AWS Q03

A network engineer needs to build a hybrid cloud architecture connecting on-premises networks to the AWS Cloud using AWS Direct Connect. The company has a few VPCs in a single AWS Region and expects to increase the number of VPCs to hundreds over time. Which AWS service or feature should the engineer use to simplify and scale this connectivity as the VPCs increase in number?

• A. VPC endpoints

• B. AWS Transit Gateway

• C. Amazon Route 53

• D. AWS Secrets Manager

Answer explanation

To simplify and scale connectivity between on-premises networks and hundreds of Amazon Virtual Private Clouds (VPCs) in a single AWS Region, the network engineer should use AWS Transit Gateway.

AWS Transit Gateway is a fully managed service that enables customers to connect thousands of VPCs, on-premises networks, and remote networks through a single gateway. It simplifies network architecture and reduces operational overhead by allowing customers to centrally manage network routing and security. With AWS Transit Gateway, customers can also scale network connectivity as their VPCs grow in number, without requiring additional configuration changes.

Therefore, the correct answer is B, AWS Transit Gateway.

Which AWS cloud architecture principle slates that systems should reduce interdependences?

• A. Scalability

• B. Services not servers

• C. Removing single points of failure

• D. Loose coupling

Answer explanation

The AWS cloud architecture principle that states that systems should reduce interdependencies is known as "loose coupling."

Loose coupling is a design principle that emphasizes the independence of components in a system. In the context of cloud architecture, it means that systems should be designed so that each component can function independently and not rely too heavily on other components. This approach reduces interdependencies and can improve system stability and scalability.

Therefore, the correct answer is D, loose coupling.

Which AWS service or feature allows a user to establish a dedicated network connection between a company's on-premises data center and the AWS Cloud?

• A. AWS Direct Connect

• B. VPC peering

• C. AWS VPN

• D. Amazon Route 53

Answer explanation

The AWS service or feature that allows a user to establish a dedicated network connection between a company's on-premises data center and the AWS Cloud is AWS Direct Connect.

AWS Direct Connect provides a dedicated, private connection between the on-premises data center and the AWS Cloud. This connection can bypass the public internet, providing a more secure and reliable way to access AWS resources. It can be used to transfer large amounts of data, run real-time applications, and establish a hybrid cloud architecture.

Therefore, the correct answer is A, AWS Direct Connect.

Which of the following is a benefit of using the AWS Cloud?

• A. Permissive security removes the administrative burden.

• B. Ability to focus on revenue-generating activities.

• C. Control over cloud network hardware.

• D. Choice of specific cloud hardware vendors.

Answer explanation

The benefit of using the AWS Cloud is the ability to focus on revenue-generating activities.

When a company chooses to use the AWS Cloud, they can leverage the infrastructure, services, and tools provided by AWS to focus on building their core business applications and services, rather than spending time and resources managing the underlying hardware and infrastructure. This can help increase agility, reduce time to market, and ultimately lead to revenue growth. Therefore, the ability to focus on revenue-generating activities is one of the key benefits of using the AWS Cloud .

What can be used to reduce the cost of running Amazon EC2 instances? (Select TWO )

• A. Spot Instances for stateless and flexible workloads

• B. Memory optimized instances for nigh-compute workloads

• C. On-Demand Instances for high-cost and sustained workloads

• D. Reserved Instances for sustained workloads

• E. Spend limits set using AWS Budgets

Answer explanation

The two options that can be used to reduce the cost of running Amazon EC2 instances are:

A. Spot Instances for stateless and flexible workloads: Spot instances are ideal for workloads that are flexible and can be interrupted as the instances can be terminated by AWS when the spot price exceeds the bid price. Using Spot Instances, the cost of running the workload can be reduced up to 90% compared to On-Demand instances.

D. Reserved Instances for sustained workloads: Reserved Instances are suitable for workloads that require a certain capacity and run continuously or frequently. Reserved instances are purchased for a term of one or three years, providing a significant discount compared to On-Demand instances.

Under the AWS shared responsibility model what is the customer's responsibility when using an AWS managed service?

• A. Physical security of the data centers

• B. Server-side encryption

• C. Customer data

• D. Operating system patching

Answer explanation

Under the AWS shared responsibility model, the customer's responsibility when using an AWS managed service is the customer data. AWS is responsible for the security of the cloud infrastructure and any AWS-managed services provided to the customer, while the customer is responsible for security in the cloud, such as data protection, access management, and network security.

An application is receiving SQL injection attacks from multiple external resources. Which AWS service or feature can help automate mitigation against these attacks?

• A. AWS WAF

• B. Security groups

• C. Elastic Load Balancer

• D. Network ACL

Answer explanation

AWS WAF (Web Application Firewall) can help automate mitigation against SQL injection attacks. It can filter and monitor the incoming traffic to web applications and protect them from common web exploits that could affect application availability, compromise security, or consume excessive resources. WAF allows users to create custom rules that block common attack patterns, including SQL injection attacks.

Which aspect of AWS infrastructure enables global deployment of compute and storage?

• A. Availability Zones

• B. Regions

• C. Tags

• D. Resource groups

Answer explanation

The correct answer is B. Regions. AWS Regions are distinct geographic locations around the world where AWS data centers are located. AWS customers can use Regions to deploy resources and build their applications with the necessary compute, storage, and database services required for their specific use case. By utilizing multiple Regions, AWS enables global deployment of compute and storage services.

A user needs to quickly deploy a nonrelational database on AWS. The user does not want to manage the underlying hardware or the database software. Which AWS service cart be used to accomplish this?

• A. Amazon RDS

• B. Amazon DynamoDB

• C. Amazon Aurora

• D. Amazon Redshift

Answer explanation

The Amazon DynamoDB service can be used to quickly deploy a nonrelational database on AWS without the user having to manage the underlying hardware or database software.

How can a user achieve high availability for a web application hosted on AWS?

• A. Use a Classic Load Balancer across multiple AWS Regions

• B. Use an Application Load Balancer across multiple Availability Zones in one AWS Region

• C. Set up automatic scaling and load balancing with another application instance running on premises

• D. Use the AWS Region with the highest number of Availability Zones

Answer explanation

The most appropriate option to achieve high availability for a web application hosted on AWS is to use an Application Load Balancer (ALB) across multiple Availability Zones in one AWS Region.

An ALB is a service that can distribute incoming traffic to multiple targets, such as Amazon EC2 instances, in one or more Availability Zones. Using an ALB allows for automatic failover to healthy instances in case of failures, providing high availability for the web application.

Deploying the ALB across multiple Availability Zones in one AWS Region is recommended to provide redundancy and help ensure that the application is available in case of an outage in one Availability Zone. It is important to note that deploying across multiple regions would increase latency and may not be suitable for all applications.