AWS Question EP4

Domain: Design Solutions for Organizational Complexity

An IT firm is using Amazon EKS clusters for deploying containers-based applications in hybrid environments. The firm is looking for an open source based service for monitoring and alerting. The operations team requires alerts based on metrics collected from the containers and dashboards to be created based on these metrics.

What scalable managed solution can be proposed for this requirement?

• A. Use Amazon CloudWatch for monitoring container-based applications. Use Amazon QuickSight to create dashboards. Use Amazon SNS for alerting based on metrics collected by Amazon CloudWatch

• B. Use Amazon CloudWatch for monitoring container-based applications. Use Amazon Managed Grafana to create dashboards and alerts based on metrics collected by Amazon CloudWatch

• C. Use Amazon Managed Service for Prometheus for monitoring container-based applications. Use Amazon Managed Grafana to create dashboards and alerting based upon metrics collected by Amazon Managed Service for Prometheus

• D. Use Amazon Managed Service for Prometheus for monitoring container-based applications. Use Amazon QuickSight to create dashboards. Use Amazon SNS for alerting based upon metrics collected by Amazon Managed Service for Prometheus

Answer explanation

Correct Answer: C

Amazon Managed Service for Prometheus is a Prometheus-compatible service for monitoring and alerting container-based applications and infrastructure. It is integrated with Amazon Elastic Kubernetes Service (EKS), Amazon Elastic Container Service (ECS), and AWS Distro for OpenTelemetry. It is fully compatible with the popular open-source Cloud Native Computing Foundation (CNCF) Prometheus project.

Amazon Managed Grafana is integrated with Use Amazon Managed Service for Prometheus to alert based upon the Prometheus metrics collected from the containers. Amazon Managed Grafana can also be used to create dashboards based on these metrics.

In the above case, Amazon Managed Service for Prometheus can be used for monitoring and collecting metrics from container-based applications deployed on Amazon EKS. For alerting and creating dashboards based on these metrics, Amazon Managed Grafana is a suitable service. Both these services are based on open-source projects.

• Option A is incorrect as Amazon Managed Service for Prometheus is a better choice than using Amazon CloudWatch for monitoring Amazon EKS-based container applications. Amazon Managed Service for Prometheus provides direct integration with Kubernetes metrics and is less costly as compared to Amazon CloudWatch.

• Option B is incorrect as Amazon Managed Service for Prometheus provides direct integration with Kubernetes metrics and is less costly as compared to Amazon CloudWatch.

• Option D is incorrect as since the customer is looking for an open-source based service, Amazon Managed Grafana is more suitable than using Amazon QuickSight and Amazon SNS in terms of dashboard creation and alerting.

Domain: Design for New Solutions

A financial company was recently a victim of suspicious activity and plans to use Amazon Detective to make it easy to analyze, investigate, and quickly identify the root cause of potential security issues or suspicious activities. The company would want to manage multiple accounts with Amazon Detective due to its huge amount of data. As an AWS Architect for the company, what would you suggest from the following options as the best available solution?

• A. Amazon Detective is a single-account service that aggregates data from monitored member accounts under a single administrative account globally. Hence, not possible to manage multiple accounts with Amazon Detective

• B. Amazon Detective is a single-account service that aggregates data from monitored member accounts under a single administrative account within the same region. Hence, not possible to manage multiple accounts with Amazon Detective

• C. Amazon Detective is a multi-account service that aggregates data from monitored member accounts under a single administrative account within the same region. Hence, it’s possible to manage multiple accounts with Amazon Detective

• D. Amazon Detective is a multi-account service that aggregates data from monitored member accounts under a single administrative account globally. Hence, it’s possible to manage multiple accounts with Amazon Detective

  
  

Answer explanation

Correct Answer: C

• Option C is correct as Amazon Detective is a multi-account service that aggregates data from monitored member accounts under a single administrative account within the same region. You can configure multi-account monitoring deployments in the same way that you configure administrative and member accounts in Amazon GuardDuty and AWS Security Hub.

• Options A and B are incorrect as it says Amazon Detective is a single-account service.

• Option D is incorrect as it says the data is aggregated under a single administrative account globally. It is within that region and not global.

Domain: Continuous Improvement for Existing Solutions

You currently have 9 EC2 instances running in a Cluster Placement Group. All these nine instances were initially launched at the same time and seemed to be performing as expected. You decide that you need to add two new instances to the group. However, when you attempt to do this, you receive a 'capacity error.' Which of the following actions will most likely fix this problem? Choose the correct answer from the options below.

• A. Create another placement group and launch new instances in that group. Make sure that both the placement groups are in the same subnet

• B. Stop and restart all the instances in the Placement Group and then try the launch again

• C. Request a capacity increase from AWS as you are initially limited to 10 instances per Placement Group

• D. Make sure all the instances are the same size and then try the launch again

Answer explanation

Correct Answer: B

• Option A is incorrect because to benefit from the enhanced networking, all the instances should be in the same Placement Group. Launching the new ones in a new Placement Group will not work in this case.

• Option B is CORRECT because the most likely reason for the "Capacity Error" is that the underlying hardware may not have the capacity to launch any additional instances on it. If the instances are stopped and restarted, AWS may move the instances to a hardware that has the capacity for all the requested instances.

• Option C is incorrect because there is no such limit on the number of instances in a Placement Group (however, you can not exceed your EC2 instance limit allocated to your account per region).

• Option D is incorrect because the capacity error is not related to the instance size and ensures that the instances are of the same size will not resolve the capacity error.

Domain: Continuous Improvement for Existing Solutions

The Dynamic Host Configuration Protocol (DHCP) provides a standard for passing configuration information to hosts on a TCP/IP network. You can have multiple sets of DHCP options, but you can associate only one set of DHCP options with a VPC at a time. You have just created your first set of DHCP options and associated it with your VPC but now realize that you have made an error in setting them up and you need to change the options. Which of the following options do you need to take to achieve this?

• A. You need to stop all the instances in the VPC. You can then change the options, and they will take effect when you start the instances

• B. You can modify the options from the console or the CLI

• C. You must create a new set of DHCP options and associate them with your VPC

• D. You can modify the options from the CLI only, not from the console

Answer explanation

Correct Answer: C

• Options A, B and D are incorrect because you cannot modify the DHCP options - neither via the console nor via CLI.

• Option C is CORRECT because once you create a set of DHCP options, you cannot modify them. You must create a new set of DHCP options and associate it with your VPC.

AWS Document says:

Changing DHCP Options

After you create a set of DHCP options, you can't modify them. If you want your VPC to use a different set of DHCP options, you must create a new set and associate them with your VPC. You can also set up your VPC to use no DHCP options at all.

You can have multiple sets of DHCP options, but you can associate only one set of DHCP options with a VPC at a time. If you delete a VPC, the DHCP options set associated with the VPC are also deleted.

After you associate a new set of DHCP options with a VPC, any existing instances and all new instances that you launch in the VPC use these options. You don't need to restart or relaunch the instances. They automatically pick up the changes within a few hours, depending on how frequently the instance renews its DHCP lease. If you want, you can explicitly renew the lease using the operating system on the instance.

AWS ParallelCluster

• 
• 
• 
• 

Answer explanation