AWS Questions EP3

SAA-CO3

Domain: Design Secure Architectures

You have planned to host a web application on AWS. You create an EC2 Instance in a public subnet that needs to connect to an EC2 Instance that will host an Oracle database. Which steps would ensure a secure setup? (SELECT TWO)

• A. Place the EC2 Instance with the Oracle database in the same public subnet as the Webserver for faster communication.

• 
  B. Place the ec2 instance that will host the Oracle database in a private subnet.

• C. Create a database Security group which allows incoming traffic only from the Web server's security group.

• D.

  Ensure that the database security group allows incoming traffic from 0.0.0.0/0.

Answer explanation

Correct Answer – B and C

The best and most secure option is to place the database in a private subnet. The below diagram from AWS Documentation shows this setup. Also, you ensure that access is not allowed from all sources but only from the web servers.

• Option A is incorrect because DB instances are placed in Private subnets and allowed to communicate with web servers in the public subnet as per the best practice guidelines. 

• Option D is incorrect because allowing all incoming traffic from the Internet to the DB instance is a security risk.

SAA-CO3

Domain: Design Secure Architectures

You have designed an application that uses AWS resources, such as S3, to operate and store users’ documents. You currently use Cognito identity pools and user pools. To increase usage and ease of signing up, you decide that adding social identity federation is the best path forward.

How would you differentiate the Cognito identity pool and the federated identity providers (e.g., Google)?

• A. They are the same and just called different things.

• B. First, you sign-in via Cognito then through a federated site, like Google.

• C. Federated identity providers and identity pools are used to authenticate services.

• D. You can choose a federated identity provider to authenticate users and associate a Cognito identity pool to authorize the users.

Answer explanation

• - Option D is correct. Federated identity providers are used to authenticate users. Then the Cognito identity pool provides the temporary token that authorizes users to access AWS resources.

• - Option A is incorrect. Cognito identity pool and the federated identity providers are separate, independent authentication methods.

• - Option B is incorrect. Only one log-in event is needed, not two.

• - Option C is incorrect. Identity providers authenticate users, not authenticate services.

SAP-CO2

Domain: Accelerate Workload Migration and Modernization

Your company is running a business analytics service that uses RDS with MySQL as the main database. The database is configured with Multi-AZ. Most recently, the load on the database has increased rapidly with the launch of new features. By looking at the logs, most of the load is generated by read-only queries. Because of the heavy read loads, the operations team has decided to put a set of read replicas in place. The new application features are launched via a cluster of containers into the virtual machines, where all the containers are having access to the same set of configurations. How can you pair the read replicas together to make sure the application running in the containers can access them properly?

• A. Create Amazon Route 53 weighted record sets to distribute requests across the read replicas

• B. Create an ELB and point to all the read replicas. Use the URL of the ELB to access the read replicas from the application

• C. Create an Elastic IP and create a route table entry to point the IP to the read replicas. Use the IP to access the read replicas from the application

• D. Read replica cluster is not supported in AWS. Use an external utility to create a DNS record and use the record to access the read replicas from the application

Answer explanation

Correct Answer: A

• Option A is CORRECT because, in Route 53, you can create individual record sets for each DNS endpoint associated with your read replicas and give them the same weight. Then the read requests are distributed across multiple read replicas.

• Option B is INCORRECT because the ELB cannot point to multiple replicas.

• Option C is INCORRECT because this is not a workable solution. Elastic IP is an external resource, and routing the Elastic IP to read replica set is impossible.

• Option D is INCORRECT because it is possible to route internal Route53 multivalve answer records to a set of IPs.

SAP-CO2

Domain: Design for New Solutions

An IT firm has its employees running its built-in applications that access the company’s AWS resources. These employees have user credentials in the company’s authentication system, based on their roles, supported by SAML.2.0. Identify the ways in which the SSO setup can be designed to gain temporary access to AWS? (Select TWO)

• A. Design  IAM users, with role based setup and pass a permission policy to achieve temporary access credentials from AWS STS to share based on employee roles in the company

• B. Create a custom identity broker application that authenticates the employees using the existing system, uses the GetFederationToken API decision, and passes a permission policy to achieve temporary access credentials from AWS - STS (Security Token Service)

• C. Create a custom identity broker application that authenticates employees using the existing system and uses the AssumeRole API call to gain temporary, role-based access to AWS

• D. Configure an AD server that synchronizes from the company’s current identity provider and configures SAML-based single-sign-on, which will then use the DecodeAuthorizationMessage API call to generate credentials for the employees

Answer explanation

Correct Answers: B and C

• Option A is incorrect because already a role-based setup is in place and it seems redundant here.

• Option B is the correct answer because (a) it creates a custom identity broker application for authenticating the users using their existing credentials, (b) it gets temporary access credentials using STS, and (c) it uses federated access for accessing the AWS resources.

• Option C is the correct answer because (a) creates a custom identity broker application for authenticating the users using their existing credentials, and (b) it uses AssumeRole API for accessing the resources using a temporary role.

• Option D is incorrect because the DecodeAuthorizationMessage API call only Decodes additional information about the authorization status of a request from an encoded message returned in response to an AWS request.

Amazon EKS Knowledge Badge Assessment

You manage an EKS Cluster with one autoscaling group using an instance type that has an EC2 Instance Savings Plan and other autoscaling group using instance types that are on demand.

In order to optimize costs, which feature of Cluster Autoscaler can favour the autoscaling group covered by Instance Savings Plan to be used first in an scale-out event?

• A. Priority Expanders

• B. Node Termination Handler

• C. Weighted Provisioners

• D. Spot Instances

Logo of: "Savings Plans"

• 
• 
•