, Port Range -22, Source 72.34.51.100/32
Network ACL Inbound Rule: Protocol -TCP, Port Range-22, Source 72.34.51.100/0

We need to configure an Amazon S3 bucket to serve static assets for your public-facing web application. Which methods ensure that all objects uploaded to the bucket are set to public read? We need to configure an Amazon S3 bucket to serve static assets for your public-facing web application. Which methods ensure that all objects uploaded to the bucket are set to public read?

1 Mark(s)

Set permissions on the object to public read during upload.
Configure the bucket ACL to set all objects to public read.
Use AWS Identity and Access Management roles to set the bucket to public read.
Amazon S3 objects default to public read, so no action is needed.

Your application provides data transformation services. Files containing data to be transformed are first uploaded to Amazon S3 & then transformed by a fleet of spot EC2 instances. Files submitted by your premium customers must be transformed with the highest priority. How should we implement such system? Your application provides data transformation services. Files containing data to be transformed are first uploaded to Amazon S3 & then transformed by a fleet of spot EC2 instances. Files submitted by your premium customers must be transformed with the highest priority. How should we implement such system?

1 Mark(s)

Use a DynamoDB table with an attribute defining the priority level. Transformation instances will scan the table for tasks, sorting the results by priority level.
Use Route 53 latency based-routing to send high priority tasks to the closest transformation instances.
Use two SQS queues, one for high priority messages, the other for default priority. Transformation instances first poll the high priority queue; if there is no message, they poll the default priority queue.
Use a single SQS queue. Each message contains the priority level. Transformation instances poll high-priority messages first.

You are working with a customer who is using Chef configuration management in their data center. Which service is designed to let the customer leverage existing Chef recipes in AWS? You are working with a customer who is using Chef configuration management in their data center. Which service is designed to let the customer leverage existing Chef recipes in AWS?

1 Mark(s)

Amazon Simple Workflow Service Amazon Simple Workflow Service
AWS Elastic Beanstalk AWS Elastic Beanstalk
AWS CloudFormation AWS CloudFormation
AWS OpsWorks AWS OpsWorks

A customer wants to leverage Amazon Simple Storage Service (S3) & Amazon Glacier as part of their backup & archive infrastructure. The customer plans to use third-party software to support this integration. Which approach will limit the access of the third party software to only the Amazon S3 bucket named "company-backup"? A customer wants to leverage Amazon Simple Storage Service (S3) & Amazon Glacier as part of their backup & archive infrastructure. The customer plans to use third-party software to support this integration. Which approach will limit the access of the third party software to only the Amazon S3 bucket named "company-backup"?

1 Mark(s)

A custom bucket policy limited to the Amazon S3 API in thee Amazon Glacier archive "company-backup".
A custom IAM user policy limited to the Amazon S3 API for the Amazon Glacier archive "company-backup".
A custom IAM user policy limited to the Amazon S3 API in "company-backup".

When an EC2 EBS-backed (EBS root) instance is stopped, what happens to the data on any ephemeral store volumes? When an EC2 EBS-backed (EBS root) instance is stopped, what happens to the data on any ephemeral store volumes?

1 Mark(s)

Data is automatically saved in an EBS volume.
Data is unavailable until the instance is restarted.
Data will be deleted and will no longer be accessible.
Data is automatically saved as an EBS snapshot.

Which technique should we use to integrate AWS IAM (Identity and Access Management) with an on-premise LDAP (Lightweight Directory Access Protocol) directory service? Which technique should we use to integrate AWS IAM (Identity and Access Management) with an on-premise LDAP (Lightweight Directory Access Protocol) directory service?

1 Mark(s)

Use an IAM policy that references the LDAP account identifiers and the AWS credentials.
Use SAML (Security Assertion Markup Language) to enable single sign-on between AWS and LDAP.
Use AWS Security Token Service from an identity broker to issue short-lived AWS credentials.
Use IAM roles to automatically rotate the IAM credentials when LDAP credentials are updated.

When creation of an EBS snapshot is initiated, but not completed, the EBS volume: When creation of an EBS snapshot is initiated, but not completed, the EBS volume:

1 Mark(s)

Can be used while the snapshot is in progress.
Cannot be detached or attached to an EC2 instance until the snapshot completes.
Can be used in read-only mode while the snapshot is in progress.
Cannot be used until the snapshot completes.

