Study Group Quiz

Cloud Practitioner:

Why is AWS more economical than traditional data centers for applications with varying compute workloads?

• Amazon EC2 costs are billed on a monthly basis.

• Users retain full administrative access to their Amazon EC2 instances

• Amazon EC2 instances can be launched on demand when needed.

• Users can permanently run enough instances to handle peak workloads.

Answer explanation

The ability to launch instances on demand when needed allows users to launch and terminate instances in response to a varying workload. This is a more economical practice than purchasing enough on premises servers to handle the peak load.

Cloud Practitioner:

Which service can identify the user that made the API call when an Amazon EC2 instance is terminated?

• AWS Trusted Advisor

• AWS CloudTrail

• AWS X-Ray

• AWS Identity and Access Management (AWS IAM)

Answer explanation

AWS CloudTrail helps users enable governance, compliance, and operational and risk auditing of their AWS accounts. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. Events include actions taken in the AWS Management Console, AWS Command Line Interface (CLI), and AWS SDKs and APIs.

Cloud Practitioner:

Which component of the AWS global infrastructure does Amazon CloudFront use to ensure low-latency delivery?

• AWS Regions

• Edge locations

• Availability Zones

• Virtual Private Cloud (VPC)

Answer explanation

To deliver content to users with lower latency, Amazon CloudFront uses a global network of points of presence (edge locations and regional edge caches) worldwide.

Cloud Practitioner:

How would a system administrator add an additional layer of login security to a user's AWS Management Console?

• Use Amazon Cloud Directory

• Audit AWS Identity and Access Management (IAM) roles

• Enable multi-factor authentication

• Enable AWS CloudTrail

Answer explanation

– Multi-factor authentication (MFA) is a simple best practice that adds an extra layer of protection on top of a username and password. With MFA enabled, when a user signs in to an AWS Management Console, they will be prompted for their username and password (the first factor—what they know), as well as for an authentication code from their MFA device (the second factor—what they have). Taken together, these multiple factors provide increased security for AWS account settings and resources.

Associate Solutions Architect:

A company plans to run a monitoring application on an Amazon EC2 instance in a VPC. Connections are made to the EC2 instance using the instance’s private IPv4 address. A solutions architect needs to design a solution that will allow traffic to be quickly directed to a standby EC2 instance if the application fails and becomes unreachable.

Which approach will meet these requirements?

• Deploy an Application Load Balancer configured with a listener for the private IP address and register the

  primary EC2 instance with the load balancer. Upon failure, de-register the instance and register the

  standby EC2 instance.

• Configure a custom DHCP option set. Configure DHCP to assign the same private IP address to the

  standby EC2 instance when the primary EC2 instance fails.

• Attach a secondary elastic network interface to the EC2 instance configured with the private IP address.

  Move the network interface to the standby EC2 instance if the primary EC2 instance becomes

  unreachable.

• Associate an Elastic IP address with the network interface of the primary EC2 instance. Disassociate the

  Elastic IP from the primary instance upon failure and associate it with a standby EC2 instance.

Answer explanation

A secondary elastic network interface can be added to an EC2 instance. While primary network interfaces cannot be detached from an instance, secondary network interfaces can be detached and attached to a different EC2 instance.

Associate Solutions Architect:

A website runs a custom web application that receives a burst of traffic each day at noon. The users upload new pictures and content daily, but have been complaining of timeouts. The architecture uses Amazon EC2 Auto Scaling groups, and the application consistently takes 1 minute to initiate upon boot up before responding to user requests.

How should a solutions architect redesign the architecture to better respond to changing traffic?

• Configure a Network Load Balancer with a slow start configuration

• Configure Amazon ElastiCache for Redis to offload direct requests from the EC2 instances

• Configure an Auto Scaling step scaling policy with an EC2 instance warmup condition.

• Configure Amazon CloudFront to use an Application Load Balancer as the origin.

Answer explanation

The current configuration puts new EC2 instances into service before they are able to respond to transactions. This could also cause the instances to overscale. With a step scaling policy, you can specify the number of seconds that it takes for a newly launched instance to warm up. Until its specified warm-up time has expired, an EC2 instance is not counted toward the aggregated metrics of the Auto Scaling group. While scaling out, the Auto Scaling logic does not consider EC2 instances that are warming up as part of the current capacity of the Auto Scaling group. Therefore, multiple alarm breaches that fall in the range of the same step adjustment result in a single scaling activity. This ensures that you do not add more instances than you need.

Associate Solutions Architect:

A company’s security team requires that all data stored in the cloud be encrypted at rest at all times using encryption keys stored on premises.

Which encryption options meet these requirements? (Select TWO.)

• Use server-side encryption with Amazon S3 managed encryption keys (SSE-S3).

