Arch-Day2-Recap

A company is storing an access key (access key ID and secret access key) in a text file on a custom AMI. The company uses the access key to access DynamoDB tables from instances created from the AMI. The security team has mandated a more secure solution. Which solution will meet the security team’s mandate?

• Put the access key in an S3 bucket, and retrieve the access key on boot from the instance.

• Pass the access key to the instances through instance user data.

• Obtain the access key from a key server launched in a private subnet.

• Create an IAM role with permissions to access the table, and launch all instances with the new role.

An application running on EC2 instances processes sensitive information stored on Amazon S3. The information is accessed over the Internet. The security team is concerned that the Internet connectivity to Amazon S3 is a security risk. Which solution will resolve the security concern?

• Access the data through an Internet Gateway.

• Access the data through a VPN connection.

• Access the data through a NAT Gateway.

• Access the data through a VPC endpoint for Amazon S3.

An organization is building an Amazon Redshift cluster in their shared services VPC. The cluster will host sensitive data. How can the organization control which networks can access the cluster?

• Run the cluster in a different VPC and connect through VPC peering.

• Create a database user inside the Amazon Redshift cluster only for users on the network.

• Define a cluster security group for the cluster that allows access from the allowed networks.

• Only allow access to networks that connect with the shared services network via VPN.

A Solutions Architect is designing an online shopping application running in a VPC on EC2 instances behind an ELB Application Load Balancer. The instances run in an Auto Scaling group across multiple Availability Zones. The application tier must read and write data to a customer managed database cluster. There should be no access to the database from the Internet, but the cluster must be able to obtain software patches from the Internet. Which VPC design meets these requirements?

• Public subnets for both the application tier and the database cluster

• Public subnets for the application tier, and private subnets for the database cluster

• Public subnets for the application tier and NAT Gateway, and private subnets for the database cluster

• Public subnets for the application tier, and private subnets for the database cluster and NAT Gateway

Amazon CloudWatch Supports which type of Monitoring plans? (Choose 2 Answers)

• Basic Monitoring, which is free

• Basic Monitoring, which has an additional cost

• Ad hoc Monitoring, which is free

• Ad hoc Monitoring, which has an additional cost

• Detailed monitoring, which has an additional cost

You’re testing three versions of a new application, with each version running on its own server and the current production version on a fourth server. You want to route 5 percent of your total traffic to each of the test servers and route the remaining 85 percent of traffic to the production server. Which routing policy will you use?

• Failover

• Weighted

• Latency

• Geolocation

Your AWS account administrator left your company today. The administrator had access to the root user and a personal IAM administrator account. With these accounts, he generated other IAM accounts and keys. Which of the following should you do today to protect your AWS infrastructure? (Choose 3 answers)

• Delete all IAM accounts

• Change the password and add MFA to the root user

• Delete the administrator's personal IAM account

• Relaunch all EC2 instances with new roles

• Rotate keys and change passwords for IAM accounts

Your team is building an order processing system that will span multiple Availability Zones. During testing, the team wanted to test how the application will react to a database failover. How can you enable this type of test?

• Create a support case asking for a failover

• Terminate the DB instance, and create a new one. Update the connection string

• Force a Multi-AZ failover from one Availability Zone to another by rebooting the primary instance using the Amazon RDS console

• It is not possible to test a failover

Your application polls an Amazon Simple Queue Service (Amazon SQS) queue frequently and returns immediately, often with empty ReceiveMessageResponses. What is one thing that can be done to reduce Amazon SQS costs?

• Pricing on Amazon SQS does not include a cost for service requests; therefore, there is no concern.

• Increase the timeout value for short polling to wait for messages longer before returning a response.

• Change the message visibility value to a higher number.

• Use long polling by supplying a WaitTimeSeconds of greater than 0 seconds when calling ReceiveMessage.

Which of the following are benefits of using Amazon EC2 roles? (Choose 2 answers)

• No policies are required.

• Credentials do not need to be stored on the Amazon EC2 instance.

• Key rotation is not necessary.

• Integration with Active Directory is automatic.