NEW
Font size
WorksheetsAWS CSA Prep
Total questions: 25
Worksheet time: 25mins
What best describes the concept of high availability?
A durable system that can operate for long periods of time without failure
The ability of the system to easily increase in size
Following proper security procedures
Always finding what you are looking for
You work for a large consulting firm that has just hired a junior consultant named Jessica, who will be working on a large AWS project. She will be working remotely and, therefore, is not present in the office. You create a new IAM user for her named "Jessica" in your company’s AWS account. On Jessica's first day, you ask her to make a change to a CloudWatch alarm in an Auto Scaling group. Jessica reports back that she does not have access to CloudWatch or auto scaling in the aws console. What is a possible explanation for this?
Because she is working remotely, she would need to SSH into the instances in the Auto Scaling group via her terminal to make the changes
Only IAM account admins can make changes to Auto Scaling groups
You have not added the appropriate IAM permissions and access policies to her user; there is a non-explicit deny to all new users
When you created the new user, you forgot to assign access keys
Always finding what you are looking for
You have been tasked with auditing the security of your VPC. As part of this process, you need to start by analyzing what traffic is allowed to and from various EC2 instances. What two parts of the VPC do you need to check to accomplish this task?
NACLs and Subnets
Security Groups and Internet Gateways
NACLs and Route Tables
Security Groups and NACLs
If your are designing an application that requires fast (10GBpS), low-latency connections between EC2 instances, what EC2 feature should you use?
Snapshots
Placement groups
Instance store volume
IOPS provisioned instances
What are the two main components of AWS auto scaling?
Elastic Load Balancer and Auto Scaling groups
Launch configuration and Auto scaling groups
Auto Scaling groups and instance types
Launch configuration and elasticity
You have provisioned several EC2 instances into private subnets; however, you now have the problem of not being able to download any new software packages or updates. Which of the following provides the best solution?
Create a bastion host in a public subnet to allow the instance in the private subnets with route to the internet.
Create a NAT Gateway in a private subnet, then create a route to it in the route table associated with the private subnets.
Change the associated route table of the private subnets to a route table with a route to an IGW, thus making the subnets public.
Create a NAT Gateway in a public subnet and create a route to it in the route table associated with the private subnets.
If you have an EBS volume in availability zone us-easet-1d and you want to attach it to an EC2 instance in availability zone us-east-1a, what procedure should you follow?
Make a copy of the volume and have it placed in us-east-1a, then attach it to the instance.
Select the volume and simply attach it to the instance in us-east-1a.
EBS volumes cannot be moved between Availability Zones.
Create a snapshot of the volume in us-east-1d, then create a new volume from the snapshot, choosing to place it in us-east-1a. Attach the new volume to the instance .
You work for a hospital that is required to store patient's medical records for a minimum of 10 years. Most of these records will never be accessed but must be made available upon request (within a few hours). What is the most cost-effective storage option?
Glacier
S3-IA (Infrequent Access)
AWS Import/Export
Reduced redundancy storage
If you need a dedicated, low-latency connection to AWS from your on-premises data center, what solution should you choose?
AWS VPN
AWS Storage Gateway
AWS VPG
AWS Direct Connect
The Availability Zone that your RDS database instance is located in is suffering from outages, and you have lost access to the database. What could you have done to prevent losing access to your database (in the event of this type of failure) without any downtime?
Created a read replica.
Enabled multi-AZ failover.
Increased the database instance size.
Made a snapshot of it.
What service should you choose if you want to send notifications via text message to a system administrator?
SWF
SQS
SNS
CloiudWatch
Which of the following CloudWatch EC2 metrics will require a custom script to enable?
CPU Utilization
Memory Utilization
CPU Credit Usage
Network Out
What AWS service allows you to treat your infrastructure as code?
CloudWatch
Elastic BeanStalk
CloudTrail
CloudFormation
What is the purpose of a Kinesis Producer?
To analyze data in the Kinesis stream.
To store data for the Kinesis stream.
To collect and send data into a Kinesis stream.
To consume the processed Kinesis data.
What is responsible for starting and stopping tasks on an ECS Container instance?
Task Definition
ECS Agent
Dockerfile
Container Registry
In order to establish a successful site-to-site VPN connection from your on-premises network to the VPC (Virtual Private Cloud), which of the following needs to be configured inside of the VPC?
A dedicated NAT instance in a public subnet
A public IP address on the customer gateway for the on-premise network
An Elastic IP address to the Virtual Private Gateway
The main route table to route traffic through a NAT instance
What best describes the concept of elasticity?
The ability to stretch your AWS budget to meet your goals.
The ability of a system to increase and decrease in size.
The ability of a system to increase in size.
The ability of a system to always be available.
You have created a new VPC in your AWS account and have launched an EC2 instance into a subnet. After the instance is provisioned, you try to connect to it via SSH but receive a "connection timed out" error. As you troubleshoot the issue, what is most likely causing the error?
The security group associated with the instance does not explicitly allow return (outbound) SSH traffic over the ephemeral port ranges .
The NACL associated with the subnet does not explicitly allow return (outbound) SSH traffic over the ephemeral port ranges.
You have too many internet gateways attached to the VPC and the traffic doesn't know which one to use.
You are not using the instances private IP address to connect.
What best describes the characteristics of EBS volumes?
They are persistent and can live past the lifetime of the instance.
They will be deleted anytime the instance is stopped.
They are ephemeral and only live during the lifetime of the instance.
They cannot be used as an instance's root storage device.
You are asked to perform a security audit on a company’s AWS environment. You log in to their AWS account with the root user credentials and discover that they are using a VPN to connect to and manage their private EC2 instances. Upon further inspection, you find that they are not regularly patching their RDS instances. Finally, you notice that they are using IAM policies rather than bucket policies to manage access to their S3 buckets. What do you cite as the most critical security risk in your report?
The company’s employees are not using a bastion host to connect to their private EC2 instances.
The company is not using bucket policies to manage S3 bucket access.
The company has not been patching their RDS instances.
The company allows people to log in with their AWS account’s root user.
What best describes a scaling policy?
A set of CloudWatch metric thresholds that dictate when to add or remove instances from the Auto Scaling group.
The percentage at which an ELB will send traffic to an instance before it sends traffic to a different instance.
The IAM access policy granted to an Auto Scaling group.
An SNS notification alert.
You keep getting an error when you try to attach an IGW to a VPC. What is the most likely cause of the error?
The IGW isn't in the same Availability Zone as the VPC.
An IGW is already attached to the VPC.
The IGW is most likely broken and a new one should be created.
The IGW needs to be associate with a route table before it can be attached to a VPC.
Which of the following is not expected behavior from SQS and may indicate a problem with your application?
Messages in JSON format fail to be created in the SQS queue.
A message in your SQS queue is duplicated.
A 500 KB message fails to be created in an SQS queue.
Messages are retrieved from your SQS queue in a different order than they were created.
Through what process are objects moved from the standard storage class to Glacier?
S3 events
Selecting a different storage class
Object versioning
Lifecycle policies
Your AWS environment contains several on-demand EC2 instances dedicated to a project that has just been cancelled. Your supervisor does not want to incur charges for these on-demand instances but also does not want to lose the data just yet because there is a chance the project may be revived in the next few days. What should you do to minimize charges for these instances in the meantime?
Terminate the instances as soon as possible.
Contact AWS and explain the situation.
Sell the instances on the AWS On-Demand Instance Marketplace. You can buy them back later if needed.
Stop the instances as soon as possible.
