Seguridad - Clase 9

A large company has multiple departments. Each department has its own AWS account. Each department has purchased Amazon EC2 Reserved Instances. Some departments do not use all the Reserved Instances that they purchased, and other departments need more Reserved Instances than they purchased. The company needs to manage the AWS accounts for all the departments so that the departments can share the Reserved Instances.

Which AWS service or tool should the company use to meet these requirements?

• AWS Systems Manager

• Cost Explorer

• AWS Trusted Advisor

• AWS Organizations

A company is launching an ecommerce application that must always be available. The application will run on Amazon EC2 instances continuously for the next 12 months.

What is the MOST cost-effective instance purchasing option that meets these requirements?

• Spot Instances

• Savings Plans

• Dedicated Hosts

• On-Demand Instances

Which documentation does AWS Artifact provide?

• Amazon EC2 terms and conditions

• AWS ISO certifications

• A history of a company's AWS spending

• A list of previous-generation Amazon EC2 instance types

What is the scope of a VPC within the AWS network?

• A VPC can span all Availability Zones globally.

• A VPC must span at least two subnets in each AWS Region.

• A VPC must span at least two edge locations in each AWS Region.

• A VPC can span all Availability Zones within an AWS Region.

Which AWS service will help protect applications running on AWS from DDoS attacks?

• Amazon GuardDuty

• AWS WAF

• AWS Shield

• Amazon Inspector

A company is implementing a new business application. The application runs on two Amazon EC2 instances and uses an Amazon S3 bucket for document storage. A solutions architect needs to ensure that the EC2 instances can access the S3 bucket.
What should the solutions architect do to meet this requirement?

• Create an IAM role that grants access to the S3 bucket. Attach the role to the EC2 instances.

• Create an IAM policy that grants access to the S3 bucket. Attach the policy to the EC2 instances.

• Create an IAM group that grants access to the S3 bucket. Attach the group to the EC2 instances.

• Create an IAM user that grants access to the S3 bucket. Attach the user account to the EC2 instances.

A company needs to review its AWS Cloud deployment to ensure that its Amazon S3 buckets do not have unauthorized configuration changes.
What should a solutions architect do to accomplish this goal?

• Turn on AWS Config with the appropriate rules.

• Turn on AWS Trusted Advisor with the appropriate checks.

• Turn on Amazon Inspector with the appropriate assessment template.

• Turn on Amazon S3 server access logging. Configure Amazon EventBridge (Amazon Cloud Watch Events).

A company hosts its multi-tier applications on AWS. For compliance, governance, auditing, and security, the company must track configuration changes on its AWS resources and record a history of API calls made to these resources.
What should a solutions architect do to meet these requirements?

• Use AWS CloudTrail to track configuration changes and AWS Config to record API calls.

• Use AWS Config to track configuration changes and AWS CloudTrail to record API calls.

• Use AWS Config to track configuration changes and Amazon CloudWatch to record API calls.

• Use AWS CloudTrail to track configuration changes and Amazon CloudWatch to record API calls.

A company is preparing to launch a public-facing web application in the AWS Cloud. The architecture consists of Amazon EC2 instances within a VPC behind an Elastic Load Balancer (ELB). A third-party service is used for the DNS. The company's solutions architect must recommend a solution to detect and protect against large-scale DDoS attacks.
Which solution meets these requirements?

• Enable Amazon GuardDuty on the account.

• Enable Amazon Inspector on the EC2 instances.

• Enable AWS Shield and assign Amazon Route 53 to it.

• Enable AWS Shield Advanced and assign the ELB to it.

A company runs a highly available image-processing application on Amazon EC2 instances in a single VPC. The EC2 instances run inside several subnets across multiple Availability Zones. The EC2 instances do not communicate with each other. However, the EC2 instances download images from Amazon S3 and upload images to Amazon S3 through a single NAT gateway. The company is concerned about data transfer charges.
What is the MOST cost-effective way for the company to avoid Regional data transfer charges?

• Launch the NAT gateway in each Availability Zone.

• Replace the NAT gateway with a NAT instance.

• Deploy a gateway VPC endpoint for Amazon S3.

• Provision an EC2 Dedicated Host to run the EC2 instances.