You have launched an Amazon Elastic Compute Cloud (EC2) instance into a public subnet with a primary private IP address assigned, an internet gateway is attached to the VPC, & the public route table is configured to send all Internet-based traffic to the Internet gateway. The instance security group is set to allow all outbound traffic but cannot access the internet. Why is the Internet unreachable from this instance? You have launched an Amazon Elastic Compute Cloud (EC2) instance into a public subnet with a primary private IP address assigned, an internet gateway is attached to the VPC, & the public route table is configured to send all Internet-based traffic to the Internet gateway. The instance security group is set to allow all outbound traffic but cannot access the internet. Why is the Internet unreachable from this instance?

1 Mark(s)

The instance does not have a public IP address.
The internet gateway security group must allow all outbound traffic.
The instance security group must allow all inbound traffic.
The instance "Source/Destination check" property must be enabled.

How can the domain’s zone apex, for example, "myzoneapexdomain.com", be pointed towards an Elastic Load Balancer? How can the domain’s zone apex, for example, "myzoneapexdomain.com", be pointed towards an Elastic Load Balancer?

1 Mark(s)

By using an Amazon Route 53 Alias record
By using an AAAA record By using an AAAA record
By using an Amazon Route 53 CNAME record
By using an A record By using an A record

Which of the following are characteristics of a reserved instance? Which of the following are characteristics of a reserved instance?

1 Mark(s)

It can be migrated across Availability Zones
It is specific to an Amazon Machine Image (AMI)
It is specific to an instance Type It is specific to an instance Type

You have an environment that consists of a public subnet using Amazon VPC & three instances that are running in this subnet. These 3 instances can successfully communicate with other hosts on the Internet. You launch a 4th instance in the same subnet, using the same AMI and security group configuration you used for the others, but find that this instance cannot be accessed from the internet. What should you do to enable Internet access? You have an environment that consists of a public subnet using Amazon VPC & three instances that are running in this subnet. These 3 instances can successfully communicate with other hosts on the Internet. You launch a 4th instance in the same subnet, using the same AMI and security group configuration you used for the others, but find that this instance cannot be accessed from the internet. What should you do to enable Internet access?

1 Mark(s)

Deploy a NAT instance into the public subnet.
Assign an Elastic IP address to the fourth instance.
Configure a publically routable IP Address in the host OS of the fourth instance.
Modify the routing table for the public subnet.

An AutoScaling group spans 3 AZs and currently has 4 running EC2 instances. When AutoScaling needs to terminate an EC2 instance by default, AutoScaling will: An AutoScaling group spans 3 AZs and currently has 4 running EC2 instances. When AutoScaling needs to terminate an EC2 instance by default, AutoScaling will:

1 Mark(s)

Allow at least five minutes for Windows/Linux shutdown scripts to complete, before terminating the instance.
Send an SNS notification, if configured to do so
Randomly select one of the 3 AZs, and then terminate an instance in that AZ.

When you put objects in Amazon S3, what is the indication that an object was successfully stored? When you put objects in Amazon S3, what is the indication that an object was successfully stored?

1 Mark(s)

A HTTP 200 result code and MD5 checksum, taken together, indicate that the operation was successful.
Amazon S3 is engineered for 99.999999999% durability. Therefore there is no need to confirm that data was inserted.
A success code is inserted into the S3 object metadata.
Each S3 account has a special bucket named _s3_logs. Success codes are written to this bucket with a timestamp and checksum.

In order to optimize performance for a compute cluster that requires low inter-node latency, which of the following feature should you use? In order to optimize performance for a compute cluster that requires low inter-node latency, which of the following feature should you use?

1 Mark(s)

Multiple Availability Zones Multiple Availability Zones
AWS Direct Connect AWS Direct Connect
Placement Groups Placement Groups
EC2 Dedicated Instances EC2 Dedicated Instances

A client application requires operating system privileges on a relational database server. What is an appropriate configuration for a highly available database architecture? A client application requires operating system privileges on a relational database server. What is an appropriate configuration for a highly available database architecture?

1 Mark(s)

A standalone Amazon EC2 instance. A standalone Amazon EC2 instance.
Amazon RDS in a Multi-AZ configuration. Amazon RDS in a Multi-AZ configuration.
Amazon EC2 instances in a replication configuration utilizing a single Availability Zone.
Amazon EC2 instances in a replication configuration utilizing two different Availability Zones.