• Use server-side encryption with AWS KMS managed encryption keys (SSE-KMS).

• Use server-side encryption with customer-provided encryption keys (SSE-C).

• Use client-side encryption to provide at-rest encryption.

• Use an AWS Lambda function invoked by Amazon S3 events to encrypt the data using the customer’s

  keys.

Answer explanation

Server-side encryption with customer-provided keys (SSE-C) enables Amazon S3 to encrypt objects on the server side using an encryption key provided in the PUT request. The same key must be provided in the GET requests for Amazon S3 to decrypt the object. Customers also have the option to encrypt data on the client side before uploading it to Amazon S3, and then they can decrypt the data after downloading it. AWS software development kits (SDKs) provide an S3 encryption client that streamlines the process.

Associate SysOps Administrator:

A company hosts a web application on an Amazon EC2 instance. Users report that the web application is occasionally unresponsive. Amazon CloudWatch metrics indicate that the CPU\ utilization is 100% during these times. A SysOps administrator must implement a solution to monitor for this issue.

Which solution will meet this requirement?

• Create a CloudWatch alarm that monitors AWS CloudTrail events for the EC2 instance.

• Create a CloudWatch alarm that monitors CloudWatch metrics for EC2 instance CPU utilization.

• Create an Amazon Simple Notification Service (Amazon SNS) topic to monitor CloudWatch metrics for EC2 instance CPU utilization.

• Create a recurring assessment check on the EC2 instance by using Amazon Inspector to detect deviations in CPU utilization.

Answer explanation

Amazon CloudWatch provides you with data and actionable insights to monitor your applications. Amazon EC2 sends metrics to CloudWatch. The CPUUtilization metric represents the percentage of allocated EC2 compute units that are currently in use on an instance. You can create a CloudWatch alarm that monitors CPUUtilization for one of your instances. For example, you might want to receive an email notification when the average CPUUtilization over a 5-minute period is greater than 75%.

Associate SysOps Administrator

A company is running a custom database on an Amazon EC2 instance. The database stores its data on an Amazon Elastic Block Store (Amazon EBS) volume. A SysOps administrator must set up a backup strategy for the EBS volume.

What should the SysOps administrator do to meet this requirement?

• Create an Amazon CloudWatch alarm for the VolumeIdleTime metric with an action to take a snapshot of the EBS volume.

• Create a pipeline in AWS Data Pipeline to take a snapshot of the EBS volume on a recurring schedule.

• Create an Amazon Data Lifecycle Manager (Amazon DLM) policy to take a snapshot of the EBS volume on a recurring schedule.

• Create an AWS DataSync task to take a snapshot of the EBS volume on a recurring schedule.

Answer explanation

— You can use Amazon Data Lifecycle Manager (Amazon DLM) to automate the creation, retention, and deletion of Amazon Elastic Block Store (Amazon EBS) snapshots. You can create a lifecycle policy that includes specific tags to back up EBS volumes on a specified schedule and for a specified retention period. For example, you can take a snapshot of an EBS volume every day and keep the snapshots for 30 days.

Professional Solutions Architect:

A solutions architect needs to reduce costs for a big data application. The application environment consists of hundreds of devices that send events to Amazon Kinesis Data Streams. The device ID is used as the partition key, so each device gets a separate shard. Each device sends between 50 KB and 450 KB of data each second. An AWS Lambda function polls the shards, processes the data, and stores the result in Amazon S3.

Every hour, another Lambda function runs an Amazon Athena query against the result data to identify outliers.\ This Lambda function places the outliers in an Amazon Simple Queue Service (Amazon SQS) queue. An Amazon EC2 Auto Scaling group of two EC2 instances monitors the queue and runs a 30- second process to address the outliers. The devices submit an average of 10 outlying values every hour.

Which combination of changes to the application will MOST reduce costs? (Select TWO.)

• Change the Auto Scaling group launch configuration to use smaller instance types in the same instance family.

• Replace the Auto Scaling group with a Lambda function that is invoked when messages arrive in the queue.

• Reconfigure the devices and data stream to set a ratio of 10 devices to 1 data stream shard.

• Reconfigure the devices and data stream to set a ratio of 2 devices to 1 data stream shard.

• Change the desired capacity of the Auto Scaling group to a single EC2 instance.

Answer explanation

The average amount of compute to address the outliers each hour is 300 seconds (10 events for 30 seconds each). Option B is correct because with AWS Lambda, you pay only for the small amount of compute time that is required to process the outlying values. While options A and E would reduce costs, they both involve paying for one or more Amazon EC2 instances that would sit unused for 3,300 seconds each hour. Options C and D reduce the shard hour costs of the Kinesis data stream. However, option C is incorrect because the amount of data would exceed the 1 MB/s quota of a single shard.